rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-33162 IBM Directory Server buffer overflow
IBM Security Directory Integrator 7.2.0 and Security Verify Directory Integrator 10.0.0 does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources, at the privilege level of a standard unprivileged user.  IBM X-Force ID:  228570.
Problem types: cwe_id: CWE-119
description: CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
Affected products: vendor: IBM
product: Security Directory Integrator
cpes: cpe:2.3:a:ibm:security_verify_directory:10.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:security_directory_integrator:7.2.0:*:*:*:*:*:*:*
default_status: unaffected
vendor: IBM
product: Security Verify Directory Integrator
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.3
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
version: 3.1
Published: 2024-08-16T18:33:35.966Z
CVE-2022-33163 IBM Security Directory Suite VA information disclosure
IBM Security Directory Suite VA 8.0.1 specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.  IBM X-Force ID:  228571.
Problem types: cwe_id: CWE-732
description: CWE-732 Incorrect Permission Assignment for Critical Resource
Affected products: vendor: IBM
product: Security Directory Suite VA
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2023-06-15T01:10:45.993Z
CVE-2022-33164 IBM Security Directory Server path traversal
IBM Security Directory Server 7.2.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view or write to arbitrary files on the system.  IBM X-Force ID:  228579.
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: IBM
product: Security Directory Integrator
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.7
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:H
version: 3.1
Published: 2023-09-08T19:58:51.729Z
CVE-2022-33165 IBM Security Directory Server information disclosure
IBM Security Directory Server 6.4.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system.  IBM X-Force ID:  228582.
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: IBM
product: Security Directory Server
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.8
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
version: 3.1
Published: 2023-10-14T14:16:33.333Z
CVE-2022-33166 IBM Security Directory Suite VA file upload
IBM Security Directory Suite VA 8.0.1 through 8.0.1.19 could allow a privileged user to upload malicious files of dangerous types that can be automatically processed within the product's environment.  IBM X-Force ID:  228586.
Problem types: cwe_id: CWE-434
description: CWE-434 Unrestricted Upload of File with Dangerous Type
Affected products: vendor: IBM
product: Security Directory Suite VA
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2023-06-15T02:33:33.518Z
CVE-2022-33167 IBM Security Directory Integrator information disclosure
IBM Security Directory Integrator 7.2.0 and IBM Security Verify Directory Integrator 10.0.0 could allow a remote attacker to obtain sensitive information, caused by the failure to set the HTTPOnly flag. A remote attacker could exploit this vulnerability to obtain sensitive information from the cookie.  IBM X-Force ID:  228587.
Problem types: cwe_id: CWE-1004
description: CWE-1004 Sensitive Cookie Without 'HttpOnly' Flag
Affected products: vendor: IBM
product: Security Directory Integrator
default_status: unaffected
vendor: IBM
product: Security Verify Directory Integrator
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 3.7
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Published: 2024-07-30T17:05:35.007Z
CVE-2022-33168 IBM Security Directory Suite VA denial of service
IBM Security Directory Suite VA 8.0.1 could allow an attacker to cause a denial of service due to uncontrolled resource consumption.  IBM X-Force ID:  228588.
Problem types: cwe_id: CWE-400
description: CWE-400 Uncontrolled Resource Consumption
Affected products: vendor: IBM
product: Security Directory Suite VA
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2023-06-15T01:19:01.037Z
CVE-2022-33169 
IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 is vulnerable to insufficiently protected credentials for users created via a bulk upload. IBM X-Force ID: 228888.
