rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-1159 Rockwell Automation Studio 5000 Logix Designer Code Injection
Rockwell Automation Studio 5000 Logix Designer (all versions) are vulnerable when an attacker who achieves administrator access on a workstation running Studio 5000 Logix Designer could inject controller code undetectable to a user.
Problem types: cwe_id: CWE-94
description: CWE-94 Improper Control of Generation of Code ('Code Injection')
Affected products: vendor: Rockwell Automation
product: Studio 5000 Logix Designer
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.7
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Sharon Brizinov and Tal Keren of Claroty reported this vulnerability to Rockwell Automation.
Published: 2022-04-01T22:17:51.000Z
CVE-2022-1160 heap buffer overflow in get_one_sourceline in vim/vim
heap buffer overflow in get_one_sourceline in GitHub repository vim/vim prior to 8.2.4647.
Problem types: cwe_id: CWE-122
description: CWE-122 Heap-based Buffer Overflow
Affected products: vendor: vim
product: vim/vim
Published: 2022-03-30T00:00:00.000Z
CVE-2022-1161 ICSA-22-090-05 Rockwell Automation Logix Controllers
An attacker with the ability to modify a user program may change user program code on some ControlLogix, CompactLogix, and GuardLogix Control systems. Studio 5000 Logix Designer writes user-readable program code to a separate location than the executed compiled code, allowing an attacker to change one and not the other.
Problem types: cwe_id: CWE-829
description: CWE-829 Inclusion of Functionality from Untrusted Control Sphere
Affected products: vendor: Rockwell Automation
product: 1768 CompactLogix controllers
vendor: Rockwell Automation
product: 1769 CompactLogix controllers
vendor: Rockwell Automation
product: CompactLogix 5370 controllers
vendor: Rockwell Automation
product: CompactLogix 5380 controllers
vendor: Rockwell Automation
product: CompactLogix 5480 controllers
vendor: Rockwell Automation
product: Compact GuardLogix 5370 controllers
vendor: Rockwell Automation
product: Compact GuardLogix 5380 controllers
vendor: Rockwell Automation
product: ControlLogix 5550 controllers
vendor: Rockwell Automation
product: ControlLogix 5560 controllers
vendor: Rockwell Automation
product: ControlLogix 5570 controllers
vendor: Rockwell Automation
product: ControlLogix 5580 controllers
vendor: Rockwell Automation
product: GuardLogix 5560 controllers
vendor: Rockwell Automation
product: GuardLogix 5570 controllers
vendor: Rockwell Automation
product: GuardLogix 5580 controllers
vendor: Rockwell Automation
product: FlexLogix 1794-L34 controllers
vendor: Rockwell Automation
product: DriveLogix 5730 controllers
vendor: Rockwell Automation
product: SoftLogix 5800 controllers
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 10
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Sharon Brizinov and Tal Keren of Claroty reported this vulnerability to CISA.
Published: 2022-04-11T19:38:14.725Z
CVE-2022-1162 
A hardcoded password was set for accounts registered using an OmniAuth provider (e.g. OAuth, LDAP, SAML) in GitLab CE/EE versions 14.7 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allowing attackers to potentially take over accounts
Problem types: description: Use of hard-coded credentials in GitLab
Affected products: vendor: GitLab
product: GitLab
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 9.1
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
version: 3.1
Credits: lang: en
value: This vulnerability has been discovered internally by the GitLab team
Published: 2022-04-04T19:46:14.000Z
CVE-2022-1163 Cross-site Scripting (XSS) - Stored in mineweb/minewebcms
Cross-site Scripting (XSS) - Stored in GitHub repository mineweb/minewebcms prior to next.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: mineweb
product: mineweb/minewebcms
Published: 2022-03-30T06:45:14.000Z
CVE-2022-1164 Wyzi < 2.4.3 - Reflected Cross-Site Scripting (XSS)
The Wyzi Theme was affected by reflected XSS vulnerabilities in the business search feature
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: WYZI Business Finder
Credits: lang: en
value: Daniel Ruf
Published: 2022-04-04T15:36:01.000Z
CVE-2022-1165 Blackhole for Bad Bots < 3.3.2 - Arbitrary IP Address Blocking via IP Spoofing
The Blackhole for Bad Bots WordPress plugin before 3.3.2 uses headers such as CF-CONNECTING-IP, CLIENT-IP etc to determine the IP address of requests hitting the blackhole URL, which allows them to be spoofed. This could result in blocking arbitrary IP addresses, such as legitimate/good search engine crawlers / bots. This could also be abused by competitors to cause damage related to visibility in search engines, can be used to bypass arbitrary blocks caused by this plugin, block any visitor or even the administrator and even more.
