rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-4176 
Out of bounds write in Lacros Graphics in Google Chrome on Chrome OS and Lacros prior to 108.0.5359.71 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via UI interactions. (Chromium security severity: High)
Problem types: description: Out of bounds write
Affected products: vendor: Google
product: Chrome
Published: 2022-11-29T00:00:00.000Z
CVE-2022-4177 
Use after free in Extensions in Google Chrome prior to 108.0.5359.71 allowed an attacker who convinced a user to install an extension to potentially exploit heap corruption via a crafted Chrome Extension and UI interaction. (Chromium security severity: High)
Problem types: description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2022-11-29T00:00:00.000Z
CVE-2022-4178 
Use after free in Mojo in Google Chrome prior to 108.0.5359.71 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Problem types: description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2022-11-29T00:00:00.000Z
CVE-2022-4179 
Use after free in Audio in Google Chrome prior to 108.0.5359.71 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension. (Chromium security severity: High)
Problem types: description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2022-11-29T00:00:00.000Z
CVE-2022-4180 
Use after free in Mojo in Google Chrome prior to 108.0.5359.71 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension. (Chromium security severity: High)
Problem types: description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2022-11-29T00:00:00.000Z
CVE-2022-4181 
Use after free in Forms in Google Chrome prior to 108.0.5359.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Problem types: description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2022-11-29T00:00:00.000Z
CVE-2022-4182 
Inappropriate implementation in Fenced Frames in Google Chrome prior to 108.0.5359.71 allowed a remote attacker to bypass fenced frame restrictions via a crafted HTML page. (Chromium security severity: Medium)
Problem types: description: Inappropriate implementation
Affected products: vendor: Google
product: Chrome
Published: 2022-11-29T00:00:00.000Z
CVE-2022-4183 
Insufficient policy enforcement in Popup Blocker in Google Chrome prior to 108.0.5359.71 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium)
Problem types: description: Insufficient policy enforcement
Affected products: vendor: Google
product: Chrome
Published: 2022-11-29T00:00:00.000Z
CVE-2022-4184 
Insufficient policy enforcement in Autofill in Google Chrome prior to 108.0.5359.71 allowed a remote attacker to bypass autofill restrictions via a crafted HTML page. (Chromium security severity: Medium)
Problem types: description: Insufficient policy enforcement
Affected products: vendor: Google
product: Chrome
Published: 2022-11-29T00:00:00.000Z
CVE-2022-4185 
Inappropriate implementation in Navigation in Google Chrome on iOS prior to 108.0.5359.71 allowed a remote attacker to spoof the contents of the modal dialogue via a crafted HTML page. (Chromium security severity: Medium)
Problem types: description: Inappropriate implementation
Affected products: vendor: Google
product: Chrome
Published: 2022-11-29T00:00:00.000Z
CVE-2022-4186 
Insufficient validation of untrusted input in Downloads in Google Chrome prior to 108.0.5359.71 allowed an attacker who convinced a user to install a malicious extension to bypass Downloads restrictions via a crafted HTML page. (Chromium security severity: Medium)
Problem types: description: Insufficient validation of untrusted input
Affected products: vendor: Google
product: Chrome
Published: 2022-11-29T00:00:00.000Z
CVE-2022-4187 
Insufficient policy enforcement in DevTools in Google Chrome on Windows prior to 108.0.5359.71 allowed a remote attacker to bypass filesystem restrictions via a crafted HTML page. (Chromium security severity: Medium)
Problem types: description: Insufficient policy enforcement
Affected products: vendor: Google
product: Chrome
Published: 2022-11-29T00:00:00.000Z
CVE-2022-4188 
Insufficient validation of untrusted input in CORS in Google Chrome on Android prior to 108.0.5359.71 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)
Problem types: description: Insufficient validation of untrusted input
Affected products: vendor: Google
product: Chrome
Published: 2022-11-29T00:00:00.000Z
