rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-40291 Cross-site request forgery (CSRF) in PHP Point of Sale version 19.0, by PHP Point of Sale, LLC

The application was vulnerable to Cross-Site Request Forgery (CSRF) attacks, allowing an attacker to coerce users into sending malicious requests to the site to delete their account, or in rare circumstances, hijack their account and create other admin accounts.


Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: PHP Point of Sale LLC
product: PHP Point of Sale
default_status: unaffected
Published: 2022-10-31T20:06:41.873Z
CVE-2022-40292 Unauthenticated username enumeration in PHP Point of Sale version 19.0, by PHP Point of Sale, LLC.

The application allowed for Unauthenticated User Enumeration by interacting with an unsecured endpoint to retrieve information on each account within the system.


Problem types: cwe_id: CWE-209
description: CWE-209 Generation of Error Message Containing Sensitive Information
Affected products: vendor: PHP Point of Sale LLC
product: PHP Point of Sale
default_status: unaffected
Published: 2022-10-31T20:07:10.233Z
CVE-2022-40293 Session fixation in PHP Point of Sale version 19.0, by PHP Point of Sale, LLC.

The application was vulnerable to a session fixation that could be used hijack accounts.


Problem types: cwe_id: CWE-384
description: CWE-384 Session Fixation
Affected products: vendor: PHP Point of Sale LLC
product: PHP Point of Sale
default_status: unaffected
Published: 2022-10-31T20:05:55.050Z
CVE-2022-40294 CSV Injection in PHP Point of Sale version 19.0, by PHP Point of Sale, LLC

The application was identified to have an CSV injection in data export functionality, allowing for malicious code to be embedded within export data and then triggered in exported data viewers.


Problem types: cwe_id: CWE-1236
description: CWE-1236 Improper Neutralization of Formula Elements in a CSV File
Affected products: vendor: PHP Point of Sale LLC
product: PHP Point of Sale
default_status: unaffected
Published: 2022-10-31T20:09:23.823Z
CVE-2022-40295 Authenticated sensitive information disclosure in PHP Point of Sale version 19.0, by PHP Point of Sale, LLC.
The application was vulnerable to an authenticated information disclosure, allowing administrators to view unsalted user passwords, which could lead to the compromise of plaintext passwords via offline attacks.
Problem types: cwe_id: CWE-916
description: CWE-916 Use of Password Hash With Insufficient Computational Effort
Affected products: vendor: PHP Point of Sale LLC
product: PHP Point of Sale
default_status: unaffected
Published: 2022-10-31T20:08:53.909Z
CVE-2022-40296 Server-side request forgery (SSRF) in PHP Point of Sale version 19.0, by PHP Point of Sale, LLC.

The application was vulnerable to a Server-Side Request Forgery attacks, allowing the backend server to interact with unexpected endpoints, potentially including internal and local services, leading to attacks in other downstream systems.