Problem types: description: Bypass Security
Affected products: vendor: IBM
product: Robotic Process Automation
Published: 2022-07-31T17:30:58.506Z
CVE-2022-33171 
The findOne function in TypeORM before 0.3.0 can either be supplied with a string or a FindOneOptions object. When input to the function is a user-controlled parsed JSON object, supplying a crafted FindOneOptions instead of an id string leads to SQL injection. NOTE: the vendor's position is that the user's application is responsible for input validation
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-04T15:51:49.000Z
CVE-2022-33172 
de.fac2 1.34 allows bypassing the User Presence protection mechanism when there is malware on the victim's PC.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-24T11:34:24.000Z
CVE-2022-33173 
An algorithm-downgrade issue was discovered in Couchbase Server before 7.0.4. Analytics Remote Links may temporarily downgrade to non-TLS connection to determine the TLS port number, using SCRAM-SHA instead.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-11T12:20:42.000Z
CVE-2022-33174 
Power Distribution Units running on Powertek firmware (multiple brands) before 3.30.30 allows remote authorization bypass in the web interface. To exploit the vulnerability, an attacker must send an HTTP packet to the data retrieval interface (/cgi/get_param.cgi) with the tmpToken cookie set to an empty string followed by a semicolon. This bypasses an active session authorization check. This can be then used to fetch the values of protected sys.passwd and sys.su.name fields that contain the username and password in cleartext.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:N
version: 3.1
Published: 2022-06-13T17:04:08.000Z
CVE-2022-33175 
Power Distribution Units running on Powertek firmware (multiple brands) before 3.30.30 have an insecure permissions setting on the user.token field that is accessible to everyone through the /cgi/get_param.cgi HTTP API. This leads to disclosing active session ids of currently logged-in administrators. The session id can then be reused to act as the administrator, allowing reading of the cleartext password, or reconfiguring the device.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:N
version: 3.1
Published: 2022-06-13T17:03:47.000Z
CVE-2022-33176 
Improper input validation in BIOS firmware for some Intel(R) NUC 11 Performance kits and Intel(R) NUC 11 Performance Mini PCs before version PATGL357.0042 may allow a privileged user to potentially enable escalation of privilege via local access.
Problem types: description: escalation of privilege
Affected products: vendor: n/a
product: Intel(R) NUC 11 Performance kits and Intel(R) NUC 11 Performance Mini PCs
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 8.2
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Published: 2022-11-11T15:48:49.818Z
CVE-2022-33177 WordPress Booking Calendar plugin <= 9.2.1 - Cross-Site Request Forgery (CSRF) vulnerabiulity
Cross-Site Request Forgery (CSRF) vulnerability in WPdevelop/Oplugins Booking Calendar plugin <= 9.2.1 at WordPress leading to Translations Update.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: WPdevelop/Oplugins
product: Booking Calendar (WordPress plugin)
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
version: 3.1
Credits: lang: en
value: Vulnerability discovered by Muhammad Daffa (Patchstack Alliance)
Published: 2022-09-06T17:18:54.357Z
CVE-2022-33178 
A vulnerability in the radius authentication system of Brocade Fabric OS before Brocade Fabric OS 9.0 could allow a remote attacker to execute arbitrary code on the Brocade switch.
Problem types: description: Improper input validation
Affected products: vendor: n/a
product: Brocade Fabric OS
Published: 2022-10-25T00:00:00.000Z
CVE-2022-33179 
A vulnerability in Brocade Fabric OS CLI before Brocade Fabric OS v9.1.0, 9.0.1e, 8.2.3c, and 7.4.2j could allow a local authenticated user to break out of restricted shells with “set context” and escalate privileges.
Problem types: description: Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: n/a
product: Brocade Fabric OS
Published: 2022-10-25T00:00:00.000Z
CVE-2022-33180 
A vulnerability in Brocade Fabric OS CLI before Brocade Fabric OS v9.1.0, 9.0.1e, 8.2.3c, 8.2.0cbn5 could allow a local authenticated attacker to export out sensitive files with “seccryptocfg”, “configupload”.
Problem types: description: Improper Authorization
Affected products: vendor: n/a
product: Brocade Fabric OS
Published: 2022-10-25T00:00:00.000Z
CVE-2022-33181 
An information disclosure vulnerability in Brocade Fabric OS CLI before Brocade Fabric OS v9.1.0, 9.0.1e, 8.2.3c, 8.2.0cbn5, 7.4.2.j could allow a local authenticated attacker to read sensitive files using switch commands “configshow” and “supportlink”.
Problem types: description: Information disclosure vulnerability
Affected products: vendor: n/a
product: Brocade Fabric OS
Published: 2022-10-25T00:00:00.000Z
CVE-2022-33182 
A privilege escalation vulnerability in Brocade Fabric OS CLI before Brocade Fabric OS v9.1.0, 9.0.1e, 8.2.3c, 8.2.0cbn5, could allow a local authenticated user to escalate its privilege to root using switch commands “supportlink”, “firmwaredownload”, “portcfgupload, license, and “fosexec”.
