rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-41772 

Delta Electronics InfraSuite Device Master Versions 00.00.01a and prior mishandle .ZIP archives containing characters used in path traversal. This path traversal could result in remote code execution. 


Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: Delta Electronics
product: InfraSuite Device Master
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: kimiya
lang: en
value: Trend Micro Zero Day Initiative
Published: 2022-10-31T19:26:33.695Z
CVE-2022-41773 Delta Electronics DIAEnergie
The affected product DIAEnergie (versions prior to v1.9.01.002) is vulnerable to a SQL injection that exists in CheckDIACloud. A low-privileged authenticated attacker could exploit this issue to inject arbitrary SQL queries.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Delta Electronics
product: DIAEnergie
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
Credits: lang: en
value: Michael Heinzl reported these vulnerabilities to CISA.
Published: 2022-10-27T20:15:38.645Z
CVE-2022-41775 Delta Electronics DIAEnergie SQL Injection
SQL Injection in 







Handler_CFG.ashx in Delta Electronics DIAEnergie versions prior to v1.9.02.001 allows an attacker to inject SQL queries via Network
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Delta Electronics
product: DIAEnergie
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Michael Heinzl reported these vulnerabilities to CISA.
Published: 2022-11-17T22:45:55.264Z
CVE-2022-41776 

Delta Electronics InfraSuite Device Master versions 00.00.01a and prior allow unauthenticated users to trigger the WriteConfiguration method, which could allow an attacker to provide new values for user configuration files such as UserListInfo.xml. This could lead to the changing of administrative passwords.


Problem types: cwe_id: CWE-306
description: CWE-306 Missing Authentication for Critical Function
Affected products: vendor: Delta Electronics
product: InfraSuite Device Master
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
version: 3.1
Credits: lang: en
value: kimiya
lang: en
value: Trend Micro Zero Day Initiative
Published: 2022-10-31T19:48:17.936Z
CVE-2022-41777 
Improper check or handling of exceptional conditions vulnerability in Nako3edit, editor component of nadesiko3 (PC Version) v3.3.74 and earlier allows a remote attacker to inject an invalid value to decodeURIComponent of nako3edit, which may lead the server to crash.
Problem types: description: Improper check or handling of exceptional conditions
Affected products: vendor: kujirahand
product: Nako3edit, editor component of nadesiko3 (PC Version)
Published: 2022-12-05T00:00:00.000Z
CVE-2022-41778 

Delta Electronics InfraSuite Device Master versions 00.00.01a and prior deserialize user-supplied data provided through the Device-DataCollect service port without proper verification. An attacker could provide malicious serialized objects to execute arbitrary code upon deserialization. 


Problem types: cwe_id: CWE-502
description: CWE-502 Deserialization of Untrusted Data
Affected products: vendor: Delta Electronics
product: InfraSuite Device Master
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: kimiya
lang: en
value: Trend Micro Zero Day Initiative
Published: 2023-01-12T23:19:47.452Z
CVE-2022-41779 

Delta Electronics InfraSuite Device Master versions 00.00.01a and prior deserialize network packets without proper verification. If the device connects to an attacker-controlled server, the attacker could send maliciously crafted packets that would be deserialized and executed, leading to remote code execution.


