rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-1434 Incorrect MAC key used in the RC4-MD5 ciphersuite
The OpenSSL 3.0 implementation of the RC4-MD5 ciphersuite incorrectly uses the AAD data as the MAC key. This makes the MAC key trivially predictable. An attacker could exploit this issue by performing a man-in-the-middle attack to modify data being sent from one endpoint to an OpenSSL 3.0 recipient such that the modified data would still pass the MAC integrity check. Note that data sent from an OpenSSL 3.0 endpoint to a non-OpenSSL 3.0 endpoint will always be rejected by the recipient and the connection will fail at that point. Many application protocols require data to be sent from the client to the server first. Therefore, in such a case, only an OpenSSL 3.0 server would be impacted when talking to a non-OpenSSL 3.0 client. If both endpoints are OpenSSL 3.0 then the attacker could modify data being sent in both directions. In this case both clients and servers could be affected, regardless of the application protocol. Note that in the absence of an attacker this bug means that an OpenSSL 3.0 endpoint communicating with a non-OpenSSL 3.0 endpoint will fail to complete the handshake when using this ciphersuite. The confidentiality of data is not impacted by this issue, i.e. an attacker cannot decrypt data that has been encrypted using this ciphersuite - they can only modify it. In order for this attack to work both endpoints must legitimately negotiate the RC4-MD5 ciphersuite. This ciphersuite is not compiled by default in OpenSSL 3.0, and is not available within the default provider or the default ciphersuite list. This ciphersuite will never be used if TLSv1.3 has been negotiated. In order for an OpenSSL 3.0 endpoint to use this ciphersuite the following must have occurred: 1) OpenSSL must have been compiled with the (non-default) compile time option enable-weak-ssl-ciphers 2) OpenSSL must have had the legacy provider explicitly loaded (either through application code or via configuration) 3) The ciphersuite must have been explicitly added to the ciphersuite list 4) The libssl security level must have been set to 0 (default is 1) 5) A version of SSL/TLS below TLSv1.3 must have been negotiated 6) Both endpoints must negotiate the RC4-MD5 ciphersuite in preference to any others that both endpoints have in common Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2).
Problem types: description: Incorrect MAC key
Affected products: vendor: OpenSSL
product: OpenSSL
Credits: lang: en
value: Tom Colley (Broadcom)
Published: 2022-05-03T15:15:23.387Z
CVE-2022-1435 WPCargo Track & Trace < 6.9.5 - Admin+ Stored Cross Site Scripting
The WPCargo Track & Trace WordPress plugin before 6.9.5 does not sanitize and escapes some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: WPCargo Track & Trace
Credits: lang: en
value: Raul
Published: 2022-05-16T14:31:03.000Z
CVE-2022-1436 WPCargo Track & Trace < 6.9.5 - Reflected Cross Site Scripting
The WPCargo Track & Trace WordPress plugin before 6.9.5 does not sanitise and escape the wpcargo_tracking_number parameter before outputting it back in the page, which could allow attackers to perform reflected Cross-Site Scripting attacks.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: WPCargo Track & Trace
Credits: lang: en
value: Raul
Published: 2022-05-16T14:31:05.000Z
CVE-2022-1437 Heap-based Buffer Overflow in radareorg/radare2
Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.7.0. The bug causes the program reads data past the end of the intented buffer. Typically, this can allow attackers to read sensitive information from other memory locations or cause a crash.
Problem types: cwe_id: CWE-122
description: CWE-122 Heap-based Buffer Overflow
Affected products: vendor: radareorg
product: radareorg/radare2
Published: 2022-04-22T14:00:15.000Z
CVE-2022-1438 Keycloak: xss on impersonation under specific circumstances
A flaw was found in Keycloak. Under specific circumstances, HTML entities are not sanitized during user impersonation, resulting in a Cross-site scripting (XSS) vulnerability.
