rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-0987 
A flaw was found in PackageKit in the way some of the methods exposed by the Transaction interface examines files. This issue allows a local user to measure the time the methods take to execute and know whether a file owned by root or other users exists.
Problem types: cwe_id: CWE-200
description: CWE-200
Affected products: vendor: n/a
product: PackageKit
Published: 2022-06-28T16:09:26.000Z
CVE-2022-0988 Delta Electronics DIAEnergie CLEARTEXT Transmission of Sensitive Information
Delta Electronics DIAEnergie (Version 1.7.5 and prior) is vulnerable to cleartext transmission as the web application runs by default on HTTP. This could allow an attacker to remotely read transmitted information between the client and product.
Problem types: cwe_id: CWE-319
description: CWE-319 Cleartext Transmission of Sensitive Information
Affected products: vendor: Delta Electronics
product: DIAEnergie
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N
version: 3.1
Credits: lang: en
value: Michael Heinzl reported these vulnerabilities to CISA.
Published: 2022-03-25T18:02:30.522Z
CVE-2022-0989 NS WooCommerce Watermark <= 2.11.3 - Abuse of Functionality
An unprivileged user could use the functionality of the NS WooCommerce Watermark WordPress plugin through 2.11.3 to load images that hide malware for example from passing malicious domains to hide their trace, by making them pass through the vulnerable domain.
Problem types: cwe_id: CWE-80
description: CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Affected products: vendor: Unknown
product: NS WooCommerce Watermark
Credits: lang: en
value: Felipe Restrepo Rodríguez
Published: 2022-04-11T14:41:03.000Z
CVE-2022-0990 Server-Side Request Forgery (SSRF) in janeczku/calibre-web
Server-Side Request Forgery (SSRF) in GitHub repository janeczku/calibre-web prior to 0.6.18.
Problem types: cwe_id: CWE-918
description: CWE-918 Server-Side Request Forgery (SSRF)
Affected products: vendor: janeczku
product: janeczku/calibre-web
Published: 2022-04-04T17:50:17.000Z
CVE-2022-0991 Insufficient Session Expiration in admidio/admidio
Insufficient Session Expiration in GitHub repository admidio/admidio prior to 4.1.9.
Problem types: cwe_id: CWE-613
description: CWE-613 Insufficient Session Expiration
Affected products: vendor: admidio
product: admidio/admidio
Published: 2022-03-19T07:35:09.000Z
CVE-2022-0992 SiteGround Security <= 1.2.5 - Authentication Bypass via 2FA Setup
The SiteGround Security plugin for WordPress is vulnerable to authentication bypass that allows unauthenticated users to log in as administrative users due to missing identity verification on initial 2FA set-up that allows unauthenticated and unauthorized users to configure 2FA for pending accounts. Upon successful configuration, the attacker is logged in as that user without access to a username/password pair which is the expected first form of authentication. This affects versions up to, and including, 1.2.5.
Problem types: cwe_id: CWE-288
description: CWE-288 Authentication Bypass Using an Alternate Path or Channel
Affected products: vendor: siteground
product: Security Optimizer – The All-In-One Protection Plugin
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
baseScore: 9.8
baseSeverity: CRITICAL
Credits: lang: en
value: Chloe Chamberland
Published: 2022-04-19T20:26:33.000Z
CVE-2022-0993 SiteGround Security <= 1.2.5 - Authorization Weakness to Authentication Bypass
The SiteGround Security plugin for WordPress is vulnerable to authentication bypass that allows unauthenticated users to log in as administrative users due to missing identity verification on the 2FA back-up code implementation that logs users in upon success. This affects versions up to, and including, 1.2.5.