Problem types: cwe_id: CWE-639
description: CWE-639 Authorization Bypass Through User-Controlled Key
Affected products: vendor: Unknown
product: Blackhole for Bad Bots
Credits: lang: en
value: Daniel Ruf
Published: 2022-04-04T15:36:03.000Z
CVE-2022-1166 JobMonster < 4.6.6.1 - Directory Listing in Upload Folder
The JobMonster Theme was vulnerable to Directory Listing in the /wp-content/uploads/jobmonster/ folder, as it did not include a default PHP file, or .htaccess file. This could expose personal data such as people's resumes. Although Directory Listing can be prevented by securely configuring the web server, vendors can also take measures to make it less likely to happen.
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: Unknown
product: Noo JobMonster
Credits: lang: en
value: Daniel Ruf
Published: 2022-04-04T15:36:05.000Z
CVE-2022-1167 CareerUp < 2.3.1 - Unauthenticated Reflected Cross-Site Scripting
There are unauthenticated reflected Cross-Site Scripting (XSS) vulnerabilities in CareerUp Careerup WordPress theme before 2.3.1, via the filter parameters.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Careerup
Credits: lang: en
value: Daniel Ruf
lang: en
value: Vlad Vector
Published: 2022-04-04T15:36:06.000Z
CVE-2022-1168 JobSearch < 1.5.1 - Unauthenticated Reflected Cross-Site Scripting (XSS)
There is a Cross-Site Scripting vulnerability in the JobSearch WP JobSearch WordPress plugin before 1.5.1.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: WP JobSearch
Credits: lang: en
value: Daniel Ruf
Published: 2022-04-04T15:36:08.000Z
CVE-2022-1169 Careerfy < 3.9.0 - Unauthenticated Reflected Cross-Site Scripting (XSS)
There is a XSS vulnerability in Careerfy.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Careerfy
Credits: lang: en
value: Daniel Ruf
Published: 2022-04-04T15:36:09.000Z
CVE-2022-1170 JobMonster < 4.5.2.9 - Unauthenticated Reflected Cross-Site Scripting
In the Noo JobMonster WordPress theme before 4.5.2.9 JobMonster there is a XSS vulnerability as the input for the search form is provided through unsanitized GET requests.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Noo JobMonster
Credits: lang: en
value: Daniel Ruf
Published: 2022-04-04T15:36:11.000Z
CVE-2022-1171 Vertical scroll recent post < 14.0 - Reflected Cross-Site Scripting
The Vertical scroll recent post WordPress plugin before 14.0 does not sanitise and escape a parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Vertical scroll recent post
Credits: lang: en
value: p7e4
Published: 2022-05-09T16:50:47.000Z
CVE-2022-1172 Null Pointer Dereference Caused Segmentation Fault in gpac/gpac
Null Pointer Dereference Caused Segmentation Fault in GitHub repository gpac/gpac prior to 2.1.0-DEV.
