rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-3984 Flowplayer Video Player < 1.0.5 - Contributor+ Stored XSS
The Flowplayer Video Player WordPress plugin before 1.0.5 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Flowplayer Video Player
default_status: unaffected
Credits: lang: en
value: Lana Codes
Published: 2022-12-19T13:41:46.964Z
CVE-2022-3985 Videojs HTML5 Player < 1.1.9 - Contributor+ Stored XSS
The Videojs HTML5 Player WordPress plugin before 1.1.9 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Videojs HTML5 Player
default_status: unaffected
Credits: lang: en
value: Lana Codes
Published: 2022-12-19T13:41:40.864Z
CVE-2022-3986 WP Stripe Checkout < 1.2.2.21 - Contributor+ Stored XSS
The WP Stripe Checkout WordPress plugin before 1.2.2.21 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: WP Stripe Checkout
default_status: unaffected
Credits: lang: en
value: Lana Codes
Published: 2022-12-19T13:41:38.527Z
CVE-2022-3987 Responsive Lightbox2 < 1.0.4 - Contributor+ Stored XSS
The Responsive Lightbox2 WordPress plugin before 1.0.4 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Responsive Lightbox2
default_status: unaffected
Credits: lang: en
value: Lana Codes
Published: 2022-12-19T13:41:47.729Z
CVE-2022-3988 Frappe Search navbar_search.html cross site scripting
A vulnerability was found in Frappe. It has been rated as problematic. Affected by this issue is some unknown functionality of the file frappe/templates/includes/navbar/navbar_search.html of the component Search. The manipulation of the argument q leads to cross site scripting. The attack may be launched remotely. The name of the patch is bfab7191543961c6cb77fe267063877c31b616ce. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-213560.
Problem types: cwe_id: CWE-707
description: CWE-707 Improper Neutralization -> CWE-74 Injection -> CWE-79 Cross Site Scripting
Affected products: vendor: unspecified
product: Frappe
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: LOW
availabilityImpact: NONE
baseScore: 3.5
baseSeverity: LOW
Published: 2022-11-14T00:00:00.000Z
CVE-2022-3989 Motors - Car Dealer, Classifieds & Listing < 1.4.4 - Arbitrary File Upload
The Motors WordPress plugin before 1.4.4 does not properly validate uploaded files for dangerous file types (such as .php) in an AJAX action, allowing an attacker to sign up on a victim's WordPress instance, upload a malicious PHP file and attempt to launch a brute-force attack to discover the uploaded payload.
Problem types: description: CWE-434 Unrestricted Upload of File with Dangerous Type
Affected products: vendor: Unknown
product: Motors
default_status: unaffected
Credits: lang: en
value: cydave
Published: 2022-12-12T17:54:58.545Z
CVE-2022-3990 
HPSFViewer might allow Escalation of Privilege. This potential vulnerability was remediated on July 29th, 2022. Customers who opted for automatic updates should have already received the remediation.
Problem types: description: n/a
Affected products: vendor: HP Inc.
product: HPSFViewer
Published: 2023-01-30T18:52:10.637Z
CVE-2022-3991 Photospace Gallery <= 2.3.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting
The Photospace Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its settings parameters saved via the update() function in versions up to, and including, 2.3.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: deanoakley
product: Photospace Gallery
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
baseScore: 6.4
baseSeverity: MEDIUM
Credits: lang: en
value: Marco Wotschka
Published: 2022-11-29T20:43:32.624Z
CVE-2022-3992 SourceCodester Sanitization Management System Banner Image cross site scripting
A vulnerability classified as problematic was found in SourceCodester Sanitization Management System. Affected by this vulnerability is an unknown functionality of the file admin/?page=system_info of the component Banner Image Handler. The manipulation leads to cross site scripting. The attack can be launched remotely. The associated identifier of this vulnerability is VDB-213571.
Problem types: cwe_id: CWE-707
description: CWE-707 Improper Neutralization -> CWE-74 Injection -> CWE-79 Cross Site Scripting
Affected products: vendor: SourceCodester
product: Sanitization Management System
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: LOW
availabilityImpact: NONE
baseScore: 2.4
baseSeverity: LOW
Published: 2022-11-14T00:00:00.000Z
CVE-2022-3993 Improper Restriction of Excessive Authentication Attempts in kareadita/kavita
Improper Restriction of Excessive Authentication Attempts in GitHub repository kareadita/kavita prior to 0.6.0.3.