Problem types: cwe_id: CWE-285
description: CWE-285 Improper Authorization
Affected products: vendor: siteground
product: Security Optimizer – The All-In-One Protection Plugin
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
baseScore: 8.1
baseSeverity: HIGH
Credits: lang: en
value: Chloe Chamberland
Published: 2022-04-19T20:26:36.000Z
CVE-2022-0994 Hummingbird < 3.3.2 - Admin+ Stored Cross-Site Scripting
The Hummingbird WordPress plugin before 3.3.2 does not sanitise and escape the Config Name, which could allow high privilege users, such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Hummingbird – Optimize Speed, Enable Cache, Minify CSS & Defer Critical JS
Credits: lang: en
value: Taurus Omar
Published: 2022-04-18T17:10:41.000Z
CVE-2022-0995 
An out-of-bounds (OOB) memory write flaw was found in the Linux kernel’s watch_queue event notification subsystem. This flaw can overwrite parts of the kernel state, potentially allowing a local user to gain privileged access or cause a denial of service on the system.
Problem types: cwe_id: CWE-787
description: CWE-787
Affected products: vendor: n/a
product: kernel
Published: 2022-03-25T18:03:08.000Z
CVE-2022-0996 
A vulnerability was found in the 389 Directory Server that allows expired passwords to access the database to cause improper authentication.
Problem types: description: Impoper Authentication
Affected products: vendor: n/a
product: 389-ds-base
Published: 2022-03-23T19:46:16.000Z
CVE-2022-0997 Local Privilege Escalation Vulnerability in Fidelis Network and Deception
Improper file permissions in the CommandPost, Collector, and Sensor components of Fidelis Network and Deception enables an attacker with local, administrative access to the CLI to modify affected script files, which could result in arbitrary commands being run as root upon subsequent logon by a root user. The vulnerability is present in Fidelis Network and Deception versions prior to 9.4.5. Patches and updates are available to address this vulnerability.
Problem types: cwe_id: CWE-276
description: CWE-276 Incorrect Default Permissions
Affected products: vendor: Fidelis Cybersecurity
product: Fidelis Network
vendor: Fidelis Cybersecurity
product: Fidelis Deception
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 3.9
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: Henry Reed, The Aerospace Corporation
Published: 2022-05-17T19:31:43.358Z
CVE-2022-0998 
An integer overflow flaw was found in the Linux kernel’s virtio device driver code in the way a user triggers the vhost_vdpa_config_validate function. This flaw allows a local user to crash or potentially escalate their privileges on the system.
Problem types: cwe_id: CWE-190
description: CWE-190
Affected products: vendor: n/a
product: Kernel
Published: 2022-03-30T16:03:05.000Z
CVE-2022-0999 mySCADA myPRO  Command Injection
An authenticated user may be able to misuse parameters to inject arbitrary operating system commands into mySCADA myPRO versions 8.25.0 and prior.
Problem types: cwe_id: CWE-77
description: CWE-77: Command Injection
Affected products: vendor: mySCADA
product: myPRO
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Michael Heinzl reported this vulnerability to CISA.
Published: 2022-04-11T19:38:30.000Z
CVE-2022-1000 Path Traversal in prasathmani/tinyfilemanager
Path Traversal in GitHub repository prasathmani/tinyfilemanager prior to 2.4.7.
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: prasathmani
product: prasathmani/tinyfilemanager
Published: 2022-03-17T10:30:14.000Z
CVE-2022-1001 WP Downgrade < 1.2.3 - Admin+ Stored Cross-Site Scripting
The WP Downgrade WordPress plugin before 1.2.3 only perform client side validation of its "WordPress Target Version" settings, but does not sanitise and escape it server side, allowing high privilege users such as admin to perform Cross-Site attacks even when the unfiltered_html capability is disallowed
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: WP Downgrade | Specific Core Version
Credits: lang: en
value: Taurus Omar
Published: 2022-04-18T17:10:42.000Z
CVE-2022-1002 HTML Injection while inviting Guests
Mattermost 6.3.0 and earlier fails to properly sanitize the HTML content in the email invitation sent to guest users, which allows registered users with special permissions to invite guest users to inject unescaped HTML content in the email invitations.