Problem types: cwe_id: CWE-918
description: CWE-918 Server-Side Request Forgery (SSRF)
Affected products: vendor: PHP Point of Sale LLC
product: PHP Point of Sale
default_status: unaffected
Published: 2022-10-31T20:07:56.767Z
CVE-2022-40297 
UBports Ubuntu Touch 16.04 allows the screen-unlock passcode to be used for a privileged shell via Sudo. This passcode is only four digits, far below typical length/complexity for a user account's password. NOTE: a third party states "The described attack cannot be executed as demonstrated.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-08T23:38:32.000Z
CVE-2022-40298 
Crestron AirMedia for Windows before 5.5.1.84 has insecure inherited permissions, which leads to a privilege escalation vulnerability found in the AirMedia Windows Application, version 4.3.1.39. A low privileged user can initiate a repair of the system and gain a SYSTEM level shell.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-22T23:30:16.000Z
CVE-2022-40299 
In Singular before 4.3.1, a predictable /tmp pathname is used (e.g., by sdb.cc), which allows local users to gain the privileges of other users via a procedure in a file under /tmp. NOTE: this CVE Record is about sdb.cc and similar files in the Singular interface that have predictable /tmp pathnames; this CVE Record is not about the lack of a safe temporary-file creation capability in the Singular language.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-09T00:18:03.000Z
CVE-2022-40300 
Zoho ManageEngine Password Manager Pro through 12120 before 12121, PAM360 through 5550 before 5600, and Access Manager Plus through 4304 before 4305 have multiple SQL injection vulnerabilities.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-16T22:47:55.000Z
CVE-2022-40302 
An issue was discovered in bgpd in FRRouting (FRR) through 8.4. By crafting a BGP OPEN message with an option of type 0xff (Extended Length from RFC 9072), attackers may cause a denial of service (assertion failure and daemon restart, or out-of-bounds read). This is possible because of inconsistent boundary checks that do not account for reading 3 bytes (instead of 2) in this 0xff case.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-03T00:00:00.000Z
CVE-2022-40303 
An issue was discovered in libxml2 before 2.10.3. When parsing a multi-gigabyte XML document with the XML_PARSE_HUGE parser option enabled, several integer counters can overflow. This results in an attempt to access an array at a negative 2GB offset, typically leading to a segmentation fault.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-22T00:00:00.000Z
CVE-2022-40304 
An issue was discovered in libxml2 before 2.10.3. Certain invalid XML entity definitions can corrupt a hash table key, potentially leading to subsequent logic errors. In one case, a double-free can be provoked.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-23T00:00:00.000Z
CVE-2022-40305 
A Server-Side Request Forgery issue in Canto Cumulus through 11.1.3 allows attackers to enumerate the internal network, overload network resources, and possibly have unspecified other impact via the server parameter to the /cwc/login login form.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-09T04:23:04.000Z
CVE-2022-40306 
The login form /Login in ECi Printanista Hub (formerly FMAudit Printscout) before 5.5.2 (July 2023) performs expensive RSA key-generation operations, which allows attackers to cause a denial of service (DoS) by requesting that form repeatedly.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-15T14:03:43.000Z
CVE-2022-40307 
An issue was discovered in the Linux kernel through 5.19.8. drivers/firmware/efi/capsule-loader.c has a race condition with a resultant use-after-free.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-09T00:00:00.000Z
CVE-2022-40308 Apache Archiva prior to 2.2.9 may allow the anonymous user to read arbitrary files
If anonymous read enabled, it's possible to read the database file directly without logging in.
Problem types: description: Arbitrary file read vulnerability
Affected products: vendor: Apache Software Foundation
product: Apache Archiva
Credits: lang: en
value: Thanks to L3yx of Syclover Security Team
Published: 2022-11-15T00:00:00.000Z
CVE-2022-40309 Apache Archiva prior to 2.2.9 allows an authenticated user to delete arbitrary directories
Users with write permissions to a repository can delete arbitrary directories.
Problem types: description: Arbitrary directory deletion
Affected products: vendor: Apache Software Foundation
product: Apache Archiva
Credits: lang: en
value: Thanks to L3yx of Syclover Security Team
Published: 2022-11-15T00:00:00.000Z
CVE-2022-40310 WordPress Rate my Post – WP Rating System plugin <= 3.3.4 - Race Condition vulnerability
Authenticated (subscriber+) Race Condition vulnerability in Rate my Post – WP Rating System plugin <= 3.3.4 at WordPress allows attackers to increase/decrease votes.
Problem types: description: Race condition
Affected products: vendor: Blaz K.
product: Rate my Post – WP Rating System (WordPress plugin)
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: Vulnerability discovered by Nguy Minh Tuan (Patchstack Alliance)
Published: 2022-09-23T14:20:52.161Z
CVE-2022-40311 WordPress Analytics Cat plugin <= 1.0.9 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability
Auth. (admin+) Stored Cross-Site Scripting (XSS) in Fatcat Apps Analytics Cat plugin <= 1.0.9 on WordPress.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Fatcat Apps
product: Analytics Cat – Google Analytics Made Easy (WordPress plugin)
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.8
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: HIGH
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: Vulnerability discovered by Vlad Vector (Patchstack)
