rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-0928 Cross-site Scripting (XSS) - Stored in microweber/microweber
Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.2.12.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: microweber
product: microweber/microweber
Published: 2022-03-11T10:25:10.000Z
CVE-2022-0929 XSS on dynamic_text module in microweber/microweber
XSS on dynamic_text module in GitHub repository microweber/microweber prior to 1.2.11.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: microweber
product: microweber/microweber
Published: 2022-03-12T10:40:09.000Z
CVE-2022-0930 File upload filter bypass leading to stored XSS in microweber/microweber
File upload filter bypass leading to stored XSS in GitHub repository microweber/microweber prior to 1.2.12.
Problem types: cwe_id: CWE-434
description: CWE-434 Unrestricted Upload of File with Dangerous Type
Affected products: vendor: microweber
product: microweber/microweber
Published: 2022-03-12T13:20:09.000Z
CVE-2022-0932 Missing Authorization in saleor/saleor
Missing Authorization in GitHub repository saleor/saleor prior to 3.1.2.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: saleor
product: saleor/saleor
Published: 2022-03-11T00:00:00.000Z
CVE-2022-0934 
A single-byte, non-arbitrary write/use-after-free flaw was found in dnsmasq. This flaw allows an attacker who sends a crafted packet processed by dnsmasq, potentially causing a denial of service.
Problem types: cwe_id: CWE-416
description: CWE-416 - Use After Free
Affected products: vendor: n/a
product: dnsmasq
Published: 2022-08-29T14:03:02.000Z
CVE-2022-0935 Host Header injection in password Reset in livehelperchat/livehelperchat
Host Header injection in password Reset in GitHub repository livehelperchat/livehelperchat prior to 3.97.
Problem types: cwe_id: CWE-840
description: CWE-840 Business Logic Errors
Affected products: vendor: livehelperchat
product: livehelperchat/livehelperchat
Published: 2022-04-07T18:21:42.000Z
CVE-2022-0936 Cross-site Scripting (XSS) - Stored in autolab/autolab
Cross-site Scripting (XSS) - Stored in GitHub repository autolab/autolab prior to 2.8.0.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: autolab
product: autolab/autolab
Published: 2022-04-11T06:15:15.000Z
CVE-2022-0937 Stored xss in showdoc through file upload in star7th/showdoc
Stored xss in showdoc through file upload in GitHub repository star7th/showdoc prior to 2.10.4.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: star7th
product: star7th/showdoc
Published: 2022-03-14T02:35:09.000Z
CVE-2022-0938 Stored XSS via file upload in star7th/showdoc
Stored XSS via file upload in GitHub repository star7th/showdoc prior to v2.10.4.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: star7th
product: star7th/showdoc
Published: 2022-03-14T08:05:10.000Z
CVE-2022-0939 Server-Side Request Forgery (SSRF) in janeczku/calibre-web
Server-Side Request Forgery (SSRF) in GitHub repository janeczku/calibre-web prior to 0.6.18.
Problem types: cwe_id: CWE-918
description: CWE-918 Server-Side Request Forgery (SSRF)
Affected products: vendor: janeczku
product: janeczku/calibre-web
Published: 2022-04-04T09:40:10.000Z
CVE-2022-0940 Stored XSS due to Unrestricted File Upload in star7th/showdoc
Stored XSS due to Unrestricted File Upload in GitHub repository star7th/showdoc prior to v2.10.4.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: star7th
product: star7th/showdoc
Published: 2022-03-14T10:45:12.000Z
CVE-2022-0941 Stored XSS due to Unrestricted File Upload in star7th/showdoc
Stored XSS due to Unrestricted File Upload in GitHub repository star7th/showdoc prior to v2.10.4.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: star7th
product: star7th/showdoc
Published: 2022-03-14T12:25:09.000Z
CVE-2022-0942 Stored XSS due to Unrestricted File Upload in star7th/showdoc
Stored XSS due to Unrestricted File Upload in GitHub repository star7th/showdoc prior to 2.10.4.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: star7th
product: star7th/showdoc
Published: 2022-03-15T13:40:10.000Z
CVE-2022-0943 Heap-based Buffer Overflow occurs in vim in vim/vim
Heap-based Buffer Overflow occurs in vim in GitHub repository vim/vim prior to 8.2.4563.
