rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-0456 
Use after free in Web Search in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to potentially exploit heap corruption via profile destruction.
Problem types: description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2022-04-05T00:51:19.000Z
CVE-2022-0457 
Type confusion in V8 in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Problem types: description: Type Confusion
Affected products: vendor: Google
product: Chrome
Published: 2022-04-05T00:51:20.000Z
CVE-2022-0458 
Use after free in Thumbnail Tab Strip in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Problem types: description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2022-04-05T00:51:22.000Z
CVE-2022-0459 
Use after free in Screen Capture in Google Chrome prior to 98.0.4758.80 allowed a remote attacker who had compromised the renderer process and convinced a user to engage in specific user interaction to potentially exploit heap corruption via a crafted HTML page.
Problem types: description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2022-04-05T00:51:23.000Z
CVE-2022-0460 
Use after free in Window Dialogue in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Problem types: description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2022-04-05T00:51:25.000Z
CVE-2022-0461 
Policy bypass in COOP in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to bypass iframe sandbox via a crafted HTML page.
Problem types: description: Policy bypass
Affected products: vendor: Google
product: Chrome
Published: 2022-04-05T00:51:26.000Z
CVE-2022-0462 
Inappropriate implementation in Scroll in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
Problem types: description: Inappropriate implementation
Affected products: vendor: Google
product: Chrome
Published: 2022-04-05T00:51:28.000Z
CVE-2022-0463 
Use after free in Accessibility in Google Chrome prior to 98.0.4758.80 allowed a remote attacker who convinced a user to engage in specific user interaction to potentially exploit heap corruption via user interaction.
Problem types: description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2022-04-05T00:51:29.000Z
CVE-2022-0464 
Use after free in Accessibility in Google Chrome prior to 98.0.4758.80 allowed a remote attacker who convinced a user to engage in specific user interaction to potentially exploit heap corruption via user interaction.
Problem types: description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2022-04-05T00:51:30.000Z
CVE-2022-0465 
Use after free in Extensions in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to potentially exploit heap corruption via user interaction.
Problem types: description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2022-04-05T00:51:32.000Z
CVE-2022-0466 
Inappropriate implementation in Extensions Platform in Google Chrome prior to 98.0.4758.80 allowed an attacker who convinced a user to install a malicious extension to potentially perform a sandbox escape via a crafted HTML page.
Problem types: description: Inappropriate implementation
Affected products: vendor: Google
product: Chrome
Published: 2022-04-05T00:51:33.000Z
CVE-2022-0467 
Inappropriate implementation in Pointer Lock in Google Chrome on Windows prior to 98.0.4758.80 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.
Problem types: description: Inappropriate implementation
Affected products: vendor: Google
product: Chrome
Published: 2022-04-05T00:51:35.000Z
CVE-2022-0468 
Use after free in Payments in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Problem types: description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2022-04-05T00:51:36.000Z
CVE-2022-0469 
Use after free in Cast in Google Chrome prior to 98.0.4758.80 allowed a remote attacker who convinced a user to engage in specific interactions to potentially exploit heap corruption via a crafted HTML page.
Problem types: description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2022-04-05T00:51:38.000Z
CVE-2022-0470 
Out of bounds memory access in V8 in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Problem types: description: Out of bounds memory access
Affected products: vendor: Google
product: Chrome
Published: 2022-04-05T00:51:39.000Z
CVE-2022-0471 Favicon by RealFaviconGenerator < 1.3.23 - Reflected Cross-Site Scripting
The Favicon by RealFaviconGenerator WordPress plugin before 1.3.23 does not properly sanitise and escape the json_result_url parameter before outputting it back in the Favicon admin dashboard, leading to a Reflected Cross-Site Scripting issue
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Favicon by RealFaviconGenerator
Credits: lang: en
value: Krzysztof Zając
Published: 2022-04-11T14:40:46.000Z
CVE-2022-0472 Unrestricted Upload of File with Dangerous Type in jsdecena/laracom
Unrestricted Upload of File with Dangerous Type in Packagist jsdecena/laracom prior to v2.0.9.
Problem types: cwe_id: CWE-434
description: CWE-434 Unrestricted Upload of File with Dangerous Type
Affected products: vendor: jsdecena
product: jsdecena/laracom
Published: 2022-02-04T22:32:06.000Z
CVE-2022-0473 Dynamic field error message is vulnerable to XSS
OTRS administrators can configure dynamic field and inject malicious JavaScript code in the error message of the regular expression check. When used in the agent interface, malicious code might be exectued in the browser. This issue affects: OTRS AG OTRS 7.0.x version: 7.0.31 and prior versions.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: OTRS AG
product: OTRS
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 3.8
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
version: 3.1
Published: 2022-02-07T10:25:11.723Z
CVE-2022-0474 Disclosure of  mail addresses
Full list of recipients from customer users in a contact field could be disclosed in notification emails event when the notification is set to be sent to each recipient individually. This issue affects: OTRS AG OTRSCustomContactFields 8.0.x version: 8.0.11 and prior versions.
