rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-1854 
Use after free in ANGLE in Google Chrome prior to 102.0.5005.61 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Problem types: description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2022-07-27T21:15:57.000Z
CVE-2022-1855 
Use after free in Messaging in Google Chrome prior to 102.0.5005.61 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Problem types: description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2022-07-27T21:16:13.000Z
CVE-2022-1856 
Use after free in User Education in Google Chrome prior to 102.0.5005.61 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension or specific user interaction.
Problem types: description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2022-07-27T21:16:26.000Z
CVE-2022-1857 
Insufficient policy enforcement in File System API in Google Chrome prior to 102.0.5005.61 allowed a remote attacker to bypass file system restrictions via a crafted HTML page.
Problem types: description: Insufficient policy enforcement
Affected products: vendor: Google
product: Chrome
Published: 2022-07-27T21:16:37.000Z
CVE-2022-1858 
Out of bounds read in DevTools in Google Chrome prior to 102.0.5005.61 allowed a remote attacker to perform an out of bounds memory read via specific user interaction.
Problem types: description: Out of bounds read
Affected products: vendor: Google
product: Chrome
Published: 2022-07-27T21:16:50.000Z
CVE-2022-1859 
Use after free in Performance Manager in Google Chrome prior to 102.0.5005.61 allowed a remote attacker who convinced a user to engage in specific user interaction to potentially exploit heap corruption via a crafted HTML page.
Problem types: description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2022-07-27T21:17:05.000Z
CVE-2022-1860 
Use after free in UI Foundations in Google Chrome on Chrome OS prior to 102.0.5005.61 allowed a remote attacker who convinced a user to engage in specific user interaction to potentially exploit heap corruption via specific user interactions.
Problem types: description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2022-07-27T21:17:17.000Z
CVE-2022-1861 
Use after free in Sharing in Google Chrome on Chrome OS prior to 102.0.5005.61 allowed a remote attacker who convinced a user to enage in specific user interactions to potentially exploit heap corruption via specific user interaction.
Problem types: description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2022-07-27T21:17:30.000Z
CVE-2022-1862 
Inappropriate implementation in Extensions in Google Chrome prior to 102.0.5005.61 allowed an attacker who convinced a user to install a malicious extension to bypass profile restrictions via a crafted HTML page.
Problem types: description: Inappropriate implementation
Affected products: vendor: Google
product: Chrome
Published: 2022-07-27T21:17:37.000Z
CVE-2022-1863 
Use after free in Tab Groups in Google Chrome prior to 102.0.5005.61 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension and specific user interaction.
Problem types: description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2022-07-27T21:17:53.000Z
CVE-2022-1864 
Use after free in WebApp Installs in Google Chrome prior to 102.0.5005.61 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension and specific user interaction.
Problem types: description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2022-07-27T21:18:07.000Z
CVE-2022-1865 
Use after free in Bookmarks in Google Chrome prior to 102.0.5005.61 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension and specific user interaction.
Problem types: description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2022-07-27T21:18:20.000Z
CVE-2022-1866 
Use after free in Tablet Mode in Google Chrome on Chrome OS prior to 102.0.5005.61 allowed a remote attacker who convinced a user to engage in specific user interactions to potentially exploit heap corruption via specific user interactions.
Problem types: description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2022-07-27T21:18:36.000Z
CVE-2022-1867 
Insufficient validation of untrusted input in Data Transfer in Google Chrome prior to 102.0.5005.61 allowed a remote attacker to bypass same origin policy via a crafted clipboard content.
Problem types: description: Insufficient validation of untrusted input
Affected products: vendor: Google
product: Chrome
Published: 2022-07-27T21:18:49.000Z
CVE-2022-1868 
Inappropriate implementation in Extensions API in Google Chrome prior to 102.0.5005.61 allowed an attacker who convinced a user to install a malicious extension to bypass navigation restrictions via a crafted HTML page.
Problem types: description: Inappropriate implementation
Affected products: vendor: Google
product: Chrome
Published: 2022-07-27T21:19:02.000Z
CVE-2022-1869 
Type Confusion in V8 in Google Chrome prior to 102.0.5005.61 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Problem types: description: Type Confusion
Affected products: vendor: Google
product: Chrome
Published: 2022-07-27T21:19:15.000Z
CVE-2022-1870 
Use after free in App Service in Google Chrome prior to 102.0.5005.61 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension.
Problem types: description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2022-07-27T21:19:28.000Z
CVE-2022-1871 
Insufficient policy enforcement in File System API in Google Chrome prior to 102.0.5005.61 allowed an attacker who convinced a user to install a malicious extension to bypass file system policy via a crafted HTML page.
