rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-3236 
A code injection vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v19.0 MR1 and older.
Problem types: description: n/a
Affected products: vendor: Sophos
product: Sophos Firewall
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2022-09-23T12:50:13.000Z
CVE-2022-3237 WP Contact Slider < 2.4.8 - Admin+ Stored Cross-Site Scripting
The WP Contact Slider WordPress plugin before 2.4.8 does not sanitize and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: WP Contact Slider
Credits: lang: en
value: Asif Nawaz Minhas
Published: 2022-10-31T00:00:00.000Z
CVE-2022-3238 
A double-free flaw was found in the Linux kernel’s NTFS3 subsystem in how a user triggers remount and umount simultaneously. This flaw allows a local user to crash or potentially escalate their privileges on the system.
Problem types: cwe_id: CWE-459
description: CWE-459
Affected products: vendor: n/a
product: Kernel
Published: 2022-11-14T00:00:00.000Z
CVE-2022-3239 
A flaw use after free in the Linux kernel video4linux driver was found in the way user triggers em28xx_usb_probe() for the Empia 28xx based TV cards. A local user could use this flaw to crash the system or potentially escalate their privileges on the system.
Problem types: cwe_id: CWE-416
description: CWE-416
Affected products: vendor: n/a
product: Kernel
Published: 2022-09-19T00:00:00.000Z
CVE-2022-3240 Follow Me Plugin <= 3.1.1 - Cross-Site Request Forgery to Cross-Site Scripting
The "Follow Me Plugin" plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.1.1. This is due to missing nonce validation on the FollowMeIgniteSocialMedia_options_page() function. This makes it possible for unauthenticated attackers to modify the plugin's settings and inject malicious JavaScript via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: brian-chappell
product: Follow Me Plugin
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
baseScore: 8.8
baseSeverity: HIGH
Credits: lang: en
value: Marco Wotschka
Published: 2022-11-15T13:25:57.082Z
CVE-2022-3241 Build App Online < 1.0.19 - Unauthenticated SQL Injection
The Build App Online WordPress plugin before 1.0.19 does not properly sanitise and escape some parameters before using them in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection
Problem types: description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: Build App Online
default_status: unaffected
Credits: lang: en
value: Francesco Marano
lang: en
value: Donato Di Pasquale
lang: en
value: WPScan
Published: 2023-01-02T21:49:12.027Z
CVE-2022-3242 HTML code Injection in template search keyword in microweber/microweber
Code Injection in GitHub repository microweber/microweber prior to 1.3.2.
Problem types: cwe_id: CWE-94
description: CWE-94 Improper Control of Generation of Code
Affected products: vendor: microweber
product: microweber/microweber
Published: 2022-09-20T10:15:20.000Z
CVE-2022-3243 Import all XML, CSV & TXT into WordPress < 6.5.8 - Admin+ SQLi
The Import all XML, CSV & TXT WordPress plugin before 6.5.8 does not properly sanitise and escape imported data before using them back SQL statements, leading to SQL injection exploitable by high privilege users such as admin
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: Import all XML, CSV & TXT into WordPress
Credits: lang: en
value: Sanjay Das
Published: 2022-10-17T00:00:00.000Z
CVE-2022-3244 Import all XML, CSV & TXT into WordPress < 6.5.8 - Missing Authorisation
The Import all XML, CSV & TXT WordPress plugin before 6.5.8 does not have authorisation in some places, which could allow any authenticated users to access some of the plugin features if they manage to get the related nonce
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: Unknown
product: Import all XML, CSV & TXT into WordPress
Credits: lang: en
value: Sanjay Das
Published: 2022-10-17T00:00:00.000Z
CVE-2022-3245  Code Injection in display of tag title on saving tags in microweber/microweber
HTML injection attack is closely related to Cross-site Scripting (XSS). HTML injection uses HTML to deface the page. XSS, as the name implies, injects JavaScript into the page. Both attacks exploit insufficient validation of user input.
