rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-4607 3D City Database OGC Web Feature Service xml external entity reference
A vulnerability was found in 3D City Database OGC Web Feature Service up to 5.2.0. It has been rated as problematic. This issue affects some unknown processing. The manipulation leads to xml external entity reference. Upgrading to version 5.2.1 is able to address this issue. The name of the patch is 246f4e2a97ad81491c00a7ed72ce5e7c7f75050a. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-216215.
Problem types: cwe_id: CWE-611
description: CWE-611 XML External Entity Reference
Affected products: vendor: 3D City Database
product: OGC Web Feature Service
CVSS v3.1: version: 3.1
baseScore: 5.5
vectorString: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Published: 2022-12-18T00:00:00.000Z
CVE-2022-4608 
A vulnerability exists in HCI IEC 60870-5-104 function included in certain versions of the RTU500 series product. The vulnerability can only be exploited, if the HCI 60870-5-104 is configured with support for IEC 62351-3. After session resumption interval is expired an RTU500 initiated update of session parameters causes an unexpected restart due to a stack overflow.
Problem types: cwe_id: CWE-787
description: CWE-787 Out-of-bounds Write
Affected products: vendor: Hitachi Energy
product: RTU500 series
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2023-07-26T05:26:42.720Z
CVE-2022-4609 Cross-site Scripting (XSS) - Stored in usememos/memos
Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.0.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: usememos
product: usememos/memos
Published: 2022-12-19T00:00:00.000Z
CVE-2022-4610 Click Studios Passwordstate risky encryption
A vulnerability, which was classified as problematic, has been found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome. Affected by this issue is some unknown functionality. The manipulation leads to risky cryptographic algorithm. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-216272.
Problem types: cwe_id: CWE-310
description: CWE-310 Cryptographic Issues -> CWE-327 Risky Cryptographic Algorithm
Affected products: vendor: Click Studios
product: Passwordstate
vendor: Click Studios
product: Passwordstate Browser Extension Chrome
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: NONE
baseScore: 1.9
baseSeverity: LOW
Credits: lang: en
value: Constantin Müller/Jan Benninger/Pascal Zenker
Published: 2022-12-19T00:00:00.000Z
CVE-2022-4611 Click Studios Passwordstate hard-coded credentials
A vulnerability, which was classified as problematic, was found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome. This affects an unknown part. The manipulation leads to hard-coded credentials. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component. The identifier VDB-216273 was assigned to this vulnerability.
Problem types: cwe_id: CWE-798
description: CWE-798 Hard-coded Credentials
Affected products: vendor: Click Studios
product: Passwordstate
vendor: Click Studios
product: Passwordstate Browser Extension Chrome
CVSS v3.1: version: 3.1
baseScore: 4.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
baseSeverity: MEDIUM
Credits: lang: en
value: Constantin Müller
lang: en
value: Jan Benninger
lang: en
value: Pascal Zenker
Published: 2022-12-19T00:00:00.000Z
CVE-2022-4612 Click Studios Passwordstate insufficiently protected credentials
A vulnerability has been found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome and classified as problematic. This vulnerability affects unknown code. The manipulation leads to insufficiently protected credentials. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component. VDB-216274 is the identifier assigned to this vulnerability.
Problem types: cwe_id: CWE-522
description: CWE-522 Insufficiently Protected Credentials
Affected products: vendor: Click Studios
product: Passwordstate
vendor: Click Studios
product: Passwordstate Browser Extension Chrome
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
Credits: lang: en
value: Constantin Müller/Jan Benninger/Pascal Zenker
Published: 2022-12-19T00:00:00.000Z
CVE-2022-4613 Click Studios Passwordstate Browser Extension Provisioning improper authorization
A vulnerability was found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome and classified as critical. This issue affects some unknown processing of the component Browser Extension Provisioning. The manipulation leads to improper authorization. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-216275.