Problem types: cwe_id: CWE-200
description: CWE-200 Information Exposure
Affected products: vendor: OTRS AG
product: OTRSCustomContactFields
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 2.4
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N
version: 3.1
Published: 2022-02-07T10:25:13.232Z
CVE-2022-0475 Possible XSS attack via translation
Malicious translator is able to inject JavaScript code in few translatable strings (where HTML is allowed). The code could be executed in the Package manager. This issue affects: OTRS AG OTRS 7.0.x version: 7.0.32 and prior versions, 8.0.x version: 8.0.19 and prior versions.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: OTRS AG
product: OTRS
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 3.5
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: Special thanks to Balázs Úr for reporting these vulnerability.
Published: 2022-03-21T09:15:38.679Z
CVE-2022-0476 Denial of Service in radareorg/radare2
Denial of Service in GitHub repository radareorg/radare2 prior to 5.6.4.
Problem types: cwe_id: CWE-400
description: CWE-400 Uncontrolled Resource Consumption
Affected products: vendor: radareorg
product: radareorg/radare2
Published: 2022-02-23T16:40:10.000Z
CVE-2022-0477 
An issue has been discovered in GitLab affecting all versions starting from 11.9 before 14.5.4, all versions starting from 14.6.0 before 14.6.4, all versions starting from 14.7.0 before 14.7.1. GitLab was not correctly handling bulk requests to delete existing packages from the package registries which could result in a Denial of Service under specific conditions.
Problem types: description: Uncontrolled resource consumption in GitLab
Affected products: vendor: GitLab
product: GitLab
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 4.9
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: This vulnerability has been discovered internally by the GitLab team
Published: 2022-04-25T16:35:06.000Z
CVE-2022-0478 Event Manager for WooCommerce < 3.5.8 - Contributor+ SQL Injection
The Event Manager and Tickets Selling for WooCommerce WordPress plugin before 3.5.8 does not validate and escape the post_author_gutenberg parameter before using it in a SQL statement when creating/editing events, which could allow users with a role as low as contributor to perform SQL Injection attacks
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: Event Manager and Tickets Selling Plugin for WooCommerce
Credits: lang: en
value: Rafael Castilho
Published: 2022-03-14T14:41:34.000Z
CVE-2022-0479 Popup Builder < 4.1.1 - SQL Injection to Reflected Cross-Site Scripting
The Popup Builder WordPress plugin before 4.1.1 does not sanitise and escape the sgpb-subscription-popup-id parameter before using it in a SQL statement in the All Subscribers admin dashboard, leading to a SQL injection, which could also be used to perform Reflected Cross-Site Scripting attack against a logged in admin opening a malicious link
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: Popup Builder – Create highly converting, mobile friendly marketing popups.
Credits: lang: en
value: Krzysztof Zając
Published: 2022-03-28T17:22:51.000Z
CVE-2022-0480 
A flaw was found in the filelock_init in fs/locks.c function in the Linux kernel. This issue can lead to host memory exhaustion due to memcg not limiting the number of Portable Operating System Interface (POSIX) file locks.
Problem types: cwe_id: CWE-770
description: CWE-770 - Allocation of Resources Without Limits or Throttling.
Affected products: vendor: n/a
product: kernel
Published: 2022-08-29T14:03:04.000Z
CVE-2022-0481 NULL Pointer Dereference in mruby/mruby
NULL Pointer Dereference in Homebrew mruby prior to 3.2.
Problem types: cwe_id: CWE-476
description: CWE-476 NULL Pointer Dereference
Affected products: vendor: mruby
product: mruby/mruby
Published: 2022-02-04T22:33:00.000Z
CVE-2022-0482 Exposure of Private Personal Information to an Unauthorized Actor in alextselegidis/easyappointments
Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository alextselegidis/easyappointments prior to 1.4.3.