Problem types: cwe_id: CWE-94
description: CWE-94 Improper Control of Generation of Code
Affected products: vendor: microweber
product: microweber/microweber
Published: 2022-09-20T13:15:20.000Z
CVE-2022-3246 Blog2Social < 6.9.10 - Subscriber+ SQLi
The Blog2Social: Social Media Auto Post & Scheduler WordPress plugin before 6.9.10 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by any authenticated users, such as subscribers
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: Blog2Social: Social Media Auto Post & Scheduler
Credits: lang: en
value: Sakri Rafael Koskimies
Published: 2022-10-25T00:00:00.000Z
CVE-2022-3247 Blog2Social < 6.9.10 - Subscriber+ SSRF
The Blog2Social: Social Media Auto Post & Scheduler WordPress plugin before 6.9.10 does not have authorisation in an AJAX action, and does not ensure that the URL to make a request to is an external one. As a result, any authenticated users, such as subscriber could perform SSRF attacks
Problem types: cwe_id: CWE-918
description: CWE-918 Server-Side Request Forgery (SSRF)
Affected products: vendor: Unknown
product: Blog2Social: Social Media Auto Post & Scheduler
Credits: lang: en
value: Sakri Rafael Koskimies
Published: 2022-10-25T00:00:00.000Z
CVE-2022-3248 Openshift api admission checks does not enforce "custom-host" permissions
A flaw was found in OpenShift API, as admission checks do not enforce "custom-host" permissions. This issue could allow an attacker to violate the boundaries, as permissions will not be applied.
Problem types: cwe_id: CWE-863
description: Incorrect Authorization
Affected products: vendor: n/a
product: kubernetes
default_status: affected
vendor: Red Hat
product: Red Hat Advanced Cluster Management for Kubernetes 2
cpes: cpe:/a:redhat:acm:2
default_status: affected
vendor: Red Hat
product: Red Hat Ansible Automation Platform 1.2
cpes: cpe:/a:redhat:ansible_automation_platform
default_status: unaffected
vendor: Red Hat
product: Red Hat Ansible Tower 3
cpes: cpe:/a:redhat:ansible_tower:3
default_status: unaffected
vendor: Red Hat
product: Red Hat OpenShift Container Platform 3.11
cpes: cpe:/a:redhat:openshift:3.11
default_status: unknown
vendor: Red Hat
product: Red Hat OpenShift Container Platform 4
cpes: cpe:/a:redhat:openshift:4
default_status: affected
vendor: Red Hat
product: Red Hat OpenShift Container Platform 4
cpes: cpe:/a:redhat:openshift:4
default_status: affected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.4
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N
version: 3.1
Published: 2023-10-05T13:28:27.973Z
CVE-2022-3249 WP CSV Exporter < 1.3.7 - Admin+ SQLi
The WP CSV Exporter WordPress plugin before 1.3.7 does not properly sanitise and escape some parameters before using them in a SQL statement, allowing high privilege users such as admin to perform SQL injection attacks
Problem types: description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: WP CSV Exporter
default_status: unaffected
Credits: lang: en
value: Asif Nawaz Minhas
Published: 2022-12-05T16:50:36.452Z
CVE-2022-3250 Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in ikus060/rdiffweb
Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository ikus060/rdiffweb prior to 2.4.6.
Problem types: cwe_id: CWE-614
description: CWE-614 Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
Affected products: vendor: ikus060
product: ikus060/rdiffweb
Published: 2022-09-21T16:55:14.000Z
CVE-2022-3251 Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in ikus060/minarca
Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository ikus060/minarca prior to 4.2.2.
