rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-37208 
JFinal CMS 5.1.0 is vulnerable to SQL Injection. These interfaces do not use the same component, nor do they have filters, but each uses its own SQL concatenation method, resulting in SQL injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-10-13T00:00:00.000Z
CVE-2022-37209 
JFinal CMS 5.1.0 is affected by: SQL Injection. These interfaces do not use the same component, nor do they have filters, but each uses its own SQL concatenation method, resulting in SQL injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-27T13:12:35.000Z
CVE-2022-37223 
JFinal CMS 5.1.0 is vulnerable to SQL Injection via /jfinal_cms/system/role/list.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-23T13:31:07.000Z
CVE-2022-37232 
Netgear N300 wireless router wnr2000v4-V1.0.0.70 is vulnerable to Buffer Overflow via uhttpd. There is a stack overflow vulnerability caused by strcpy.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-23T00:10:00.000Z
CVE-2022-37234 
Netgear Nighthawk AC1900 Smart WiFi Dual Band Gigabit Router R7000-V1.0.11.134_10.2.119 is vulnerable to Buffer Overflow via the wl binary in firmware. There is a stack overflow vulnerability caused by strncpy.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-22T18:26:11.000Z
CVE-2022-37235 
Netgear Nighthawk AC1900 Smart WiFi Dual Band Gigabit Router R7000-V1.0.11.134_10.2.119 is vulnerable to Buffer Overflow via the wl binary in firmware. There is a stack overflow vulnerability caused by strncat
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-23T00:06:29.000Z
CVE-2022-37237 
An attacker can send malicious RTMP requests to make the ZLMediaKit server crash remotely. Affected version is below commit 7d8b212a3c3368bc2f6507cb74664fc419eb9327.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-30T15:30:04.000Z
CVE-2022-37238 
MDaemon Technologies SecurityGateway for Email Servers 8.5.2 is vulnerable to Cross Site Scripting (XSS) via the currentRequest parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-25T15:01:12.000Z
CVE-2022-37239 
MDaemon Technologies SecurityGateway for Email Servers 8.5.2 is vulnerable to Cross Site Scripting (XSS) via the rulles_list_ajax endpoint.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-25T14:59:13.000Z
CVE-2022-37240 
MDaemon Technologies SecurityGateway for Email Servers 8.5.2 is vulnerable to HTTP Response splitting via the format parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-25T14:56:25.000Z
CVE-2022-37241 
MDaemon Technologies SecurityGateway for Email Servers 8.5.2 is vulnerable to Cross Site Scripting (XSS) via the data_leak_list_ajax endpoint.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-25T14:54:47.000Z
CVE-2022-37242 
MDaemon Technologies SecurityGateway for Email Servers 8.5.2, is vulnerable to HTTP Response splitting via the data parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-25T14:53:07.000Z
CVE-2022-37243 
MDaemon Technologies SecurityGateway for Email Servers 8.5.2 is vulnerable to Cross Site Scripting (XSS) via the whitelist endpoint.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-25T14:43:36.000Z
CVE-2022-37244 
MDaemon Technologies SecurityGateway for Email Servers 8.5.2 is vulnerable to IFRAME Injectionvia the currentRequest parameter. after login leads to inject malicious tag leads to IFRAME injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-25T14:41:42.000Z
CVE-2022-37245 
MDaemon Technologies SecurityGateway for Email Servers 8.5.2 is vulnerable to Cross Site Scripting (XSS) via the Blacklist endpoint.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-25T14:13:53.000Z
CVE-2022-37246 
Craft CMS 4.2.0.1 is affected by Cross Site Scripting (XSS) in the file src/web/assets/cp/src/js/BaseElementSelectInput.js and in specific on the line label: elementInfo.label.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-21T14:14:01.000Z
CVE-2022-37247 
Craft CMS 4.2.0.1 is vulnerable to stored a cross-site scripting (XSS) via /admin/settings/fields page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-16T20:27:42.000Z
CVE-2022-37248 
Craft CMS 4.2.0.1 is vulnerable to Cross Site Scripting (XSS) via src/helpers/Cp.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-16T15:09:46.000Z
CVE-2022-37250 
Craft CMS 4.2.0.1 suffers from Stored Cross Site Scripting (XSS) in /admin/myaccount.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-16T14:57:51.000Z
CVE-2022-37251 
Craft CMS 4.2.0.1 is vulnerable to Cross Site Scripting (XSS) via Drafts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-16T20:54:16.000Z
CVE-2022-37253 
Persistent cross-site scripting (XSS) in Crime Reporting System 1.0 allows a remote attacker to introduce arbitary Javascript via manipulation of an unsanitized POST parameter
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-06T19:46:50.000Z
CVE-2022-37254 
DolphinPHP 1.5.1 is vulnerable to Cross Site Scripting (XSS) via Background - > System - > system function - > configuration management.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-19T16:45:49.000Z
CVE-2022-37255 
TP-Link Tapo C310 1.3.0 devices allow access to the RTSP video feed via credentials of User --- and Password TPL075526460603.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-16T00:00:00.000Z