Problem types: description: Insufficient policy enforcement
Affected products: vendor: Google
product: Chrome
Published: 2022-07-27T21:19:40.000Z
CVE-2022-1872 
Insufficient policy enforcement in Extensions API in Google Chrome prior to 102.0.5005.61 allowed an attacker who convinced a user to install a malicious extension to bypass downloads policy via a crafted HTML page.
Problem types: description: Insufficient policy enforcement
Affected products: vendor: Google
product: Chrome
Published: 2022-07-27T21:19:53.000Z
CVE-2022-1873 
Insufficient policy enforcement in COOP in Google Chrome prior to 102.0.5005.61 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
Problem types: description: Insufficient policy enforcement
Affected products: vendor: Google
product: Chrome
Published: 2022-07-27T21:20:06.000Z
CVE-2022-1874 
Insufficient policy enforcement in Safe Browsing in Google Chrome on Mac prior to 102.0.5005.61 allowed a remote attacker to bypass downloads protection policy via a crafted HTML page.
Problem types: description: Insufficient policy enforcement
Affected products: vendor: Google
product: Chrome
Published: 2022-07-27T21:20:20.000Z
CVE-2022-1875 
Inappropriate implementation in PDF in Google Chrome prior to 102.0.5005.61 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
Problem types: description: Inappropriate implementation
Affected products: vendor: Google
product: Chrome
Published: 2022-07-27T21:20:33.000Z
CVE-2022-1876 
Heap buffer overflow in DevTools in Google Chrome prior to 102.0.5005.61 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page.
Problem types: description: Heap buffer overflow
Affected products: vendor: Google
product: Chrome
Published: 2022-07-27T21:20:46.000Z
CVE-2022-1881 
In affected versions of Octopus Server an Insecure Direct Object Reference vulnerability exists where it is possible for a user to download Project Exports from a Project they do not have permissions to access. This vulnerability only impacts projects within the same Space.
Problem types: description: Insecure Direct Object Reference (IDOR)
Affected products: vendor: Octopus Deploy
product: Octopus Server
Published: 2022-07-15T07:40:10.000Z
CVE-2022-1882 
A use-after-free flaw was found in the Linux kernel’s pipes functionality in how a user performs manipulations with the pipe post_one_notification() after free_pipe_info() that is already called. This flaw allows a local user to crash or potentially escalate their privileges on the system.
Problem types: cwe_id: CWE-416
description: CWE-416
Affected products: vendor: n/a
product: kernel
Published: 2022-05-26T00:00:00.000Z
CVE-2022-1883 SQL Injection in camptocamp/terraboard
SQL Injection in GitHub repository camptocamp/terraboard prior to 2.2.0.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command
Affected products: vendor: camptocamp
product: camptocamp/terraboard
Published: 2022-05-25T08:20:11.000Z
CVE-2022-1884 Remote Command Execution in gogs/gogs
A remote command execution vulnerability exists in gogs/gogs versions <=0.12.7 when deployed on a Windows server. The vulnerability arises due to improper validation of the `tree_path` parameter during file uploads. An attacker can set `tree_path=.git.` to upload a file into the .git directory, allowing them to write or rewrite the `.git/config` file. If the `core.sshCommand` is set, this can lead to remote command execution.
Problem types: cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command
Affected products: vendor: gogs
product: gogs/gogs
Published: 2024-11-15T10:53:00.844Z
CVE-2022-1885 Cimy Header Image Rotator <= 6.1.1 - Arbitrary Settings Update via CSRF
The Cimy Header Image Rotator WordPress plugin through 6.1.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: Cimy Header Image Rotator
Credits: lang: en
value: Daniel Ruf
Published: 2022-06-27T08:58:14.000Z
CVE-2022-1886 Heap-based Buffer Overflow in vim/vim
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.
Problem types: cwe_id: CWE-122
description: CWE-122 Heap-based Buffer Overflow
Affected products: vendor: vim
product: vim/vim
Published: 2022-05-26T00:00:00.000Z
CVE-2022-1887 
The search term could have been specified externally to trigger SQL injection. This vulnerability affects Firefox for iOS < 101.
Problem types: description: SQL injection in history tab
Affected products: vendor: Mozilla
product: Firefox for iOS
Published: 2022-12-22T00:00:00.000Z
CVE-2022-1888 Fuji Electric Alpha7 PC Loader Fuji Electric Alpha7 PC Loader
Alpha7 PC Loader (All versions) is vulnerable to a stack-based buffer overflow while processing a specifically crafted project file, which may allow an attacker to execute arbitrary code.
