rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-1770 Improper Privilege Management in polonel/trudesk
Improper Privilege Management in GitHub repository polonel/trudesk prior to 1.2.2.
Problem types: cwe_id: CWE-269
description: CWE-269 Improper Privilege Management
Affected products: vendor: polonel
product: polonel/trudesk
Published: 2022-05-20T18:05:10.000Z
CVE-2022-1771 Uncontrolled Recursion in vim/vim
Uncontrolled Recursion in GitHub repository vim/vim prior to 8.2.4975.
Problem types: cwe_id: CWE-674
description: CWE-674 Uncontrolled Recursion
Affected products: vendor: vim
product: vim/vim
Published: 2022-05-18T00:00:00.000Z
CVE-2022-1772 Google Places Review < 2.0.0 - Admin+ Stored Cross Site Scripting
The Google Places Reviews WordPress plugin before 2.0.0 does not properly escape its Google API key setting, which is reflected on the site's administration panel. A malicious administrator could abuse this bug, in a multisite WordPress configuration, to trick super-administrators into viewing the booby-trapped payload and taking over their account.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Google Places Reviews
Credits: lang: en
value: Krishna Harsha Kondaveeti
Published: 2022-06-13T12:42:45.000Z
CVE-2022-1773 WP Athletics <= 1.1.7 - Reflected Cross-Site Scripting
The WP Athletics WordPress plugin through 1.1.7 does not sanitise and escape a parameter before outputting back in an admin page, leading to a Reflected Cross-Site Scripting
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: WP Athletics
Credits: lang: en
value: Wejdan Alomari
Published: 2022-06-13T12:42:46.000Z
CVE-2022-1774 Exposure of Sensitive Information to an Unauthorized Actor in jgraph/drawio
Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository jgraph/drawio prior to 18.0.7.
Problem types: cwe_id: CWE-200
description: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: jgraph
product: jgraph/drawio
Published: 2022-05-18T20:40:10.000Z
CVE-2022-1775 Weak Password Requirements in polonel/trudesk
Weak Password Requirements in GitHub repository polonel/trudesk prior to 1.2.2.
Problem types: cwe_id: CWE-521
description: CWE-521 Weak Password Requirements
Affected products: vendor: polonel
product: polonel/trudesk
Published: 2022-05-20T22:35:11.000Z
CVE-2022-1776 Icegram < 2.1.8 - Contributor+ Stored Cross-Site Scripting
The Popups, Welcome Bar, Optins and Lead Generation Plugin WordPress plugin before 2.1.8 does not sanitize and escape some campaign parameters, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Popups, Welcome Bar, Optins and Lead Generation Plugin – Icegram
Credits: lang: en
value: Pritam Dash
Published: 2022-06-27T08:57:34.000Z
CVE-2022-1777 Filr - Secure Document Library < 1.2.2.1 - Subscriber+ AJAX Calls
The Filr WordPress plugin before 1.2.2.1 does not have authorisation check in two of its AJAX actions, allowing them to be called by any authenticated users, such as subscriber. They are are protected with a nonce, however the nonce is leaked on the dashboard. This could allow them to upload arbitrary HTML files as well as delete all files or arbitrary ones.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: Unknown
product: Filr – Secure document library
Credits: lang: en
value: dc11
Published: 2022-06-13T12:42:48.000Z
CVE-2022-1778 A vulnerability exists during the start of the affected SYS600, where an input validation flaw causes a buffer-overflow while reading a specific configuration file. Subsequently SYS600 will fail to start. The configuration file can only be accessed by ...