Problem types: cwe_id: CWE-359
description: CWE-359 Exposure of Private Personal Information to an Unauthorized Actor
Affected products: vendor: alextselegidis
product: alextselegidis/easyappointments
Published: 2022-03-09T10:20:10.000Z
CVE-2022-0483 Local privilege escalation due to insecure folder permissions
Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis VSS Doctor (Windows) before build 53
Problem types: cwe_id: CWE-427
description: CWE-427
Affected products: vendor: Acronis
product: Acronis VSS Doctor
Published: 2022-02-11T17:40:41.425Z
CVE-2022-0484 Improper URL Validation causes Mirantis Container Cloud Lens Extension to open external programs
Lack of validation of URLs causes Mirantis Container Cloud Lens Extension before v3.1.1 to open external programs other than the default browser to perform sign on to a new cluster. An attacker could host a webserver which serves a malicious Mirantis Container Cloud configuration file and induce the victim to add a new cluster via its URL. This issue affects: Mirantis Mirantis Container Cloud Lens Extension v3 versions prior to v3.1.1.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Mirantis
product: Mirantis Container Cloud Lens Extension
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Mirantis PSIRT
Published: 2022-02-04T22:29:20.398Z
CVE-2022-0485 
A flaw was found in the copying tool `nbdcopy` of libnbd. When performing multi-threaded copies using asynchronous nbd calls, nbdcopy was blindly treating the completion of an asynchronous command as successful, rather than checking the *error parameter. This could result in the silent creation of a corrupted destination image.
Problem types: cwe_id: CWE-252
description: CWE-252 - Unchecked Return Value.
Affected products: vendor: n/a
product: libnbd
Published: 2022-08-29T14:03:04.000Z
CVE-2022-0486 Privileged Command Injection Vulnerability in Fidelis Network and Deception
Improper file permissions in the CommandPost, Collector, Sensor, and Sandbox components of Fidelis Network and Deception enables an attacker with local, administrative access to the CLI to modify affected files and enable escalation of privileges equivalent to the root user. The vulnerability is present in Fidelis Network and Deception versions prior to 9.4.5. Patches and updates are available to address this vulnerability.
Problem types: cwe_id: CWE-276
description: CWE-276 Incorrect Default Permissions
Affected products: vendor: Fidelis Cybersecurity
product: Fidelis Network
vendor: Fidelis Cybersecurity
product: Fidelis Deception
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 4.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: Henry Reed, The Aerospace Corporation
Published: 2022-05-17T19:32:58.251Z
CVE-2022-0487 
A use-after-free vulnerability was found in rtsx_usb_ms_drv_remove in drivers/memstick/host/rtsx_usb_ms.c in memstick in the Linux kernel. In this flaw, a local attacker with a user privilege may impact system Confidentiality. This flaw affects kernel versions prior to 5.14 rc1.
Problem types: cwe_id: CWE-416
description: CWE-416
Affected products: vendor: n/a
product: kernel
Published: 2022-02-04T22:29:21.000Z
CVE-2022-0488 
An issue has been discovered in GitLab CE/EE affecting all versions starting with version 8.10. It was possible to trigger a timeout on a page with markdown by using a specific amount of block-quotes.
Problem types: description: Uncontrolled resource consumption in GitLab
Affected products: vendor: GitLab
product: GitLab
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 3.5
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L
version: 3.1
Credits: lang: en
value: This vulnerability was found internally by a member of the GitLab team.
Published: 2022-03-28T18:53:08.000Z
CVE-2022-0489 
An issue has been discovered in GitLab CE/EE affecting all versions starting with 8.15 . It was possible to trigger a DOS by using the math feature with a specific formula in issue comments.
Problem types: description: Uncontrolled resource consumption in GitLab
Affected products: vendor: GitLab
product: GitLab
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 3.5
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L
version: 3.1
Credits: lang: en
value: Thanks @cancerz, for reporting this vulnerability through our HackerOne bug bounty program
Published: 2022-04-01T22:17:35.000Z
CVE-2022-0492 
A vulnerability was found in the Linux kernel’s cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function. This flaw, under certain circumstances, allows the use of the cgroups v1 release_agent feature to escalate privileges and bypass the namespace isolation unexpectedly.
Problem types: cwe_id: CWE-287
description: CWE-287
Affected products: vendor: n/a
product: kernel
Published: 2022-03-03T00:00:00.000Z
CVE-2022-0493 String Locator < 2.5.0 - Admin+ Arbitrary File Read
The String locator WordPress plugin before 2.5.0 does not properly validate the path of the files to be searched, allowing high privilege users such as admin to query arbitrary files on the web server via a path traversal vector. Furthermore, due to a flaw in the search, allowing a pattern to be provided, which will be used to output the relevant matches from the matching file, all content of the file can be disclosed.
