rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-0556 
A local privilege escalation vulnerability caused by incorrect permission assignment in some directories of the Zyxel AP Configurator (ZAC) version 1.1.4, which could allow an attacker to execute arbitrary code as a local administrator.
Problem types: cwe_id: CWE-269
description: CWE-269: Improper Privilege Management
Affected products: vendor: Zyxel
product: Zyxel AP Configurator (ZAC)
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.3
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Published: 2022-04-11T11:50:16.000Z
CVE-2022-0557 OS Command Injection in microweber/microweber
OS Command Injection in Packagist microweber/microweber prior to 1.2.11.
Problem types: cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command
Affected products: vendor: microweber
product: microweber/microweber
Published: 2022-02-11T08:45:10.000Z
CVE-2022-0558 Cross-site Scripting (XSS) - Stored in microweber/microweber
Cross-site Scripting (XSS) - Stored in Packagist microweber/microweber prior to 1.2.11.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: microweber
product: microweber/microweber
Published: 2022-02-10T09:40:10.000Z
CVE-2022-0559 Use After Free in radareorg/radare2
Use After Free in GitHub repository radareorg/radare2 prior to 5.6.2.
Problem types: cwe_id: CWE-416
description: CWE-416 Use After Free
Affected products: vendor: radareorg
product: radareorg/radare2
Published: 2022-02-16T10:15:11.000Z
CVE-2022-0560 Open Redirect in microweber/microweber
Open Redirect in Packagist microweber/microweber prior to 1.2.11.
Problem types: cwe_id: CWE-601
description: CWE-601 URL Redirection to Untrusted Site
Affected products: vendor: microweber
product: microweber/microweber
Published: 2022-02-11T12:55:11.000Z
CVE-2022-0561 
Null source pointer passed as an argument to memcpy() function within TIFFFetchStripThing() in tif_dirread.c in libtiff versions from 3.9.0 to 4.3.0 could lead to Denial of Service via crafted TIFF file. For users that compile libtiff from sources, the fix is available with commit eecb0712.
Problem types: description: Incorrect calculation of buffer size in libtiff
Affected products: vendor: libtiff
product: libtiff
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
baseScore: 5.5
baseSeverity: MEDIUM
Credits: lang: en
value: shahchintanh@gmail.com
Published: 2022-02-11T00:00:00.000Z
CVE-2022-0562 
Null source pointer passed as an argument to memcpy() function within TIFFReadDirectory() in tif_dirread.c in libtiff versions from 4.0 to 4.3.0 could lead to Denial of Service via crafted TIFF file. For users that compile libtiff from sources, a fix is available with commit 561599c.
Problem types: description: Null pointer dereference in libtiff
Affected products: vendor: libtiff
product: libtiff
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
baseScore: 5.5
baseSeverity: MEDIUM
Credits: lang: en
value: shahchintanh@gmail.com
Published: 2022-02-11T00:00:00.000Z
CVE-2022-0563 
A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an "INPUTRC" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4.
Problem types: cwe_id: CWE-209
description: CWE-209
Affected products: vendor: n/a
product: util-linux
Published: 2022-02-21T00:00:00.000Z
CVE-2022-0564 Qlik Sense Enterprise Domain User enumeration
A vulnerability in Qlik Sense Enterprise on Windows could allow an remote attacker to enumerate domain user accounts. An attacker could exploit this vulnerability by sending authentication requests to an affected system. A successful exploit could allow the attacker to compare the response time that are returned by the affected system to determine which accounts are valid user accounts. Affected systems are only vulnerable if they have LDAP configured.

The affected URI is /internal_forms_authentication/ the response time of the form is longer if the supplied user does not exists and shorter if the user exists.
Problem types: cwe_id: CWE-204
description: CWE-204: Observable Response Discrepancy
Affected products: vendor: Qlik Sense
product: Qlik Sense Enterprise on Windows
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: Hidde Smit (DIVD)
lang: en
value: Diego Klinkhamer (DIVD)
lang: en
value: Frank Breedijk (DIVD)
Published: 2022-02-21T00:00:00.000Z
CVE-2022-0565 Cross-site Scripting in pimcore/pimcore
Cross-site Scripting in Packagist pimcore/pimcore prior to 10.3.1.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: pimcore
product: pimcore/pimcore
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.6
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
version: 3.1
Published: 2022-02-12T12:30:10.000Z
CVE-2022-0566 
It may be possible for an attacker to craft an email message that causes Thunderbird to perform an out-of-bounds write of one byte when processing the message. This vulnerability affects Thunderbird < 91.6.1.