Problem types: cwe_id: CWE-79
description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Red Hat
product: Red Hat Single Sign-On 7
cpes: cpe:/a:redhat:red_hat_single_sign_on:7.6
default_status: unaffected
vendor: Red Hat
product: Red Hat Single Sign-On 7.6 for RHEL 7
cpes: cpe:/a:redhat:red_hat_single_sign_on:7.6::el7
default_status: affected
vendor: Red Hat
product: Red Hat Single Sign-On 7.6 for RHEL 8
cpes: cpe:/a:redhat:red_hat_single_sign_on:7.6::el8
default_status: affected
vendor: Red Hat
product: Red Hat Single Sign-On 7.6 for RHEL 9
cpes: cpe:/a:redhat:red_hat_single_sign_on:7.6::el9
default_status: affected
vendor: Red Hat
product: RHEL-8 based Middleware Containers
cpes: cpe:/a:redhat:rhosemc:1.0::el8
default_status: affected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.4
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Red Hat would like to thank Grzegorz Tworek (SISOFT s.c.) for reporting this issue.
Published: 2023-09-20T13:34:22.495Z
CVE-2022-1439 Reflected XSS on demo.microweber.org/demo/module/ in microweber/microweber
Reflected XSS on demo.microweber.org/demo/module/ in GitHub repository microweber/microweber prior to 1.2.15. Execute Arbitrary JavaScript as the attacked user. It's the only payload I found working, you might need to press "tab" but there is probably a paylaod that runs without user interaction.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: microweber
product: microweber/microweber
Published: 2022-04-22T16:30:14.000Z
CVE-2022-1440 Command Injection vulnerability in git-interface@2.1.1 in yarkeev/git-interface
Command Injection vulnerability in git-interface@2.1.1 in GitHub repository yarkeev/git-interface prior to 2.1.2. If both are provided by user input, then the use of a `--upload-pack` command-line argument feature of git is also supported for `git clone`, which would then allow for any operating system command to be spawned by the attacker.
Problem types: cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command
Affected products: vendor: yarkeev
product: yarkeev/git-interface
Published: 2022-04-22T17:30:13.000Z
CVE-2022-1441 
MP4Box is a component of GPAC-2.0.0, which is a widely-used third-party package on RPM Fusion. When MP4Box tries to parse a MP4 file, it calls the function `diST_box_read()` to read from video. In this function, it allocates a buffer `str` with fixed length. However, content read from `bs` is controllable by user, so is the length, which causes a buffer overflow.
Problem types: cwe_id: CWE-119
description: CWE-119
Affected products: vendor: n/a
product: gpac
Published: 2022-04-25T00:00:00.000Z
CVE-2022-1442 Metform Elementor Contact Form Builder <= 2.1.3 - Sensitive Information Disclosure
The Metform WordPress plugin is vulnerable to sensitive information disclosure due to improper access control in the ~/core/forms/action.php file which can be exploited by an unauthenticated attacker to view all API keys and secrets of integrated third-party APIs like that of PayPal, Stripe, Mailchimp, Hubspot, HelpScout, reCAPTCHA and many more, in versions up to and including 2.1.3.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: roxnor
product: MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
baseScore: 7.5
baseSeverity: HIGH
Credits: lang: en
value: Muhammad Zeeshan
Published: 2022-05-10T19:30:12.000Z
CVE-2022-1444 heap-use-after-free in radareorg/radare2
heap-use-after-free in GitHub repository radareorg/radare2 prior to 5.7.0. This vulnerability is capable of inducing denial of service.
Problem types: cwe_id: CWE-416
description: CWE-416 Use After Free
Affected products: vendor: radareorg
product: radareorg/radare2
Published: 2022-04-23T21:20:10.000Z
CVE-2022-1445 Stored Cross Site Scripting vulnerability in the checked_out_to parameter in snipe/snipe-it
Stored Cross Site Scripting vulnerability in the checked_out_to parameter in GitHub repository snipe/snipe-it prior to 5.4.3. The vulnerability is capable of stolen the user Cookie.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: snipe
product: snipe/snipe-it
Published: 2022-04-24T14:30:12.000Z
CVE-2022-1451 Out-of-bounds Read  in r_bin_java_constant_value_attr_new function in radareorg/radare2
Out-of-bounds Read in r_bin_java_constant_value_attr_new function in GitHub repository radareorg/radare2 prior to 5.7.0. The bug causes the program reads data past the end 2f the intented buffer. Typically, this can allow attackers to read sensitive information from other memory locations or cause a crash. More details see [CWE-125: Out-of-bounds read](https://cwe.mitre.org/data/definitions/125.html).