Problem types: cwe_id: CWE-307
description: CWE-307 Improper Restriction of Excessive Authentication Attempts
Affected products: vendor: kareadita
product: kareadita/kavita
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.4
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H
version: 3.1
Published: 2022-11-14T00:00:00.000Z
CVE-2022-3994 Authenticator < 1.3.1 - Subscriber+ Denial of Service via Feed Token Disclosure
The Authenticator WordPress plugin before 1.3.1 does not prevent subscribers from updating a site's feed access token, which may deny other users access to the functionality in certain configurations.
Problem types: description: CWE-400 Uncontrolled Resource Consumption
Affected products: vendor: Unknown
product: Authenticator
default_status: unaffected
Credits: lang: en
value: Lana Codes
lang: en
value: WPScan
Published: 2023-01-02T21:49:19.538Z
CVE-2022-3995 TeraWallet – For WooCommerce <= 1.4.3 - Insecure Direct Object Reference
The TeraWallet plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 1.4.3. This is due to insufficient validation of the user-controlled key on the lock_unlock_terawallet AJAX action.  This makes it possible for authenticated attackers, with subscriber-level permissions and above, to lock/unlock other users wallets.
Problem types: cwe_id: CWE-639
description: CWE-639 Authorization Bypass Through User-Controlled Key
Affected products: vendor: subratamal
product: Wallet for WooCommerce
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
baseScore: 4.3
baseSeverity: MEDIUM
Credits: lang: en
value: Marco Wotschka
Published: 2022-11-29T20:43:15.611Z
CVE-2022-3996 X.509 Policy Constraints Double Locking
If an X.509 certificate contains a malformed policy constraint and
policy processing is enabled, then a write lock will be taken twice
recursively.  On some operating systems (most widely: Windows) this
results in a denial of service when the affected process hangs.  Policy
processing being enabled on a publicly facing server is not considered
to be a common setup.

Policy processing is enabled by passing the `-policy'
argument to the command line utilities or by calling the
`X509_VERIFY_PARAM_set1_policies()' function.

Update (31 March 2023): The description of the policy processing enablement
was corrected based on CVE-2023-0466.
Problem types: cwe_id: CWE-667
description: CWE-667 Improper Locking
Affected products: vendor: OpenSSL
product: OpenSSL
default_status: unaffected
Credits: lang: en
value: Polar Bear
lang: en
value: Paul Dale
Published: 2022-12-13T15:43:06.821Z
CVE-2022-3997 MonikaBrzica scm upis_u_bazu.php sql injection
A vulnerability, which was classified as critical, has been found in MonikaBrzica scm. Affected by this issue is some unknown functionality of the file upis_u_bazu.php. The manipulation of the argument email/lozinka/ime/id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-213698 is the identifier assigned to this vulnerability.
Problem types: cwe_id: CWE-707
description: CWE-707 Improper Neutralization -> CWE-74 Injection -> CWE-89 SQL Injection
Affected products: vendor: MonikaBrzica
product: scm
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: LOW
baseScore: 6.3
baseSeverity: MEDIUM
Published: 2022-11-15T00:00:00.000Z
CVE-2022-3998 MonikaBrzica scm uredi_korisnika.php sql injection
A vulnerability, which was classified as critical, was found in MonikaBrzica scm. This affects an unknown part of the file uredi_korisnika.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-213699.
Problem types: cwe_id: CWE-707
description: CWE-707 Improper Neutralization -> CWE-74 Injection -> CWE-89 SQL Injection
Affected products: vendor: MonikaBrzica
product: scm
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: LOW
baseScore: 6.3
baseSeverity: MEDIUM
Published: 2022-11-15T00:00:00.000Z
CVE-2022-3999 WooCommerce Shipping - DPD baltic < 1.2.57 - Subscriber+ Arbitrary Options Deletion
The DPD Baltic Shipping WordPress plugin before 1.2.57 does not have authorisation and CSRF in an AJAX action, which could allow any authenticated users, such as subscriber to delete arbitrary options from the blog, which could make the blog unavailable.
