rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-23921 ICSA-22-053-01 GE Proficy CIMPLICITY-IPM
Exploitation of this vulnerability may result in local privilege escalation and code execution. GE maintains exploitation of this vulnerability is only possible if the attacker has login access to a machine actively running CIMPLICITY, the CIMPLICITY server is not already running a project, and the server is licensed for multiple projects.
Problem types: cwe_id: CWE-269
description: CWE-269 Improper Privilege Management
Affected products: vendor: General Electric
product: Proficy CIMPLICITY
CVSS v3.1: attackComplexity: HIGH
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Yuval Ardon and Roman Dvorkin of OTORIO reported this vulnerability to CISA
Published: 2022-02-25T18:10:55.935Z
CVE-2022-23922 WIN-911 2021 Incorrect Default Permissions
WIN-911 2021 R1 and R2 are vulnerable to a permissions misconfiguration that may allow an attacker to locally write files to the Program Announcer directory and elevate permissions whenever the program is executed.
Problem types: cwe_id: CWE-276
description: CWE-276 Incorrect Default Permissions
Affected products: vendor: WIN-911
product: WIN-911
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 5.6
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:L
version: 3.1
Credits: lang: en
value: Noam Moshe of Claroty reported these vulnerabilities to CISA.
Published: 2022-02-24T18:26:58.463Z
CVE-2022-23923 Sandbox Bypass
All versions of package jailed are vulnerable to Sandbox Bypass via an exported alert() method which can access the main application. Exported methods are stored in the application.remote object.
Problem types: description: Sandbox Bypass
Affected products: vendor: n/a
product: jailed
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 8.6
baseSeverity: HIGH
confidentialityImpact: HIGH
exploitCodeMaturity: PROOF_OF_CONCEPT
integrityImpact: LOW
privilegesRequired: NONE
remediationLevel: NOT_DEFINED
reportConfidence: NOT_DEFINED
scope: UNCHANGED
temporalScore: 8.1
temporalSeverity: HIGH
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P
version: 3.1
Credits: lang: en
value: Cristian-Alexandru Staicu
lang: en
value: Abdullah Alhamdan
Published: 2022-05-01T15:25:26.502Z
CVE-2022-23924 
Potential vulnerabilities have been identified in the system BIOS of certain HP PC products which may allow Escalation of Privilege, Arbitrary Code Execution, Unauthorized Code Execution, Denial of Service, and Information Disclosure.
Problem types: description: Escalation of Privilege; Arbitrary Code Execution; Unauthorized Code Execution; Denial of Service; Information Disclosure
Affected products: vendor: n/a
product: HP PC BIOS
Published: 2022-03-11T17:54:12.000Z
CVE-2022-23925 
Potential vulnerabilities have been identified in the system BIOS of certain HP PC products which may allow Escalation of Privilege, Arbitrary Code Execution, Unauthorized Code Execution, Denial of Service, and Information Disclosure.
Problem types: description: Escalation of Privilege; Arbitrary Code Execution; Unauthorized Code Execution; Denial of Service; Information Disclosure
Affected products: vendor: n/a
product: HP PC BIOS
Published: 2022-03-11T17:54:12.000Z
CVE-2022-23926 
Potential vulnerabilities have been identified in the system BIOS of certain HP PC products which may allow Escalation of Privilege, Arbitrary Code Execution, Unauthorized Code Execution, Denial of Service, and Information Disclosure.
Problem types: description: Escalation of Privilege; Arbitrary Code Execution; Unauthorized Code Execution; Denial of Service; Information Disclosure
Affected products: vendor: n/a
product: HP PC BIOS
Published: 2022-03-11T17:54:16.000Z
CVE-2022-23927 
Potential vulnerabilities have been identified in the system BIOS of certain HP PC products which may allow Escalation of Privilege, Arbitrary Code Execution, Unauthorized Code Execution, Denial of Service, and Information Disclosure.
Problem types: description: Escalation of Privilege; Arbitrary Code Execution; Unauthorized Code Execution; Denial of Service; Information Disclosure
Affected products: vendor: n/a
product: HP PC BIOS
Published: 2022-03-11T17:54:16.000Z
CVE-2022-23928 
Potential vulnerabilities have been identified in the system BIOS of certain HP PC products which may allow Escalation of Privilege, Arbitrary Code Execution, Unauthorized Code Execution, Denial of Service, and Information Disclosure.
