rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-2132 
A permissive list of allowed inputs flaw was found in DPDK. This issue allows a remote attacker to cause a denial of service triggered by sending a crafted Vhost header to DPDK.
Problem types: cwe_id: CWE-791
description: CWE-791->CWE-183->CWE-641->CWE-770
Affected products: vendor: n/a
product: dpdk
Published: 2022-08-31T15:32:58.000Z
CVE-2022-2133 OAuth Single Sign On < 6.22.6 - Authentication Bypass
The OAuth Single Sign On WordPress plugin before 6.22.6 doesn't validate that OAuth access token requests are legitimate, which allows attackers to log onto the site with the only knowledge of a user's email address.
Problem types: cwe_id: CWE-287
description: CWE-287 Improper Authentication
Affected products: vendor: Unknown
product: OAuth Single Sign On – SSO (OAuth Client)
Credits: lang: en
value: Lana Codes
Published: 2022-07-17T10:36:17.000Z
CVE-2022-2134 Allocation of Resources Without Limits or Throttling in inventree/inventree
Allocation of Resources Without Limits or Throttling in GitHub repository inventree/inventree prior to 0.8.0.
Problem types: cwe_id: CWE-770
description: CWE-770 Allocation of Resources Without Limits or Throttling
Affected products: vendor: inventree
product: inventree/inventree
Published: 2022-06-20T00:00:00.000Z
CVE-2022-2135 Advantech iView
The affected product is vulnerable to multiple SQL injections, which may allow an unauthorized attacker to disclose information.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Advantech iView
product: iView
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: rgod, working with Trend Micro’s Zero Day Initiative, reported these vulnerabilities to CISA
Published: 2022-07-22T14:58:45.454Z
CVE-2022-2136 Advantech iView
The affected product is vulnerable to multiple SQL injections that require low privileges for exploitation and may allow an unauthorized attacker to disclose information.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Advantech iView
product: iView
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: rgod, working with Trend Micro’s Zero Day Initiative, reported these vulnerabilities to CISA
Published: 2022-07-22T14:58:55.154Z
CVE-2022-2137 Advantech iView
The affected product is vulnerable to two SQL injections that require high privileges for exploitation and may allow an unauthorized attacker to disclose information
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Advantech iView
product: iView
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.9
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: rgod, working with Trend Micro’s Zero Day Initiative, reported these vulnerabilities to CISA
Published: 2022-07-22T14:57:57.232Z
CVE-2022-2138 Advantech iView
The affected product is vulnerable due to missing authentication, which may allow an attacker to read or modify sensitive data and execute arbitrary code, resulting in a denial-of-service condition.
Problem types: cwe_id: CWE-306
description: CWE-306 Missing Authentication for Critical Function
Affected products: vendor: Advantech iView
product: iView
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.2
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
version: 3.1
Credits: lang: en
value: rgod, working with Trend Micro’s Zero Day Initiative, reported these vulnerabilities to CISA
Published: 2022-07-22T14:58:18.441Z
CVE-2022-2139 Advantech iView
The affected product is vulnerable to directory traversal, which may allow an attacker to access unauthorized files and execute arbitrary code.
Problem types: cwe_id: CWE-23
description: CWE-23 Relative Path Traversal
Affected products: vendor: Advantech iView
product: iView
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: rgod, working with Trend Micro’s Zero Day Initiative, reported these vulnerabilities to CISA
Published: 2022-07-22T14:58:03.033Z
CVE-2022-2140 Elcomplus SmartICS Cross-site Scripting
Elcomplus SmartICS v2.3.4.0 does not neutralize user-controllable input, which allows an authenticated user to inject arbitrary code into specific parameters.
Problem types: cwe_id: CWE-79
description: CWE-79: Cross-site Scripting
Affected products: vendor: Elcomplus
product: SmartICS
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Michael Heinzl reported these vulnerabilities to CISA.
Published: 2022-06-27T16:14:48.000Z
CVE-2022-2141 ICSA-22-200-01 MiCODUS MV720 GPS tracker Improper Authentication
SMS-based GPS commands can be executed by MiCODUS MV720 GPS tracker without authentication.
Problem types: cwe_id: CWE-287
description: CWE-287 Improper Authentication
Affected products: vendor: MiCODUS
product: MV720
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Pedro Umbelino, Dan Dahlberg, and Jacob Olcott of BitSight reported these vulnerabilities to CISA.
