rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-4441 Privilege Escalation Vulnerability in Hitachi Storage Plug-in for VMware vCenter
Incorrect Privilege Assignment vulnerability in Hitachi Storage Plug-in for VMware vCenter allows remote authenticated users to cause privilege escalation.
This issue affects Hitachi Storage Plug-in for VMware vCenter: from 04.9.0 before 04.9.1.

Problem types: cwe_id: CWE-266
description: CWE-266 Incorrect Privilege Assignment
cwe_id: CWE-287
description: CWE-287 Improper Authentication
Affected products: vendor: Hitachi
product: Hitachi Storage Plug-in for VMware vCenter
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.6
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
version: 3.1
Published: 2023-01-31T01:42:21.954Z
CVE-2022-4442 WCK < 2.3.3 - Admin+ Stored XSS
The Custom Post Types and Custom Fields creator WordPress plugin before 2.3.3 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example, in multisite setup).
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Custom Post Types and Custom Fields creator
default_status: unaffected
Credits: lang: en
value: Do Nguyen
lang: en
value: WPScan
Published: 2023-01-16T15:37:54.312Z
CVE-2022-4443 BruteBank - WP Security & Firewall < 1.9 - Settings Update via CSRF
The BruteBank WordPress plugin before 1.9 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged-in admin change them via a CSRF attack.
Problem types: description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: BruteBank
default_status: unaffected
Credits: lang: en
value: rezaduty
lang: en
value: WPScan
Published: 2023-01-23T14:31:34.041Z
CVE-2022-4444 ipti br.tag cross site scripting
A vulnerability was found in ipti br.tag. It has been declared as problematic. Affected by this vulnerability is an unknown functionality. The manipulation leads to cross site scripting. The attack can be launched remotely. Upgrading to version 2.13.0 is able to address this issue. The name of the patch is 7e311be22d3a0a1b53e61cb987ba13d681d85f06. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-215431.
Problem types: cwe_id: CWE-707
description: CWE-707 Improper Neutralization -> CWE-74 Injection -> CWE-79 Cross Site Scripting
Affected products: vendor: ipti
product: br.tag
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: LOW
availabilityImpact: NONE
baseScore: 3.5
baseSeverity: LOW
Published: 2022-12-13T00:00:00.000Z
CVE-2022-4445 FL3R FeelBox <= 8.1 - Unauthenticated SQLi
The FL3R FeelBox WordPress plugin through 8.1 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.
Problem types: description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: FL3R FeelBox
default_status: affected
Credits: lang: en
value: cydave
lang: en
value: WPScan
Published: 2023-02-13T14:32:00.912Z
CVE-2022-4446 PHP Remote File Inclusion in tsolucio/corebos
PHP Remote File Inclusion in GitHub repository tsolucio/corebos prior to 8.0.
Problem types: cwe_id: CWE-98
description: CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
Affected products: vendor: tsolucio
product: tsolucio/corebos
Published: 2022-12-13T00:00:00.000Z
CVE-2022-4447 Fontsy <= 1.8.6 - Multiple Unauthenticated SQLi
The Fontsy WordPress plugin through 1.8.6 does not properly sanitize and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.
Problem types: description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: Fontsy
default_status: affected
Credits: lang: en
value: cydave
lang: en
value: WPScan
Published: 2023-01-16T15:38:06.991Z
CVE-2022-4448 GiveWP < 2.24.0 - Contributor+ Stored XSS
The GiveWP WordPress plugin before 2.24.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: GiveWP
default_status: unaffected
Credits: lang: en
value: Lana Codes
lang: en
value: WPScan
Published: 2023-02-13T14:32:04.877Z
CVE-2022-4449 Page Scroll To ID < 1.7.6 - Contributor+ Stored XSS
The Page scroll to id WordPress plugin before 1.7.6 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Page scroll to id
default_status: unaffected
Credits: lang: en
value: Lana Codes
lang: en
value: WPScan
Published: 2023-01-16T15:37:41.047Z
CVE-2022-4450 Double free after calling PEM_read_bio_ex
The function PEM_read_bio_ex() reads a PEM file from a BIO and parses and
decodes the "name" (e.g. "CERTIFICATE"), any header data and the payload data.