Problem types: description: Escalation of Privilege; Arbitrary Code Execution; Unauthorized Code Execution; Denial of Service; Information Disclosure
Affected products: vendor: n/a
product: HP PC BIOS
Published: 2022-03-11T17:54:18.000Z
CVE-2022-23929 
Potential vulnerabilities have been identified in the system BIOS of certain HP PC products which may allow Escalation of Privilege, Arbitrary Code Execution, Unauthorized Code Execution, Denial of Service, and Information Disclosure.
Problem types: description: Escalation of Privilege; Arbitrary Code Execution; Unauthorized Code Execution; Denial of Service; Information Disclosure
Affected products: vendor: n/a
product: HP PC BIOS
Published: 2022-03-11T17:54:17.000Z
CVE-2022-23930 
Potential vulnerabilities have been identified in the system BIOS of certain HP PC products which may allow Escalation of Privilege, Arbitrary Code Execution, Unauthorized Code Execution, Denial of Service, and Information Disclosure.
Problem types: description: Escalation of Privilege; Arbitrary Code Execution; Unauthorized Code Execution; Denial of Service; Information Disclosure
Affected products: vendor: n/a
product: HP PC BIOS
Published: 2022-03-11T17:54:13.000Z
CVE-2022-23931 
Potential vulnerabilities have been identified in the system BIOS of certain HP PC products which may allow Escalation of Privilege, Arbitrary Code Execution, Unauthorized Code Execution, Denial of Service, and Information Disclosure.
Problem types: description: Escalation of Privilege; Arbitrary Code Execution; Unauthorized Code Execution; Denial of Service; Information Disclosure
Affected products: vendor: n/a
product: HP PC BIOS
Published: 2022-03-11T17:54:14.000Z
CVE-2022-23932 
Potential vulnerabilities have been identified in the system BIOS of certain HP PC products which may allow Escalation of Privilege, Arbitrary Code Execution, Unauthorized Code Execution, Denial of Service, and Information Disclosure.
Problem types: description: Escalation of Privilege; Arbitrary Code Execution; Unauthorized Code Execution; Denial of Service; Information Disclosure
Affected products: vendor: n/a
product: HP PC BIOS
Published: 2022-03-11T17:54:19.000Z
CVE-2022-23933 
Potential vulnerabilities have been identified in the system BIOS of certain HP PC products which may allow Escalation of Privilege, Arbitrary Code Execution, Unauthorized Code Execution, Denial of Service, and Information Disclosure.
Problem types: description: Escalation of Privilege; Arbitrary Code Execution; Unauthorized Code Execution; Denial of Service; Information Disclosure
Affected products: vendor: n/a
product: HP PC BIOS
Published: 2022-03-11T17:54:20.000Z
CVE-2022-23934 
Potential vulnerabilities have been identified in the system BIOS of certain HP PC products which may allow Escalation of Privilege, Arbitrary Code Execution, Unauthorized Code Execution, Denial of Service, and Information Disclosure.
Problem types: description: Escalation of Privilege; Arbitrary Code Execution; Unauthorized Code Execution; Denial of Service; Information Disclosure
Affected products: vendor: n/a
product: HP PC BIOS
Published: 2022-03-11T17:54:15.000Z
CVE-2022-23935 
lib/Image/ExifTool.pm in ExifTool before 12.38 mishandles a $file =~ /\|$/ check, leading to command injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-25T05:10:12.000Z
CVE-2022-23937 
In Wind River VxWorks 6.9 and 7, a specific crafted packet may lead to an out-of-bounds read during an IKE initial exchange scenario.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AC:L/AV:N/A:L/C:N/I:N/PR:N/S:U/UI:N
version: 3.1
Published: 2022-03-29T01:21:06.000Z
CVE-2022-23940 
SuiteCRM through 7.12.1 and 8.x through 8.0.1 allows Remote Code Execution. Authenticated users with access to the Scheduled Reports module can achieve this by leveraging PHP deserialization in the email_recipients property. By using a crafted request, they can create a malicious report, containing a PHP-deserialization payload in the email_recipients field. Once someone accesses this report, the backend will deserialize the content of the email_recipients field and the payload gets executed. Project dependencies include a number of interesting PHP deserialization gadgets (e.g., Monolog/RCE1 from phpggc) that can be used for Code Execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-07T19:06:35.000Z
CVE-2022-23942 Apache Doris hardcoded cryptography initialization
Apache Doris, prior to 1.0.0, used a hardcoded key and IV to initialize the cipher used for ldap password, which may lead to information disclosure.
