rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-0699 
A double-free condition exists in contrib/shpsort.c of shapelib 1.5.0 and older releases. This issue may allow an attacker to cause a denial of service or have other unspecified impact via control over malloc.
Problem types: cwe_id: CWE-416
description: CWE-416
Affected products: vendor: n/a
product: shapelib
Published: 2022-10-17T00:00:00.000Z
CVE-2022-0700 Simple Theme Options < 1.7 - Admin+ Stored Cross-Site Scripting
The Simple Tracking WordPress plugin before 1.7 does not sanitise and escape its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Simple Tracking
Credits: lang: en
value: fuzzyap1
Published: 2022-03-14T14:41:47.000Z
CVE-2022-0701 SEO 301 Meta <= 1.9.1 - Admin+ Stored Cross-Site Scripting
The SEO 301 Meta WordPress plugin through 1.9.1 does not escape its Request and Destination settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Seo 301 Meta
Credits: lang: en
value: fuzzyap1
Published: 2022-03-14T14:41:49.000Z
CVE-2022-0702 Petfinder Listings <= 1.0.18 - Admin+ Stored Cross-Site Scripting
The Petfinder Listings WordPress plugin through 1.0.18 does not escape its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Petfinder Listings
Credits: lang: en
value: fuzzyap1
Published: 2022-03-14T14:41:50.000Z
CVE-2022-0703 GD Mylist <= 1.1.1 - Admin+ Stored Cross-Site Scripting
The GD Mylist WordPress plugin through 1.1.1 does not sanitise and escape some of its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: GDMylist
Credits: lang: en
value: fuzzyap1
Published: 2022-03-14T14:41:52.000Z
CVE-2022-0704 Cross-site Scripting (XSS) - Stored in pimcore/pimcore
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.4.0.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: pimcore
product: pimcore/pimcore
Published: 2022-03-16T09:15:15.000Z
CVE-2022-0705 Cross-site Scripting (XSS) - Stored in pimcore/pimcore
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.4.0.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: pimcore
product: pimcore/pimcore
Published: 2022-03-16T10:30:12.000Z
CVE-2022-0706 Easy Digital Downloads < 2.11.6 - Admin+ Stored Cross-Site Scripting
The Easy Digital Downloads WordPress plugin before 2.11.6 does not sanitise and escape the Downloadable File Name in the Logs, which could allow high privilege users to perform Cross-Site Scripting attacks when the unfiltered_html capability is disallowed
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Easy Digital Downloads – Simple eCommerce for Selling Digital Files
Credits: lang: en
value: muhamad hidayat
Published: 2022-04-18T17:10:29.000Z
CVE-2022-0707 Easy Digital Downloads < 2.11.6 - Arbitrary Payment Note Insertion via CSRF
The Easy Digital Downloads WordPress plugin before 2.11.6 does not have CSRF check in place when inserting payment notes, which could allow attackers to make a logged admin insert arbitrary notes via a CSRF attack
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: Easy Digital Downloads – Simple eCommerce for Selling Digital Files
Credits: lang: en
value: muhamad hidayat
Published: 2022-04-18T17:10:31.000Z
CVE-2022-0708 Team Creator's Email Address is disclosed to Team Members via one of the APIs
Mattermost 6.3.0 and earlier fails to protect email addresses of the creator of the team via one of the APIs, which allows authenticated team members to access this information resulting in sensitive & private information disclosure.
Problem types: cwe_id: CWE-200
description: CWE-200 Information Exposure
Affected products: vendor: Mattermost
product: Mattermost
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Published: 2022-02-21T17:49:29.000Z
CVE-2022-0709 Booking Package < 1.5.29 - Unauthenticated Sensitive Data Disclosure
The Booking Package WordPress plugin before 1.5.29 requires a token for exporting the ical representation of it's booking calendar, but this token is returned in the json response to unauthenticated users performing a booking, leading to a sensitive data disclosure vulnerability.