Published: 2022-10-21T15:32:11.718Z
CVE-2022-40312 WordPress GiveWP Plugin <= 2.25.1 is vulnerable to Server Side Request Forgery (SSRF)
Server-Side Request Forgery (SSRF) vulnerability in GiveWP GiveWP – Donation Plugin and Fundraising Platform.This issue affects GiveWP – Donation Plugin and Fundraising Platform: from n/a through 2.25.1.
Problem types: cwe_id: CWE-918
description: CWE-918 Server-Side Request Forgery (SSRF)
Affected products: vendor: GiveWP
product: GiveWP – Donation Plugin and Fundraising Platform
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Rafie Muhammad (Patchstack)
Published: 2023-12-18T15:08:55.293Z
CVE-2022-40313 
Recursive rendering of Mustache template helpers containing user input could, in some cases, result in an XSS risk or a page failing to load.
Problem types: description: Stored XSS
Affected products: vendor: n/a
product: moodle
Published: 2022-09-30T16:34:00.000Z
CVE-2022-40314 
A remote code execution risk when restoring backup files originating from Moodle 1.9 was identified.
Problem types: description: Remote code execution
Affected products: vendor: n/a
product: moodle
Published: 2022-09-30T16:29:22.000Z
CVE-2022-40315 
A limited SQL injection risk was identified in the "browse list of users" site administration page.
Problem types: description: SQL injection
Affected products: vendor: n/a
product: moodle
Published: 2022-09-30T16:35:15.000Z
CVE-2022-40316 
The H5P activity attempts report did not filter by groups, which in separate groups mode could reveal information to non-editing teachers about attempts/users in groups they should not have access to.
Problem types: description: SQL injection
Affected products: vendor: n/a
product: moodle
Published: 2022-09-30T16:37:12.000Z
CVE-2022-40317 
OpenKM 6.3.11 allows stored XSS related to the javascript&colon; substring in an A element.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-09T16:45:31.000Z
CVE-2022-40318 
An issue was discovered in bgpd in FRRouting (FRR) through 8.4. By crafting a BGP OPEN message with an option of type 0xff (Extended Length from RFC 9072), attackers may cause a denial of service (assertion failure and daemon restart, or out-of-bounds read). This is possible because of inconsistent boundary checks that do not account for reading 3 bytes (instead of 2) in this 0xff case. NOTE: this behavior occurs in bgp_open_option_parse in the bgp_open.c file, a different location (with a different attack vector) relative to CVE-2022-40302.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-03T00:00:00.000Z
CVE-2022-40319 
The LISTSERV 17 web interface allows remote attackers to conduct Insecure Direct Object References (IDOR) attacks via a modified email address in a wa.exe URL. The impact is unauthorized modification of a victim's LISTSERV account.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-01-17T00:00:00.000Z
CVE-2022-40320 
cfg_tilde_expand in confuse.c in libConfuse 3.3 has a heap-based buffer over-read.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-09T20:38:22.000Z
CVE-2022-40322 
SysAid Help Desk before 22.1.65 allows XSS, aka FR# 66542 and 65579.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-11T20:11:26.000Z
CVE-2022-40323 
SysAid Help Desk before 22.1.65 allows XSS in the Password Services module, aka FR# 67241.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-11T20:11:34.000Z
CVE-2022-40324 
SysAid Help Desk before 22.1.65 allows XSS via the Linked SRs field, aka FR# 67258.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-11T20:11:40.000Z
CVE-2022-40325 
SysAid Help Desk before 22.1.65 allows XSS via the Asset Dashboard, aka FR# 67262.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-11T20:11:47.000Z
CVE-2022-40337 
OASES (aka Open Aviation Strategic Engineering System) 8.8.0.2 allows attackers to execute arbitrary code via the Open Print Folder menu.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-16T15:19:17.000Z
CVE-2022-40341 
mojoPortal v2.7 was discovered to contain an arbitrary file upload vulnerability which allows attackers to execute arbitrary code via a crafted PNG file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-30T18:46:24.000Z
CVE-2022-40347 
SQL Injection vulnerability in Intern Record System version 1.0 in /intern/controller.php in 'phone', 'email', 'deptType' and 'name' parameters, allows attackers to execute arbitrary code and gain sensitive information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-17T00:00:00.000Z
CVE-2022-40348 
Cross Site Scripting (XSS) vulnerability in Intern Record System version 1.0 in /intern/controller.php in 'name' and 'email' parameters, allows attackers to execute arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-18T00:00:00.000Z
CVE-2022-40352 
Online Tours & Travels Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/update_traveller.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-27T13:14:43.000Z
CVE-2022-40353 
Online Tours & Travels Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/up_booking.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-27T13:14:44.000Z
CVE-2022-40354 
Online Tours & Travels Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/update_booking.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-27T13:14:45.000Z
CVE-2022-40357 
A security issue was discovered in Z-BlogPHP <= 1.7.2. A Server-Side Request Forgery (SSRF) vulnerability in the zb_users/plugin/UEditor/php/action_crawler.php file allows remote attackers to force the application to make arbitrary requests via injection of arbitrary URLs into the source parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-20T20:01:30.000Z
CVE-2022-40358 