Problem types: cwe_id: CWE-614
description: CWE-614 Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
Affected products: vendor: ikus060
product: ikus060/minarca
Published: 2022-09-21T16:55:08.000Z
CVE-2022-3252 
Improper detection of complete HTTP body decompression SwiftNIO Extras provides a pair of helpers for transparently decompressing received HTTP request or response bodies. These two objects (HTTPRequestDecompressor and HTTPResponseDecompressor) both failed to detect when the decompressed body was considered complete. If trailing junk data was appended to the HTTP message body, the code would repeatedly attempt to decompress this data and fail. This would lead to an infinite loop making no forward progress, leading to livelock of the system and denial-of-service. This issue can be triggered by any attacker capable of sending a compressed HTTP message. Most commonly this is HTTP servers, as compressed HTTP messages cannot be negotiated for HTTP requests, but it is possible that users have configured decompression for HTTP requests as well. The attack is low effort, and likely to be reached without requiring any privilege or system access. The impact on availability is high: the process immediately becomes unavailable but does not immediately crash, meaning that it is possible for the process to remain in this state until an administrator intervenes or an automated circuit breaker fires. If left unchecked this issue will very slowly exhaust memory resources due to repeated buffer allocation, but the buffers are not written to and so it is possible that the processes will not terminate for quite some time. This risk can be mitigated by removing transparent HTTP message decompression. The issue is fixed by correctly detecting the termination of the compressed body as reported by zlib and refusing to decompress further data. The issue was found by Vojtech Rylko (https://github.com/vojtarylko) and reported publicly on GitHub.
Problem types: cwe_id: CWE-606
description: CWE-606: Unchecked Input for Loop Condition
Affected products: vendor: Swift Project
product: SwiftNIO Extras
Published: 2022-09-21T18:45:16.000Z
CVE-2022-3254 AWP Classifieds Plugin < 4.3 - Unauthenticated SQLi
The WordPress Classifieds Plugin WordPress plugin before 4.3 does not properly sanitise and escape some parameters before using them in a SQL statement via an AJAX action available to unauthenticated users and when a specific premium module is active, leading to a SQL injection
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: WordPress Classifieds Plugin – Ad Directory & Listings by AWP Classifieds
Credits: lang: en
value: cydave
Published: 2022-10-31T00:00:00.000Z
CVE-2022-3255 Cross-site Scripting (XSS) - Reflected in pimcore/pimcore
If an attacker can control a script that is executed in the victim's browser, then they can typically fully compromise that user. Amongst other things, the attacker can: Perform any action within the application that the user can perform. View any information that the user is able to view. Modify any information that the user is able to modify. Initiate interactions with other application users, including malicious attacks, that will appear to originate from the initial victim user.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: pimcore
product: pimcore/pimcore
Published: 2022-09-21T12:00:21.000Z
CVE-2022-3256 Use After Free in vim/vim
Use After Free in GitHub repository vim/vim prior to 9.0.0530.
Problem types: cwe_id: CWE-416
description: CWE-416 Use After Free
Affected products: vendor: vim
product: vim/vim
Published: 2022-09-22T00:00:00.000Z
CVE-2022-3257 Server-side Denial of Service while processing a specifically crafted GIF file
Mattermost version 7.1.x and earlier fails to sufficiently process a specifically crafted GIF file when it is uploaded while drafting a post, which allows authenticated users to cause resource exhaustion while processing the file, resulting in server-side Denial of Service.
Problem types: cwe_id: CWE-400
description: CWE-400 Uncontrolled Resource Consumption
Affected products: vendor: Mattermost
product: Mattermost
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 3.1
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
version: 3.1
Credits: lang: en
value: Thanks to Philippe Antoine (catenacyber) for contributing to this improvement under the Mattermost responsible disclosure policy.
Published: 2022-09-23T14:13:39.000Z
CVE-2022-3258 
Incorrect Permission Assignment for Critical Resource vulnerability in HYPR Workforce Access on Windows allows Authentication Abuse.
Problem types: cwe_id: CWE-732
description: CWE-732 Incorrect Permission Assignment for Critical Resource
Affected products: vendor: HYPR
product: Workforce Access
default_status: affected
CVSS v3.1: attackComplexity: HIGH
attackVector: PHYSICAL
availabilityImpact: LOW
baseScore: 3.7
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:P/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L
version: 3.1
Published: 2022-11-03T18:04:32.101Z
CVE-2022-3259 
Openshift 4.9 does not use HTTP Strict Transport Security (HSTS) which may allow man-in-the-middle (MITM) attacks.