Problem types: cwe_id: CWE-798
description: CWE-798 Use of Hard-coded Credentials
Affected products: vendor: Apache Software Foundation
product: Apache Doris(Incubating)
Credits: lang: en
value: We would like to thanks to Dwi Siswanto<me@dw1.io> for the report of this issue
Published: 2022-04-26T16:05:10.000Z
CVE-2022-23943 mod_sed: Read/write beyond bounds
Out-of-bounds Write vulnerability in mod_sed of Apache HTTP Server allows an attacker to overwrite heap memory with possibly attacker provided data. This issue affects Apache HTTP Server 2.4 version 2.4.52 and prior versions.
Problem types: cwe_id: CWE-787
description: CWE-787 Out-of-bounds Write
cwe_id: CWE-190
description: CWE-190 Integer Overflow or Wraparound
Affected products: vendor: Apache Software Foundation
product: Apache HTTP Server
Credits: lang: en
value: Ronald Crane (Zippenhop LLC)
Published: 2022-03-14T10:15:54.000Z
CVE-2022-23944 Apache ShenYu 2.4.1 Improper access control
User can access /plugin api without authentication. This issue affected Apache ShenYu 2.4.0 and 2.4.1.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: Apache Software Foundation
product: Apache ShenYu (incubating)
Published: 2022-01-25T13:00:24.000Z
CVE-2022-23945 Apache ShenYu missing authentication allows gateway registration
Missing authentication on ShenYu Admin when register by HTTP. This issue affected Apache ShenYu 2.4.0 and 2.4.1.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: Apache Software Foundation
product: Apache ShenYu (incubating)
Published: 2022-01-25T13:00:25.000Z
CVE-2022-23946 
A stack-based buffer overflow vulnerability exists in the Gerber Viewer gerber and excellon GCodeNumber parsing functionality of KiCad EDA 6.0.1 and master commit de006fc010. A specially-crafted gerber or excellon file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability.
Problem types: cwe_id: CWE-121
description: CWE-121: Stack-based Buffer Overflow
Affected products: vendor: n/a
product: KiCad
Published: 2022-02-04T22:28:58.000Z
CVE-2022-23947 
A stack-based buffer overflow vulnerability exists in the Gerber Viewer gerber and excellon DCodeNumber parsing functionality of KiCad EDA 6.0.1 and master commit de006fc010. A specially-crafted gerber or excellon file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability.
Problem types: cwe_id: CWE-121
description: CWE-121: Stack-based Buffer Overflow
Affected products: vendor: n/a
product: KiCad
Published: 2022-02-04T22:28:59.000Z
CVE-2022-23948 
A flaw was found in Keylime before 6.3.0. The logic in the Keylime agent for checking for a secure mount can be fooled by previously created unprivileged mounts allowing secrets to be leaked to other processes on the host.
Problem types: cwe_id: CWE-200
description: CWE-200
Affected products: vendor: n/a
product: keylime
Published: 2022-09-21T18:23:36.000Z
CVE-2022-23949 
In Keylime before 6.3.0, unsanitized UUIDs can be passed by a rogue agent and can lead to log spoofing on the verifier and registrar.
Problem types: cwe_id: CWE-290
description: CWE-290
Affected products: vendor: n/a
product: keylime
Published: 2022-09-21T18:23:47.000Z
CVE-2022-23950 
In Keylime before 6.3.0, Revocation Notifier uses a fixed /tmp path for UNIX domain socket which can allow unprivileged users a method to prohibit keylime operations.
Problem types: cwe_id: CWE-379
description: CWE-379
Affected products: vendor: n/a
product: keylime
Published: 2022-09-21T18:25:02.000Z
CVE-2022-23951 
In Keylime before 6.3.0, quote responses from the agent can contain possibly untrusted ZIP data which can lead to zip bombs.