If the function succeeds then the "name_out", "header" and "data" arguments are
populated with pointers to buffers containing the relevant decoded data. The
caller is responsible for freeing those buffers. It is possible to construct a
PEM file that results in 0 bytes of payload data. In this case PEM_read_bio_ex()
will return a failure code but will populate the header argument with a pointer
to a buffer that has already been freed. If the caller also frees this buffer
then a double free will occur. This will most likely lead to a crash. This
could be exploited by an attacker who has the ability to supply malicious PEM
files for parsing to achieve a denial of service attack.

The functions PEM_read_bio() and PEM_read() are simple wrappers around
PEM_read_bio_ex() and therefore these functions are also directly affected.

These functions are also called indirectly by a number of other OpenSSL
functions including PEM_X509_INFO_read_bio_ex() and
SSL_CTX_use_serverinfo_file() which are also vulnerable. Some OpenSSL internal
uses of these functions are not vulnerable because the caller does not free the
header argument if PEM_read_bio_ex() returns a failure code. These locations
include the PEM_read_bio_TYPE() functions as well as the decoders introduced in
OpenSSL 3.0.

The OpenSSL asn1parse command line application is also impacted by this issue.
Problem types: description: double-free
Affected products: vendor: OpenSSL
product: OpenSSL
default_status: unaffected
Credits: lang: en
value: CarpetFuzz
lang: en
value: Dawei Wang
lang: en
value: Marc Schönefeld
lang: en
value: Kurt Roeckx
lang: en
value: Matt Caswell
Published: 2023-02-08T19:04:04.874Z
CVE-2022-4451 Sassy Social Share < 3.3.45 - Contributor+ Stored XSS
The Social Sharing WordPress plugin before 3.3.45 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Social Sharing Plugin
default_status: unaffected
Credits: lang: en
value: Lana Codes
lang: en
value: WPScan
Published: 2023-01-16T15:38:06.045Z
CVE-2022-4452 
Insufficient data validation in crosvm in Google Chrome prior to 107.0.5304.62 allowed a remote attacker to potentially exploit object corruption via a crafted HTML page. (Chromium security severity: High)
Problem types: description: Insufficient data validation
Affected products: vendor: Google
product: Chrome
Published: 2023-08-25T14:44:44.837Z
CVE-2022-4453 3D FlipBook <= 1.13.2 - Contributor+ Stored XSS
The 3D FlipBook WordPress plugin through 1.13.2 does not validate or escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks against high privilege users like administrators.
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: 3D FlipBook
default_status: affected
Credits: lang: en
value: Lana Codes
lang: en
value: WPScan
Published: 2023-01-16T15:37:44.926Z
CVE-2022-4454 m0ver bible-online Search search.java query sql injection
A vulnerability, which was classified as critical, has been found in m0ver bible-online. Affected by this issue is the function query of the file src/main/java/custom/application/search.java of the component Search Handler. The manipulation leads to sql injection. The name of the patch is 6ef0aabfb2d4ccd53fcaa9707781303af357410e. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-215444.
Problem types: cwe_id: CWE-707
description: CWE-707 Improper Neutralization -> CWE-74 Injection -> CWE-89 SQL Injection
Affected products: vendor: m0ver
product: bible-online
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
attackVector: ADJACENT_NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: LOW
baseScore: 5.5
baseSeverity: MEDIUM
Published: 2022-12-13T00:00:00.000Z
CVE-2022-4455 sproctor php-calendar index.php cross site scripting
A vulnerability was identified in sproctor php-calendar up to 2.0.13. This impacts an unknown function of the file index.php. Such manipulation of the argument $_SERVER['PHP_SELF'] leads to cross site scripting. The attack may be launched remotely. The name of the patch is a2941109b42201c19733127ced763e270a357809. It is advisable to implement a patch to correct this issue.