CVE-2022-37257 
Prototype pollution vulnerability in function convertLater in npm-convert.js in stealjs steal 2.2.4 via the requestedVersion variable in npm-convert.js.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-15T12:30:55.000Z
CVE-2022-37258 
Prototype pollution vulnerability in function convertLater in npm-convert.js in stealjs steal 2.2.4 via the packageName variable in npm-convert.js.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-16T20:57:18.000Z
CVE-2022-37259 
A Regular Expression Denial of Service (ReDoS) flaw was found in stealjs steal 2.2.4 via the string variable in babel.js.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-20T17:31:22.000Z
CVE-2022-37260 
A Regular Expression Denial of Service (ReDoS) flaw was found in stealjs steal 2.2.4 via the input variable in main.js.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-15T18:18:22.000Z
CVE-2022-37262 
A Regular Expression Denial of Service (ReDoS) flaw was found in stealjs steal 2.2.4 via the source and sourceWithComments variable in main.js.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-15T15:37:47.000Z
CVE-2022-37264 
Prototype pollution vulnerability in stealjs steal 2.2.4 via the optionName variable in main.js.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-15T15:44:40.000Z
CVE-2022-37265 
Prototype pollution vulnerability in stealjs steal 2.2.4 via the alias variable in babel.js.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-20T17:36:24.000Z
CVE-2022-37266 
Prototype pollution vulnerability in function extend in babel.js in stealjs steal 2.2.4 via the key variable in babel.js.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-15T12:27:41.000Z
CVE-2022-37290 
GNOME Nautilus 42.2 allows a NULL pointer dereference and get_basename application crash via a pasted ZIP archive.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-14T00:00:00.000Z
CVE-2022-37292 
Tenda AX12 V22.03.01.21_CN is vulnerable to Buffer Overflow. This overflow is triggered in the sub_42FDE4 function, which satisfies the request of the upper-level interface function sub_430124, that is, handles the post request under /goform/SetIpMacBind.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-25T15:07:34.000Z
CVE-2022-37298 
Shinken Solutions Shinken Monitoring Version 2.4.3 affected is vulnerable to Incorrect Access Control. The SafeUnpickler class found in shinken/safepickle.py implements a weak authentication scheme when unserializing objects passed from monitoring nodes to the Shinken monitoring server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-10-20T00:00:00.000Z
CVE-2022-37299 
An issue was discovered in Shirne CMS 1.2.0. There is a Path Traversal vulnerability which could cause arbitrary file read via /static/ueditor/php/controller.php
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-09T14:10:07.000Z
CVE-2022-37300 
A CWE-640: Weak Password Recovery Mechanism for Forgotten Password vulnerability exists that could cause unauthorized access in read and write mode to the controller when communicating over Modbus. Affected Products: EcoStruxure Control Expert Including all Unity Pro versions (former name of EcoStruxure Control Expert) (V15.0 SP1 and prior), EcoStruxure Process Expert, Including all versions of EcoStruxure Hybrid DCS (former name of EcoStruxure Process Expert) (V2021 and prior), Modicon M340 CPU (part numbers BMXP34*) (V3.40 and prior), Modicon M580 CPU (part numbers BMEP* and BMEH*) (V3.20 and prior).
Problem types: cwe_id: CWE-640
description: CWE-640 Weak Password Recovery Mechanism for Forgotten Password
Affected products: vendor: Schneider Electric
product: EcoStruxure Control Expert
vendor: Schneider Electric
product: EcoStruxure Process Expert
vendor: Schneider Electric
product: Modicon M340 CPU
vendor: Schneider Electric
product: Modicon M580 CPU
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2022-09-12T17:40:10.000Z
CVE-2022-37301 
A CWE-191: Integer Underflow (Wrap or Wraparound) vulnerability exists that could cause a denial of service of the controller due to memory access violations when using the Modbus TCP protocol. Affected products: Modicon M340 CPU (part numbers BMXP34*)(V3.40 and prior), Modicon M580 CPU (part numbers BMEP* and BMEH*)(V3.22 and prior), Legacy Modicon Quantum/Premium(All Versions), Modicon Momentum MDI (171CBU*)(All Versions), Modicon MC80 (BMKC80)(V1.7 and prior)
Problem types: cwe_id: CWE-191
description: CWE-191 Integer Underflow (Wrap or Wraparound)
Affected products: vendor: Schneider Electric
product: Modicon M340 CPU (part numbers BMXP34*)
vendor: Schneider Electric
product: Modicon M580 CPU (part numbers BMEP* and BMEH*) 
vendor: Schneider Electric
product: Legacy Modicon Quantum/Premium
vendor: Schneider Electric
product: Modicon Momentum MDI (171CBU*)
vendor: Schneider Electric
product: Modicon MC80 (BMKC80)
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
Published: 2022-11-22T00:00:00.000Z
CVE-2022-37302 
A CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could cause a crash of the Control Expert software when an incorrect project file is opened. Affected Products: EcoStruxure Control Expert(V15.1 HF001 and prior).