Problem types: cwe_id: CWE-400
description: CWE-400
Affected products: vendor: n/a
product: keylime
Published: 2022-09-21T18:25:07.000Z
CVE-2022-23952 
In Keylime before 6.3.0, current keylime installer installs the keylime.conf file, which can contain sensitive data, as world-readable.
Problem types: cwe_id: CWE-200
description: CWE-200
Affected products: vendor: n/a
product: keylime
Published: 2022-09-21T18:25:13.000Z
CVE-2022-23953 
Potential vulnerabilities have been identified in the BIOS for some HP PC products which may allow denial of service.
Problem types: description: Denial of Service
Affected products: vendor: n/a
product: HP ProBook 440 G8 Notebook PC; HP ProDesk 405 G6 Small Form Factor PC
Published: 2022-03-02T20:58:08.000Z
CVE-2022-23954 
Potential vulnerabilities have been identified in the BIOS for some HP PC products which may allow denial of service.
Problem types: description: Denial of Service
Affected products: vendor: n/a
product: HP ProBook 440 G8 Notebook PC; HP ProDesk 405 G6 Small Form Factor PC
Published: 2022-03-02T21:33:04.000Z
CVE-2022-23955 
Potential vulnerabilities have been identified in the BIOS for some HP PC products which may allow denial of service.
Problem types: description: Denial of Service
Affected products: vendor: n/a
product: HP ProBook 440 G8 Notebook PC; HP ProDesk 405 G6 Small Form Factor PC
Published: 2022-03-02T21:34:26.000Z
CVE-2022-23956 
Potential vulnerabilities have been identified in the BIOS for some HP PC products which may allow denial of service.
Problem types: description: Denial of Service
Affected products: vendor: n/a
product: HP ProBook 440 G8 Notebook PC; HP ProDesk 405 G6 Small Form Factor PC
Published: 2022-03-02T20:56:33.000Z
CVE-2022-23957 
Potential vulnerabilities have been identified in the BIOS for some HP PC products which may allow denial of service.
Problem types: description: Denial of Service
Affected products: vendor: n/a
product: HP ProBook 440 G8 Notebook PC; HP ProDesk 405 G6 Small Form Factor PC
Published: 2022-03-02T21:36:42.000Z
CVE-2022-23958 
Potential vulnerabilities have been identified in the BIOS for some HP PC products which may allow denial of service.
Problem types: description: Denial of Service
Affected products: vendor: n/a
product: HP ProBook 440 G8 Notebook PC; HP ProDesk 405 G6 Small Form Factor PC
Published: 2022-03-02T21:35:37.000Z
CVE-2022-23959 
In Varnish Cache before 6.6.2 and 7.x before 7.0.2, Varnish Cache 6.0 LTS before 6.0.10, and and Varnish Enterprise (Cache Plus) 4.1.x before 4.1.11r6 and 6.0.x before 6.0.9r4, request smuggling can occur for HTTP/1 connections.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-26T00:38:55.000Z
CVE-2022-23960 
Certain Arm Cortex and Neoverse processors through 2022-03-08 do not properly restrict cache speculation, aka Spectre-BHB. An attacker can leverage the shared branch history in the Branch History Buffer (BHB) to influence mispredicted branches. Then, cache allocation can allow the attacker to obtain sensitive information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-12T23:57:21.000Z
CVE-2022-23961 
In Thruk Monitoring through 2.46.3, the login field of the login form is vulnerable to reflected XSS. This vulnerability can be exploited by unauthenticated remote attackers to target users of the monitoring interface.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-05-08T00:00:00.000Z
CVE-2022-23968 
Xerox VersaLink devices on specific versions of firmware before 2022-01-26 allow remote attackers to brick the device via a crafted TIFF file in an unauthenticated HTTP POST request. There is a permanent denial of service because image parsing causes a reboot, but image parsing is restarted as soon as the boot process finishes. However, this boot loop can be resolved by a field technician. The TIFF file must have an incomplete Image Directory. Affected firmware versions include xx.42.01 and xx.50.61. NOTE: the 2022-01-24 NeoSmart article included "believed to affect all previous and later versions as of the date of this posting" but a 2022-01-26 vendor statement reports "the latest versions of firmware are not vulnerable to this issue."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-26T05:01:51.000Z
CVE-2022-23970 ASUS RT-AX56U - Path Traversal
ASUS RT-AX56U’s update_json function has a path traversal vulnerability due to insufficient filtering for special characters in the URL parameter. An unauthenticated LAN attacker can overwrite a system file by uploading another file with the same file name, which results in service disruption.