Problem types: description: Crafted email could trigger an out-of-bounds write
Affected products: vendor: Mozilla
product: Thunderbird
Published: 2022-12-22T00:00:00.000Z
CVE-2022-0567 
A flaw was found in ovn-kubernetes. This flaw allows a system administrator or privileged attacker to create an egress network policy that bypasses existing ingress policies of other pods in a cluster, allowing network traffic to access pods that should not be reachable. This issue results in information disclosure and other attacks on other pods that should not be reachable.
Problem types: cwe_id: CWE-20
description: CWE-20
Affected products: vendor: n/a
product: ovn-kubernetes
Published: 2022-04-20T15:30:35.000Z
CVE-2022-0569 Observable Discrepancy in snipe/snipe-it
Observable Discrepancy in Packagist snipe/snipe-it prior to v5.3.9.
Problem types: cwe_id: CWE-203
description: CWE-203 Observable Discrepancy
Affected products: vendor: snipe
product: snipe/snipe-it
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Published: 2022-02-12T23:55:09.000Z
CVE-2022-0570 Heap-based Buffer Overflow in mruby/mruby
Heap-based Buffer Overflow in Homebrew mruby prior to 3.2.
Problem types: cwe_id: CWE-122
description: CWE-122 Heap-based Buffer Overflow
Affected products: vendor: mruby
product: mruby/mruby
Published: 2022-02-13T04:50:10.000Z
CVE-2022-0571 Cross-site Scripting (XSS) - Reflected in phoronix-test-suite/phoronix-test-suite
Cross-site Scripting (XSS) - Reflected in GitHub repository phoronix-test-suite/phoronix-test-suite prior to 10.8.2.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: phoronix-test-suite
product: phoronix-test-suite/phoronix-test-suite
Published: 2022-02-13T11:00:11.000Z
CVE-2022-0572 Heap-based Buffer Overflow in vim/vim
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.
Problem types: cwe_id: CWE-122
description: CWE-122 Heap-based Buffer Overflow
Affected products: vendor: vim
product: vim/vim
Published: 2022-02-13T00:00:00.000Z
CVE-2022-0573 
JFrog Artifactory before 7.36.1 and 6.23.41, is vulnerable to Insecure Deserialization of untrusted data which can lead to DoS, Privilege Escalation and Remote Code Execution when a specially crafted request is sent by a low privileged authenticated user due to insufficient validation of a user-provided serialized object.
Problem types: cwe_id: CWE-502
description: CWE-502 Deserialization of Untrusted Data
Affected products: vendor: JFrog
product: JFrog Artifactory
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2022-05-16T14:32:04.000Z
CVE-2022-0574 Improper Access Control in publify/publify
Improper Access Control in GitHub repository publify/publify prior to 9.2.8.
Problem types: cwe_id: CWE-284
description: CWE-284 Improper Access Control
Affected products: vendor: publify
product: publify/publify
Published: 2022-05-16T14:31:39.000Z
CVE-2022-0575 Cross-site Scripting (XSS) - Stored in librenms/librenms
Cross-site Scripting (XSS) - Stored in Packagist librenms/librenms prior to 22.2.0.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: librenms
product: librenms/librenms
Published: 2022-02-13T23:40:15.000Z
CVE-2022-0576 Cross-site Scripting (XSS) - Generic in librenms/librenms
Cross-site Scripting (XSS) - Generic in Packagist librenms/librenms prior to 22.1.0.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: librenms
product: librenms/librenms
Published: 2022-02-13T23:40:09.000Z
CVE-2022-0577 Exposure of Sensitive Information to an Unauthorized Actor in scrapy/scrapy
Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository scrapy/scrapy prior to 2.6.1.
Problem types: cwe_id: CWE-200
description: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: scrapy
product: scrapy/scrapy
Published: 2022-03-02T04:05:10.000Z
CVE-2022-0578 Code Injection in publify/publify
Code Injection in GitHub repository publify/publify prior to 9.2.8.
Problem types: cwe_id: CWE-94
description: CWE-94 Improper Control of Generation of Code
Affected products: vendor: publify
product: publify/publify
Published: 2022-05-16T14:31:45.000Z
CVE-2022-0579 Missing Authorization in snipe/snipe-it
Missing Authorization in Packagist snipe/snipe-it prior to 5.3.9.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: snipe
product: snipe/snipe-it
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2022-02-14T19:00:10.000Z
CVE-2022-0580 Incorrect Authorization in librenms/librenms
Incorrect Authorization in Packagist librenms/librenms prior to 22.2.0.