Problem types: cwe_id: CWE-788
description: CWE-788 Access of Memory Location After End of Buffer
Affected products: vendor: radareorg
product: radareorg/radare2
Published: 2022-04-24T20:50:16.000Z
CVE-2022-1452 Out-of-bounds Read in r_bin_java_bootstrap_methods_attr_new function in radareorg/radare2
Out-of-bounds Read in r_bin_java_bootstrap_methods_attr_new function in GitHub repository radareorg/radare2 prior to 5.7.0. The bug causes the program reads data past the end 2f the intented buffer. Typically, this can allow attackers to read sensitive information from other memory locations or cause a crash. More details see [CWE-125: Out-of-bounds read](https://cwe.mitre.org/data/definitions/125.html).
Problem types: cwe_id: CWE-125
description: CWE-125 Out-of-bounds Read
Affected products: vendor: radareorg
product: radareorg/radare2
Published: 2022-04-24T20:50:10.000Z
CVE-2022-1453 RSVPMaker <= 9.2.5 - Unauthenticated SQL Injection
The RSVPMaker plugin for WordPress is vulnerable to unauthenticated SQL Injection due to missing SQL escaping and parameterization on user supplied data passed to a SQL query in the rsvpmaker-util.php file. This makes it possible for unauthenticated attackers to steal sensitive information from the database in versions up to and including 9.2.5.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: davidfcarr
product: RSVPMaker
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
baseScore: 9.8
baseSeverity: CRITICAL
Credits: lang: en
value: Tobias Kay Dalå (oxnan)
Published: 2022-05-10T19:29:20.000Z
CVE-2022-1455 Call Now Button < 1.1.2 - Reflected Cross-Site Scripting
The Call Now Button WordPress plugin before 1.1.2 does not escape a parameter before outputting it back in an attribute of a hidden input, leading to a Reflected Cross-Site Scripting when the premium is enabled
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Call Now Button
Credits: lang: en
value: 7coo and JrXnm
Published: 2022-05-16T14:31:07.000Z
CVE-2022-1456 Poll Maker < 4.0.2 - Admin+ Stored Cross-Site Scripting
The Poll Maker WordPress plugin before 4.0.2 does not sanitise and escape some settings, which could allow high privilege users such as admin to perform Store Cross-Site Scripting attack even when unfiltered_html is disallowed
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Poll Maker
Credits: lang: en
value: 0x23.so
Published: 2022-05-30T08:35:47.000Z
CVE-2022-1457 Store XSS in title parameter executing at EditUser Page & EditProducto page in neorazorx/facturascripts
Store XSS in title parameter executing at EditUser Page & EditProducto page in GitHub repository neorazorx/facturascripts prior to 2022.04. Cross-site scripting attacks can have devastating consequences. Code injected into a vulnerable application can exfiltrate data or install malware on the user's machine. Attackers can masquerade as authorized users via session cookies, allowing them to perform any action allowed by the user account.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: neorazorx
product: neorazorx/facturascripts
Published: 2022-04-25T09:40:10.000Z
CVE-2022-1458 Stored XSS Leads To Session Hijacking in openemr/openemr
Stored XSS Leads To Session Hijacking in GitHub repository openemr/openemr prior to 6.1.0.1.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: openemr
product: openemr/openemr
Published: 2022-04-25T09:50:10.000Z
CVE-2022-1459 Non-Privilege User Can View Patient’s Disclosures in openemr/openemr
Non-Privilege User Can View Patient’s Disclosures in GitHub repository openemr/openemr prior to 6.1.0.1.