CVE-2022-4189 
Insufficient policy enforcement in DevTools in Google Chrome prior to 108.0.5359.71 allowed an attacker who convinced a user to install a malicious extension to bypass navigation restrictions via a crafted Chrome Extension. (Chromium security severity: Medium)
Problem types: description: Insufficient policy enforcement
Affected products: vendor: Google
product: Chrome
Published: 2022-11-29T00:00:00.000Z
CVE-2022-4190 
Insufficient data validation in Directory in Google Chrome prior to 108.0.5359.71 allowed a remote attacker to bypass file system restrictions via a crafted HTML page. (Chromium security severity: Medium)
Problem types: description: Insufficient data validation
Affected products: vendor: Google
product: Chrome
Published: 2022-11-29T00:00:00.000Z
CVE-2022-4191 
Use after free in Sign-In in Google Chrome prior to 108.0.5359.71 allowed a remote attacker who convinced a user to engage in specific UI interaction to potentially exploit heap corruption via profile destruction. (Chromium security severity: Medium)
Problem types: description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2022-11-29T00:00:00.000Z
CVE-2022-4192 
Use after free in Live Caption in Google Chrome prior to 108.0.5359.71 allowed a remote attacker who convinced a user to engage in specific UI interaction to potentially exploit heap corruption via UI interaction. (Chromium security severity: Medium)
Problem types: description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2022-11-29T00:00:00.000Z
CVE-2022-4193 
Insufficient policy enforcement in File System API in Google Chrome prior to 108.0.5359.71 allowed a remote attacker to bypass file system restrictions via a crafted HTML page. (Chromium security severity: Medium)
Problem types: description: Insufficient policy enforcement
Affected products: vendor: Google
product: Chrome
Published: 2022-11-29T00:00:00.000Z
CVE-2022-4194 
Use after free in Accessibility in Google Chrome prior to 108.0.5359.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
Problem types: description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2022-11-29T00:00:00.000Z
CVE-2022-4195 
Insufficient policy enforcement in Safe Browsing in Google Chrome prior to 108.0.5359.71 allowed a remote attacker to bypass Safe Browsing warnings via a malicious file. (Chromium security severity: Medium)
Problem types: description: Insufficient policy enforcement
Affected products: vendor: Google
product: Chrome
Published: 2022-11-29T00:00:00.000Z
CVE-2022-4196 Multi Step Form < 1.7.8 - Admin+ Stored XSS
The Multi Step Form WordPress plugin before 1.7.8 does not sanitise and escape some of its form fields, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Multi Step Form
default_status: unaffected
Credits: lang: en
value: zhangyunpei and Yeting Li VARAS@IIE
lang: en
value: WPScan
Published: 2023-01-09T22:13:40.058Z
CVE-2022-4197 Sliderby10Web < 1.2.53 - Admin+ Stored XSS
The Sliderby10Web WordPress plugin before 1.2.53 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Sliderby10Web
default_status: unaffected
Credits: lang: en
value: zhangyunpei and Yeting Li VARAS@IIE
lang: en
value: WPScan
Published: 2022-12-26T12:28:00.982Z
CVE-2022-4198 WP Social Sharing <= 2.2 - Admin+ Stored XSS
The WP Social Sharing WordPress plugin through 2.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: WP Social Sharing
default_status: affected
Credits: lang: en
value: zhangyunpei and Yeting Li VARAS@IIE
lang: en
value: WPScan
Published: 2023-01-02T21:49:15.457Z
CVE-2022-4199 Link Library < 7.4.1 - Admin+ Stored XSS
The Link Library WordPress plugin before 7.4.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Link Library
default_status: unaffected
Credits: lang: en
value: iohex
lang: en
value: WPScan
Published: 2023-01-16T15:37:51.207Z
CVE-2022-4200 Login with Cognito <= 1.4.8 - Admin+ Stored XSS
The Login with Cognito WordPress plugin through 1.4.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Login with Cognito
default_status: affected
Credits: lang: en
value: iohex
lang: en
value: WPScan
Published: 2023-01-02T21:49:34.280Z
CVE-2022-4201 
A blind SSRF in GitLab CE/EE affecting all from 11.3 prior to 15.4.6, 15.5 prior to 15.5.5, and 15.6 prior to 15.6.1 allows an attacker to connect to local addresses when configuring a malicious GitLab Runner.