Problem types: cwe_id: CWE-266
description: CWE-266 Incorrect Privilege Assignment -> CWE-285 Improper Authorization
Affected products: vendor: Click Studios
product: Passwordstate
vendor: Click Studios
product: Passwordstate Browser Extension Chrome
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: LOW
baseScore: 5
baseSeverity: MEDIUM
Credits: lang: en
value: Constantin Müller/Jan Benninger/Pascal Zenker
Published: 2022-12-19T00:00:00.000Z
CVE-2022-4614 Cross-site Scripting (XSS) - Stored in alagrede/znote-app
Cross-site Scripting (XSS) - Stored in GitHub repository alagrede/znote-app prior to 1.7.11.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: alagrede
product: alagrede/znote-app
Published: 2022-12-19T00:00:00.000Z
CVE-2022-4615 Cross-site Scripting (XSS) - Reflected in openemr/openemr
Cross-site Scripting (XSS) - Reflected in GitHub repository openemr/openemr prior to 7.0.0.2.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: openemr
product: openemr/openemr
Published: 2022-12-19T00:00:00.000Z
CVE-2022-4616 
The webserver in Delta DX-3021 versions prior to 1.24 is vulnerable to 
command injection through the network diagnosis page. This vulnerability
 could allow a remote unauthenticated user to add files, delete files, 
and change file permissions.


Problem types: cwe_id: CWE-77
description: CWE-77 Command Injection
Affected products: vendor: Delta Industrial Automation
product: 4G Router DX-3021
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Parul Sindhwad, Anurag M. Chevendra, Dr. Faruk Kazi from CoE-CNDS Lab, VJTI, Mumbai, India reported this vulnerability to CISA.
Published: 2023-01-12T23:54:02.112Z
CVE-2022-4617 Cross-site Scripting (XSS) - Reflected in microweber/microweber
Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 1.3.2.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: microweber
product: microweber/microweber
Published: 2022-12-21T00:00:00.000Z
CVE-2022-4619 Sidebar Widgets by CodeLights <= 1.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
The Sidebar Widgets by CodeLights plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Extra CSS class’ parameter in versions up to, and including, 1.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: rsukhar
product: Sidebar Widgets by CodeLights
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N
baseScore: 5.5
baseSeverity: MEDIUM
Credits: lang: en
value: Marco Wotschka
Published: 2022-12-20T15:17:07.161Z
CVE-2022-4621 Panasonic Sanyo CCTV Network Camera
Panasonic Sanyo CCTV Network Cameras versions 1.02-05 and 2.03-0x are 
vulnerable to CSRFs that can be exploited to allow an attacker to 
perform changes with administrator level privileges. 




Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Panasonic
product: Sanyo CCTV Network Camera
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
version: 3.1
Credits: lang: en
value: Gjoko Krstic of Zero Science Lab
Published: 2023-01-17T16:36:58.518Z
CVE-2022-4622 Login Logout Menu <= 1.3.3 - Contributor+ Stored XSS in Shortcode
The Login Logout Menu WordPress plugin through 1.3.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Login Logout Menu
default_status: affected
Credits: lang: en
value: Lana Codes
lang: en
value: WPScan
Published: 2023-02-21T08:50:48.474Z
CVE-2022-4623 ND Shortcodes < 7.0 - Contributor+ Stored XSS via Shortcodes
The ND Shortcodes WordPress plugin before 7.0 does not validate and escape numerous of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: ND Shortcodes
default_status: unaffected
Credits: lang: en
value: Lana Codes
lang: en
value: WPScan
Published: 2023-07-04T07:23:28.054Z
CVE-2022-4624 GS Logo Slider < 3.3.8 - Contributor+ Stored XSS in Shortcode
The GS Logo Slider WordPress plugin before 3.3.8 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: GS Logo Slider
default_status: unaffected
Credits: lang: en
value: Lana Codes
lang: en
value: WPScan
Published: 2023-01-23T14:31:31.474Z
CVE-2022-4625 Login Logout Menu < 1.4.0 - Contributor+ Stored XSS in Shortcode
The Login Logout Menu WordPress plugin before 1.4.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Login Logout Menu
default_status: unaffected
Credits: lang: en
value: Lana Codes
lang: en
value: WPScan
Published: 2023-01-23T14:31:23.333Z
CVE-2022-4626 PPWP – WordPress Password Protect Page < 1.8.6 - Contributor+ Stored XSS in Shortcode