Improper Input Validation vulnerability in Hitachi Energy MicroSCADA X SYS600 while reading a specific configuration file causes a buffer-overflow that causes a failure to start the SYS600. The configuration file can only be accessed by an administrator access. This issue affects: Hitachi Energy MicroSCADA X SYS600 version 10 to version 10.3.1. cpe:2.3:a:hitachienergy:microscada_x_sys600:10:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:microscada_x_sys600:10.1:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:microscada_x_sys600:10.1.1:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:microscada_x_sys600:10.2:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:microscada_x_sys600:10.2.1:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:microscada_x_sys600:10.3:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:microscada_x_sys600:10.3.1:*:*:*:*:*:*:*
Problem types: cwe_id: CWE-119
description: CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
Affected products: vendor: Hitachi Energy
product: MicroSCADA X SYS600
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2022-09-14T17:05:36.801Z
CVE-2022-1779 Auto Delete Posts <= 1.3.0 - Arbitrary Settings Update via CSRF
The Auto Delete Posts WordPress plugin through 1.3.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and delete specific posts, categories and attachments at once.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: Auto Delete Posts
Credits: lang: en
value: Daniel Ruf
Published: 2022-06-13T12:42:49.000Z
CVE-2022-1780 LaTeX for WordPress <= 3.4.10 - Arbitrary Settings Update via CSRF to Stored XSS
The LaTeX for WordPress plugin through 3.4.10 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack which could also lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: LaTeX for WordPress
Credits: lang: en
value: Daniel Ruf
Published: 2022-06-13T12:42:51.000Z
CVE-2022-1781 postTabs  <= 2.10.6 - Arbitrary Settings Update via CSRF to Stored XSS
The postTabs WordPress plugin through 2.10.6 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack, which also lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: postTabs
Credits: lang: en
value: Daniel Ruf
Published: 2022-06-13T12:42:52.000Z
CVE-2022-1782 Cross-site Scripting (XSS) - Generic in erudika/para
Cross-site Scripting (XSS) - Generic in GitHub repository erudika/para prior to v1.45.11.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: erudika
product: erudika/para
Published: 2022-05-18T09:00:14.000Z
CVE-2022-1783 
An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.3 before 14.9.5, all versions starting from 14.10 before 14.10.4, all versions starting from 15.0 before 15.0.1. It may be possible for malicious group maintainers to add new members to a project within their group, through the REST API, even after their group owner enabled a setting to prevent members from being added to projects within that group.
Problem types: description: Uncontrolled resource consumption in GitLab
Affected products: vendor: GitLab
product: GitLab
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 2.7
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: Thanks [@salh4ckr](https://hackerone.com/salh4ckr) for reporting this vulnerability through our HackerOne bug bounty program.
Published: 2022-06-06T17:00:32.000Z
CVE-2022-1784 Server-Side Request Forgery (SSRF) in jgraph/drawio
Server-Side Request Forgery (SSRF) in GitHub repository jgraph/drawio prior to 18.0.8.
Problem types: cwe_id: CWE-918
description: CWE-918 Server-Side Request Forgery (SSRF)
Affected products: vendor: jgraph
product: jgraph/drawio
Published: 2022-05-20T12:15:11.000Z
CVE-2022-1785 Out-of-bounds Write in vim/vim
Out-of-bounds Write in GitHub repository vim/vim prior to 8.2.4977.
Problem types: cwe_id: CWE-787
description: CWE-787 Out-of-bounds Write
Affected products: vendor: vim
product: vim/vim
Published: 2022-05-19T00:00:00.000Z
CVE-2022-1786 
A use-after-free flaw was found in the Linux kernel’s io_uring subsystem in the way a user sets up a ring with IORING_SETUP_IOPOLL with more than one task completing submissions on this ring. This flaw allows a local user to crash or escalate their privileges on the system.