Problem types: cwe_id: CWE-80
description: CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Affected products: vendor: Mattermost
product: Mattermost
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 2
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: Thanks to Imamul Mursalin for contributing to this improvement under the Mattermost responsible disclosure policy.
Published: 2022-03-18T18:00:22.000Z
CVE-2022-1003 Sysadmin can override existing configs & bypass restrictions like EnableUploads
One of the API in Mattermost version 6.3.0 and earlier fails to properly protect the permissions, which allows the system administrators to combine the two distinct privileges/capabilities in a way that allows them to override certain restricted configurations like EnableUploads.
Problem types: cwe_id: CWE-268
description: CWE-268 Privilege Chaining
Affected products: vendor: Mattermost
product: Mattermost
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 3.3
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: Thanks to Rohitesh Gupta for contributing to this improvement under the Mattermost responsible disclosure policy.
Published: 2022-03-18T18:00:21.000Z
CVE-2022-1004 Information disclosure in the External Interface
Accounted time is shown in the Ticket Detail View (External Interface), even if ExternalFrontend::TicketDetailView###AccountedTimeDisplay is disabled.
Problem types: cwe_id: CWE-200
description: CWE-200 Information Exposure
Affected products: vendor: OTRS AG
product: OTRS
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: Special thanks to Jasmin Hammes for reporting these vulnerability.
Published: 2022-03-21T09:15:52.322Z
CVE-2022-1005 WP Statistics < 13.2.2 - Reflected Cross-Site Scripting
The WP Statistics WordPress plugin before 13.2.2 does not sanitise the REQUEST_URI parameter before outputting it back in the rendered page, leading to Cross-Site Scripting (XSS) in web browsers which do not encode characters
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: WP Statistics
Credits: lang: en
value: Taurus Omar
Published: 2022-06-06T08:50:53.000Z
CVE-2022-1006 Advanced Booking Calendar < 1.7.1 - Admin+ SQLi
The Advanced Booking Calendar WordPress plugin before 1.7.1 does not sanitise and escape the id parameter when editing Calendars, which could allow high privilege users such as admin to perform SQL injection attacks
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: Advanced Booking Calendar
Credits: lang: en
value: YICHENG LIU-ZTE CHENFENG lab
Published: 2022-04-11T14:41:04.000Z
CVE-2022-1007 Advanced Booking Calendar < 1.7.1 - Reflected Cross-Site Scripting
The Advanced Booking Calendar WordPress plugin before 1.7.1 does not sanitise and escape the room parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting issue
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Advanced Booking Calendar
Credits: lang: en
value: YICHENG LIU-ZTE CHENFENG lab
Published: 2022-04-11T14:41:06.000Z
CVE-2022-1008 One Click Demo Import < 3.1.0 - Admin+ Arbitrary File Upload
The One Click Demo Import WordPress plugin before 3.1.0 does not validate the imported file, allowing high privilege users such as admin to upload arbitrary files (such as PHP) even when FILE_MODS and FILE_EDIT are disallowed
Problem types: cwe_id: CWE-434
description: CWE-434 Unrestricted Upload of File with Dangerous Type
Affected products: vendor: Unknown
product: One Click Demo Import
Credits: lang: en
value: YICHENG LIU-ZTE CHENFENG lab
Published: 2022-04-11T14:41:07.000Z
CVE-2022-1009 Smush < 3.9.9 - Admin+ Reflected Cross-Site Scripting
The Smush WordPress plugin before 3.9.9 does not sanitise and escape a configuration parameter before outputting it back in an admin page when uploading a malicious preset configuration, leading to a Reflected Cross-Site Scripting. For the attack to be successful, an attacker would need an admin to upload a malicious configuration file
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Smush – Lazy Load Images, Optimize & Compress Images
Credits: lang: en
value: Taurus Omar
Published: 2022-05-30T08:35:37.000Z
CVE-2022-1010 Login using WordPress Users < 1.13.4 - Admin+ Stored Cross-Site Scripting
The Login using WordPress Users ( WP as SAML IDP ) WordPress plugin before 1.13.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Login using WordPress Users ( WP as SAML IDP )
Credits: lang: en
value: Niraj Mahajan
Published: 2022-06-27T08:55:59.000Z
CVE-2022-1011 
A use-after-free flaw was found in the Linux kernel’s FUSE filesystem in the way a user triggers write(). This flaw allows a local user to gain unauthorized access to data from the FUSE filesystem, resulting in privilege escalation.