The PPWP WordPress plugin before 1.8.6 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: PPWP
default_status: unaffected
Credits: lang: en
value: Lana Codes
lang: en
value: WPScan
Published: 2023-02-06T19:59:50.239Z
CVE-2022-4627 ShiftNav – Responsive Mobile Menu < 1.7.2 - Contributor+ Stored XSS in Shortcode
The ShiftNav WordPress plugin before 1.7.2 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: ShiftNav
default_status: unaffected
Credits: lang: en
value: Lana Codes
lang: en
value: WPScan
Published: 2023-01-23T14:31:51.276Z
CVE-2022-4628 Easy PayPal Buy Now Button < 1.7.4 - Contributor+ Stored XSS in Shortcode
The Easy PayPal Buy Now Button WordPress plugin before 1.7.4 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Easy PayPal Buy Now Button
default_status: unaffected
Credits: lang: en
value: Lana Codes
lang: en
value: WPScan
Published: 2023-02-13T14:32:04.118Z
CVE-2022-4629 Product Slider for WooCommerce < 2.6.4 - Contributor+ Stored XSS in Shortcode
The Product Slider for WooCommerce WordPress plugin before 2.6.4 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Product Slider for WooCommerce
default_status: unaffected
Credits: lang: en
value: Lana Codes
lang: en
value: WPScan
Published: 2023-01-23T14:31:26.062Z
CVE-2022-4630 Sensitive Cookie Without 'HttpOnly' Flag in lirantal/daloradius
Sensitive Cookie Without 'HttpOnly' Flag in GitHub repository lirantal/daloradius prior to master.
Problem types: cwe_id: CWE-1004
description: CWE-1004 Sensitive Cookie Without 'HttpOnly' Flag
Affected products: vendor: lirantal
product: lirantal/daloradius
Published: 2022-12-21T00:00:00.000Z
CVE-2022-4631 WP-Ban ban-options.php cross site scripting
A vulnerability, which was classified as problematic, was found in WP-Ban. Affected is an unknown function of the file ban-options.php. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The name of the patch is 22b925449c84faa9b7496abe4f8f5661cb5eb3bf. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-216480.
Problem types: cwe_id: CWE-707
description: CWE-707 Improper Neutralization -> CWE-74 Injection -> CWE-79 Cross Site Scripting
Affected products: vendor: unspecified
product: WP-Ban
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: LOW
availabilityImpact: NONE
baseScore: 3.5
baseSeverity: LOW
Published: 2022-12-21T00:00:00.000Z
CVE-2022-4632 Auto Upload Images cross site scripting
A vulnerability has been found in Auto Upload Images up to 3.3.0 and classified as problematic. Affected by this vulnerability is an unknown functionality. The manipulation leads to cross site scripting. The attack can be launched remotely. Upgrading to version 3.3.1 is able to address this issue. The name of the patch is 895770ee93887ec78429c78ffdfb865bee6f9436. It is recommended to upgrade the affected component. The identifier VDB-216481 was assigned to this vulnerability.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross Site Scripting
Affected products: vendor: n/a
product: Auto Upload Images
CVSS v3.1: version: 3.1
baseScore: 3.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
baseSeverity: LOW
Published: 2022-12-21T00:00:00.000Z
CVE-2022-4633 Auto Upload Images Settings setting-page.php cross-site request forgery
A vulnerability was found in Auto Upload Images up to 3.3.0 and classified as problematic. Affected by this issue is some unknown functionality of the file src/setting-page.php of the component Settings Handler. The manipulation leads to cross-site request forgery. The attack may be launched remotely. Upgrading to version 3.3.1 is able to address this issue. The name of the patch is 895770ee93887ec78429c78ffdfb865bee6f9436. It is recommended to upgrade the affected component. VDB-216482 is the identifier assigned to this vulnerability.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery
Affected products: vendor: n/a
product: Auto Upload Images
CVSS v3.1: version: 3.1
baseScore: 4.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
baseSeverity: MEDIUM
Published: 2022-12-21T00:00:00.000Z
CVE-2022-4634 CVE-2022-4634
All versions prior to Delta Electronic’s CNCSoft version 1.01.34 (running ScreenEditor versions 1.01.5 and prior) are vulnerable to a stack-based buffer overflow, which could allow an attacker to remotely execute arbitrary code.