Problem types: cwe_id: CWE-843
description: CWE-843
Affected products: vendor: n/a
product: kernel
Published: 2022-05-31T18:45:44.000Z
CVE-2022-1787 Sideblog <= 6.0 - Arbitrary Settings Update via CSRF to Stored XSS
The Sideblog WordPress plugin through 6.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: Sideblog WordPress Plugin
Credits: lang: en
value: Daniel Ruf
Published: 2022-06-13T12:42:54.000Z
CVE-2022-1788 Change Uploaded File Permissions <= 4.0.0 - File Permission Update via CSRF
Due to missing checks the Change Uploaded File Permissions WordPress plugin through 4.0.0 is vulnerable to CSRF attacks. This can be used to change the file and folder permissions of any folder. This could be problematic when specific files like ini files are made readable for everyone due to this.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: Change Uploaded File Permissions
Credits: lang: en
value: Daniel Ruf
Published: 2022-06-13T12:42:55.000Z
CVE-2022-1789 
With shadow paging enabled, the INVPCID instruction results in a call to kvm_mmu_invpcid_gva. If INVPCID is executed with CR0.PG=0, the invlpg callback is not set and the result is a NULL pointer dereference.
Problem types: cwe_id: CWE-476
description: CWE-476
Affected products: vendor: n/a
product: kernel
Published: 2022-05-31T18:48:00.000Z
CVE-2022-1790 New User Email Set Up <= 0.5.2 - Arbitrary Settings Update via CSRF
The New User Email Set Up WordPress plugin through 0.5.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: New User Email Set Up
Credits: lang: en
value: Daniel Ruf
Published: 2022-06-13T12:42:57.000Z
CVE-2022-1791 One Click Plugin Updater <= 2.4.14 - Arbitrary Settings Update via CSRF
The One Click Plugin Updater WordPress plugin through 2.4.14 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and disable / hide the badge of the available updates and the related check.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: One Click Plugin Updater
Credits: lang: en
value: Daniel Ruf
Published: 2022-06-13T12:42:58.000Z
CVE-2022-1792 Quick Subscribe <= 1.7.1 - Arbitrary Settings Update via CSRF to Stored XSS
The Quick Subscribe WordPress plugin through 1.7.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and leading to Stored XSS due to the lack of sanitisation and escaping in some of them
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: Quick Subscribe
Credits: lang: en
value: Daniel Ruf
Published: 2022-06-13T12:43:00.000Z
CVE-2022-1793 Private Files <= 0.40 - Protection Disabling via CSRF
The Private Files WordPress plugin through 0.40 is missing CSRF check when disabling the protection, which could allow attackers to make a logged in admin perform such action via a CSRF attack and make the blog public
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: Private Files
Credits: lang: en
value: Daniel Ruf
Published: 2022-06-13T12:43:02.000Z
CVE-2022-1794 Plaintext Storage of a password in CODESYS V3 OPC DA Server
The CODESYS OPC DA Server prior V3.5.18.20 stores PLC passwords as plain text in its configuration file so that it is visible to all authorized Microsoft Windows users of the system.
Problem types: cwe_id: CWE-256
description: CWE-256 Unprotected Storage of Credentials
Affected products: vendor: CODESYS
product: CODESYS OPC DA Server
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 5.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2022-07-11T10:40:27.897Z
CVE-2022-1795 Use After Free in gpac/gpac
Use After Free in GitHub repository gpac/gpac prior to v2.1.0-DEV.
Problem types: cwe_id: CWE-416
description: CWE-416 Use After Free
Affected products: vendor: gpac
product: gpac/gpac
Published: 2022-05-18T00:00:00.000Z
CVE-2022-1796 Use After Free in vim/vim
Use After Free in GitHub repository vim/vim prior to 8.2.4979.
Problem types: cwe_id: CWE-416
description: CWE-416 Use After Free
Affected products: vendor: vim
product: vim/vim
Published: 2022-05-19T00:00:00.000Z
CVE-2022-1797 Rockwell Automation Logix Controllers Uncontrolled Resource Consumption
A malformed Class 3 common industrial protocol message with a cached connection can cause a denial-of-service condition in Rockwell Automation Logix Controllers, resulting in a major nonrecoverable fault. If the target device becomes unavailable, a user would have to clear the fault and redownload the user project file to bring the device back online.