Problem types: cwe_id: CWE-665
description: CWE-665
Affected products: vendor: n/a
product: OpenShift
Published: 2022-12-09T00:00:00.000Z
CVE-2022-3260 
The response header has not enabled X-FRAME-OPTIONS, Which helps prevents against Clickjacking attack.. Some browsers would interpret these results incorrectly, allowing clickjacking attacks.
Problem types: cwe_id: CWE-1021
description: CWE-1021
Affected products: vendor: n/a
product: Openshift
Published: 2022-12-08T00:00:00.000Z
CVE-2022-3261 Plain-text passwords saved in /var/log/messages
A flaw was found in OpenStack. Multiple components show plain-text passwords in /var/log/messages during the OpenStack overcloud update run, leading to a disclosure of sensitive information problem.
Problem types: cwe_id: CWE-256
description: Plaintext Storage of a Password
Affected products: vendor: n/a
product: openstack
default_status: affected
vendor: Red Hat
product: Red Hat OpenStack Platform 16.2
cpes: cpe:/a:redhat:openstack:16.2
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 4.4
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2023-09-15T20:20:18.481Z
CVE-2022-3262 
A flaw was found in Openshift. A pod with a DNSPolicy of "ClusterFirst" may incorrectly resolve the hostname based on a service provided. This flaw allows an attacker to supply an incorrect name with the DNS search policy, affecting confidentiality and availability.
Problem types: cwe_id: CWE-453
description: CWE-453
Affected products: vendor: n/a
product: openshift
Published: 2022-12-08T00:00:00.000Z
CVE-2022-3263 Measuresoft ScadaPro Server Improper Access Control
The security descriptor of Measuresoft ScadaPro Server version 6.7 has inconsistent permissions, which could allow a local user with limited privileges to modify the service binary path and start malicious commands with SYSTEM privileges.
Problem types: cwe_id: CWE-284
description: CWE-284 Improper Access Control
Affected products: vendor: Measuresoft
product: ScadaPro Server
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: @rgod777, working with Trend Micro Zero Day Initiative, reported this vulnerability to CISA.
Published: 2022-09-23T18:30:36.700Z
CVE-2022-3265 
A cross-site scripting issue has been discovered in GitLab CE/EE affecting all versions prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2. It was possible to exploit a vulnerability in setting the labels colour feature which could lead to a stored XSS that allowed attackers to perform arbitrary actions on behalf of victims at client side.
Problem types: description: Improper neutralization of input during web page generation ('cross-site scripting') in GitLab
Affected products: vendor: GitLab
product: GitLab
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:N
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: HIGH
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: NONE
baseScore: 7.3
baseSeverity: HIGH
Credits: lang: en
value: Thanks [yvvdwf](https://hackerone.com/yvvdwf) for reporting this vulnerability through our HackerOne bug bounty program
Published: 2022-11-09T00:00:00.000Z
CVE-2022-3266 
An out-of-bounds read can occur when decoding H264 video. This results in a potentially exploitable crash. This vulnerability affects Firefox ESR < 102.3, Thunderbird < 102.3, and Firefox < 105.
Problem types: description: Out of bounds read when decoding H264
Affected products: vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Thunderbird
vendor: Mozilla
product: Firefox
Published: 2022-12-22T00:00:00.000Z
CVE-2022-3267 Cross-Site Request Forgery (CSRF) in ikus060/rdiffweb
Cross-Site Request Forgery (CSRF) in GitHub repository ikus060/rdiffweb prior to 2.4.6.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: ikus060
product: ikus060/rdiffweb
Published: 2022-09-22T09:20:14.000Z
CVE-2022-3268 Weak Password Requirements in ikus060/minarca
Weak Password Requirements in GitHub repository ikus060/minarca prior to 4.2.2.
Problem types: cwe_id: CWE-521
description: CWE-521 Weak Password Requirements
Affected products: vendor: ikus060
product: ikus060/minarca
Published: 2022-09-22T09:20:09.000Z
CVE-2022-3269 Session Fixation in ikus060/rdiffweb
Session Fixation in GitHub repository ikus060/rdiffweb prior to 2.4.7.