Problem types: cwe_id: CWE-416
description: CWE-416
Affected products: vendor: n/a
product: kernel
Published: 2022-03-18T00:00:00.000Z
CVE-2022-1012 
A memory leak problem was found in the TCP source port generation algorithm in net/ipv4/tcp.c due to the small table perturb size. This flaw may allow an attacker to information leak and may cause a denial of service problem.
Problem types: cwe_id: CWE-401
description: CWE-401
Affected products: vendor: n/a
product: Kernel
Published: 2022-08-05T00:00:00.000Z
CVE-2022-1013 Personal Dictionary < 1.3.4 - Unauthenticated SQLi
The Personal Dictionary WordPress plugin before 1.3.4 fails to properly sanitize user supplied POST data before it is being interpolated in an SQL statement and then executed, leading to a blind SQL injection vulnerability.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: Personal Dictionary
Credits: lang: en
value: cydave
Published: 2022-05-09T16:50:43.000Z
CVE-2022-1014 WP Contacts Manager <= 2.2.4 - Unauthenticated SQLi
The WP Contacts Manager WordPress plugin through 2.2.4 fails to properly sanitize user supplied POST data before it is being interpolated in an SQL statement and then executed, leading to an SQL injection vulnerability.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: WP Contacts Manager
Credits: lang: en
value: cydave
Published: 2022-05-23T07:15:23.000Z
CVE-2022-1015 
A flaw was found in the Linux kernel in linux/net/netfilter/nf_tables_api.c of the netfilter subsystem. This flaw allows a local user to cause an out-of-bounds write issue.
Problem types: cwe_id: CWE-787
description: CWE-787
Affected products: vendor: n/a
product: kernel
Published: 2022-04-29T00:00:00.000Z
CVE-2022-1016 
A flaw was found in the Linux kernel in net/netfilter/nf_tables_core.c:nft_do_chain, which can cause a use-after-free. This issue needs to handle 'return' with proper preconditions, as it can lead to a kernel information leak problem caused by a local, unprivileged attacker.
Problem types: cwe_id: CWE-824
description: CWE-824 - Access of Uninitialized Pointer.
Affected products: vendor: n/a
product: Kernel
Published: 2022-08-29T14:03:06.000Z
CVE-2022-1018 ICSA-22-088-01 Rockwell Automation ISaGRAF
When opening a malicious solution file provided by an attacker, the application suffers from an XML external entity vulnerability due to an unsafe call within a dynamic link library file. An attacker could exploit this to pass data from local files to a remote web server, leading to a loss of confidentiality.
Problem types: cwe_id: CWE-611
description: CWE-611 Improper Restriction of XML External Entity Reference ('XXE')
Affected products: vendor: Rockwell Automation
product: Connected Component Workbench
vendor: Rockwell Automation
product: ISaGRAF
vendor: Rockwell Automation
product: Safety Instrumented Systems Workstation
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 5.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: kimiya of Trend Micro’s Zero Day Initiative reported this vulnerability to CISA.
Published: 2022-04-01T22:17:24.599Z
CVE-2022-1019 Automated Logic WebCtrl Server Open Redirection Vulnerability
Automated Logic's WebCtrl Server Version 6.1 'Help' index pages are vulnerable to open redirection. The vulnerability allows an attacker to send a maliciously crafted URL which could result in redirecting the user to a malicious webpage or downloading a malicious file.