Problem types: cwe_id: CWE-502
description: CWE-502 Deserialization of Untrusted Data
Affected products: vendor: Delta Electronics
product: InfraSuite Device Master
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: kimiya
lang: en
value: Trend Micro Zero Day Initiative
Published: 2022-10-31T19:19:35.913Z
CVE-2022-41780 F5OS CLI vulnerability CVE-2022-41780
In F5OS-A version 1.x before 1.1.0 and F5OS-C version 1.x before 1.4.0, a directory traversal vulnerability exists in an undisclosed location of the F5OS CLI that allows an attacker to read arbitrary files.
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: F5
product: F5OS-A
vendor: F5
product: F5OS-C
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
baseScore: 5.5
baseSeverity: MEDIUM
Credits: lang: en
value: This issue was discovered internally by F5.
Published: 2022-10-19T21:22:10.493Z
CVE-2022-41781 WordPress Permalink Manager Lite plugin <= 2.2.20 - Broken Access Control vulnerability
Broken Access Control vulnerability in Permalink Manager Lite plugin <= 2.2.20 on WordPress.
Problem types: cwe_id: CWE-264
description: CWE-264 Permissions, Privileges, and Access Controls
Affected products: vendor: Maciej Bis
product: Permalink Manager Lite
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
version: 3.1
Credits: lang: en
value: Vulnerability discovered by Tien Nguyen Anh (Patchstack Alliance)
Published: 2022-11-18T19:00:40.013Z
CVE-2022-41783 
tdpServer of TP-Link RE300 V1 improperly processes its input, which may allow an attacker to cause a denial-of-service (DoS) condition of the product's OneMesh function.
Problem types: description: Improper Handling of Syntactically Invalid Structure
Affected products: vendor: TP-Link
product: TP-Link RE300 V1
Published: 2022-12-07T00:00:00.000Z
CVE-2022-41784 
Improper access control in kernel mode driver for the Intel(R) OFU software before version 14.1.30 may allow an authenticated user to potentially enable escalation of privilege via local access
Problem types: description: escalation of privilege
cwe_id: CWE-284
description: Improper access control
Affected products: vendor: n/a
product: Intel(R) OFU software
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 8.8
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
Published: 2023-05-10T13:17:10.808Z
CVE-2022-41785 WordPress Photo Gallery – Image Gallery by Ape Plugin <= 2.2.8 is vulnerable to Cross Site Scripting (XSS)
Auth. (contributor+) Stored Cross-Site Scripting vulnerability in Galleryape Gallery Images Ape plugin <= 2.2.8 versions.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Galleryape
product: Gallery Images Ape
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: thiennv (Patchstack Alliance)
Published: 2023-03-21T05:57:16.560Z
CVE-2022-41786 WordPress WP Job Portal Plugin <= 2.0.1 is vulnerable to Broken Access Control
Missing Authorization vulnerability in WP Job Portal WP Job Portal – A Complete Job Board.This issue affects WP Job Portal – A Complete Job Board: from n/a through 2.0.1.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: WP Job Portal
product: WP Job Portal – A Complete Job Board
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
version: 3.1
Credits: lang: en
value: István Márton (Patchstack Alliance)
Published: 2024-01-17T17:14:35.810Z
CVE-2022-41787 BIG-IP DNS Express vulnerability CVE-2022-41787
In BIG-IP versions 17.0.x before 17.0.0.1, 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5.1, and 13.1.x before 13.1.5.1, when DNS profile is configured on a virtual server with DNS Express enabled, undisclosed DNS queries with DNSSEC can cause TMM to terminate.
Problem types: cwe_id: CWE-476
description: CWE-476 NULL Pointer Dereference
Affected products: vendor: F5
product: BIG-IP DNS
vendor: F5
product: BIG-IP LTM
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
Credits: lang: en
value: This issue was discovered internally by F5.
Published: 2022-10-19T21:22:36.379Z
CVE-2022-41788 WordPress Soledad premium theme <= 8.2.5 - Auth. Cross-Site Scripting (XSS) vulnerability
Auth. (subscriber+) Cross-Site Scripting (XSS) vulnerability in Soledad premium theme <= 8.2.5 on WordPress.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: PenciDesign
product: Soledad (WordPress theme)
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: Vulnerability discovered by Dave Jong (Patchstack)
Published: 2022-11-18T22:09:27.321Z
CVE-2022-41789 Potential XSS on default page header
Cross-site Scripting (XSS) vulnerability in BlueSpiceDiscovery skin of BlueSpice allows logged in user with edit permissions to inject arbitrary HTML into the default page header of a wikipage.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Hallo Welt! GmbH