Problem types: cwe_id: CWE-200
description: CWE-200 Information Exposure
Affected products: vendor: Unknown
product: Booking Package – Appointment Booking Calendar System
Credits: lang: en
value: huli of Cymetrics
Published: 2022-04-04T15:35:47.000Z
CVE-2022-0710 Header Footer Code Manager <= 1.1.16 Reflected XSS
The Header Footer Code Manager plugin <= 1.1.16 for WordPress is vulnerable to Reflected Cross-Site Scripting (XSS) via the $_REQUEST['page'] parameter.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: 99robots
product: Header Footer Code Manager
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.1
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: Ramuel Gall, Wordfence
Published: 2022-02-24T18:27:06.000Z
CVE-2022-0711 
A flaw was found in the way HAProxy processed HTTP responses containing the "Set-Cookie2" header. This flaw could allow an attacker to send crafted HTTP response packets which lead to an infinite loop, eventually resulting in a denial of service condition. The highest threat from this vulnerability is availability.
Problem types: cwe_id: CWE-835
description: CWE-835
Affected products: vendor: n/a
product: haproxy
Published: 2022-03-02T21:59:03.000Z
CVE-2022-0712 NULL Pointer Dereference in radareorg/radare2
NULL Pointer Dereference in GitHub repository radareorg/radare2 prior to 5.6.4.
Problem types: cwe_id: CWE-476
description: CWE-476 NULL Pointer Dereference
Affected products: vendor: radareorg
product: radareorg/radare2
Published: 2022-02-22T17:52:48.000Z
CVE-2022-0713 Heap-based Buffer Overflow in radareorg/radare2
Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.6.4.
Problem types: cwe_id: CWE-122
description: CWE-122 Heap-based Buffer Overflow
Affected products: vendor: radareorg
product: radareorg/radare2
Published: 2022-02-22T18:30:11.000Z
CVE-2022-0714 Heap-based Buffer Overflow in vim/vim
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.4436.
Problem types: cwe_id: CWE-122
description: CWE-122 Heap-based Buffer Overflow
Affected products: vendor: vim
product: vim/vim
Published: 2022-02-22T00:00:00.000Z
CVE-2022-0715 
A CWE-287: Improper Authentication vulnerability exists that could cause an attacker to arbitrarily change the behavior of the UPS when a key is leaked and used to upload malicious firmware. Affected Product: APC Smart-UPS Family: SMT Series (SMT Series ID=18: UPS 09.8 and prior / SMT Series ID=1040: UPS 01.2 and prior / SMT Series ID=1031: UPS 03.1 and prior), SMC Series (SMC Series ID=1005: UPS 14.1 and prior / SMC Series ID=1007: UPS 11.0 and prior / SMC Series ID=1041: UPS 01.1 and prior), SCL Series (SCL Series ID=1030: UPS 02.5 and prior / SCL Series ID=1036: UPS 02.5 and prior), SMX Series (SMX Series ID=20: UPS 10.2 and prior / SMX Series ID=23: UPS 07.0 and prior), SRT Series (SRT Series ID=1010/1019/1025: UPS 08.3 and prior / SRT Series ID=1024: UPS 01.0 and prior / SRT Series ID=1020: UPS 10.4 and prior / SRT Series ID=1021: UPS 12.2 and prior / SRT Series ID=1001/1013: UPS 05.1 and prior / SRT Series ID=1002/1014: UPSa05.2 and prior), APC SmartConnect Family: SMT Series (SMT Series ID=1015: UPS 04.5 and prior), SMC Series (SMC Series ID=1018: UPS 04.2 and prior), SMTL Series (SMTL Series ID=1026: UPS 02.9 and prior), SCL Series (SCL Series ID=1029: UPS 02.5 and prior / SCL Series ID=1030: UPS 02.5 and prior / SCL Series ID=1036: UPS 02.5 and prior / SCL Series ID=1037: UPS 03.1 and prior), SMX Series (SMX Series ID=1031: UPS 03.1 and prior)
Problem types: cwe_id: CWE-287
description: CWE-287 Improper Authentication
Affected products: vendor: Schneider Electric
product: APC Smart-UPS
vendor: Schneider Electric
product: SmartConnect
Published: 2022-03-09T19:30:14.000Z
CVE-2022-0717 Out-of-bounds Read in mruby/mruby
Out-of-bounds Read in GitHub repository mruby/mruby prior to 3.2.