Problem types: cwe_id: CWE-863
description: CWE-863 Incorrect Authorization
Affected products: vendor: librenms
product: librenms/librenms
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
version: 3.1
Published: 2022-02-14T22:55:09.000Z
CVE-2022-0581 
Crash in the CMS protocol dissector in Wireshark 3.6.0 to 3.6.1 and 3.4.0 to 3.4.11 allows denial of service via packet injection or crafted capture file
Problem types: description: Missing release of memory after effective lifetime in Wireshark
Affected products: vendor: Wireshark Foundation
product: Wireshark
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: LOW
baseScore: 6.3
baseSeverity: MEDIUM
Credits: lang: en
value: TODO
Published: 2022-02-14T00:00:00.000Z
CVE-2022-0582 
Unaligned access in the CSN.1 protocol dissector in Wireshark 3.6.0 to 3.6.1 and 3.4.0 to 3.4.11 allows denial of service via packet injection or crafted capture file
Problem types: description: Improper input validation in Wireshark
Affected products: vendor: Wireshark Foundation
product: Wireshark
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: LOW
baseScore: 6.3
baseSeverity: MEDIUM
Credits: lang: en
value: Sharon Brizinov
Published: 2022-02-14T00:00:00.000Z
CVE-2022-0583 
Crash in the PVFS protocol dissector in Wireshark 3.6.0 to 3.6.1 and 3.4.0 to 3.4.11 allows denial of service via packet injection or crafted capture file
Problem types: description: Buffer over-read in Wireshark
Affected products: vendor: Wireshark Foundation
product: Wireshark
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: LOW
baseScore: 6.3
baseSeverity: MEDIUM
Credits: lang: en
value: Sharon Brizinov
Published: 2022-02-14T00:00:00.000Z
CVE-2022-0585 
Large loops in multiple protocol dissectors in Wireshark 3.6.0 to 3.6.1 and 3.4.0 to 3.4.11 allow denial of service via packet injection or crafted capture file
Problem types: description: Excessive iteration in Wireshark
Affected products: vendor: Wireshark Foundation
product: Wireshark
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: LOW
baseScore: 4.3
baseSeverity: MEDIUM
Credits: lang: en
value: Sharon Brizinov
Published: 2022-02-18T00:00:00.000Z
CVE-2022-0586 
Infinite loop in RTMPT protocol dissector in Wireshark 3.6.0 to 3.6.1 and 3.4.0 to 3.4.11 allows denial of service via packet injection or crafted capture file
Problem types: description: Loop with unreachable exit condition ('infinite loop') in Wireshark
Affected products: vendor: Wireshark Foundation
product: Wireshark
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: LOW
baseScore: 6.3
baseSeverity: MEDIUM
Credits: lang: en
value: Sharon Brizinov
Published: 2022-02-14T00:00:00.000Z
CVE-2022-0587 Improper Authorization in librenms/librenms
Improper Authorization in Packagist librenms/librenms prior to 22.2.0.
Problem types: cwe_id: CWE-285
description: CWE-285 Improper Authorization
Affected products: vendor: librenms
product: librenms/librenms
Published: 2022-02-15T07:45:09.000Z
CVE-2022-0588 Missing Authorization in librenms/librenms
Missing Authorization in Packagist librenms/librenms prior to 22.2.0.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: librenms
product: librenms/librenms
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
version: 3.1
Published: 2022-02-15T08:05:21.000Z
CVE-2022-0589 Cross-site Scripting (XSS) - Stored in librenms/librenms
Cross-site Scripting (XSS) - Stored in Packagist librenms/librenms prior to 22.1.0.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: librenms
product: librenms/librenms
Published: 2022-02-15T08:10:10.000Z
CVE-2022-0590 BulletProof Security < 5.8 - Admin+ Stored Cross-Site Scripting (XSS)
The BulletProof Security WordPress plugin before 5.8 does not sanitise and escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: BulletProof Security
Credits: lang: en
value: Mika
Published: 2022-03-21T18:55:47.000Z
CVE-2022-0591 Formcraft3 < 3.8.28 - Unauthenticated SSRF
The FormCraft WordPress plugin before 3.8.28 does not validate the URL parameter in the formcraft3_get AJAX action, leading to SSRF issues exploitable by unauthenticated users
Problem types: cwe_id: CWE-918
description: CWE-918 Server-Side Request Forgery (SSRF)
Affected products: vendor: Unknown
product: FormCraft
Credits: lang: en
value: Brandon James Roldan
Published: 2022-03-21T18:55:48.000Z
CVE-2022-0592 MapSVG < 6.2.20 - Unauthenticated SQLi
The MapSVG WordPress plugin before 6.2.20 does not validate and escape a parameter via a REST endpoint before using it in a SQL statement, leading to a SQL Injection exploitable by unauthenticated users.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: MapSVG
Credits: lang: en
value: Brandon James Roldan
Published: 2022-05-09T16:50:29.000Z
CVE-2022-0593 Login with phone number < 1.3.7 - Unauthenticated remote plugin deletion
The Login with phone number WordPress plugin before 1.3.7 includes a file delete.php with no form of authentication or authorization checks placed in the plugin directory, allowing unauthenticated user to remotely delete the plugin files leading to a potential Denial of Service situation.