Problem types: cwe_id: CWE-119
description: CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
Affected products: vendor: Schneider Electric
product: EcoStruxure Control Expert
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 5.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
version: 3.1
Published: 2022-09-13T09:35:12.000Z
CVE-2022-37305 
The Remote Keyless Entry (RKE) receiving unit on certain Honda vehicles through 2018 allows remote attackers to perform unlock operations and force a resynchronization after capturing five consecutive valid RKE signals over the radio, aka a RollBack attack. The attacker retains the ability to unlock indefinitely.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-24T05:05:40.000Z
CVE-2022-37306 
OX App Suite before 7.10.6-rev30 allows XSS via an upsell trigger.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-16T00:00:00.000Z
CVE-2022-37307 
OX App Suite through 7.10.6 allows XSS via XHTML CDATA for a snippet, as demonstrated by the onerror attribute of an IMG element within an e-mail signature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-26T00:00:00.000Z
CVE-2022-37308 
OX App Suite through 7.10.6 allows XSS via HTML in text/plain e-mail messages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-26T00:00:00.000Z
CVE-2022-37309 
OX App Suite through 7.10.6 allows XSS via script code within a contact that has an e-mail address but lacks a name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-26T00:00:00.000Z
CVE-2022-37310 
OX App Suite through 7.10.6 allows XSS via a malicious capability to the metrics or help module, as demonstrated by a /#!!&app=io.ox/files&cap= URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-26T00:00:00.000Z
CVE-2022-37311 
OX App Suite through 7.10.6 has Uncontrolled Resource Consumption via a large location request parameter to the redirect servlet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-26T00:00:00.000Z
CVE-2022-37312 
OX App Suite through 7.10.6 has Uncontrolled Resource Consumption via a large request body containing a redirect URL to the deferrer servlet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-26T00:00:00.000Z
CVE-2022-37313 
OX App Suite through 7.10.6 allows SSRF because the anti-SSRF protection mechanism only checks the first DNS AA or AAAA record.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-26T00:00:00.000Z
CVE-2022-37315 
graphql-go (aka GraphQL for Go) through 0.8.0 has infinite recursion in the type definition parser.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-01T21:53:26.000Z
CVE-2022-37316 
Archer Platform 6.8 before 6.11 P3 (6.11.0.3) contains an improper API access control vulnerability in a multi-instance system that could potentially present unauthorized metadata to an authenticated user of the affected system. 6.10 P3 HF1 (6.10.0.3.1) is also a fixed release.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AC:L/AV:N/A:N/C:H/I:N/PR:L/S:U/UI:N
version: 3.1
Published: 2022-08-25T22:49:00.000Z
CVE-2022-37317 
Archer Platform 6.x before 6.11 P3 contain an HTML injection vulnerability. An authenticated remote attacker could potentially exploit this vulnerability by tricking a victim application user to execute malicious code in the context of the web application. 6.10 P4 (6.10.0.4) and 6.11 P2 HF4 (6.11.0.2.4) are also fixed releases.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.6
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AC:L/AV:N/A:L/C:H/I:L/PR:L/S:U/UI:N
version: 3.1
Published: 2022-08-25T22:42:47.000Z
CVE-2022-37318 
Archer Platform 6.9 SP2 P2 before 6.11 P3 (6.11.0.3) contain a reflected XSS vulnerability. A remote unauthenticated malicious Archer user could potentially exploit this vulnerability by tricking a victim application user into supplying malicious JavaScript code to the vulnerable web application. This code is then reflected to the victim and gets executed by the web browser in the context of the vulnerable web application. 6.10 P4 (6.10.0.4) and 6.11 P2 HF4 (6.11.0.2.4) are also fixed releases.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AC:H/AV:N/A:L/C:H/I:L/PR:N/S:U/UI:N
version: 3.1
Published: 2022-08-25T22:44:16.000Z
CVE-2022-37325 
In Sangoma Asterisk through 16.28.0, 17.x and 18.x through 18.14.0, and 19.x through 19.6.0, an incoming Setup message to addons/ooh323c/src/ooq931.c with a malformed Calling or Called Party IE can cause a crash.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-05T00:00:00.000Z
CVE-2022-37326 
Docker Desktop for Windows before 4.6.0 allows attackers to delete (or create) any file through the dockerBackendV2 windowscontainers/start API by controlling the pidfile field inside the DaemonJSON field in the WindowsContainerStartRequest class. This can indirectly lead to privilege escalation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-27T00:00:00.000Z
CVE-2022-37327 
Improper input validation in BIOS firmware for Intel(R) NUC, Intel(R) NUC Performance Kit, Intel(R) NUC Performance Mini PC, Intel(R) NUC 8 Compute Element, Intel(R) NUC Pro Kit, Intel(R) NUC Pro Board, Intel(R) NUC 11 Compute Element, Intel(R) NUC 12 Compute Element, Intel(R) NUC Extreme, Intel(R) NUC 12 Extreme Compute Element, Intel(R) NUC Laptop Kit, Intel(R) NUC Enthusiast, Intel(R) NUC Essential, Intel(R) NUC Laptop Kit, Intel(R) NUC Extreme Compute Element, Intel(R) NUC Boards, Intel(R) NUC Pro Compute Element, Intel(R) NUC Rugged may allow a privileged user to enable information disclosure via local access.