Problem types: cwe_id: CWE-121
description: CWE-121 Stack-based Buffer Overflow
Affected products: vendor: Fuji Electric
product: Alpha7 PC Loader
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Published: 2022-08-31T15:32:57.691Z
CVE-2022-1889 Newsletter < 7.4.6 - Admin+ Stored Cross-Site Scripting
The Newsletter WordPress plugin before 7.4.6 does not escape and sanitise the preheader_text setting, which could allow high privilege users to perform Stored Cross-Site Scripting attacks when the unfilteredhtml is disallowed
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Newsletter – Send awesome emails from WordPress
Credits: lang: en
value: PHYO WIN SHEIN
Published: 2022-06-20T10:26:13.000Z
CVE-2022-1890 
A buffer overflow in the ReadyBootDxe driver in some Lenovo Notebook products may allow an attacker with local privileges to execute arbitrary code.
Problem types: cwe_id: CWE-122
description: CWE-122 Heap-based Buffer Overflow
Affected products: vendor: Lenovo
product: BIOS
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.7
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Lenovo thanks Martin Smolár from ESET for reporting these issues.
Published: 2023-01-23T15:18:46.294Z
CVE-2022-1891 
A buffer overflow in the SystemLoadDefaultDxe driver in some Lenovo Notebook products may allow an attacker with local privileges to execute arbitrary code.
Problem types: cwe_id: CWE-122
description: CWE-122 Heap-based Buffer Overflow
Affected products: vendor: Lenovo
product: BIOS
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.7
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Lenovo thanks Martin Smolár from ESET for reporting these issues.
Published: 2023-01-23T15:25:33.599Z
CVE-2022-1892 
A buffer overflow in the SystemBootManagerDxe driver in some Lenovo Notebook products may allow an attacker with local privileges to execute arbitrary code.
Problem types: cwe_id: CWE-122
description: CWE-122 Heap-based Buffer Overflow
Affected products: vendor: Lenovo
product: BIOS
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.7
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Lenovo thanks Martin Smolár from ESET for reporting these issues.
Published: 2023-01-23T15:31:19.243Z
CVE-2022-1893 Improper Removal of Sensitive Information Before Storage or Transfer 	 in polonel/trudesk
Improper Removal of Sensitive Information Before Storage or Transfer in GitHub repository polonel/trudesk prior to 1.2.3.
Problem types: cwe_id: CWE-212
description: CWE-212 Improper Removal of Sensitive Information Before Storage or Transfer
Affected products: vendor: polonel
product: polonel/trudesk
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.6
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
version: 3.1
Published: 2022-05-31T21:50:10.000Z
CVE-2022-1894 Popup Builder < 4.1.11 - Admin+ Stored Cross-Site Scripting
The Popup Builder WordPress plugin before 4.1.11 does not escape and sanitize some settings, which could allow high privilege users to perform Stored Cross-Site Scripting attacks when the unfiltred_html is disallowed
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Popup Builder – Create highly converting, mobile friendly marketing popups.
Credits: lang: en
value: Pritam Dash
Published: 2022-07-11T12:56:21.000Z
CVE-2022-1895 underConstruction < 1.20 - Construction Mode Deactivation via CSRF
The underConstruction WordPress plugin before 1.20 does not have CSRF check in place when deactivating the construction mode, which could allow attackers to make a logged in admin perform such action via a CSRF attack
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: underConstruction
Credits: lang: en
value: Daniel Ruf
Published: 2022-06-20T10:26:14.000Z
CVE-2022-1896 underConstruction < 1.21 - Admin+ Stored Cross-Site Scripting
The underConstruction WordPress plugin before 1.21 does not sanitise or escape the "Display a custom page using your own HTML" setting before outputting it, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiletred_html capability is disallowed.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: underConstruction
Credits: lang: en
value: Asif Nawaz Minhas
Published: 2022-06-20T10:26:16.000Z
CVE-2022-1897 Out-of-bounds Write in vim/vim
Out-of-bounds Write in GitHub repository vim/vim prior to 8.2.
Problem types: cwe_id: CWE-787
description: CWE-787 Out-of-bounds Write
Affected products: vendor: vim
product: vim/vim
Published: 2022-05-27T00:00:00.000Z
CVE-2022-1898 Use After Free in vim/vim
Use After Free in GitHub repository vim/vim prior to 8.2.
Problem types: cwe_id: CWE-416
description: CWE-416 Use After Free
Affected products: vendor: vim
product: vim/vim
Published: 2022-05-27T00:00:00.000Z
CVE-2022-1899 Out-of-bounds Read in radareorg/radare2
Out-of-bounds Read in GitHub repository radareorg/radare2 prior to 5.7.0.