Problem types: description: CWE-862 Missing Authorization
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: DPD Baltic Shipping
default_status: unaffected
Credits: lang: en
value: Lana Codes
lang: en
value: WPScan
Published: 2022-12-12T17:54:49.698Z
CVE-2022-40000 
Cross Site Scripting (XSS) vulnerability in FeehiCMS-2.1.1 allows remote attackers to run arbitrary code via the username field of the admin log in page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-15T00:00:00.000Z
CVE-2022-40001 
Cross Site Scripting (XSS) vulnerability in FeehiCMS-2.1.1 allows remote attackers to run arbitrary code via the title field of the create article page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-15T00:00:00.000Z
CVE-2022-40002 
Cross Site Scripting (XSS) vulnerability in FeehiCMS-2.1.1 allows remote attackers to run arbirtary code via the callback parameter to /cms/notify.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-15T00:00:00.000Z
CVE-2022-40004 
Cross Site Scripting (XSS) vulnerability in Things Board 3.4.1 allows remote attackers to escalate privilege via crafted URL to the Audit Log.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-15T00:00:00.000Z
CVE-2022-40005 
Intelbras WiFiber 120AC inMesh before 1-1-220826 allows command injection by authenticated users, as demonstrated by the /boaform/formPing6 and /boaform/formTracert URIs for ping and traceroute.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-25T00:00:00.000Z
CVE-2022-40008 
SWFTools commit 772e55a was discovered to contain a heap-buffer overflow via the function readU8 at /lib/ttf.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-20T19:14:19.000Z
CVE-2022-40009 
SWFTools commit 772e55a was discovered to contain a heap-use-after-free via the function grow_unicode at /lib/ttf.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-20T19:14:20.000Z
CVE-2022-40010 
Tenda AC6 AC1200 Smart Dual-Band WiFi Router 15.03.06.50_multi was discovered to contain a cross-site scripting (XSS) vulnerability via the deviceId parameter in the Parental Control module.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-06-26T00:00:00.000Z
CVE-2022-40011 
Typora through 1.3.8 allows XSS if a document containing an SVG element with an attacker-controlled onload attribute is exported and then used at a victim's origin.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-23T00:00:00.000Z
CVE-2022-40016 
Use After Free (UAF) vulnerability in ireader media-server before commit 3e0f63f1d3553f75c7d4eb32fa7c7a1976a9ff84 in librtmp, allows attackers to cause a denial of service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-15T00:00:00.000Z
CVE-2022-40021 
QVidium Technologies Amino A140 (prior to firmware version 1.0.0-283) was discovered to contain a command injection vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-17T00:00:00.000Z
CVE-2022-40022 
Microchip Technology (Microsemi) SyncServer S650 was discovered to contain a command injection vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-13T00:00:00.000Z
CVE-2022-40023 
Sqlalchemy mako before 1.2.2 is vulnerable to Regular expression Denial of Service when using the Lexer class to parse. This also affects babelplugin and linguaplugin.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-07T00:00:00.000Z
CVE-2022-40026 
SourceCodester Simple Task Managing System v1.0 was discovered to contain a SQL injection vulnerability via the bookId parameter at board.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-21T17:11:40.000Z
CVE-2022-40027 
SourceCodester Simple Task Managing System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component newTask.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the shortName parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-21T17:11:41.000Z
CVE-2022-40028 
SourceCodester Simple Task Managing System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component newProjectValidation.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the fullName parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-21T17:11:42.000Z
CVE-2022-40029 
SourceCodester Simple Task Managing System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component newProjectValidation.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the shortName parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-21T17:11:43.000Z
CVE-2022-40030 
SourceCodester Simple Task Managing System v1.0 was discovered to contain a SQL injection vulnerability via the bookId parameter at changeStatus.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-21T17:11:44.000Z
CVE-2022-40032 
SQL Injection vulnerability in Simple Task Managing System version 1.0 in login.php in 'username' and 'password' parameters, allows attackers to execute arbitrary code and gain sensitive information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-17T00:00:00.000Z
CVE-2022-40034 
Cross-Site Scripting (XSS) vulnerability found in Rawchen blog-ssm v1.0 allows attackers to execute arbitrary code via the 'notifyInfo' parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-01-23T00:00:00.000Z
CVE-2022-40035 