Problem types: cwe_id: CWE-400
description: CWE-400: Uncontrolled Resource Consumption
Affected products: vendor: Rockwell Automation
product: CompactLogix 5380 controllers
vendor: Rockwell Automation
product: Compact GuardLogix 5380 controllers
vendor: Rockwell Automation
product: CompactLogix 5480 controllers
vendor: Rockwell Automation
product: ControlLogix 5580 controllers
vendor: Rockwell Automation
product: GuardLogix 5580 controllers
vendor: Rockwell Automation
product: CompactLogix 5370 controllers
vendor: Rockwell Automation
product: Compact GuardLogix 5370 controllers
vendor: Rockwell Automation
product: ControlLogix 5570 controllers
vendor: Rockwell Automation
product: GuardLogix 5570 controllers
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.8
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: Rockwell Automation discovered this vulnerability during routine security testing and reported it to CISA.
Published: 2022-05-31T19:04:44.000Z
CVE-2022-1798 Path Traversal vulnerability in Kubevirt
A path traversal vulnerability in KubeVirt versions up to 0.56 (and 0.55.1) on all platforms allows a user able to configure the kubevirt to read arbitrary files on the host filesystem which are publicly readable or which are readable for UID 107 or GID 107. /proc/self/<> is not accessible.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Google LLC
product: Kubevirt
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 8.7
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:H
version: 3.1
Credits: lang: en
value: Oliver Brooks and James Klopchic of NCC Group
lang: en
value: Diane Dubois and Roman Mohr of Google
Published: 2022-09-15T15:45:12.000Z
CVE-2022-1799 Incorrect signature verification on Google play-services-basement in Google Play SDK
Incorrect signature trust exists within Google Play services SDK play-services-basement. A debug version of Google Play services is trusted by the SDK for devices that are non-GMS. We recommend upgrading the SDK past the 2022-05-03 release.
Problem types: cwe_id: CWE-501
description: CWE-501 Trust Boundary Violation
Affected products: vendor: Google LLC
product: Google Play Services SDK
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.7
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N
version: 3.1
Published: 2022-07-29T09:15:12.000Z
CVE-2022-1800 Export any WordPress data to XML/CSV < 1.3.5 - Admin+ SQL Injection
The Export any WordPress data to XML/CSV WordPress plugin before 1.3.5 does not sanitize the cpt POST parameter when exporting post data before using it in a database query, leading to an SQL injection vulnerability.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: Export any WordPress data to XML/CSV
Credits: lang: en
value: Asif Nawaz Minhas
Published: 2022-06-13T12:43:04.000Z
CVE-2022-1801 Very Simple Contact Form < 11.6 - Captcha bypass
The Very Simple Contact Form WordPress plugin before 11.6 exposes the solution to the captcha in the rendered contact form, both as hidden input fields and as plain text in the page, making it very easy for bots to bypass the captcha check, rendering the page a likely target for spam bots.
Problem types: cwe_id: CWE-804
description: CWE-804 Guessable CAPTCHA
Affected products: vendor: Unknown
product: Very Simple Contact Form
Credits: lang: en
value: Sebastian Cruz Cardona
Published: 2022-06-20T10:25:59.000Z
CVE-2022-1802 
If an attacker was able to corrupt the methods of an Array object in JavaScript via prototype pollution, they could have achieved execution of attacker-controlled JavaScript code in a privileged context. This vulnerability affects Firefox ESR < 91.9.1, Firefox < 100.0.2, Firefox for Android < 100.3.0, and Thunderbird < 91.9.1.
Problem types: description: Prototype pollution in Top-Level Await implementation
Affected products: vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Firefox for Android
vendor: Mozilla
product: Thunderbird
Published: 2022-12-22T00:00:00.000Z
CVE-2022-1803 Improper Restriction of Rendered UI Layers or Frames in polonel/trudesk
Improper Restriction of Rendered UI Layers or Frames in GitHub repository polonel/trudesk prior to 1.2.2.