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: ASUS
product: RT-AX56U
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 8.1
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
version: 3.1
Credits: lang: en
value: hanpeng (Cyber Kunlun Lab)
Published: 2022-04-07T18:22:24.706Z
CVE-2022-23971 ASUS RT-AX56U - Path Traversal
ASUS RT-AX56U’s update_PLC/PORT file has a path traversal vulnerability due to insufficient filtering for special characters in the URL parameter. An unauthenticated LAN attacker can overwrite a system file by uploading another PLC/PORT file with the same file name, which results in service disruption.
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: ASUS
product: RT-AX56U
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 8.1
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
version: 3.1
Credits: lang: en
value: hanpeng (Cyber Kunlun Lab)
Published: 2022-04-07T18:22:26.279Z
CVE-2022-23972 ASUS RT-AX56U - SQL Injection
ASUS RT-AX56U’s SQL handling function has an SQL injection vulnerability due to insufficient user input validation. An unauthenticated LAN attacker to inject arbitrary SQL code to read, modify and delete database.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: ASUS
product: RT-AX56U
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: hanpeng (Cyber Kunlun Lab)
Published: 2022-04-07T18:22:27.892Z
CVE-2022-23973 ASUS RT-AX56U - Stack overflew
ASUS RT-AX56U’s user profile configuration function is vulnerable to stack-based buffer overflow due to insufficient validation for parameter length. An unauthenticated LAN attacker can execute arbitrary code to perform arbitrary operations or disrupt service.
Problem types: cwe_id: CWE-787
description: CWE-787 Out-of-bounds Write
Affected products: vendor: ASUS
product: RT-AX56U
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: hanpeng (Cyber Kunlun Lab)
Published: 2022-04-07T18:22:29.853Z
CVE-2022-23974 Pinot segment push endpoint has a vulnerability in unprotected environments
In 0.9.3 or older versions of Apache Pinot segment upload path allowed segment directories to be imported into pinot tables. In pinot installations that allow open access to the controller a specially crafted request can potentially be exploited to cause disruption in pinot service. Pinot release 0.10.0 fixes this. See https://docs.pinot.apache.org/basics/releases/0.10.0
Problem types: cwe_id: CWE-674
description: CWE-674 Uncontrolled Recursion
Affected products: vendor: Apache Software Foundation
product: Apache Pinot
Credits: lang: en
value: Apache Pinot would like to thank bubblegumkk@qq.com, Kuiplatain@knownsec and FA1C0N@RPO_OFFICIAL for reporting the issue
Published: 2022-04-05T19:55:08.000Z
CVE-2022-23975 WordPress Access Demo Importer plugin <= 1.0.7 - Cross-Site Request Forgery (CSRF) vulnerability leading to Arbitrary Plugin Activation
Cross-Site Request Forgery (CSRF) in Access Demo Importer <= 1.0.7 on WordPress allows an attacker to activate any installed plugin.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: AccessPress Themes
product: Access Demo Importer (WordPress plugin)
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
version: 3.1
Credits: lang: en
value: Vulnerability discovered by Ex.Mi (Patchstack)
Published: 2022-04-18T16:20:30.943Z
CVE-2022-23976 WordPress Access Demo Importer plugin <= 1.0.7 - Cross-Site Request Forgery (CSRF) vulnerability leading to Data Reset (Posts / Pages / Media)
Cross-Site Request Forgery (CSRF) in Access Demo Importer <= 1.0.7 on WordPress allows an attacker to reset all data (posts / pages / media).
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: AccessPress Themes
product: Access Demo Importer (WordPress plugin)
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.1
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
version: 3.1
Credits: lang: en
value: Vulnerability discovered by Ex.Mi (Patchstack)
Published: 2022-04-18T16:20:30.233Z