Problem types: description: information disclosure
cwe_id: CWE-20
description: Improper input validation
Affected products: vendor: n/a
product: Intel(R) NUC, Intel(R) NUC Performance Kit, Intel(R) NUC Performance Mini PC, Intel(R) NUC 8 Compute Element, Intel(R) NUC Pro Kit, Intel(R) NUC Pro Board, Intel(R) NUC 11 Compute Element, Intel(R) NUC 12 Compute Element, Intel(R) NUC Extreme, Intel(R) NUC 12 Extreme Compute Element, Intel(R) NUC Laptop Kit, Intel(R) NUC Enthusiast, Intel(R) NUC Essential, Intel(R) NUC Laptop Kit, Intel(R) NUC Extreme Compute Element, Intel(R) NUC Boards, Intel(R) NUC Pro Compute Element, Intel(R) NUC Rugged
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 6.1
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:N
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: HIGH
userInteraction: NONE
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: LOW
availabilityImpact: NONE
Published: 2023-05-10T13:16:47.728Z
CVE-2022-37328 WordPress History Timeline plugin <= 1.0.5 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability
Authenticated (author+) Stored Cross-Site Scripting (XSS) vulnerability in Themes Awesome History Timeline plugin <= 1.0.5 at WordPress.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Themes Awesome
product: History Timeline (WordPress plugin)
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 3.4
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: HIGH
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: Vulnerability discovered by Ngo Van Thien (Patchstack Alliance)
Published: 2022-09-23T14:23:39.991Z
CVE-2022-37329 
Uncontrolled search path in some Intel(R) Quartus(R) Prime Pro and Standard Edition software may allow an authenticated user to potentially enable escalation of privilege via local access.
Problem types: description: escalation of privilege
Affected products: vendor: n/a
product: Intel(R) Quartus(R) Prime Pro and Standard Edition software
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 6.7
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: LOW
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
Published: 2023-02-16T20:00:09.070Z
CVE-2022-37330 WordPress WHA Crossword plugin <= 1.1.10 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability
Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in WHA Crossword plugin <= 1.1.10 at WordPress.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: WHA
product: WHA Crossword (WordPress plugin)
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: Vulnerability discovered by Ngo Van Thien (Patchstack Alliance)
Published: 2022-09-23T13:33:42.058Z
CVE-2022-37331 
An out-of-bounds write vulnerability exists in the Gaussian format orientation functionality of Open Babel 3.1.1 and master commit 530dbfa3. A specially crafted malformed file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.
Problem types: cwe_id: CWE-119
description: CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
Affected products: vendor: Open Babel
product: Open Babel
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: LOW
baseScore: 7.3
baseSeverity: HIGH
Credits: lang: en
value: Discovered by Claudio Bozzato of Cisco Talos.
Published: 2023-07-21T20:25:38.616Z
CVE-2022-37332 
A use-after-free vulnerability exists in the JavaScript engine of Foxit Software's PDF Reader, version 12.0.1.12430. A specially-crafted PDF document can trigger the reuse of previously freed memory via misusing media player API, which can lead to arbitrary code execution. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a specially-crafted, malicious site if the browser plugin extension is enabled.
Problem types: cwe_id: CWE-416
description: CWE-416: Use After Free
Affected products: vendor: Foxit
product: Foxit Reader
Published: 2022-11-21T16:05:36.155Z