Problem types: cwe_id: CWE-121
description: CWE-121
Affected products: vendor: Delta Industrial Automation
product: ScreenEditor
default_status: unaffected
vendor: Delta Industrial Automation
product: CNCSoft
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Simon Humbert, working with Trend Micro Zero Day Initiative
Published: 2023-02-02T22:53:40.907Z
CVE-2022-4636 
Black Box KVM Firmware version 3.4.31307 on models ACR1000A-R-R2, ACR1000A-T-R2, ACR1002A-T, ACR1002A-R, and ACR1020A-T is vulnerable to path traversal, which may allow an attacker to steal user credentials and other sensitive information through local file inclusion.


Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: Black Box
product: KVM ACR1020A-T
default_status: unaffected
vendor: Black Box
product: KVM ACR1002A-R
default_status: unaffected
vendor: Black Box
product: KVM ACR1002A-T
default_status: unaffected
vendor: Black Box
product: KVM ACR1000A-T-R2
default_status: unaffected
vendor: Black Box
product: KVM ACR1000A-R-R2
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Ferhat Çil
Published: 2023-01-10T19:54:23.077Z
CVE-2022-4637 ep3-bs cross site scripting
A vulnerability classified as problematic has been found in ep3-bs up to 1.7.x. This affects an unknown part. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 1.8.0 is able to address this issue. The name of the patch is ef49e709c8adecc3a83cdc6164a67162991d2213. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-216495.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross Site Scripting
Affected products: vendor: n/a
product: ep3-bs
CVSS v3.1: version: 3.1
baseScore: 3.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
baseSeverity: LOW
Published: 2022-12-21T00:00:00.000Z
CVE-2022-4638 collective.contact.widget widgets.py title cross site scripting
A vulnerability classified as problematic was found in collective.contact.widget up to 1.12. This vulnerability affects the function title of the file src/collective/contact/widget/widgets.py. The manipulation leads to cross site scripting. The attack can be initiated remotely. The name of the patch is 5da36305ca7ed433782be8901c47387406fcda12. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-216496.
Problem types: cwe_id: CWE-707
description: CWE-707 Improper Neutralization -> CWE-74 Injection -> CWE-79 Cross Site Scripting
Affected products: vendor: unspecified
product: collective.contact.widget
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: LOW
availabilityImpact: NONE
baseScore: 3.5
baseSeverity: LOW
Published: 2022-12-21T00:00:00.000Z
CVE-2022-4639 sslh Packet Dumping probe.c hexdump format string
A vulnerability, which was classified as critical, has been found in sslh. This issue affects the function hexdump of the file probe.c of the component Packet Dumping Handler. The manipulation of the argument msg_info leads to format string. The attack may be initiated remotely. The name of the patch is b19f8a6046b080e4c2e28354a58556bb26040c6f. It is recommended to apply a patch to fix this issue. The identifier VDB-216497 was assigned to this vulnerability.
Problem types: cwe_id: CWE-119
description: CWE-119 Memory Corruption -> CWE-134 Format String
Affected products: vendor: unspecified
product: sslh
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: LOW
baseScore: 5.6
baseSeverity: MEDIUM
Published: 2022-12-21T00:00:00.000Z