An issue was discovered in AjaXplorer 4.2.3, allows attackers to cause cross site scripting vulnerabilities via a crafted svg file upload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-23T17:21:40.000Z
CVE-2022-40359 
Cross site scripting (XSS) vulnerability in kfm through 1.4.7 via crafted GET request to /kfm/index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-23T17:25:23.000Z
CVE-2022-40361 
Cross Site Scripting Vulnerability in Elite CRM v1.2.11 allows attacker to execute arbitrary code via the language parameter to the /ngs/login endpoint.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-01-11T00:00:00.000Z
CVE-2022-40363 
A buffer overflow in the component nfc_device_load_mifare_ul_data of Flipper Devices Inc., Flipper Zero before v0.65.2 allows attackers to cause a Denial of Service (DoS) via a crafted NFC file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-29T12:16:40.000Z
CVE-2022-40365 
Cross site scripting (XSS) vulnerability in ouqiang gocron through 1.5.3, allows attackers to execute arbitrary code via scope.row.hostname in web/vue/src/pages/taskLog/list.vue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-14T20:06:43.000Z
CVE-2022-40373 
Cross Site Scripting (XSS) vulnerability in FeehiCMS 2.1.1 allows remote attackers to run arbitrary code via upload of crafted XML file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-15T00:00:00.000Z
CVE-2022-40402 
Wedding Planner v1.0 was discovered to contain a SQL injection vulnerability via the booking parameter at /admin/client_assign.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-26T13:00:04.000Z
CVE-2022-40403 
Wedding Planner v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/feature_edit.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-26T13:00:05.000Z
CVE-2022-40404 
Wedding Planner v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/select.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-26T13:00:06.000Z
CVE-2022-40405 
WoWonder Social Network Platform v4.1.2 was discovered to contain a SQL injection vulnerability via the offset parameter at requests.php?f=load-my-blogs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-14T00:00:00.000Z
CVE-2022-40407 
A zip slip vulnerability in the file upload function of Chamilo v1.11 allows attackers to execute arbitrary code via a crafted Zip file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-29T13:20:22.000Z
CVE-2022-40408 
FeehiCMS v2.1.1 was discovered to contain a cross-site scripting (XSS) vulnerability via a crafted payload injected into the Comment box under the Single Page module.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-29T13:33:54.000Z
CVE-2022-40424 
The d8s-urls for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. A potential code execution backdoor inserted by third parties is the democritus-networking package. The affected version of d8s-urls is 0.1.0
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-19T14:43:27.000Z
CVE-2022-40425 
The d8s-html for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-networking package. The affected version is 0.1.0.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-19T15:15:51.000Z
CVE-2022-40426 
The d8s-asns for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-networking package. The affected version is 0.1.0.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-19T15:17:43.000Z
CVE-2022-40427 
The d8s-domains for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-networking package. The affected version is 0.1.0
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-19T14:54:11.000Z
CVE-2022-40428 
The d8s-mpeg for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-networking package. The affected version is 0.1.0.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-19T15:19:19.000Z
CVE-2022-40429 
The d8s-ip-addresses for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-networking package. The affected version is 0.1.0.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-19T15:08:06.000Z
CVE-2022-40430 
The d8s-utility for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-networking package. The affected version is 0.1.0.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-19T15:21:17.000Z
CVE-2022-40431 
The d8s-pdfs for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-networking package. The affected version is 0.1.0.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-19T15:11:37.000Z
CVE-2022-40432 
The d8s-strings for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-hypothesis package. The affected version is 0.1.0.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-19T15:23:26.000Z
CVE-2022-40434 
Softr v2.0 was discovered to be vulnerable to HTML injection via the Name field of the Account page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-19T00:00:00.000Z
CVE-2022-40435 
Employee Performance Evaluation System v1.0 was discovered to contain a persistent cross-site scripting (XSS) vulnerability via adding new entries under the Departments and Designations module.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-19T00:00:00.000Z
CVE-2022-40438 
Buffer overflow vulnerability in function AP4_MemoryByteStream::WritePartial in mp42aac in Bento4 v1.6.0-639, allows attackers to cause a denial of service via a crafted file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-14T20:06:38.000Z
CVE-2022-40439 
An memory leak issue was discovered in AP4_StdcFileByteStream::Create in mp42ts in Bento4 v1.6.0-639, allows attackers to cause a denial of service via a crafted file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-14T20:06:32.000Z
CVE-2022-40440 
mxGraph v4.2.2 was discovered to contain a cross-site scripting (XSS) vulnerability via the setTooltips() function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-10-11T00:00:00.000Z