product: BlueSpice
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: NONE
baseScore: 3.3
baseSeverity: LOW
Published: 2022-11-15T14:24:50.166Z
CVE-2022-41790 WordPress WP Time Slots Booking Form Plugin <= 1.1.76 is vulnerable to Broken Access Control
Missing Authorization vulnerability in CodePeople WP Time Slots Booking Form.This issue affects WP Time Slots Booking Form: from n/a through 1.1.76.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: CodePeople
product: WP Time Slots Booking Form
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: István Márton (Patchstack Alliance)
Published: 2024-01-17T18:13:44.505Z
CVE-2022-41791 WordPress ProfileGrid plugin <= 5.1.6 - Auth. CSV Injection vulnerability
Auth. (subscriber+) CSV Injection vulnerability in ProfileGrid plugin <= 5.1.6 on WordPress.
Problem types: description: CSV Injection
Affected products: vendor: Profilegrid
product: ProfileGrid (WordPress plugin)
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.8
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:L
version: 3.1
Credits: lang: en
value: Vulnerability discovered by Mika (Patchstack Alliance)
Published: 2022-11-17T22:08:40.097Z
CVE-2022-41793 
An out-of-bounds write vulnerability exists in the CSR format title functionality of Open Babel 3.1.1 and master commit 530dbfa3. A specially crafted malformed file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.
Problem types: cwe_id: CWE-120
description: CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Affected products: vendor: Open Babel
product: Open Babel
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
Credits: lang: en
value: Discovered by Claudio Bozzato of Cisco Talos.
Published: 2023-07-21T20:25:40.659Z
CVE-2022-41794 
A heap based buffer overflow vulnerability exists in the PSD thumbnail resource parsing code of OpenImageIO 2.3.19.0. A specially-crafted PSD file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.
Problem types: cwe_id: CWE-122
description: CWE-122: Heap-based Buffer Overflow
Affected products: vendor: OpenImageIO Project
product: OpenImageIO
Published: 2022-12-23T23:03:51.372Z
CVE-2022-41796 
Untrusted search path vulnerability in the installer of Content Transfer (for Windows) Ver.1.3 and prior allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
Problem types: description: Untrusted search path vulnerability
Affected products: vendor: Sony Corporation
product: Content Transfer (for Windows)
Published: 2022-10-24T00:00:00.000Z
CVE-2022-41797 
Improper authorization in handler for custom URL scheme vulnerability in Lemon8 App for Android versions prior to 3.3.5 and Lemon8 App for iOS versions prior to 3.3.5 allows a remote attacker to lead a user to access an arbitrary website via the vulnerable App. As a result, the user may become a victim of a phishing attack.
Problem types: description: Improper Authorization in Handler for Custom URL Scheme
Affected products: vendor: ByteDance K.K.
product: Lemon8 App for Android and Lemon8 App for iOS
Published: 2022-10-24T00:00:00.000Z
CVE-2022-41798 
Session information easily guessable vulnerability exists in Kyocera Document Solutions MFPs and printers, which may allow a network-adjacent attacker to log in to the product by spoofing a user with guessed session information. Affected products/versions are as follows: TASKalfa 7550ci/6550ci, TASKalfa 5550ci/4550ci/3550ci/3050ci, TASKalfa 255c/205c, TASKalfa 256ci/206ci, ECOSYS M6526cdn/M6526cidn, FS-C2126MFP/C2126MFP+/C2026MFP/C2026MFP+, TASKalfa 8000i/6500i, TASKalfa 5500i/4500i/3500i, TASKalfa 305/255, TASKalfa 306i/256i, LS-3140MFP/3140MFP+/3640MFP, ECOSYS M2535dn, LS-1135MFP/1035MFP, LS-C8650DN/C8600DN, ECOSYS P6026cdn, FS-C5250DN, LS-4300DN/4200DN/2100DN, ECOSYS P4040dn, ECOSYS P2135dn, and FS-1370DN.
Problem types: description: Session Information Easily Guessable
Affected products: vendor: KYOCERA Document Solutions Inc.
product: Kyocera Document Solutions MFPs and printers
Published: 2022-12-05T00:00:00.000Z
CVE-2022-41799 
Improper access control vulnerability in GROWI prior to v5.1.4 (v5 series) and versions prior to v4.5.25 (v4 series) allows a remote authenticated attacker to bypass access restriction and download the markdown data from the pages set to private by the other users.
Problem types: description: Improper Access Control
Affected products: vendor: WESEEK, Inc.
product: GROWI v5 series and v4 series
Published: 2022-10-24T00:00:00.000Z
CVE-2022-41800 Appliance mode iControl REST vulnerability