Problem types: cwe_id: CWE-125
description: CWE-125 Out-of-bounds Read
Affected products: vendor: mruby
product: mruby/mruby
Published: 2022-02-23T02:05:11.000Z
CVE-2022-0718 
A flaw was found in python-oslo-utils. Due to improper parsing, passwords with a double quote ( " ) in them cause incorrect masking in debug logs, causing any part of the password after the double quote to be plaintext.
Problem types: cwe_id: CWE-522
description: CWE-522 - Insufficiently Protected Credentials
Affected products: vendor: n/a
product: openstack/python-oslo.utils
Published: 2022-08-29T14:03:04.000Z
CVE-2022-0719 Cross-site Scripting (XSS) - Reflected in microweber/microweber
Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 1.3.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: microweber
product: microweber/microweber
Published: 2022-02-23T10:15:12.000Z
CVE-2022-0720 Amelia < 1.0.47 - Customer+ Arbitrary Appointments Update and Sensitive Data Disclosure
The Amelia WordPress plugin before 1.0.47 does not have proper authorisation when managing appointments, allowing any customer to update other's booking, as well as retrieve sensitive information about the bookings, such as the full name and phone number of the person who booked it.
Problem types: cwe_id: CWE-863
description: CWE-863 Incorrect Authorization
Affected products: vendor: Unknown
product: Amelia – Events & Appointments Booking Calendar
Credits: lang: en
value: huli of Cymetrics
Published: 2022-03-28T17:23:18.000Z
CVE-2022-0721 Insertion of Sensitive Information Into Debugging Code in microweber/microweber
Insertion of Sensitive Information Into Debugging Code in GitHub repository microweber/microweber prior to 1.3.
Problem types: cwe_id: CWE-215
description: CWE-215 Insertion of Sensitive Information Into Debugging Code
Affected products: vendor: microweber
product: microweber/microweber
Published: 2022-02-23T10:30:11.000Z
CVE-2022-0722 Exposure of Sensitive Information to an Unauthorized Actor in ionicabizau/parse-url
Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository ionicabizau/parse-url prior to 7.0.0.
Problem types: cwe_id: CWE-200
description: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: ionicabizau
product: ionicabizau/parse-url
Published: 2022-06-27T10:50:10.000Z
CVE-2022-0723 Cross-site Scripting (XSS) - Reflected in microweber/microweber
Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 1.2.11.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: microweber
product: microweber/microweber
Published: 2022-02-26T10:45:10.000Z
CVE-2022-0724 Insecure Storage of Sensitive Information in microweber/microweber
Insecure Storage of Sensitive Information in GitHub repository microweber/microweber prior to 1.3.
Problem types: cwe_id: CWE-922
description: CWE-922 Insecure Storage of Sensitive Information
Affected products: vendor: microweber
product: microweber/microweber
Published: 2022-02-23T10:45:11.000Z
CVE-2022-0725 
A flaw was found in keepass. The vulnerability occurs due to logging the plain text passwords in system log and leads to an Information Exposure vulnerability. This flaw allows an attacker to interact and read sensitive passwords and logs.
Problem types: cwe_id: CWE-200
description: CWE-200
Affected products: vendor: n/a
product: keepass
Published: 2022-03-07T14:00:21.000Z
CVE-2022-0726 Missing Authorization in chocobozzz/peertube
Missing Authorization in GitHub repository chocobozzz/peertube prior to 4.1.0.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: chocobozzz
product: chocobozzz/peertube
Published: 2022-02-23T00:00:00.000Z
CVE-2022-0727 Improper Access Control in chocobozzz/peertube
Improper Access Control in GitHub repository chocobozzz/peertube prior to 4.1.0.