Problem types: cwe_id: CWE-476
description: CWE-476 NULL Pointer Dereference
Affected products: vendor: gpac
product: gpac/gpac
Published: 2022-03-30T09:30:16.000Z
CVE-2022-1173 stored xss in getgrav/grav
stored xss in GitHub repository getgrav/grav prior to 1.7.33.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: getgrav
product: getgrav/grav
Published: 2022-04-26T16:06:42.000Z
CVE-2022-1174 
A potential DoS vulnerability was discovered in Gitlab CE/EE versions 13.7 before 14.7.7, all versions starting from 14.8 before 14.8.5, all versions starting from 14.9 before 14.9.2 allowed an attacker to trigger high CPU usage via a special crafted input added in Issues, Merge requests, Milestones, Snippets, Wiki pages, etc.
Problem types: description: Uncontrolled resource consumption in GitLab
Affected products: vendor: GitLab
product: GitLab
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
version: 3.1
Credits: lang: en
value: Thanks [scaramouche31](https://hackerone.com/scaramouche31) for reporting this vulnerability through our HackerOne bug bounty program
Published: 2022-04-04T19:46:06.000Z
CVE-2022-1175 
Improper neutralization of user input in GitLab CE/EE versions 14.4 before 14.7.7, all versions starting from 14.8 before 14.8.5, all versions starting from 14.9 before 14.9.2 allowed an attacker to exploit XSS by injecting HTML in notes.
Problem types: description: Improper neutralization of input during web page generation ('cross-site scripting') in GitLab
Affected products: vendor: GitLab
product: GitLab
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 8.7
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
version: 3.1
Credits: lang: en
value: Thanks [joaxcar](https://hackerone.com/joaxcar) for reporting this vulnerability through our HackerOne bug bounty program
Published: 2022-04-04T19:46:15.000Z
CVE-2022-1176 Loose comparison causes IDOR on multiple endpoints in livehelperchat/livehelperchat
Loose comparison causes IDOR on multiple endpoints in GitHub repository livehelperchat/livehelperchat prior to 3.96.
Problem types: cwe_id: CWE-843
description: CWE-843 Access of Resource Using Incompatible Type
Affected products: vendor: livehelperchat
product: livehelperchat/livehelperchat
Published: 2022-03-31T10:10:10.000Z
CVE-2022-1177 Accounting User Can Download Patient Reports in openemr in openemr/openemr
Accounting User Can Download Patient Reports in openemr in GitHub repository openemr/openemr prior to 6.1.0.
Problem types: cwe_id: CWE-1220
description: CWE-1220 Insufficient Granularity of Access Control
Affected products: vendor: openemr
product: openemr/openemr
Published: 2022-03-30T11:00:28.000Z
CVE-2022-1178 Stored Cross Site Scripting in openemr/openemr
Stored Cross Site Scripting in GitHub repository openemr/openemr prior to 6.0.0.4.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: openemr
product: openemr/openemr
Published: 2022-03-30T11:00:20.000Z
CVE-2022-1179 Non-Privilege User Can Created New Rule and Lead to Stored Cross Site Scripting in openemr/openemr
Non-Privilege User Can Created New Rule and Lead to Stored Cross Site Scripting in GitHub repository openemr/openemr prior to 6.0.0.4.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: openemr
product: openemr/openemr
Published: 2022-03-30T11:05:28.000Z
CVE-2022-1180 Reflected Cross Site Scripting in openemr/openemr
Reflected Cross Site Scripting in GitHub repository openemr/openemr prior to 6.0.0.4.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: openemr
product: openemr/openemr
Published: 2022-03-30T11:05:20.000Z
CVE-2022-1181 Stored Cross Site Scripting in openemr/openemr
Stored Cross Site Scripting in GitHub repository openemr/openemr prior to 6.0.0.2.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: openemr
product: openemr/openemr
Published: 2022-03-30T11:05:13.000Z
CVE-2022-1182 Visual Slide Box Builder <= 3.2.9 - Subscriber+ SQLi
The Visual Slide Box Builder WordPress plugin through 3.2.9 does not sanitise and escape various parameters before using them in SQL statements via some of its AJAX actions available to any authenticated users (such as subscriber), leading to SQL Injections
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: Visual Slide Box Builder
Credits: lang: en
value: p7e4
Published: 2022-05-16T14:30:39.000Z
CVE-2022-1183 Destroying a TLS session early causes assertion failure
On vulnerable configurations, the named daemon may, in some circumstances, terminate with an assertion failure. Vulnerable configurations are those that include a reference to http within the listen-on statements in their named.conf. TLS is used by both DNS over TLS (DoT) and DNS over HTTPS (DoH), but configurations using DoT alone are unaffected. Affects BIND 9.18.0 -> 9.18.2 and version 9.19.0 of the BIND 9.19 development branch.