Problem types: description: Server-side request forgery (ssrf) in GitLab
Affected products: vendor: GitLab
product: GitLab
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: LOW
userInteraction: NONE
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: NONE
baseScore: 3.5
baseSeverity: LOW
Credits: lang: en
value: This vulnerability has been discovered internally by the GitLab team
Published: 2023-01-27T00:00:00.000Z
CVE-2022-4202 GPAC lsr_dec.c lsr_translate_coords integer overflow
A vulnerability, which was classified as problematic, was found in GPAC 2.1-DEV-rev490-g68064e101-master. Affected is the function lsr_translate_coords of the file laser/lsr_dec.c. The manipulation leads to integer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The name of the patch is b3d821c4ae9ba62b3a194d9dcb5e99f17bd56908. It is recommended to apply a patch to fix this issue. VDB-214518 is the identifier assigned to this vulnerability.
Problem types: cwe_id: CWE-189
description: CWE-189 Numeric Error -> CWE-190 Integer Overflow
Affected products: vendor: unspecified
product: GPAC
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: LOW
baseScore: 6.3
baseSeverity: MEDIUM
Published: 2022-11-29T00:00:00.000Z
CVE-2022-4203 X.509 Name Constraints Read Buffer Overflow
A read buffer overrun can be triggered in X.509 certificate verification,
specifically in name constraint checking. Note that this occurs
after certificate chain signature verification and requires either a
CA to have signed the malicious certificate or for the application to
continue certificate verification despite failure to construct a path
to a trusted issuer.

The read buffer overrun might result in a crash which could lead to
a denial of service attack. In theory it could also result in the disclosure
of private memory contents (such as private keys, or sensitive plaintext)
although we are not aware of any working exploit leading to memory
contents disclosure as of the time of release of this advisory.

In a TLS client, this can be triggered by connecting to a malicious
server. In a TLS server, this can be triggered if the server requests
client authentication and a malicious client connects.
Problem types: description: read buffer overrun
Affected products: vendor: OpenSSL
product: OpenSSL
default_status: unaffected
Credits: lang: en
value: Corey Bonnell from Digicert
lang: en
value: Viktor Dukhovni
Published: 2023-02-24T14:53:08.485Z
CVE-2022-4205 
In Gitlab EE/CE before 15.6.1, 15.5.5 and 15.4.6 using a branch with a hexadecimal name could override an existing hash.
Problem types: description: Access of resource using incompatible type ('type confusion') in GitLab
Affected products: vendor: GitLab
product: GitLab
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:L
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: HIGH
availabilityImpact: LOW
baseScore: 6.3
baseSeverity: MEDIUM
Credits: lang: en
value: This vulnerability has been discovered internally by the GitLab team
Published: 2023-01-27T00:00:00.000Z
CVE-2022-4206 
A sensitive information leak issue has been discovered in all versions of DAST API scanner from 1.6.50 prior to 2.0.102, exposing the Authorization header in the vulnerability report
Problem types: description: Information exposure in DAST API scanner
Affected products: vendor: GitLab
product: DAST API scanner
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: NONE
baseScore: 5
baseSeverity: MEDIUM
Credits: lang: en
value: This vulnerability has been discovered internally by the GitLab team
Published: 2023-02-01T00:00:00.000Z
CVE-2022-4207 
The Image Hover Effects Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several values that can be added to an Image Hover in versions 9.8.1 to 9.8.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. By default, the plugin only allows administrators access to edit Image Hovers, however, if a site admin makes the plugin's features available to lower privileged users through the 'Who Can Edit?' setting then this can be exploited by those users.