Problem types: cwe_id: CWE-284
description: CWE-284 Improper Access Control
Affected products: vendor: chocobozzz
product: chocobozzz/peertube
Published: 2022-02-23T13:20:10.000Z
CVE-2022-0728 Easy Smooth Scroll Links < 2.23.1 - Admin+ Stored Cross-Site Scripting
The Easy Smooth Scroll Links WordPress plugin before 2.23.1 does not sanitise and escape its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Easy Smooth Scroll Links
Credits: lang: en
value: Park won seok
Published: 2022-04-11T14:40:49.000Z
CVE-2022-0729 Use of Out-of-range Pointer Offset in vim/vim
Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4440.
Problem types: cwe_id: CWE-823
description: CWE-823 Use of Out-of-range Pointer Offset
Affected products: vendor: vim
product: vim/vim
Published: 2022-02-23T00:00:00.000Z
CVE-2022-0730 
Under certain ldap conditions, Cacti authentication can be bypassed with certain credential types.
Problem types: cwe_id: CWE-287
description: CWE-287
Affected products: vendor: n/a
product: Cati
Published: 2022-03-03T00:00:00.000Z
CVE-2022-0731 Improper Access Control (IDOR) in dolibarr/dolibarr
Improper Access Control (IDOR) in GitHub repository dolibarr/dolibarr prior to 16.0.
Problem types: cwe_id: CWE-284
description: CWE-284 Improper Access Control
Affected products: vendor: dolibarr
product: dolibarr/dolibarr
Published: 2022-02-23T18:35:12.000Z
CVE-2022-0732 
The backend infrastructure shared by multiple mobile device monitoring services does not adequately authenticate or authorize API requests, creating an IDOR (Insecure Direct Object Reference) vulnerability.
Problem types: cwe_id: CWE-284
description: CWE-284 Improper Access Control
Affected products: vendor: 1Byte
product: Copy9
vendor: 1Byte
product: FoneTracker
vendor: 1Byte
product: iSpyoo
vendor: 1Byte
product: GuestSpy
vendor: 1Byte
product: TheSpyApp
vendor: 1Byte
product: ExactSpy
vendor: 1Byte
product: SecondClone
vendor: 1Byte
product: The Truth Spy
vendor: 1Byte
product: MxSpy
Published: 2022-02-24T16:10:11.015Z
CVE-2022-0734 
A cross-site scripting vulnerability was identified in the CGI program of Zyxel USG/ZyWALL series firmware versions 4.35 through 4.70, USG FLEX series firmware versions 4.50 through 5.20, ATP series firmware versions 4.35 through 5.20, and VPN series firmware versions 4.35 through 5.20, that could allow an attacker to obtain some information stored in the user's browser, such as cookies or session tokens, via a malicious script.
Problem types: cwe_id: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Zyxel
product: USG/ZyWALL series firmware
vendor: Zyxel
product: USG FLEX series firmware
vendor: Zyxel
product: ATP series firmware
vendor: Zyxel
product: VPN series firmware
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.8
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
version: 3.1
Published: 2022-05-24T02:10:12.000Z
CVE-2022-0735 
An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.10 before 14.6.5, all versions starting from 14.7 before 14.7.4, all versions starting from 14.8 before 14.8.2. An unauthorised user was able to steal runner registration tokens through an information disclosure vulnerability using quick actions commands.
Problem types: description: Information exposure in GitLab
Affected products: vendor: GitLab
product: GitLab
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 10
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: This vulnerability was found internally by a member of the GitLab team.
Published: 2022-03-28T18:52:59.000Z
CVE-2022-0736 Insecure Temporary File in mlflow/mlflow
Insecure Temporary File in GitHub repository mlflow/mlflow prior to 1.23.1.