Problem types: description: In BIND 9.18.0 -> 9.18.2 and version 9.19.0 of the BIND 9.19 development branch, an assertion failure can be triggered if a TLS connection to a configured http TLS listener with a defined endpoint is destroyed too early.
Affected products: vendor: ISC
product: BIND9
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: ISC would like to thank Thomas Amgarten from arcade solutions ag for bringing this vulnerability to our attention.
Published: 2022-05-19T09:55:09.565Z
CVE-2022-1184 
A use-after-free flaw was found in fs/ext4/namei.c:dx_insert_block() in the Linux kernel’s filesystem sub-component. This flaw allows a local attacker with a user privilege to cause a denial of service.
Problem types: cwe_id: CWE-416
description: CWE-416 - Use After Free
Affected products: vendor: n/a
product: Kernel
Published: 2022-08-29T00:00:00.000Z
CVE-2022-1185 
A denial of service vulnerability when rendering RDoc files in GitLab CE/EE versions 10 to 14.7.7, 14.8.0 to 14.8.5, and 14.9.0 to 14.9.2 allows an attacker to crash the GitLab web application with a maliciously crafted RDoc file
Problem types: description: Uncontrolled resource consumption in GitLab
Affected products: vendor: GitLab
product: GitLab
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: Thanks [vakzz](https://hackerone.com/vakzz) for reporting this vulnerability through our HackerOne bug bounty program
Published: 2022-04-04T19:46:09.000Z
CVE-2022-1186 Be POPIA Compliant <= 1.1.5 - Sensitive Information Exposure
The WordPress plugin Be POPIA Compliant exposed sensitive information to unauthenticated users consisting of site visitors emails and usernames via an API route, in versions up to an including 1.1.5.
Problem types: cwe_id: CWE-200
description: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: bepopiacompliant
product: Be POPIA Compliant
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
baseScore: 5.3
baseSeverity: MEDIUM
Credits: lang: en
value: Chris Meistre
Published: 2022-04-19T20:26:38.000Z
CVE-2022-1187 WP YouTube Live <= 1.7.21 - Reflected Cross-Site Scripting
The WordPress WP YouTube Live Plugin is vulnerable to Reflected Cross-Site Scripting via POST data found in the ~/inc/admin.php file which allows unauthenticated attackers to inject arbitrary web scripts in versions up to, and including, 1.7.21.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: macbookandrew
product: WP YouTube Live
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
baseScore: 6.1
baseSeverity: MEDIUM
Credits: lang: en
value: p7e4
Published: 2022-04-19T20:26:35.000Z
CVE-2022-1188 
An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.1 before 14.7.7, all versions starting from 14.8 before 14.8.5, all versions starting from 14.9 before 14.9.2 where a blind SSRF attack through the repository mirroring feature was possible.
Problem types: description: Server-side request forgery (ssrf) in GitLab
Affected products: vendor: GitLab
product: GitLab
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 3.7
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: Thanks [jimeno](https://hackerone.com/jimeno) for reporting this vulnerability through our HackerOne bug bounty program
Published: 2022-04-04T19:46:05.000Z
CVE-2022-1189 
An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.2 before 14.7.7, all versions starting from 14.8 before 14.8.5, all versions starting from 14.9 before 14.9.2 that allowed for an unauthorised user to read the the approval rules of a private project.