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: Unknown
product: String locator
Credits: lang: en
value: qerogram
Published: 2022-03-28T17:22:54.000Z
CVE-2022-0494 
A kernel information leak flaw was identified in the scsi_ioctl function in drivers/scsi/scsi_ioctl.c in the Linux kernel. This flaw allows a local attacker with a special user privilege (CAP_SYS_ADMIN or CAP_SYS_RAWIO) to create issues with confidentiality.
Problem types: cwe_id: CWE-200
description: CWE-200
Affected products: vendor: n/a
product: kernel
Published: 2022-03-25T18:03:05.000Z
CVE-2022-0495 SQL Injection in KOHA
The library automation system product KOHA developed by Parantez Teknoloji before version 19.05.03 has an unauthenticated SQL Injection vulnerability. This has been fixed in the version 19.05.03.01.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Parantez Teknoloji
product: Parantez Teknoloji
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: LOW
baseSeverity: CRITICAL
baseScore: 9.4
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
Credits: lang: en
value: Bartu Utku Sarp
Published: 2022-09-21T08:45:20.355Z
CVE-2022-0496 
A vulnerbiility was found in Openscad, where a DXF-format drawing with particular (not necessarily malformed!) properties may cause an out-of-bounds memory access when imported using import().
Problem types: cwe_id: CWE-119
description: CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer.
Affected products: vendor: n/a
product: openscad
Published: 2022-08-29T14:03:04.000Z
CVE-2022-0497 
A vulnerbiility was found in Openscad, where a .scad file with no trailing newline could cause an out-of-bounds read during parsing of annotations.
Problem types: cwe_id: CWE-125
description: CWE-125 - Out-of-bounds Read.
Affected products: vendor: n/a
product: openscad
Published: 2022-08-29T14:03:04.000Z
CVE-2022-0499 Sermon Browser <= 0.45.22 - Arbitrary File Upload via CSRF
The Sermon Browser WordPress plugin through 0.45.22 does not have CSRF checks in place when uploading Sermon files, and does not validate them in any way, allowing attackers to make a logged in admin upload arbitrary files such as PHP ones.
Problem types: cwe_id: CWE-434
description: CWE-434 Unrestricted Upload of File with Dangerous Type
cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: Sermon Browser
Credits: lang: en
value: Krishna Harsha Kondaveeti
Published: 2022-03-28T17:22:55.000Z
CVE-2022-0500 
A flaw was found in unrestricted eBPF usage by the BPF_BTF_LOAD, leading to a possible out-of-bounds memory write in the Linux kernel’s BPF subsystem due to the way a user loads BTF. This flaw allows a local user to crash or escalate their privileges on the system.
Problem types: cwe_id: CWE-119
description: CWE-119
Affected products: vendor: n/a
product: kernel
Published: 2022-03-25T18:03:03.000Z
CVE-2022-0501 Cross-site Scripting (XSS) - Reflected in ptrofimov/beanstalk_console
Cross-site Scripting (XSS) - Reflected in Packagist ptrofimov/beanstalk_console prior to 1.7.12.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: ptrofimov
product: ptrofimov/beanstalk_console
Published: 2022-02-05T15:55:09.000Z
CVE-2022-0502 Cross-site Scripting (XSS) - Stored in livehelperchat/livehelperchat
Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: livehelperchat
product: livehelperchat/livehelperchat
Published: 2022-02-06T10:50:10.000Z
CVE-2022-0503 Multisite Content Copier/Updater < 2.1.2 - Reflected Cross-Site Scripting
The WordPress Multisite Content Copier/Updater WordPress plugin before 2.1.2 does not sanitise and escape the s parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue in the network dashboard
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: WordPress Multisite Content Copier/Updater
Credits: lang: en
value: Asif Nawaz Minhas
Published: 2022-03-14T14:41:35.000Z
CVE-2022-0504 Generation of Error Message Containing Sensitive Information in microweber/microweber
Generation of Error Message Containing Sensitive Information in Packagist microweber/microweber prior to 1.2.11.
Problem types: cwe_id: CWE-209
description: CWE-209 Generation of Error Message Containing Sensitive Information
Affected products: vendor: microweber
product: microweber/microweber
Published: 2022-02-08T08:55:21.000Z
CVE-2022-0505 Cross-Site Request Forgery (CSRF) in microweber/microweber
Cross-Site Request Forgery (CSRF) in Packagist microweber/microweber prior to 1.2.11.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: microweber
product: microweber/microweber
Published: 2022-02-08T08:55:16.000Z
CVE-2022-0506 Cross-site Scripting (XSS) - Stored in microweber/microweber
Cross-site Scripting (XSS) - Stored in Packagist microweber/microweber prior to 1.2.11.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: microweber
product: microweber/microweber
Published: 2022-02-08T08:55:10.000Z