Published: 2022-07-20T15:24:21.042Z
CVE-2022-2142 Advantech iView
The affected product is vulnerable to a SQL injection with high attack complexity, which may allow an unauthorized attacker to disclose information.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Advantech iView
product: iView
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: rgod, working with Trend Micro’s Zero Day Initiative, reported these vulnerabilities to CISA
Published: 2022-07-22T14:59:30.208Z
CVE-2022-2143 Advantech iView
The affected product is vulnerable to two instances of command injection, which may allow an attacker to remotely execute arbitrary code.
Problem types: cwe_id: CWE-77
description: CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
Affected products: vendor: Advantech iView
product: iView
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: rgod, working with Trend Micro’s Zero Day Initiative, reported these vulnerabilities to CISA
Published: 2022-07-22T14:59:13.360Z
CVE-2022-2144 Jquery Validation For Contact Form 7 < 5.3 - Arbitrary Options Update via CSRF
The Jquery Validation For Contact Form 7 WordPress plugin before 5.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change Blog options like default_role, users_can_register via a CSRF attack
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: Jquery Validation For Contact Form 7
Credits: lang: en
value: Gibran Abdillah
Published: 2022-07-17T10:36:23.000Z
CVE-2022-2145 Cloudlfare WARP Arbitrary File Overwrite
Cloudflare WARP client for Windows (up to v. 2022.5.309.0) allowed creation of mount points from its ProgramData folder. During installation of the WARP client, it was possible to escalate privileges and overwrite SYSTEM protected files.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
cwe_id: CWE-59
description: CWE-59 Improper Link Resolution Before File Access ('Link Following')
Affected products: vendor: Cloudflare
product: WARP
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 5.8
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:H/A:H
version: 3.1
Credits: lang: en
value: Patrick Murphy (@hackandpwn)
Published: 2022-06-28T17:45:20.000Z
CVE-2022-2146 Import CSV Files <= 1.0 - Reflected Cross-Site Scripting
The Import CSV Files WordPress plugin through 1.0 does not sanitise and escaped imported data before outputting them back in a page, and is lacking CSRF check when performing such action as well, resulting in a Reflected Cross-Site Scripting
Problem types: description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: Import CSV Files
default_status: affected
Credits: lang: en
value: Benachi
lang: en
value: WPScan
Published: 2022-07-17T10:36:27.000Z
CVE-2022-2147 Unquoted Service Path in Cloudflare WARP for Windows
Cloudflare Warp for Windows from version 2022.2.95.0 contained an unquoted service path which enables arbitrary code execution leading to privilege escalation. The fix was released in version 2022.3.186.0.
Problem types: cwe_id: CWE-428
description: CWE-428 Unquoted Search Path or Element
Affected products: vendor: Cloudflare
product: WARP
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Jonathan Gregson
Published: 2022-06-23T21:00:16.000Z
CVE-2022-2148 LinkedIn Company Updates <= 1.5.3 - Admin+ Stored Cross-Site Scripting
The LinkedIn Company Updates WordPress plugin through 1.5.3 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: LinkedIn Company Updates
Credits: lang: en
value: Vinay Varma Mudunuri
lang: en
value: Krishna Harsha Kondaveeti
Published: 2022-07-17T10:36:29.000Z
CVE-2022-2149 Very Simple Breadcrumb <= 1.0 - Admin+ Stored Cross-Site Scripting
The Very Simple Breadcrumb WordPress plugin through 1.0 does not sanitise and escape its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Very Simple Breadcrumb
Credits: lang: en
value: Rahul Selvakumar
Published: 2022-07-17T10:36:35.000Z
CVE-2022-2151 Best Contact Management Software <= 3.7.3 - Admin+ Stored Cross-Site Scripting
The Best Contact Management Software WordPress plugin through 3.7.3 does not sanitise and escape its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Best Contact Management Software for WordPress
Credits: lang: en
value: Benachi
Published: 2022-07-17T10:36:40.000Z
CVE-2022-2152 Duplicate Page and Post Plugin < 2.8 - Admin+ Stored Cross-Site Scripting
The Duplicate Page and Post WordPress plugin before 2.8 does not sanitise and escape its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Duplicate Page and Post
Credits: lang: en
value: Sachin Kumar from eSec Forte Technologies Pvt Ltd
Published: 2022-08-15T08:36:07.000Z
CVE-2022-2153 
A flaw was found in the Linux kernel’s KVM when attempting to set a SynIC IRQ. This issue makes it possible for a misbehaving VMM to write to SYNIC/STIMER MSRs, causing a NULL pointer dereference. This flaw allows an unprivileged local attacker on the host to issue specific ioctl calls, causing a kernel oops condition that results in a denial of service.