Problem types: cwe_id: CWE-384
description: CWE-384 Session Fixation
Affected products: vendor: ikus060
product: ikus060/rdiffweb
Published: 2022-09-23T09:20:09.000Z
CVE-2022-3272 Improper Handling of Length Parameter Inconsistency in ikus060/rdiffweb
Improper Handling of Length Parameter Inconsistency in GitHub repository ikus060/rdiffweb prior to 2.4.8.
Problem types: cwe_id: CWE-130
description: CWE-130 Improper Handling of Length Parameter Inconsistency
Affected products: vendor: ikus060
product: ikus060/rdiffweb
Published: 2022-09-26T16:50:10.000Z
CVE-2022-3273 Allocation of Resources Without Limits or Throttling in ikus060/rdiffweb
Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.5.0a4.
Problem types: cwe_id: CWE-770
description: CWE-770 Allocation of Resources Without Limits or Throttling
Affected products: vendor: ikus060
product: ikus060/rdiffweb
Published: 2022-10-06T00:00:00.000Z
CVE-2022-3274 Cross-Site Request Forgery (CSRF) on user's settings in GitHub repository ikus060/rdiffweb prior to 2.4.6. in ikus060/rdiffweb
Cross-Site Request Forgery (CSRF) in GitHub repository ikus060/rdiffweb prior to 2.4.7.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: ikus060
product: ikus060/rdiffweb
Published: 2022-09-22T18:15:11.000Z
CVE-2022-3275 Puppetlabs-apt Command Injection
Command injection is possible in the puppetlabs-apt module prior to version 9.0.0. A malicious actor is able to exploit this vulnerability only if they are able to provide unsanitized input to the module. This condition is rare in most deployments of Puppet and Puppet Enterprise.
Problem types: cwe_id: CWE-78
description: CWE-78 OS Command Injection
Affected products: vendor: Puppet
product: puppetlabs-apt
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
attackVector: ADJACENT_NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 8.4
baseSeverity: HIGH
Credits: lang: en
value: Tamás Koczka and the Google Security Team
Published: 2022-10-07T00:00:00.000Z
CVE-2022-3276 Puppetlabs-mysql Command Injection
Command injection is possible in the puppetlabs-mysql module prior to version 13.0.0. A malicious actor is able to exploit this vulnerability only if they are able to provide unsanitized input to the module. This condition is rare in most deployments of Puppet and Puppet Enterprise.
Problem types: cwe_id: CWE-78
description: CWE-78 OS Command Injection
Affected products: vendor: Puppet
product: puppetlabs-mysql
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
attackVector: ADJACENT_NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 8.4
baseSeverity: HIGH
Credits: lang: en
value: Tamás Koczka and the Google Security Team
Published: 2022-10-07T00:00:00.000Z
CVE-2022-3277 
An uncontrolled resource consumption flaw was found in openstack-neutron. This flaw allows a remote authenticated user to query a list of security groups for an invalid project. This issue creates resources that are unconstrained by the user's quota. If a malicious user were to submit a significant number of requests, this could lead to a denial of service.
Problem types: cwe_id: CWE-400
description: CWE-400
Affected products: vendor: n/a
product: openstack-neutron
Published: 2023-03-06T00:00:00.000Z
CVE-2022-3278 NULL Pointer Dereference in vim/vim
NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0552.
Problem types: cwe_id: CWE-476
description: CWE-476 NULL Pointer Dereference
Affected products: vendor: vim
product: vim/vim
Published: 2022-09-23T00:00:00.000Z
CVE-2022-3279 
An unhandled exception in job log parsing in GitLab CE/EE affecting all versions prior to 15.2.5, 15.3 prior to 15.3.4, and 15.4 prior to 15.4.1 allows an attacker to prevent access to job logs
Problem types: description: Uncaught exception in GitLab
Affected products: vendor: GitLab
product: GitLab
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: LOW
baseScore: 2.7
baseSeverity: LOW
Credits: lang: en
value: Thanks [exem_pt](https://hackerone.com/exem_pt) for reporting this vulnerability through our HackerOne bug bounty program
Published: 2022-10-17T00:00:00.000Z