Problem types: description: Improper authorization in GitLab
Affected products: vendor: GitLab
product: GitLab
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 3.1
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: This vulnerability has been discovered internally by the GitLab team
Published: 2022-04-04T19:46:00.000Z
CVE-2022-1190 
Improper handling of user input in GitLab CE/EE versions 8.3 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allowed an attacker to exploit a stored XSS by abusing multi-word milestone references in issue descriptions, comments, etc.
Problem types: description: Improper neutralization of input during web page generation ('cross-site scripting') in GitLab
Affected products: vendor: GitLab
product: GitLab
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 8.7
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
version: 3.1
Credits: lang: en
value: Thanks  ryhmnlfj for reporting this vulnerability through our HackerOne bug bounty program
Published: 2022-04-04T19:46:15.000Z
CVE-2022-1191 SSRF on index.php/cobrowse/proxycss/ in livehelperchat/livehelperchat
SSRF on index.php/cobrowse/proxycss/ in GitHub repository livehelperchat/livehelperchat prior to 3.96.
Problem types: cwe_id: CWE-918
description: CWE-918 Server-Side Request Forgery (SSRF)
Affected products: vendor: livehelperchat
product: livehelperchat/livehelperchat
Published: 2022-03-31T08:35:09.000Z
CVE-2022-1192 Turn off all comments <= 1.0 - Reflected Cross-Site Scripting
The Turn off all comments WordPress plugin through 1.0 does not sanitise and escape the rows parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Turn off all comments
Credits: lang: en
value: p7e4
Published: 2022-05-23T07:15:26.000Z
CVE-2022-1193 
Improper access control in GitLab CE/EE versions 10.7 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allows a malicious actor to obtain details of the latest commit in a private project via Merge Requests under certain circumstances
Problem types: description: Improper access control in GitLab
Affected products: vendor: GitLab
product: GitLab
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: Thanks [albatraoz](https://hackerone.com/albatraoz) for reporting this vulnerability through our HackerOne bug bounty program
Published: 2022-04-11T19:38:25.000Z
CVE-2022-1194 Mobile Events Manager < 1.4.8 - Admin+ CSV Injection
The Mobile Events Manager WordPress plugin before 1.4.8 does not properly escape the Enquiry source field when exporting events, or the Paid for field when exporting transactions as CSV, leading to a CSV injection vulnerability.
Problem types: cwe_id: CWE-1236
description: CWE-1236 Improper Neutralization of Formula Elements in a CSV File
Affected products: vendor: Unknown
product: Mobile Events Manager
Credits: lang: en
value: Varun thorat
Published: 2022-09-16T08:40:25.000Z
CVE-2022-1195 
A use-after-free vulnerability was found in the Linux kernel in drivers/net/hamradio. This flaw allows a local attacker with a user privilege to cause a denial of service (DOS) when the mkiss or sixpack device is detached and reclaim resources early.
Problem types: cwe_id: CWE-362
description: CWE-362->CWE-416
Affected products: vendor: n/a
product: kernel
Published: 2022-04-29T15:40:58.000Z
CVE-2022-1196 
After a VR Process is destroyed, a reference to it may have been retained and used, leading to a use-after-free and potentially exploitable crash. This vulnerability affects Thunderbird < 91.8 and Firefox ESR < 91.8.
Problem types: description: Use-after-free after VR Process destruction
Affected products: vendor: Mozilla
product: Thunderbird
vendor: Mozilla
product: Firefox ESR
Published: 2022-12-22T00:00:00.000Z
CVE-2022-1197 
When importing a revoked key that specified key compromise as the revocation reason, Thunderbird did not update the existing copy of the key that was not yet revoked, and the existing key was kept as non-revoked. Revocation statements that used another revocation reason, or that didn't specify a revocation reason, were unaffected. This vulnerability affects Thunderbird < 91.8.
Problem types: description: OpenPGP revocation information was ignored
Affected products: vendor: Mozilla
product: Thunderbird
Published: 2022-12-22T00:00:00.000Z