Problem types: cwe_id: CWE-476
description: CWE-476
Affected products: vendor: n/a
product: kernel
Published: 2022-08-31T00:00:00.000Z
CVE-2022-2155 A vulnerability exists in the Lumada APM’s User Asset Group feature due to a flaw in access control mechanism implementation on the “Limited Engineer” role. 

A vulnerability exists in the affected versions of Lumada APM’s User Asset Group feature
due to a flaw in access control mechanism implementation on the “Limited Engineer” role, granting it access to the embedded Power BI reports
feature. An attacker that manages to exploit the vulnerability on a customer’s Lumada APM could access unauthorized information by gaining
unauthorized access to any Power BI reports installed by the customer. 

Furthermore, the vulnerability enables an attacker to manipulate asset issue comments on assets, which should not be available to the attacker.



Affected versions 
  *  Lumada APM on-premises version 6.0.0.0 - 6.4.0.*



List of CPEs: 
  *  cpe:2.3:a:hitachienergy:lumada_apm:6.0.0.0:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:lumada_apm:6.1.0.0:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:lumada_apm:6.2.0.0:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:lumada_apm:6.3.0.0:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:lumada_apm:6.4.0.0:*:*:*:*:*:*:*



Problem types: cwe_id: CWE-863
description: CWE-863 Incorrect Authorization
Affected products: vendor: Hitachi Energy
product: Lumada APM
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.7
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
version: 3.1
Published: 2023-01-12T14:01:51.857Z
CVE-2022-2156 
Use after free in Core in Google Chrome prior to 103.0.5060.53 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Problem types: description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2022-07-28T00:40:20.000Z
CVE-2022-2157 
Use after free in Interest groups in Google Chrome prior to 103.0.5060.53 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.
Problem types: description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2022-07-28T00:40:26.000Z
CVE-2022-2158 
Type confusion in V8 in Google Chrome prior to 103.0.5060.53 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Problem types: description: Type Confusion
Affected products: vendor: Google
product: Chrome
Published: 2022-07-28T00:40:31.000Z
CVE-2022-2160 
Insufficient policy enforcement in DevTools in Google Chrome on Windows prior to 103.0.5060.53 allowed an attacker who convinced a user to install a malicious extension to obtain potentially sensitive information from a user's local files via a crafted HTML page.
Problem types: description: Insufficient policy enforcement
Affected products: vendor: Google
product: Chrome
Published: 2022-07-28T00:40:37.000Z
CVE-2022-2161 
Use after free in WebApp Provider in Google Chrome prior to 103.0.5060.53 allowed a remote attacker who convinced the user to engage in specific user interactions to potentially exploit heap corruption via specific UI interactions.
Problem types: description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2022-07-28T00:40:43.000Z
CVE-2022-2162 
Insufficient policy enforcement in File System API in Google Chrome on Windows prior to 103.0.5060.53 allowed a remote attacker to bypass file system access via a crafted HTML page.
Problem types: description: Insufficient policy enforcement
Affected products: vendor: Google
product: Chrome
Published: 2022-07-28T00:40:48.000Z
CVE-2022-2163 
Use after free in Cast UI and Toolbar in Google Chrome prior to 103.0.5060.134 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via UI interaction.
Problem types: description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2022-07-28T01:00:25.000Z
CVE-2022-2164 
Inappropriate implementation in Extensions API in Google Chrome prior to 103.0.5060.53 allowed an attacker who convinced a user to install a malicious extension to bypass discretionary access control via a crafted HTML page.
Problem types: description: Inappropriate implementation
Affected products: vendor: Google
product: Chrome
Published: 2022-07-28T00:41:01.000Z
CVE-2022-2165 
Insufficient data validation in URL formatting in Google Chrome prior to 103.0.5060.53 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name.