Problem types: description: Privilege escalation
Affected products: vendor: n/a
product: Brocade Fabric OS
Published: 2022-10-25T00:00:00.000Z
CVE-2022-33183 
A vulnerability in Brocade Fabric OS CLI before Brocade Fabric OS v9.1.0, 9.0.1e, 8.2.3c, 8.2.0cbn5, 7.4.2.j could allow a remote authenticated attacker to perform stack buffer overflow using in “firmwaredownload” and “diagshow” commands.
Problem types: description: Stack Buffer Overflow
Affected products: vendor: n/a
product: Brocade Fabric OS
Published: 2022-10-25T00:00:00.000Z
CVE-2022-33184 
A vulnerability in fab_seg.c.h libraries of all Brocade Fabric OS versions before Brocade Fabric OS v9.1.1, v9.0.1e, v8.2.3c, v8.2.0_cbn5, 7.4.2j could allow local authenticated attackers to exploit stack-based buffer overflows and execute arbitrary code as the root user account.
Problem types: description: Stack Buffer Overflow and Code Execution
Affected products: vendor: n/a
product: Brocade Fabric OS
Published: 2022-10-25T00:00:00.000Z
CVE-2022-33185 
Several commands in Brocade Fabric OS before Brocade Fabric OS v.9.0.1e, and v9.1.0 use unsafe string functions to process user input. Authenticated local attackers could abuse these vulnerabilities to exploit stack-based buffer overflows, allowing arbitrary code execution as the root user account.
Problem types: description: Stack Buffer Overflow
Affected products: vendor: n/a
product: Brocade Fabric OS
Published: 2022-10-25T00:00:00.000Z
CVE-2022-33186 
A vulnerability in Brocade Fabric OS software v9.1.1, v9.0.1e, v8.2.3c, v7.4.2j, and earlier versions could allow a remote unauthenticated attacker to execute on a Brocade Fabric OS switch commands capable of modifying zoning, disabling the switch, disabling ports, and modifying the switch IP address.
Problem types: description: Privilege escalation
Affected products: vendor: n/a
product: Brocade Fabric OS
Published: 2022-12-08T00:00:00.000Z
CVE-2022-33187 Brocade SANnav before v2.2.1 logs usernames and encoded passwords in debug-enabled logs
Brocade SANnav before v2.2.1 logs usernames and encoded passwords in 
debug-enabled logs. The vulnerability could allow an attacker with admin
 privilege to read sensitive information.


Problem types: cwe_id: CWE-532
description: CWE-532 Insertion of Sensitive Information into Log File
Affected products: vendor: Brocade
product: Brocade SANnav
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N
version: 3.1
Published: 2022-12-09T01:48:24.949Z
CVE-2022-33189 
An OS command injection vulnerability exists in the XCMD setAlexa functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9Z. A specially-crafted XCMD can lead to arbitrary command execution. An attacker can send a malicious XML payload to trigger this vulnerability.
Problem types: cwe_id: CWE-78
description: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: abode systems, inc.
product: iota All-In-One Security Kit
Published: 2022-10-25T16:33:48.021Z
CVE-2022-33190 
Improper input validation in the Intel(R) SUR software before version 2.4.8902 may allow an authenticated user to potentially enable escalation of privilege via local access.
Problem types: description: escalation of privilege
Affected products: vendor: n/a
product: Intel(R) SUR software
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 7.1
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: HIGH
availabilityImpact: HIGH
Published: 2023-02-16T20:00:11.419Z
CVE-2022-33191 WordPress Testimonials plugin <= 3.0.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability
Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in Chinmoy Paul's Testimonials plugin <= 3.0.1 at WordPress.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Chinmoy Paul (chinmoy29)
product: Testimonials (WordPress plugin)
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.1
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: Vulnerability discovered by Ngo Van Thien (Patchstack Alliance)
Published: 2022-07-22T16:46:52.229Z
CVE-2022-33192 
Four OS command injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A XCMD can lead to arbitrary command execution. An attacker can send a sequence of malicious commands to trigger these vulnerabilities.This vulnerability specifically focuses on the unsafe use of the `WL_SSID` and `WL_SSID_HEX` configuration values in the function at offset `0x1c7d28` of firmware 6.9Z.