File Upload Vulnerability found in Rawchen Blog-ssm v1.0 allowing attackers to execute arbitrary commands and gain escalated privileges via the /uploadFileList component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-01-25T00:00:00.000Z
CVE-2022-40036 
An issue was discovered in Rawchen blog-ssm v1.0 allows an attacker to obtain sensitive user information by bypassing permission checks via the /adminGetUserList component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-01-24T00:00:00.000Z
CVE-2022-40037 
An issue discovered in Rawchen blog-ssm v1.0 allows remote attacker to escalate privileges and execute arbitrary commands via the component /upFile.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-01-24T00:00:00.000Z
CVE-2022-40043 
Centreon v20.10.18 was discovered to contain a SQL injection vulnerability via the esc_name (Escalation Name) parameter at Configuration/Notifications/Escalations.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-26T15:38:17.000Z
CVE-2022-40044 
Centreon v20.10.18 was discovered to contain a cross-site scripting (XSS) vulnerability via the esc_name (Escalation Name) parameter at Configuration/Notifications/Escalations. This vulnerability allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-26T15:38:18.000Z
CVE-2022-40047 
Flatpress v1.2.1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the page parameter at /flatpress/admin.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-10-11T00:00:00.000Z
CVE-2022-40048 
Flatpress v1.2.1 was discovered to contain a remote code execution (RCE) vulnerability in the Upload File function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-29T00:55:27.000Z
CVE-2022-40049 
SQL injection vulnerability in sourcecodester Theme Park Ticketing System 1.0 allows remote attackers to view sensitive information via the id parameter to the /tpts/manage_user.php page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-01-06T00:00:00.000Z
CVE-2022-40050 
ZFile v4.1.1 was discovered to contain an arbitrary file upload vulnerability via the component /file/upload/1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-26T19:11:36.000Z
CVE-2022-40055 
An issue in GX Group GPON ONT Titanium 2122A T2122-V1.26EXL allows attackers to escalate privileges via a brute force attack at the login page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-10-17T00:00:00.000Z
CVE-2022-40067 
Tenda AC21 V 16.03.08.15 is vulnerable to Buffer Overflow via /bin/httpd, function: formSetVirtualSer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-19T14:40:21.000Z
CVE-2022-40068 
Tenda AC21 V16.03.08.15 is vulnerable to Buffer Overflow via /bin/httpd, function: formSetQosBand.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-19T14:39:22.000Z
CVE-2022-40069 
]Tenda AC21 V 16.03.08.15 is vulnerable to Buffer Overflow via /bin/httpd, function: fromSetSysTime.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-19T14:38:03.000Z
CVE-2022-40070 
Tenda AC21 V 16.03.08.15 is vulnerable to Buffer Overflow via bin/httpd, function: formSetFirewallCfg.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-19T14:36:51.000Z
CVE-2022-40071 
Tenda AC21 V 16.03.08.15 is vulnerable to Buffer Overflow via /bin/httpd, formSetDeviceName.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-19T14:35:35.000Z
CVE-2022-40072 
Tenda AC21 V 16.03.08.15 is vulnerable to Buffer Overflow via /bin/httpd, function: setSmartPowerManagement.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-19T14:34:37.000Z
CVE-2022-40073 
Tenda AC21 V 16.03.08.15 is vulnerable to Buffer Overflow via /bin/httpd, saveParentControlInfo.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-19T14:33:23.000Z
CVE-2022-40074 
Tenda AC21 V 16.03.08.15 is vulnerable to Buffer Overflow via /bin/httpd, setSchedWifi.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-19T14:31:29.000Z
CVE-2022-40075 
Tenda AC21 V 16.03.08.15 is vulnerable to Buffer Overflow via /bin/httpd, form_fast_setting_wifi_set.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-19T14:30:29.000Z
CVE-2022-40076 
Tenda AC21 V16.03.08.15 is vulnerable to Buffer Overflow via /bin/httpd, function: fromSetWifiGusetBasic.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-19T14:29:42.000Z
CVE-2022-40080 
Stack overflow vulnerability in Aspire E5-475G 's BIOS firmware, in the FpGui module, a second call to GetVariable services allows local attackers to execute arbitrary code in the UEFI DXE phase and gain escalated privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-16T00:00:00.000Z
CVE-2022-40082 
Hertz v0.3.0 ws discovered to contain a path traversal vulnerability via the normalizePath function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-28T13:34:02.000Z
CVE-2022-40083 
Labstack Echo v4.8.0 was discovered to contain an open redirect vulnerability via the Static Handler component. This vulnerability can be leveraged by attackers to cause a Server-Side Request Forgery (SSRF).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-28T13:34:03.000Z
CVE-2022-40084 
OpenCRX before v5.2.2 was discovered to be vulnerable to password enumeration due to the difference in error messages received during a password reset which could enable an attacker to determine if a username, email or ID is valid.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-10-20T00:00:00.000Z