Problem types: cwe_id: CWE-122
description: CWE-122 Heap-based Buffer Overflow
Affected products: vendor: vim
product: vim/vim
Published: 2022-03-14T00:00:00.000Z
CVE-2022-0944 Template injection in connection test endpoint leads to RCE in sqlpad/sqlpad
Template injection in connection test endpoint leads to RCE in GitHub repository sqlpad/sqlpad prior to 6.10.1.
Problem types: cwe_id: CWE-1336
description: CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine
Affected products: vendor: sqlpad
product: sqlpad/sqlpad
Published: 2022-03-15T01:00:15.000Z
CVE-2022-0945 Stored XSS viva axd and cshtml file upload in star7th/showdoc in star7th/showdoc
Stored XSS viva axd and cshtml file upload in star7th/showdoc in GitHub repository star7th/showdoc prior to v2.10.4.
Problem types: cwe_id: CWE-434
description: CWE-434 Unrestricted Upload of File with Dangerous Type
Affected products: vendor: star7th
product: star7th/showdoc
Published: 2022-03-15T03:50:35.000Z
CVE-2022-0946 Stored XSS viva cshtm file upload in star7th/showdoc
Stored XSS viva cshtm file upload in GitHub repository star7th/showdoc prior to v2.10.4.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: star7th
product: star7th/showdoc
Published: 2022-03-14T13:20:08.000Z
CVE-2022-0947 Arctic Wireless Gateway Firewall vulnerability
A vulnerability in ABB ARG600 Wireless Gateway series that could allow an attacker to exploit the vulnerability by remotely connecting to the serial port gateway, and/or protocol converter, depending on the configuration.
Problem types: cwe_id: CWE-665
description: CWE-665 Improper Initialization
Affected products: vendor: ABB
product: ABB ARG600 Wireless Gateway series
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
version: 3.1
Published: 2022-05-10T18:58:01.818Z
CVE-2022-0948 Order Listener for WooCommerce < 3.2.2 - Unauthenticated SQLi
The Order Listener for WooCommerce WordPress plugin before 3.2.2 does not sanitise and escape the id parameter before using it in a SQL statement via a REST route available to unauthenticated users, leading to an SQL injection
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: Order Listener for WooCommerce – Play Sounds Instantly on New Orders
Credits: lang: en
value: cydave
Published: 2022-05-09T16:50:41.000Z
CVE-2022-0949 WP Block and Stop Bad Bots < 6.930 - Unauthenticated SQLi
The Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection WordPress plugin before 6.930 does not properly sanitise and escape the fingerprint parameter before using it in a SQL statement via the stopbadbots_grava_fingerprint AJAX action, available to unauthenticated users, leading to a SQL injection
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection
Credits: lang: en
value: cydave
Published: 2022-04-11T14:40:59.000Z
CVE-2022-0950 Unrestricted Upload of File with Dangerous Type in star7th/showdoc
Unrestricted Upload of File with Dangerous Type in GitHub repository star7th/showdoc prior to 2.10.4.
Problem types: cwe_id: CWE-434
description: CWE-434 Unrestricted Upload of File with Dangerous Type
Affected products: vendor: star7th
product: star7th/showdoc
Published: 2022-03-15T08:20:10.000Z
CVE-2022-0951 File Upload Restriction Bypass leading to Stored XSS Vulnerability in star7th/showdoc
File Upload Restriction Bypass leading to Stored XSS Vulnerability in GitHub repository star7th/showdoc prior to 2.10.4.