Problem types: description: Insufficient data validation
Affected products: vendor: Google
product: Chrome
Published: 2022-07-28T00:41:15.000Z
CVE-2022-2166 Improper Restriction of Excessive Authentication Attempts in mastodon/mastodon
Improper Restriction of Excessive Authentication Attempts in GitHub repository mastodon/mastodon prior to 4.0.0.
Problem types: cwe_id: CWE-307
description: CWE-307 Improper Restriction of Excessive Authentication Attempts
Affected products: vendor: mastodon
product: mastodon/mastodon
Published: 2022-11-16T00:00:00.000Z
CVE-2022-2167 Newspaper < 12 - Reflected Cross-Site Scripting
The Newspaper WordPress theme before 12 does not sanitise a parameter before outputting it back in an HTML attribute via an AJAX action, leading to a Reflected Cross-Site Scripting
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Newspaper
Credits: lang: en
value: Truoc Phan from Techlab Corporation
Published: 2022-10-31T00:00:00.000Z
CVE-2022-2168 Download Manager < 3.2.44 - Reflected Cross-Site Scripting
The Download Manager WordPress plugin before 3.2.44 does not escape a generated URL before outputting it back in an attribute of the history dashboard, leading to Reflected Cross-Site Scripting
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Download Manager
Credits: lang: en
value: ZhongFu Su(JrXnm) of WuHan University
Published: 2022-07-17T10:36:46.000Z
CVE-2022-2169 Loading Page with Loading Screen < 1.0.83 - Admin+ Stored Cross-Site Scripting
The Loading Page with Loading Screen WordPress plugin before 1.0.83 does not escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Loading Page with Loading Screen
Credits: lang: en
value: Nikhil Kapoor
Published: 2022-07-17T10:36:52.000Z
CVE-2022-2170 Microsoft Advertising Universal Event Tracking < 1.0.4 - Admin+ Stored Cross-Site Scripting
The Microsoft Advertising Universal Event Tracking (UET) WordPress plugin before 1.0.4 does not sanitise and escape its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. Due to the nature of this plugin, well crafted XSS can also leak into the frontpage.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Microsoft Advertising Universal Event Tracking (UET)
Credits: lang: en
value: Chowdhury Faizal Ahammed
Published: 2022-08-01T12:49:17.000Z
CVE-2022-2171 Progressive License <= 1.1.0 - CSRF to Stored XSS
The Progressive License WordPress plugin through 1.1.0 is lacking any CSRF check when saving its settings, which could allow attackers to make a logged in admin change them. Furthermore, as the plugin allows arbitrary HTML to be inserted in one of the settings, this could lead to Stored XSS issue which will be triggered in the frontend as well.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: Progressive License
Credits: lang: en
value: Daniel Ruf
Published: 2022-08-01T12:49:33.000Z
CVE-2022-2172 LinkWorth Plugin < 3.3.4 - Arbitrary Setting Update via CSRF
The LinkWorth WordPress plugin before 3.3.4 does not implement nonce checks, which could allow attackers to make a logged in admin change settings via a CSRF attack.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: LinkWorth Plugin
Credits: lang: en
value: Daniel Ruf
Published: 2022-08-22T14:59:50.000Z
CVE-2022-2173 Advanced Database Cleaner < 3.1.1 - Reflected Cross-Site Scripting
The Advanced Database Cleaner WordPress plugin before 3.1.1 does not escape numerous generated URLs before outputting them back in href attributes of admin dashboard pages, leading to Reflected Cross-Site Scripting
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Advanced Database Cleaner
Credits: lang: en
value: ZhongFu Su(JrXnm) of WuHan University
Published: 2022-07-17T10:36:59.000Z
CVE-2022-2174 Cross-site Scripting (XSS) - Reflected in microweber/microweber
Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 1.2.18.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: microweber
product: microweber/microweber
Published: 2022-06-22T12:00:38.000Z
CVE-2022-2175 Buffer Over-read in vim/vim
Buffer Over-read in GitHub repository vim/vim prior to 8.2.
Problem types: cwe_id: CWE-126
description: CWE-126 Buffer Over-read
Affected products: vendor: vim
product: vim/vim
Published: 2022-06-23T00:00:00.000Z