In all versions of BIG-IP, when running in Appliance mode, an authenticated user assigned the Administrator role may be able to bypass Appliance mode restrictions, utilizing an undisclosed iControl REST endpoint. A successful exploit can allow the attacker to cross a security boundary.  

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.


Problem types: cwe_id: CWE-77
description: CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
Affected products: vendor: F5
product: BIG-IP
default_status: unknown
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 8.7
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
version: 3.1
Credits: lang: en
value: F5 acknowledges Ron Bowes of Rapid7 for bringing this issue to our attention and following the highest standards of coordinated disclosure.
Published: 2022-12-07T03:12:17.395Z
CVE-2022-41801 
Uncontrolled resource consumption in the Intel(R) Connect M Android application before version 1.82 may allow an authenticated user to potentially enable denial of service via local access.
Problem types: description: denial of service
cwe_id: CWE-400
description: Uncontrolled resource consumption
Affected products: vendor: n/a
product: Intel(R) Connect M Android application
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 5
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
Published: 2023-05-10T13:17:18.763Z
CVE-2022-41802 Kernel subsystem in kernel_liteos_a has a kernel stack overflow vulnerability when call SysClockGetres.
Kernel subsystem within OpenHarmony-v3.1.4 and prior versions in kernel_liteos_a has a kernel stack overflow vulnerability when call SysClockGetres. 4 bytes padding data from kernel stack are copied to user space incorrectly and leaked.
Problem types: cwe_id: CWE-120
description: CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Affected products: vendor: OpenHarmony
product: OpenHarmony
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 4
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
version: 3.1
Published: 2022-12-08T00:00:00.000Z
CVE-2022-41804 
Unauthorized error injection in Intel(R) SGX or Intel(R) TDX for some Intel(R) Xeon(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access.
Problem types: description: escalation of privilege
cwe_id: CWE-1334
description: Unauthorized error injection
Affected products: vendor: n/a
product: Intel(R) Xeon(R) Processors
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 7.2
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:L/I:H/A:H
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: HIGH
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: HIGH
availabilityImpact: HIGH
Published: 2023-08-11T02:37:08.111Z
CVE-2022-41805 WordPress Booster for WooCommerce plugin <= 5.6.6 - Cross-Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in Booster for WooCommerce plugin <= 5.6.6 on WordPress.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Pluggabl LLC
product: Booster for WooCommerce (WordPress plugin)
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
version: 3.1
Credits: lang: en
value: Vulnerability discovered by Muhammad Daffa (Patchstack Alliance)
Published: 2022-11-18T18:44:15.302Z
CVE-2022-41806 BIG-IP AFM NAT64 Policy Vulnerability CVE-2022-41806
In versions 16.1.x before 16.1.3.2 and 15.1.x before 15.1.5.1, when BIG-IP AFM Network Address Translation policy with IPv6/IPv4 translation rules is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization.
Problem types: cwe_id: CWE-400
description: CWE-400 Uncontrolled Resource Consumption
Affected products: vendor: F5
product: BIG-IP AFM
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
Credits: lang: en
value: This issue was discovered internally by F5.
Published: 2022-10-19T21:22:58.738Z
CVE-2022-41807 
Missing authorization vulnerability exists in Kyocera Document Solutions MFPs and printers, which may allow a network-adjacent attacker to alter the product settings without authentication by sending a specially crafted request. Affected products/versions are as follows: TASKalfa 7550ci/6550ci, TASKalfa 5550ci/4550ci/3550ci/3050ci, TASKalfa 255c/205c, TASKalfa 256ci/206ci, ECOSYS M6526cdn/M6526cidn, FS-C2126MFP/C2126MFP+/C2026MFP/C2026MFP+, TASKalfa 8000i/6500i, TASKalfa 5500i/4500i/3500i, TASKalfa 305/255, TASKalfa 306i/256i, LS-3140MFP/3140MFP+/3640MFP, ECOSYS M2535dn, LS-1135MFP/1035MFP, LS-C8650DN/C8600DN, ECOSYS P6026cdn, FS-C5250DN, LS-4300DN/4200DN/2100DN, ECOSYS P4040dn, ECOSYS P2135dn, and FS-1370DN.
Problem types: description: Missing authorization
Affected products: vendor: KYOCERA Document Solutions Inc.
product: Kyocera Document Solutions MFPs and printers
Published: 2022-12-05T00:00:00.000Z