Problem types: cwe_id: CWE-434
description: CWE-434 Unrestricted Upload of File with Dangerous Type
Affected products: vendor: star7th
product: star7th/showdoc
Published: 2022-03-15T08:20:15.000Z
CVE-2022-0952 Sitemap by click5 < 1.0.36 - Unauthenticated Arbitrary Options Update
The Sitemap by click5 WordPress plugin before 1.0.36 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the plugin. As a result, unauthenticated attackers could change arbitrary blog options, such as the users_can_register and default_role, allowing them to create a new admin account and take over the blog.
Problem types: description: CWE-862 Missing Authorization
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: Sitemap by click5
default_status: unaffected
Credits: lang: en
value: cydave
lang: en
value: WPScan
Published: 2022-05-02T16:05:46.000Z
CVE-2022-0953 Anti-Malware Security and Brute-Force Firewall < 4.20.96 - Reflected Cross-Site Scripting
The Anti-Malware Security and Brute-Force Firewall WordPress plugin before 4.20.96 does not sanitise and escape the QUERY_STRING before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting in browsers which do not encode characters
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Anti-Malware Security and Brute-Force Firewall
Credits: lang: en
value: Taurus Omar
Published: 2022-04-25T15:51:12.000Z
CVE-2022-0954 Multiple Stored Cross-site Scripting (XSS) Vulnerabilities in Shop's Other Settings, Shop's Autorespond E-mail Settings and Shops' Payments Methods in microweber/microweber
Multiple Stored Cross-site Scripting (XSS) Vulnerabilities in Shop's Other Settings, Shop's Autorespond E-mail Settings and Shops' Payments Methods in GitHub repository microweber/microweber prior to 1.2.11.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: microweber
product: microweber/microweber
Published: 2022-03-15T11:40:09.000Z
CVE-2022-0955 Cross-site Scripting (XSS) - Stored in pimcore/data-hub
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/data-hub prior to 1.2.4.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: pimcore
product: pimcore/data-hub
Published: 2022-03-24T14:45:15.000Z
CVE-2022-0956 Stored XSS via File Upload in star7th/showdoc
Stored XSS via File Upload in GitHub repository star7th/showdoc prior to v.2.10.4.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: star7th
product: star7th/showdoc
Published: 2022-03-15T12:20:10.000Z
CVE-2022-0957 Stored XSS via File Upload in star7th/showdoc
Stored XSS via File Upload in GitHub repository star7th/showdoc prior to 2.10.4.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: star7th
product: star7th/showdoc
Published: 2022-03-15T12:30:12.000Z
CVE-2022-0958 Mark Posts < 2.0.1 - Admin+ Stored Cross-Site Scripting
The Mark Posts WordPress plugin before 2.0.1 does not escape new markers, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Mark Posts
Credits: lang: en
value: fuzzyap1
Published: 2022-04-04T15:35:59.000Z
CVE-2022-0959 
A malicious, but authorised and authenticated user can construct an HTTP request using their existing CSRF token and session cookie to manually upload files to any location that the operating system user account under which pgAdmin is running has permission to write.
Problem types: cwe_id: CWE-434
description: CWE-434
Affected products: vendor: n/a
product: pgadmin
Published: 2022-03-16T14:03:38.000Z
CVE-2022-0960 Stored XSS viva .properties file upload in star7th/showdoc
Stored XSS viva .properties file upload in GitHub repository star7th/showdoc prior to 2.10.4.
Problem types: cwe_id: CWE-434
description: CWE-434 Unrestricted Upload of File with Dangerous Type
Affected products: vendor: star7th
product: star7th/showdoc
Published: 2022-03-14T14:45:13.000Z
CVE-2022-0961 The microweber application allows large characters to insert in the input field "post title" which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request. in microweber/microweber
The microweber application allows large characters to insert in the input field "post title" which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request. in GitHub repository microweber/microweber prior to 1.2.12.
Problem types: cwe_id: CWE-190
description: CWE-190 Integer Overflow or Wraparound
Affected products: vendor: microweber
product: microweber/microweber
Published: 2022-03-15T14:55:10.000Z
CVE-2022-0962 Stored XSS viva .webma file upload in star7th/showdoc
Stored XSS viva .webma file upload in GitHub repository star7th/showdoc prior to 2.10.4.