Problem types: cwe_id: CWE-78
description: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: abode systems, inc.
product: iota All-In-One Security Kit
Published: 2022-10-25T16:33:49.061Z
CVE-2022-33193 
Four OS command injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A XCMD can lead to arbitrary command execution. An attacker can send a sequence of malicious commands to trigger these vulnerabilities.This vulnerability specifically focuses on the unsafe use of the `WL_WPAPSK` configuration value in the function located at offset `0x1c7d28` of firmware 6.9Z.
Problem types: cwe_id: CWE-78
description: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: abode systems, inc.
product: iota All-In-One Security Kit
Published: 2022-10-25T16:33:50.086Z
CVE-2022-33194 
Four OS command injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A XCMD can lead to arbitrary command execution. An attacker can send a sequence of malicious commands to trigger these vulnerabilities.This vulnerability focuses on the unsafe use of the `WL_Key` and `WL_DefaultKeyID` configuration values in the function located at offset `0x1c7d28` of firmware 6.9Z , and even more specifically on the command execution occuring at offset `0x1c7f6c`.
Problem types: cwe_id: CWE-78
description: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: abode systems, inc.
product: iota All-In-One Security Kit
Published: 2022-10-25T16:33:51.055Z
CVE-2022-33195 
Four OS command injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A XCMD can lead to arbitrary command execution. An attacker can send a sequence of malicious commands to trigger these vulnerabilities.This vulnerability focuses on the unsafe use of the `WL_DefaultKeyID` in the function located at offset `0x1c7d28` of firmware 6.9Z, and even more specifically on the command execution occuring at offset `0x1c7fac`.
Problem types: cwe_id: CWE-78
description: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: abode systems, inc.
product: iota All-In-One Security Kit
Published: 2022-10-25T16:33:52.055Z
CVE-2022-33196 
Incorrect default permissions in some memory controller configurations for some Intel(R) Xeon(R) Processors when using Intel(R) Software Guard Extensions which may allow a privileged user to potentially enable escalation of privilege via local access.
Problem types: description: escalation of privilege
Affected products: vendor: n/a
product: Intel(R) Xeon(R) Processors with IntelÂ® Software Guard Extensions (SGX)
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 7.2
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: HIGH
userInteraction: NONE
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: NONE
Published: 2023-02-16T20:00:22.704Z
CVE-2022-33198 WordPress Accordions plugin <= 2.0.2 - Unauthenticated WordPress Options Change vulnerability
Unauthenticated WordPress Options Change vulnerability in Biplob Adhikari's Accordions plugin <= 2.0.2 at WordPress.
Problem types: cwe_id: CWE-264
description: CWE-264 Permissions, Privileges, and Access Controls
Affected products: vendor: Biplob Adhikari
product: Accordions (WordPress plugin)
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Vulnerability discovered by m0ze (Patchstack)
Published: 2022-07-21T17:26:30.629Z
CVE-2022-33201 WordPress MailerLite – Signup forms (official) plugin <= 1.5.7 - Cross-Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in MailerLite – Signup forms (official) plugin <= 1.5.7 at WordPress allows an attacker to change the API key.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: MailerLite
product: MailerLite (WordPress plugin)
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Vulnerability discovered by Muhammad Daffa (Patchstack Alliance)
Published: 2022-08-05T15:08:21.172Z
CVE-2022-33202 
Authentication bypass vulnerability in the setup screen of L2Blocker(on-premise) Ver4.8.5 and earlier and L2Blocker(Cloud) Ver4.8.5 and earlier allows an adjacent attacker to perform an unauthorized login and obtain the stored information or cause a malfunction of the device by using alternative paths or channels for Sensor.
Problem types: description: Authentication bypass
Affected products: vendor: SOFTCREATE CORP.
product: L2Blocker
Published: 2022-06-27T00:20:25.000Z