Problem types: cwe_id: CWE-79
description: Cross Site Scripting
cwe_id: CWE-94
description: Code Injection
Affected products: vendor: sproctor
product: php-calendar
CVSS v3.1: version: 3.1
baseScore: 3.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:X/RL:O/RC:C
baseSeverity: LOW
Credits: lang: en
value: Jalaj Kumar Nimesh
lang: en
value: Jalaj (VulDB User)
Published: 2022-12-13T00:00:00.000Z
CVE-2022-4456 falling-fruit cross site scripting
A vulnerability has been found in falling-fruit and classified as problematic. This vulnerability affects unknown code. The manipulation leads to cross site scripting. The attack can be initiated remotely. The name of the patch is 15adb8e1ea1f1c3e3d152fc266071f621ef0c621. It is recommended to apply a patch to fix this issue. VDB-215446 is the identifier assigned to this vulnerability.
Problem types: cwe_id: CWE-707
description: CWE-707 Improper Neutralization -> CWE-74 Injection -> CWE-79 Cross Site Scripting
Affected products: vendor: unspecified
product: falling-fruit
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: LOW
availabilityImpact: NONE
baseScore: 3.5
baseSeverity: LOW
Published: 2022-12-13T00:00:00.000Z
CVE-2022-4457 WARP client manifest misconfiguration leading to Task Hijacking
Due to a misconfiguration in the manifest file of the WARP client for Android, it was possible to a perform a task hijacking attack. An attacker could create a malicious mobile application which could hijack legitimate app and steal potentially sensitive information when installed on the victim's device.


Problem types: cwe_id: CWE-200
description: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: Cloudflare
product: WARP
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 5.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:L
version: 3.1
Credits: lang: en
value: Sheikh Rishad
Published: 2023-01-11T16:32:28.382Z
CVE-2022-4458 Amr Shortcode Any Widget <= 4.0 - Contributor+ Stored XSS
The amr shortcode any widget WordPress plugin through 4.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: amr shortcode any widget
default_status: affected
Credits: lang: en
value: Lana Codes
lang: en
value: WPScan
Published: 2023-02-13T14:32:11.163Z
CVE-2022-4459 WP Show Posts < 1.1.4 - Contributor+ Stored XSS
The WP Show Posts WordPress plugin before 1.1.4 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: WP Show Posts
default_status: unaffected
Credits: lang: en
value: Lana Codes
lang: en
value: WPScan
Published: 2023-02-06T19:59:25.734Z
CVE-2022-4460 Sidebar Widgets by CodeLights <= 1.4 - Contributor+ Stored XSS
The Sidebar Widgets by CodeLights WordPress plugin through 1.4 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as a contributor to perform Stored Cross-Site Scripting attacks, which could be used against high-privilege users such as admins.
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Sidebar Widgets by CodeLights
default_status: affected
Credits: lang: en
value: Lana Codes
lang: en
value: WPScan
Published: 2023-01-16T15:38:02.964Z
CVE-2022-4462 
An issue has been discovered in GitLab affecting all versions starting from 12.8 before 15.7.8, all versions starting from 15.8 before 15.8.4, all versions starting from 15.9 before 15.9.2. This vulnerability could allow a user to unmask the Discord Webhook URL through viewing the raw API response.
Problem types: description: Information exposure in GitLab
Affected products: vendor: GitLab
product: GitLab
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: NONE
baseScore: 5
baseSeverity: MEDIUM
Credits: lang: en
value: Thanks [vaib25vicky](https://hackerone.com/vaib25vicky) for reporting this vulnerability through our HackerOne bug bounty program
Published: 2023-03-09T00:00:00.000Z
CVE-2022-4464 Themify Portfolio Post < 1.2.1 - Contributor+ Stored XSS
Themify Portfolio Post WordPress plugin before 1.2.1 does not validate and escapes some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as a contributor to perform Stored Cross-Site Scripting attacks, which could be used against high privileged users such as admin.
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Themify Portfolio Post
default_status: unaffected
Credits: lang: en
value: Lana Codes
lang: en
value: WPScan
Published: 2023-01-16T15:37:47.997Z
CVE-2022-4465 WP Video Lightbox < 1.9.7 - Contributor+ Stored XSS
The WP Video Lightbox WordPress plugin before 1.9.7 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin.