Problem types: description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: biplob018
product: Image Hover Effects Ultimate (Image Gallery, Effects, Lightbox, Comparison or Magnifier)
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N
baseScore: 5.5
baseSeverity: MEDIUM
Credits: lang: en
value: Dan Shallom
Published: 2022-12-13T20:18:36.516Z
CVE-2022-4208 Chained Quiz <= 1.3.2 - Reflected Cross-Site Scripting via datef
The Chained Quiz plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'datef' parameter on the 'chainedquiz_list' page in versions up to, and including, 1.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: prasunsen
product: Chained Quiz
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
baseScore: 6.1
baseSeverity: MEDIUM
Credits: lang: en
value: Muhammad Zeeshan
Published: 2022-12-02T20:25:37.319Z
CVE-2022-4209 Chained Quiz <= 1.3.2 - Reflected Cross-Site Scripting via pointsf
The Chained Quiz plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'pointsf' parameter on the 'chainedquiz_list' page in versions up to, and including, 1.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: prasunsen
product: Chained Quiz
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
baseScore: 6.1
baseSeverity: MEDIUM
Credits: lang: en
value: Muhammad Zeeshan
Published: 2022-12-02T20:25:57.704Z
CVE-2022-4210 Chained Quiz <= 1.3.2 - Reflected Cross-Site Scripting via dnf
The Chained Quiz plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'dnf' parameter on the 'chainedquiz_list' page in versions up to, and including, 1.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: prasunsen
product: Chained Quiz
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
baseScore: 6.1
baseSeverity: MEDIUM
Credits: lang: en
value: Muhammad Zeeshan
Published: 2022-12-02T20:26:45.548Z
CVE-2022-4211 Chained Quiz <= 1.3.2 - Reflected Cross-Site Scripting via emailf
The Chained Quiz plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'emailf' parameter on the 'chainedquiz_list' page in versions up to, and including, 1.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: prasunsen
product: Chained Quiz
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
baseScore: 6.1
baseSeverity: MEDIUM
Credits: lang: en
value: Muhammad Zeeshan
Published: 2022-12-02T20:27:55.674Z
CVE-2022-4212 Chained Quiz <= 1.3.2 - Reflected Cross-Site Scripting via ipf
The Chained Quiz plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'ipf' parameter on the 'chainedquiz_list' page in versions up to, and including, 1.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: prasunsen
product: Chained Quiz
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
baseScore: 6.1
baseSeverity: MEDIUM
Credits: lang: en
value: Muhammad Zeeshan
Published: 2022-12-02T20:29:12.966Z
CVE-2022-4213 Chained Quiz <= 1.3.2.2 - Reflected Cross-Site Scripting via dn
The Chained Quiz plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'dn' parameter on the 'chainedquiz_list' page in versions up to, and including, 1.3.2.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: prasunsen
product: Chained Quiz
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
baseScore: 6.1
baseSeverity: MEDIUM
Credits: lang: en
value: Muhammad Zeeshan
Published: 2022-12-02T20:19:08.928Z
CVE-2022-4214 Chained Quiz <= 1.3.2.3 - Reflected Cross-Site Scripting via ip
The Chained Quiz plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'ip' parameter on the 'chainedquiz_list' page in versions up to, and including, 1.3.2.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: prasunsen
product: Chained Quiz
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
baseScore: 6.1
baseSeverity: MEDIUM
Credits: lang: en
value: Muhammad Zeeshan
Published: 2022-12-02T20:17:20.632Z
CVE-2022-4215 Chained Quiz <= 1.3.2.3 - Reflected Cross-Site Scripting via date
The Chained Quiz plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'date' parameter on the 'chainedquiz_list' page in versions up to, and including, 1.3.2.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: prasunsen
product: Chained Quiz
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
baseScore: 6.1
baseSeverity: MEDIUM
Credits: lang: en
value: Muhammad Zeeshan
Published: 2022-12-02T20:15:45.531Z