Problem types: cwe_id: CWE-377
description: CWE-377 Insecure Temporary File
Affected products: vendor: mlflow
product: mlflow/mlflow
Published: 2022-02-23T08:45:13.000Z
CVE-2022-0737 Text Hover < 4.2 - Admin+ Stored Cross-Site Scripting
The Text Hover WordPress plugin before 4.2 does not sanitize and escape the text to hover, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Text Hover
Credits: lang: en
value: Rohan Chaudhari
Published: 2022-04-18T17:10:33.000Z
CVE-2022-0738 
An issue has been discovered in GitLab affecting all versions starting from 14.6 before 14.6.5, all versions starting from 14.7 before 14.7.4, all versions starting from 14.8 before 14.8.2. GitLab was leaking user passwords when adding mirrors with SSH credentials under specific conditions.
Problem types: description: Information exposure in GitLab
Affected products: vendor: GitLab
product: GitLab
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.2
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: This vulnerability has been discovered internally by the GitLab team
Published: 2022-03-28T18:53:04.000Z
CVE-2022-0739 BookingPress < 1.0.11 - Unauthenticated SQL Injection
The BookingPress WordPress plugin before 1.0.11 fails to properly sanitize user supplied POST data before it is used in a dynamically constructed SQL query via the bookingpress_front_get_category_services AJAX action (available to unauthenticated users), leading to an unauthenticated SQL Injection
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: BookingPress – Appointments Booking Calendar Plugin and Online Scheduling Plugin
Credits: lang: en
value: cydave
Published: 2022-03-21T18:56:00.000Z
CVE-2022-0740 
Incorrect authorization in the Asana integration's branch restriction feature in all versions of GitLab CE/EE starting from version 7.8.0 before 14.7.7, all versions starting from 14.8 before 14.8.5, all versions starting from 14.9 before 14.9.2 makes it possible to close Asana tasks from unrestricted branches.
Problem types: description: Incorrect authorization in GitLab
Affected products: vendor: GitLab
product: GitLab
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 3.1
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: Thanks [ooooooo_q](https://hackerone.com/ooooooo_q) for reporting this vulnerability through our HackerOne bug bounty program
Published: 2022-04-04T19:45:59.000Z
CVE-2022-0741 
Improper input validation in all versions of GitLab CE/EE using sendmail to send emails allowed an attacker to steal environment variables via specially crafted email addresses.
Problem types: description: Improper input validation in GitLab
Affected products: vendor: GitLab
product: GitLab
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.8
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Thanks [vakzz](https://hackerone.com/vakzz) for reporting this vulnerability through our HackerOne bug bounty program
Published: 2022-04-01T22:17:40.000Z
CVE-2022-0742 Memory leak in ICMP6 in Linux Kernel
Memory leak in icmp6 implementation in Linux Kernel 5.13+ allows a remote attacker to DoS a host by making it go out-of-memory via icmp6 packets of type 130 or 131. We recommend upgrading past commit 2d3916f3189172d5c69d33065c3c21119fe539fc.
Problem types: cwe_id: CWE-275
description: CWE-275 Permission Issues
Affected products: vendor: Linux
product: Kernel
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.1
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
version: 3.1
Published: 2022-03-18T11:20:11.000Z
CVE-2022-0743 Cross-site Scripting (XSS) - Stored in getgrav/grav
Cross-site Scripting (XSS) - Stored in GitHub repository getgrav/grav prior to 1.7.31.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: getgrav
product: getgrav/grav
Published: 2022-02-28T23:00:12.000Z
CVE-2022-0745 Like Button Rating < 2.6.45 - Arbitrary e-mail Sending
The Like Button Rating WordPress plugin before 2.6.45 allows any logged-in user, such as subscriber, to send arbitrary e-mails to any recipient, with any subject and body
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: Unknown
product: Like Button Rating ♥ LikeBtn
Credits: lang: en
value: Krzysztof Zając
Published: 2022-06-13T12:41:30.000Z
CVE-2022-0746 Business Logic Errors in dolibarr/dolibarr
Business Logic Errors in GitHub repository dolibarr/dolibarr prior to 16.0.
Problem types: cwe_id: CWE-840
description: CWE-840 Business Logic Errors
Affected products: vendor: dolibarr
product: dolibarr/dolibarr
Published: 2022-02-25T09:05:10.000Z