Problem types: cwe_id: CWE-434
description: CWE-434 Unrestricted Upload of File with Dangerous Type
Affected products: vendor: star7th
product: star7th/showdoc
Published: 2022-03-14T15:30:15.000Z
CVE-2022-0963 Unrestricted XML Files Leads to Stored XSS in microweber/microweber
Unrestricted XML Files Leads to Stored XSS in GitHub repository microweber/microweber prior to 1.2.12.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: microweber
product: microweber/microweber
Published: 2022-03-15T15:30:13.000Z
CVE-2022-0964 Stored XSS viva .webmv file upload in star7th/showdoc
Stored XSS viva .webmv file upload in GitHub repository star7th/showdoc prior to 2.10.4.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: star7th
product: star7th/showdoc
Published: 2022-03-15T15:35:29.000Z
CVE-2022-0965 Stored XSS viva .ofd file upload in star7th/showdoc
Stored XSS viva .ofd file upload in GitHub repository star7th/showdoc prior to 2.10.4.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: star7th
product: star7th/showdoc
Published: 2022-03-15T15:35:23.000Z
CVE-2022-0966 Stored XSS via File Upload in star7th/showdoc in star7th/showdoc
Stored XSS via File Upload in star7th/showdoc in GitHub repository star7th/showdoc prior to 2.4.10.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: star7th
product: star7th/showdoc
Published: 2022-03-15T15:35:17.000Z
CVE-2022-0967 Stored XSS via File Upload in star7th/showdoc in star7th/showdoc in star7th/showdoc
Stored XSS via File Upload in star7th/showdoc in star7th/showdoc in GitHub repository star7th/showdoc prior to 2.10.4.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: star7th
product: star7th/showdoc
Published: 2022-03-15T15:35:11.000Z
CVE-2022-0968 The microweber application allows large characters to insert in the input field "fist & last name" which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request. in microweber/microweber in microweber/microweber
The microweber application allows large characters to insert in the input field "fist & last name" which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request. in microweber/microweber in GitHub repository microweber/microweber prior to 1.2.12.
Problem types: cwe_id: CWE-190
description: CWE-190 Integer Overflow or Wraparound
Affected products: vendor: microweber
product: microweber/microweber
Published: 2022-03-15T15:40:18.000Z
CVE-2022-0969 Image optimization & Lazy Load < 3.3.2 - Admin+ Stored Cross-Site Scripting
The Image optimization & Lazy Load by Optimole WordPress plugin before 3.3.2 does not sanitise and escape its "Lazyload background images for selectors" settings, which could allow high privilege users such as admin to perform Cross-Site scripting attacks even when the unfiltered_html capability is disallowed.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Image optimization & Lazy Load by Optimole
Credits: lang: en
value: Mika
Published: 2022-04-11T14:41:01.000Z
CVE-2022-0970 Cross-site Scripting (XSS) - Stored in getgrav/grav
Cross-site Scripting (XSS) - Stored in GitHub repository getgrav/grav prior to 1.7.31.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: getgrav
product: getgrav/grav
Published: 2022-03-15T16:40:10.000Z
CVE-2022-0971 
Use after free in Blink Layout in Google Chrome on Android prior to 99.0.4844.74 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.
Problem types: description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2022-07-21T21:05:23.000Z
CVE-2022-0972 
Use after free in Extensions in Google Chrome prior to 99.0.4844.74 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page.
Problem types: description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2022-07-21T21:05:27.000Z
CVE-2022-0973 
Use after free in Safe Browsing in Google Chrome prior to 99.0.4844.74 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Problem types: description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2022-07-21T21:05:33.000Z
CVE-2022-0974 
Use after free in Splitscreen in Google Chrome on Chrome OS prior to 99.0.4844.74 allowed a remote attacker who convinced a user to engage in specific user interaction to potentially exploit heap corruption via a crafted HTML page.