Problem types: cwe_id: CWE-1118
description: CWE-1118 Insufficient Documentation of Error Handling Techniques
Affected products: vendor: openemr
product: openemr/openemr
Published: 2022-04-25T09:55:10.000Z
CVE-2022-1460 
An issue has been discovered in GitLab affecting all versions starting from 9.2 before 14.8.6, all versions starting from 14.9 before 14.9.4, all versions starting from 14.10 before 14.10.1. GitLab was not performing correct authorizations on scheduled pipelines allowing a malicious user to run a pipeline in the context of another user.
Problem types: description: Improper authorization in GitLab
Affected products: vendor: GitLab
product: GitLab
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.1
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N
version: 3.1
Credits: lang: en
value: Thanks [peterl](https://hackerone.com/peterl) for reporting this vulnerability through our HackerOne bug bounty program
Published: 2022-05-11T14:45:11.000Z
CVE-2022-1461 Non Privilege User can Enable or Disable Registered in openemr/openemr
Non Privilege User can Enable or Disable Registered in GitHub repository openemr/openemr prior to 6.1.0.1.
Problem types: cwe_id: CWE-1220
description: CWE-1220 Insufficient Granularity of Access Control
Affected products: vendor: openemr
product: openemr/openemr
Published: 2022-04-25T10:15:12.000Z
CVE-2022-1462 
An out-of-bounds read flaw was found in the Linux kernel’s TeleTYpe subsystem. The issue occurs in how a user triggers a race condition using ioctls TIOCSPTLCK and TIOCGPTPEER and TIOCSTI and TCXONC with leakage of memory in the flush_to_ldisc function. This flaw allows a local user to crash the system or read unauthorized random data from memory.
Problem types: cwe_id: CWE-362
description: CWE-362
Affected products: vendor: n/a
product: kernel
Published: 2022-05-31T00:00:00.000Z
CVE-2022-1463 Booking Calendar <= 9.1 - PHP Object Injection via Shortcode
The Booking Calendar plugin for WordPress is vulnerable to PHP Object Injection via the [bookingflextimeline] shortcode in versions up to, and including, 9.1. This could be exploited by subscriber-level users and above to call arbitrary PHP objects on a vulnerable site.
Problem types: cwe_id: CWE-502
description: CWE-502 Deserialization of Untrusted Data
Affected products: vendor: wpdevelop
product: Booking Calendar
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Ramuel Gall, Wordfence
Published: 2022-05-10T19:37:41.000Z
CVE-2022-1464 Stored xss bug  in gogs/gogs
Stored xss bug in GitHub repository gogs/gogs prior to 0.12.7. As the repo is public , any user can view the report and when open the attachment then xss is executed. This bug allow executed any javascript code in victim account .
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: gogs
product: gogs/gogs
Published: 2022-05-05T13:45:12.000Z
CVE-2022-1465 WPC Smart Wishlist for WooCommerce < 2.9.9 - Reflected Cross-Site Scripting
The WPC Smart Wishlist for WooCommerce WordPress plugin before 2.9.9 does not sanitise and escape a parameter before outputting it back in an attribute via an AJAX action, leading to a Reflected Cross-Site Scripting issue.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: WPC Smart Wishlist for WooCommerce
Credits: lang: en
value: Utkarsh Agrawal
Published: 2022-05-16T14:31:08.000Z
CVE-2022-1466 
Due to improper authorization, Red Hat Single Sign-On is vulnerable to users performing actions that they should not be allowed to perform. It was possible to add users to the master realm even though no respective permission was granted.
Problem types: cwe_id: CWE-863
description: CWE-863
Affected products: vendor: n/a
product: rhsso
Published: 2022-04-26T18:33:22.000Z
CVE-2022-1467 AVEVA InTouch Access Anywhere Exposure of Resource to Wrong Sphere
Windows OS can be configured to overlay a “language bar” on top of any application. When this OS functionality is enabled, the OS language bar UI will be viewable in the browser alongside the AVEVA InTouch Access Anywhere and Plant SCADA Access Anywhere applications. It is possible to manipulate the Windows OS language bar to launch an OS command prompt, resulting in a context-escape from application into OS.