Problem types: cwe_id: CWE-73
description: CWE-73 External Control of File Name or Path
Affected products: vendor: Unknown
product: Login with phone number
Credits: lang: en
value: Michal Lipinski
Published: 2022-03-14T14:41:36.000Z
CVE-2022-0594 Shareaholic < 9.7.6 - Information Disclosure
The Professional Social Sharing Buttons, Icons & Related Posts WordPress plugin before 9.7.6 does not have proper authorisation check in one of the AJAX action, available to unauthenticated (in v < 9.7.5) and author+ (in v9.7.5) users, allowing them to call it and retrieve various information such as the list of active plugins, various version like PHP, cURL, WP etc.
Problem types: cwe_id: CWE-863
description: CWE-863 Incorrect Authorization
Affected products: vendor: Unknown
product: Professional Social Sharing Buttons, Icons & Related Posts – Shareaholic
Credits: lang: en
value: Brandon James Roldan
Published: 2022-07-25T12:45:37.000Z
CVE-2022-0595 Drag and Drop Multiple File Upload - Contact Form 7 < 1.3.6.3 - Unauthenticated Stored XSS
The Drag and Drop Multiple File Upload WordPress plugin before 1.3.6.3 allows SVG files to be uploaded by default via the dnd_codedropz_upload AJAX action, which could lead to Stored Cross-Site Scripting issue
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Drag and Drop Multiple File Upload – Contact Form 7
Credits: lang: en
value: Brandon James Roldan
Published: 2022-03-28T17:22:57.000Z
CVE-2022-0596 Improper Validation of Specified Quantity in Input in microweber/microweber
Improper Validation of Specified Quantity in Input in Packagist microweber/microweber prior to 1.2.11.
Problem types: cwe_id: CWE-1284
description: CWE-1284 Improper Validation of Specified Quantity in Input
Affected products: vendor: microweber
product: microweber/microweber
Published: 2022-02-15T00:00:00.000Z
CVE-2022-0597 Open Redirect in microweber/microweber
Open Redirect in Packagist microweber/microweber prior to 1.2.11.
Problem types: cwe_id: CWE-601
description: CWE-601 URL Redirection to Untrusted Site
Affected products: vendor: microweber
product: microweber/microweber
Published: 2022-02-15T13:50:10.000Z
CVE-2022-0598 Login with phone number < 1.3.8 - Multiple Admin+ Stored XSS
The Login with phone number WordPress plugin before 1.3.8 does not sanitise and escape plugin settings which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Login with phone number
Credits: lang: en
value: Michal Lipinski
Published: 2022-08-01T12:47:18.000Z
CVE-2022-0599 Mapping Multiple URLs Redirect Same Page <= 5.8 - Reflected Cross-Site Scripting
The Mapping Multiple URLs Redirect Same Page WordPress plugin through 5.8 does not sanitize and escape the mmursp_id parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Mapping multiple URLs redirect same page
Credits: lang: en
value: Ran Crane
Published: 2022-03-28T17:22:59.000Z
CVE-2022-0600 Conference Scheduler < 2.4.3 - Reflected Cross-Site Scripting
The Conference Scheduler WordPress plugin before 2.4.3 does not sanitize and escape the tab parameter before outputting back in an admin page, leading to a Reflected Cross-Site Scripting.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Conference Scheduler
Credits: lang: en
value: Ran Crane
Published: 2022-03-28T17:23:01.000Z
CVE-2022-0601 Countdown & Clock < 2.2.9 - Reflected Cross-Site Scripting
The Countdown, Coming Soon, Maintenance WordPress plugin before 2.2.9 does not sanitize and escape the post parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Countdown, Coming Soon, Maintenance – Countdown & Clock
Credits: lang: en
value: Ran Crane
Published: 2022-03-14T14:41:38.000Z
CVE-2022-0602 Cross-site Scripting (XSS) - DOM in tastyigniter/tastyigniter
Cross-site Scripting (XSS) - DOM in GitHub repository tastyigniter/tastyigniter prior to 3.3.0.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: tastyigniter
product: tastyigniter/tastyigniter
Published: 2022-04-05T15:55:10.000Z
CVE-2022-0603 
Use after free in File Manager in Google Chrome on Chrome OS prior to 98.0.4758.102 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Problem types: description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2022-04-04T23:55:22.000Z