Problem types: cwe_id: CWE-1021
description: CWE-1021 Improper Restriction of Rendered UI Layers or Frames
Affected products: vendor: polonel
product: polonel/trudesk
Published: 2022-05-20T21:40:18.000Z
CVE-2022-1804 Accountsservice incorrectly drops privileges
accountsservice no longer drops permissions when writting .pam_environment
Problem types: cwe_id: CWE-269
description: CWE-269 Improper Privilege Management
Affected products: vendor: Ubuntu
product: Linux
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 5.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: Gunnar Hjalmarsson
lang: en
value: Marc Deslauriers
lang: en
value: Seth Arnold
Published: 2025-03-25T12:28:08.041Z
CVE-2022-1805 
When connecting to Amazon Workspaces, the SHA256 presented by AWS connection provisioner is not fully verified by Zero Clients. The issue could be exploited by an adversary that places a MITM (Man in the Middle) between a zero client and AWS session provisioner in the network. This issue is only applicable when connecting to an Amazon Workspace from a PCoIP Zero Client.
Problem types: description: Man in the Middle Attack
Affected products: vendor: n/a
product: Tera2 Zero Client
Published: 2022-07-28T14:21:09.000Z
CVE-2022-1806 Cross-site Scripting (XSS) - Reflected in rtxteam/rtx
Cross-site Scripting (XSS) - Reflected in GitHub repository rtxteam/rtx prior to checkpoint_2022-05-18.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: rtxteam
product: rtxteam/rtx
Published: 2022-05-20T09:10:12.000Z
CVE-2022-1807 
Multiple SQLi vulnerabilities in Webadmin allow for privilege escalation from admin to super-admin in Sophos Firewall older than version 18.5 MR4 and version 19.0 MR1.
Problem types: description: n/a
Affected products: vendor: Sophos
product: Sophos Firewall
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2022-09-07T18:00:14.000Z
CVE-2022-1808 Execution with Unnecessary Privileges in polonel/trudesk
Execution with Unnecessary Privileges in GitHub repository polonel/trudesk prior to 1.2.3.
Problem types: cwe_id: CWE-250
description: CWE-250 Execution with Unnecessary Privileges
Affected products: vendor: polonel
product: polonel/trudesk
Published: 2022-05-31T22:00:13.000Z
CVE-2022-1809 Access of Uninitialized Pointer in radareorg/radare2
Access of Uninitialized Pointer in GitHub repository radareorg/radare2 prior to 5.7.0.
Problem types: cwe_id: CWE-824
description: CWE-824 Access of Uninitialized Pointer
Affected products: vendor: radareorg
product: radareorg/radare2
Published: 2022-05-21T22:25:09.000Z
CVE-2022-1810 Authorization Bypass Through User-Controlled Key in publify/publify
Authorization Bypass Through User-Controlled Key in GitHub repository publify/publify prior to 9.2.9.
Problem types: cwe_id: CWE-639
description: CWE-639 Authorization Bypass Through User-Controlled Key
Affected products: vendor: publify
product: publify/publify
Published: 2022-05-23T00:00:00.000Z
CVE-2022-1811 Unrestricted Upload of File with Dangerous Type in publify/publify
Unrestricted Upload of File with Dangerous Type in GitHub repository publify/publify prior to 9.2.9.
Problem types: cwe_id: CWE-434
description: CWE-434 Unrestricted Upload of File with Dangerous Type
Affected products: vendor: publify
product: publify/publify
Published: 2022-05-23T13:30:12.000Z
CVE-2022-1812 Integer Overflow or Wraparound in publify/publify
Integer Overflow or Wraparound in GitHub repository publify/publify prior to 9.2.10.
Problem types: cwe_id: CWE-190
description: CWE-190 Integer Overflow or Wraparound
Affected products: vendor: publify
product: publify/publify
Published: 2023-01-14T00:00:00.000Z
CVE-2022-1813 OS Command Injection in yogeshojha/rengine
OS Command Injection in GitHub repository yogeshojha/rengine prior to 1.2.0.
Problem types: cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command
Affected products: vendor: yogeshojha
product: yogeshojha/rengine
Published: 2022-05-22T16:10:09.000Z