Problem types: cwe_id: CWE-125
description: CWE-125 Out-of-bounds Read
Affected products: vendor: radareorg
product: radareorg/radare2
Published: 2022-05-26T16:25:10.000Z
CVE-2022-1900 Copify <= 1.3.0 - Cross-Site Request Forgery to Cross-Site Scripting
The Copify plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.0. This is due to missing nonce validation on the CopifySettings page. This makes it possible for unauthenticated attackers to update the plugins settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: robmcvey
product: Copify
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
baseScore: 8.8
baseSeverity: HIGH
Credits: lang: en
value: Yuki Hoshi
Published: 2022-06-13T12:47:42.000Z
CVE-2022-1901 
In affected versions of Octopus Deploy it is possible to unmask sensitive variables by using variable preview.
Problem types: description: Sensitive Variable Exposure
Affected products: vendor: Octopus Deploy
product: Octopus Server
Published: 2022-08-19T07:55:08.000Z
CVE-2022-1902 
A flaw was found in the Red Hat Advanced Cluster Security for Kubernetes. Notifier secrets were not properly sanitized in the GraphQL API. This flaw allows authenticated ACS users to retrieve Notifiers from the GraphQL API, revealing secrets that can escalate their privileges.
Problem types: cwe_id: CWE-497
description: CWE-497
Affected products: vendor: n/a
product: Red Hat Advanced Cluster Security for Kubernetes
Published: 2022-09-01T19:54:44.000Z
CVE-2022-1903 ARMember < 3.4.8 - Unauthenticated Admin Account Takeover
The ARMember WordPress plugin before 3.4.8 is vulnerable to account takeover (even the administrator) due to missing nonce and authorization checks in an AJAX action available to unauthenticated users, allowing them to change the password of arbitrary users by knowing their username
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: Unknown
product: ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup
Credits: lang: en
value: cydave
Published: 2022-06-27T08:58:19.000Z
CVE-2022-1904 Easy Pricing Tables < 3.2.1 - Reflected Cross-Site-Scripting
The Pricing Tables WordPress Plugin WordPress plugin before 3.2.1 does not sanitise and escape parameter before outputting it back in a page available to any user (both authenticated and unauthenticated) when a specific setting is enabled, leading to a Reflected Cross-Site Scripting
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Pricing Tables WordPress Plugin – Easy Pricing Tables
Credits: lang: en
value: cydave
Published: 2022-06-27T08:58:25.000Z
CVE-2022-1905 Events Made Easy < 2.2.81 - Unauthenticated SQLi
The Events Made Easy WordPress plugin before 2.2.81 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: Events Made Easy
Credits: lang: en
value: cydave
Published: 2022-06-20T10:26:17.000Z
CVE-2022-1906 Copyright Proof <= 4.16 - Reflected Cross-Site-Scripting
The Copyright Proof WordPress plugin through 4.16 does not sanitise and escape a parameter before outputting it back via an AJAX action available to both unauthenticated and authenticated users, leading to a Reflected Cross-Site Scripting when a specific setting is enabled.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Copyright Proof
Credits: lang: en
value: cydave
Published: 2022-08-01T12:48:28.000Z
CVE-2022-1907 Buffer Over-read in bfabiszewski/libmobi
Buffer Over-read in GitHub repository bfabiszewski/libmobi prior to 0.11.
Problem types: cwe_id: CWE-126
description: CWE-126 Buffer Over-read
Affected products: vendor: bfabiszewski
product: bfabiszewski/libmobi
Published: 2022-05-27T08:30:13.000Z
CVE-2022-1908 Buffer Over-read in bfabiszewski/libmobi
Buffer Over-read in GitHub repository bfabiszewski/libmobi prior to 0.11.
Problem types: cwe_id: CWE-126
description: CWE-126 Buffer Over-read
Affected products: vendor: bfabiszewski
product: bfabiszewski/libmobi
Published: 2022-05-27T08:35:16.000Z
CVE-2022-1909 Cross-site Scripting (XSS) - Stored in causefx/organizr
Cross-site Scripting (XSS) - Stored in GitHub repository causefx/organizr prior to 2.1.2200.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: causefx
product: causefx/organizr
Published: 2022-05-27T08:35:11.000Z
CVE-2022-1910 Shortcodes and extra features for Phlox theme < 2.9.8 - Reflected Cross-Site-Scripting
The Shortcodes and extra features for Phlox WordPress plugin before 2.9.8 does not sanitise and escape a parameter before outputting it back in the response, leading to a Reflected Cross-Site Scripting
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Shortcodes and extra features for Phlox theme
Credits: lang: en
value: cydave
Published: 2022-07-11T12:56:28.000Z
CVE-2022-1911 Information disclosure in M-Files Server
Error in parser function in M-Files Server versions before 22.6.11534.1 and before 22.6.11505.0 allowed unauthenticated access to some information of the underlying operating system.
Problem types: cwe_id: CWE-200
description: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: M-Files
product: M-Files Server
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Published: 2022-11-30T14:35:17.470Z