Problem types: cwe_id: CWE-668
description: CWE-668: Exposure of Resource to Wrong Sphere
Affected products: vendor: AVEVA
product: AVEVA InTouch Access Anywhere
vendor: AVEVA
product: AVEVA Plant SCADA Access Anywhere
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.4
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Giovanni Delvecchio from Aceaspa reported this vulnerability to AVEVA.
Published: 2022-05-23T19:17:02.000Z
CVE-2022-1468 
On all versions of 17.0.x, 16.1.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x on F5 BIG-IP, an authenticated iControl REST user with at least guest role privileges can cause processing delays to iControl REST requests via undisclosed requests. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
Problem types: cwe_id: CWE-400
description: CWE-400 Uncontrolled Resource Consumption
Affected products: vendor: F5
product: BIG-IP
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
version: 3.1
Credits: lang: en
value: F5 acknowledges the KITRI BOB Team for bringing this issue to our attention and following the highest standards of coordinated disclosure.  KITRI BOB Team: Jeong Su Hwan, Kim Dong Jun, Jung Min Woo, Jang Min Ki, Lee Jung Woo, Heo Seung Hwan
Published: 2022-05-05T16:20:23.680Z
CVE-2022-1469 FiboSearch < 1.18.0 - Admin+ Stored Cross-Site Scripting
The FiboSearch WordPress plugin before 1.17.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: FiboSearch – Ajax Search for WooCommerce
Credits: lang: en
value: Dipak Panchal
Published: 2022-06-06T08:51:02.000Z
CVE-2022-1470 Ultimate WooCommerce CSV Importer <= 2.0 - Reflected Cross-Site Scripting
The Ultimate WooCommerce CSV Importer WordPress plugin through 2.0 does not sanitise and escape the imported data before outputting it back in the page, leading to a Reflected Cross-Site Scripting
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Ultimate WooCommerce CSV Importer
Credits: lang: en
value: Benachi
Published: 2022-06-27T08:56:46.000Z
CVE-2022-1471 Remote Code execution in SnakeYAML
SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization. Deserializing yaml content provided by an attacker can lead to remote code execution. We recommend using SnakeYaml's SafeConsturctor when parsing untrusted content to restrict deserialization. We recommend upgrading to version 2.0 and beyond.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: SnakeYAML
product: SnakeYAML
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 8.3
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
version: 3.1
Published: 2022-12-01T10:47:07.203Z
CVE-2022-1472 Better Find and Replace < 1.3.6 - Admin+ SQLi
The Better Find and Replace WordPress plugin before 1.3.6 does not properly sanitise, validate and escape various parameters before using them in an SQL statement, leading to an SQL Injection
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: Better Find and Replace
Credits: lang: en
value: lucy
Published: 2022-06-20T10:25:49.000Z
CVE-2022-1473 Resource leakage when decoding certificates and keys
The OPENSSL_LH_flush() function, which empties a hash table, contains a bug that breaks reuse of the memory occuppied by the removed hash table entries. This function is used when decoding certificates or keys. If a long lived process periodically decodes certificates or keys its memory usage will expand without bounds and the process might be terminated by the operating system causing a denial of service. Also traversing the empty hash table entries will take increasingly more time. Typically such long lived processes might be TLS clients or TLS servers configured to accept client certificate authentication. The function was added in the OpenSSL 3.0 version thus older releases are not affected by the issue. Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2).
Problem types: description: Denial of Service
Affected products: vendor: OpenSSL
product: OpenSSL
Credits: lang: en
value: Aliaksei Levin
Published: 2022-05-03T15:15:25.051Z
CVE-2022-1474 WP Event Manager < 3.1.28 - Reflected Cross-Site Scripting
The WP Event Manager WordPress plugin before 3.1.28 does not sanitise and escape its search before outputting it back in an attribute on the event dashboard, leading to a Reflected Cross-Site Scripting
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: WP Event Manager – Easily Build your Calendar of Events!
Credits: lang: en
value: Utkarsh Agrawal
Published: 2022-07-11T12:55:45.000Z