Problem types: description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2022-07-21T21:05:39.000Z
CVE-2022-0975 
Use after free in ANGLE in Google Chrome prior to 99.0.4844.74 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Problem types: description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2022-07-21T21:05:45.000Z
CVE-2022-0976 
Heap buffer overflow in GPU in Google Chrome prior to 99.0.4844.74 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Problem types: description: Heap buffer overflow
Affected products: vendor: Google
product: Chrome
Published: 2022-07-21T21:05:51.000Z
CVE-2022-0977 
Use after free in Browser UI in Google Chrome on Chrome OS prior to 99.0.4844.74 allowed a remote attacker who convinced a user to engage in specific user interaction to potentially exploit heap corruption via a crafted HTML page.
Problem types: description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2022-07-21T21:05:58.000Z
CVE-2022-0978 
Use after free in ANGLE in Google Chrome prior to 99.0.4844.74 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Problem types: description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2022-07-21T21:06:08.000Z
CVE-2022-0979 
Use after free in Safe Browsing in Google Chrome on Android prior to 99.0.4844.74 allowed a remote attacker who convinced a user to engage in specific user interaction to potentially exploit heap corruption via a crafted HTML page.
Problem types: description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2022-07-21T21:06:15.000Z
CVE-2022-0980 
Use after free in New Tab Page in Google Chrome prior to 99.0.4844.74 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via specific user interactions.
Problem types: description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2022-07-21T21:06:22.000Z
CVE-2022-0981 
A flaw was found in Quarkus. The state and potentially associated permissions can leak from one web request to another in RestEasy Reactive. This flaw allows a low-privileged user to perform operations on the database with a different set of privileges than intended.
Problem types: cwe_id: CWE-863
description: CWE-863
Affected products: vendor: n/a
product: quarkus
Published: 2022-03-23T19:46:41.000Z
CVE-2022-0982 Buffer Overflow via crafted client request in Accel-PPP v1.12
The telnet_input_char function in opt/src/accel-pppd/cli/telnet.c suffers from a memory corruption vulnerability, whereby user input cmdline_len is copied into a fixed buffer b->buf without any bound checks. If the server connects with a malicious client, crafted client requests can remotely trigger this vulnerability.
Problem types: description: https://cwe.mitre.org/data/definitions/120.html
Affected products: vendor: https://accel-ppp.org/
product: Accel-PPP
Credits: lang: en
value: Chloe Ong from Government Technology Agency of Singapore
lang: en
value: Eugene Lim from Government Technology Agency of Singapore
Published: 2022-03-16T14:04:22.485Z
CVE-2022-0983 
An SQL injection risk was identified in Badges code relating to configuring criteria. Access to the relevant capability was limited to teachers and managers by default.
Problem types: cwe_id: CWE-89
description: CWE-89
Affected products: vendor: n/a
product: moodle
Published: 2022-03-25T18:03:07.000Z
CVE-2022-0984 
Users with the capability to configure badge criteria (teachers and managers by default) were able to configure course badges with profile field criteria, which should only be available for site badges.
Problem types: cwe_id: CWE-863
description: CWE-863
Affected products: vendor: n/a
product: moodle
Published: 2022-04-29T16:05:10.000Z
CVE-2022-0985 
Insufficient capability checks could allow users with the moodle/site:uploadusers capability to delete users, without having the necessary moodle/user:delete capability.
Problem types: cwe_id: CWE-287
description: CWE-287
Affected products: vendor: n/a
product: moodle
Published: 2022-04-29T15:48:30.000Z
CVE-2022-0986 Reflected Cross-site Scripting (XSS) Vulnerability in hestiacp/hestiacp
Reflected Cross-site Scripting (XSS) Vulnerability in GitHub repository hestiacp/hestiacp prior to 1.5.11.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: hestiacp
product: hestiacp/hestiacp
Published: 2022-03-16T12:45:12.000Z