Problem types: cwe_id: CWE-601
description: CWE-601 URL Redirection to Untrusted Site ('Open Redirect')
Affected products: vendor: Automated Logic
product: WebCtrl Server
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: NONE
baseScore: 5.2
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: Chizuru Toyama from Trend Micro
Published: 2022-04-19T20:38:25.000Z
CVE-2022-1020 Woo Product Table < 3.1.2 - Unauthenticated Arbitrary Function Call
The Product Table for WooCommerce (wooproducttable) WordPress plugin before 3.1.2 does not have authorisation and CSRF checks in the wpt_admin_update_notice_option AJAX action (available to both unauthenticated and authenticated users), as well as does not validate the callback parameter, allowing unauthenticated attackers to call arbitrary functions with either none or one user controlled argument
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: Product Table for WooCommerce (wooproducttable)
Credits: lang: en
value: Mark Costlow
Published: 2022-04-18T17:10:44.000Z
CVE-2022-1021 Insecure Storage of Sensitive Information in chatwoot/chatwoot
Insecure Storage of Sensitive Information in GitHub repository chatwoot/chatwoot prior to 2.6.0.
Problem types: cwe_id: CWE-922
description: CWE-922 Insecure Storage of Sensitive Information
Affected products: vendor: chatwoot
product: chatwoot/chatwoot
Published: 2022-08-19T12:40:10.000Z
CVE-2022-1022 Cross-site Scripting (XSS) - Stored in chatwoot/chatwoot
Cross-site Scripting (XSS) - Stored in GitHub repository chatwoot/chatwoot prior to 2.5.0.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: chatwoot
product: chatwoot/chatwoot
Published: 2022-04-21T14:25:12.000Z
CVE-2022-1023 Podcast Importer SecondLine < 1.3.8 - Admin+ SQLi
The Podcast Importer SecondLine WordPress plugin before 1.3.8 does not sanitise and properly escape some imported data, which could allow SQL injection attacks to be performed by imported a malicious podcast file
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: Podcast Importer SecondLine
Credits: lang: en
value: YICHENG LIU-ZTE CHENFENG lab
Published: 2022-04-11T14:41:09.000Z
CVE-2022-1025 
All unpatched versions of Argo CD starting with v1.0.0 are vulnerable to an improper access control bug, allowing a malicious user to potentially escalate their privileges to admin-level.
Problem types: cwe_id: CWE-284
description: CWE-284->CWE-1220
Affected products: vendor: n/a
product: ArgoCD
Published: 2022-07-12T20:39:54.000Z
CVE-2022-1026 Kyocera Net View Address Book Exposure
Kyocera multifunction printers running vulnerable versions of Net View unintentionally expose sensitive user information, including usernames and passwords, through an insufficiently protected address book export function.
Problem types: cwe_id: CWE-522
description: CWE-522 Insufficiently Protected Credentials
Affected products: vendor: Kyocera
product: Multifunction Printer Net Viewer
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 8.6
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Aaron Herndon, Rapid7
Published: 2022-04-04T14:15:18.324Z
CVE-2022-1027 Page Restriction WordPress < 1.2.7 - Admin+ Stored Cross-Site Scripting
The Page Restriction WordPress (WP) WordPress plugin before 1.2.7 allows bad actors with administrator privileges to the settings page to inject Javascript code to its settings leading to stored Cross-Site Scripting that will only affect administrator users.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Page Restriction WordPress (WP) – Protect WP Pages/Post
Credits: lang: en
value: Niraj Mahajan
Published: 2022-04-25T15:51:14.000Z
CVE-2022-1028 WordPress Security < 4.2.1 - Admin+ Stored Cross-Site Scripting
The WordPress Security Firewall, Malware Scanner, Secure Login and Backup plugin before 4.2.1 does not sanitise and escape some of its settings, leading to malicious users with administrator privileges to store malicious Javascript code leading to Cross-Site Scripting attacks when unfiltered_html is disallowed (for example in multisite setup)
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: WordPress Security – Firewall, Malware Scanner, Secure Login and Backup
Credits: lang: en
value: Niraj Mahajan
Published: 2022-06-27T08:56:06.000Z