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: WP Video Lightbox
default_status: unaffected
Credits: lang: en
value: Lana Codes
lang: en
value: WPScan
Published: 2023-01-16T15:37:40.280Z
CVE-2022-4466 WordPress Infinite Scroll - Ajax Load More < 5.6.0.3 - Contributor+ Stored XSS
The WordPress Infinite Scroll WordPress plugin before 5.6.0.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: WordPress Infinite Scroll
default_status: unaffected
Credits: lang: en
value: Lana Codes
lang: en
value: WPScan
Published: 2023-03-13T16:03:37.989Z
CVE-2022-4467 Search & Filter < 1.2.16 - Contributor+ Stored XSS
The Search & Filter WordPress plugin before 1.2.16 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin.
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Search & Filter
default_status: unaffected
Credits: lang: en
value: Lana Codes
lang: en
value: WPScan
Published: 2023-01-23T14:31:52.174Z
CVE-2022-4468 WP Recipe Maker < 8.6.1 - Contributor+ Stored XSS
The WP Recipe Maker WordPress plugin before 8.6.1 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin.
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: WP Recipe Maker
default_status: unaffected
Credits: lang: en
value: Lana Codes
lang: en
value: WPScan
Published: 2023-01-09T22:13:32.184Z
CVE-2022-4469 Simple Membership < 4.2.2 - Contributor+ Stored XSS
The Simple Membership WordPress plugin before 4.2.2 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin.
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Simple Membership
default_status: unaffected
Credits: lang: en
value: Lana Codes
lang: en
value: WPScan
Published: 2023-01-16T15:37:43.390Z
CVE-2022-4470 Widgets for Google Reviews < 9.8 - Contributor+ Stored XSS
The Widgets for Google Reviews WordPress plugin before 9.8 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Widgets for Google Reviews
default_status: unaffected
Credits: lang: en
value: Lana Codes
lang: en
value: WPScan
Published: 2023-01-30T20:31:57.105Z
CVE-2022-4471 YARPP - Yet Another Related Posts Plugin < 5.30.3 - Contributor+ Stored XSS
The YARPP WordPress plugin before 5.30.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: YARPP
default_status: unaffected
Credits: lang: en
value: Lana Codes
lang: en
value: WPScan
Published: 2023-02-13T14:32:30.170Z
CVE-2022-4472 Simple Sitemap < 3.5.8 - Contributor+ Stored XSS
The Simple Sitemap WordPress plugin before 3.5.8 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Simple Sitemap
default_status: unaffected
Credits: lang: en
value: Lana Codes
lang: en
value: WPScan
Published: 2023-01-30T20:31:35.144Z
CVE-2022-4473 Widget Shortcode <= 0.3.5 - Contributor+ Stored XSS
The Widget Shortcode WordPress plugin through 0.3.5 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Widget Shortcode
default_status: affected
Credits: lang: en
value: Lana Codes
lang: en
value: WPScan
Published: 2023-02-13T14:31:58.526Z
CVE-2022-4474 Easy Social Feed – Social Photos Gallery – Post Feed – Like Box < 6.4.0 - Contributor+ Stored XSS
The Easy Social Feed WordPress plugin before 6.4.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin.
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Easy Social Feed
default_status: unaffected
Credits: lang: en
value: Lana Codes
lang: en
value: WPScan
Published: 2023-01-23T14:31:37.923Z
CVE-2022-4475 Collapse-O-Matic < 1.8.3 - Contributor+ Stored XSS
The Collapse-O-Matic WordPress plugin before 1.8.3 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin.
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Collapse-O-Matic
default_status: unaffected
Credits: lang: en
value: Lana Codes
lang: en
value: WPScan
Published: 2023-01-23T14:31:34.811Z
CVE-2022-4476 Download Manager < 3.2.62 - Contributor+ Stored XSS
The Download Manager WordPress plugin before 3.2.62 does not validate and escapes some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as a contributor to perform Stored Cross-Site Scripting attacks against logged-in admins.
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Download Manager
default_status: unaffected
Credits: lang: en
value: Lana Codes
lang: en
value: WPScan
Published: 2023-01-16T15:38:02.126Z