rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-3897 WP Affiliate Platform <= 6.3.9 - Authenticated (Administrator+) Stored Cross-Site Scripting
The WP Affiliate Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in versions up to, and including, 6.3.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: tipsandtrickshq
product: WP Affiliate Platform
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N
baseScore: 5.5
baseSeverity: MEDIUM
Credits: lang: en
value: Marco Wotschka
Published: 2022-11-29T20:42:01.833Z
CVE-2022-3898 WP Affiliate Platform <= 6.3.9 - Cross-Site Request Forgery
The WP Affiliate Platform plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 6.3.9. This is due to missing or incorrect nonce validation on various functions including the affiliates_menu method. This makes it possible for unauthenticated attackers to delete affiliate records, via forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: tipsandtrickshq
product: WP Affiliate Platform
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
baseScore: 8.8
baseSeverity: HIGH
Credits: lang: en
value: Marco Wotschka
Published: 2022-11-29T20:42:19.502Z
CVE-2022-3899 3DPrint < 3.5.6.9 - Arbitrary File and Directory Deletion via CSRF
The 3dprint WordPress plugin before 3.5.6.9 does not protect against CSRF attacks in the modified version of Tiny File Manager included with the plugin, allowing an attacker to craft a malicious request that will delete any number of files or directories on the target server by tricking a logged in admin into submitting a form.
Problem types: description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: 3dprint
default_status: unaffected
Credits: lang: en
value: WPScan team
lang: en
value: WPScan
Published: 2024-01-16T15:50:51.026Z
CVE-2022-3900 Cooked Pro < 1.7.5.7 - Unauthenticated PHP Object Injection
The Cooked Pro WordPress plugin before 1.7.5.7 does not properly validate or sanitize the recipe_args parameter before unserializing it in the cooked_loadmore action, allowing an unauthenticated attacker to trigger a PHP Object injection vulnerability.
Problem types: description: CWE-502 Deserialization of Untrusted Data
Affected products: vendor: Unknown
product: Cooked Pro
default_status: unaffected
Credits: lang: en
value: Marcin Motwicki
Published: 2022-12-12T17:57:08.950Z
CVE-2022-3901 Visioweb.js - Prototype Pollution can results in XSS
Prototype Pollution in Visioweb.js 1.10.6 allows attackers to execute XSS on the client system.
Problem types: cwe_id: CWE-1321
description: CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Affected products: vendor: Visio Globe
product: Visioweb
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.2
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: Jan-Jaap Korpershoek
lang: en
value: Victor Pasman (DIVD)
Published: 2023-02-20T18:07:34.082Z
CVE-2022-3902 
An issue has been discovered in GitLab affecting all versions starting from 9.3 before 15.4.6, all versions starting from 15.5 before 15.5.5, all versions starting from 15.6 before 15.6.1. It was possible for a project maintainer to unmask webhook secret tokens by reviewing the logs after testing webhooks.
Problem types: description: Information exposure in GitLab
Affected products: vendor: GitLab
product: GitLab
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
baseScore: 5.5
baseSeverity: MEDIUM
Credits: lang: en
value: Thanks [joaxcar](https://hackerone.com/joaxcar) for reporting this vulnerability through our HackerOne bug bounty program
Published: 2023-01-24T00:00:00.000Z
CVE-2022-3903 
An incorrect read request flaw was found in the Infrared Transceiver USB driver in the Linux kernel. This issue occurs when a user attaches a malicious USB device. A local user could use this flaw to starve the resources, causing denial of service or potentially crashing the system.
Problem types: cwe_id: CWE-843
description: CWE-843
Affected products: vendor: n/a
product: Kernel
Published: 2022-11-14T00:00:00.000Z
CVE-2022-3904 MonsterInsights < 8.9.1 - Stored Cross-Site Scripting via Google Analytics
The MonsterInsights WordPress plugin before 8.9.1 does not sanitize or escape page titles in the top posts/pages section, allowing an unauthenticated attacker to inject arbitrary web scripts into the titles by spoofing requests to google analytics.
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: MonsterInsights
default_status: unaffected
Credits: lang: en
value: Grzegorz Niedziela
lang: en
value: WPScan
Published: 2023-01-16T15:37:44.169Z
CVE-2022-3906 Easy Form Builder < 3.4.0 - Admin+ Stored XSS
The Easy Form Builder WordPress plugin before 3.4.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Easy Form Builder
default_status: unaffected
Credits: lang: en
value: Vaibhav Koli
Published: 2022-12-12T17:54:52.119Z
CVE-2022-3907 Clerk < 4.0.0 - Authentication Bypass and API Keys Disclosure
The Clerk WordPress plugin before 4.0.0 is affected by time-based attacks in the validation function for all API requests due to the usage of comparison operators to verify API keys against the ones stored in the site options.
Problem types: description: CWE-203 Observable Discrepancy
Affected products: vendor: Unknown
product: Clerk
default_status: unaffected
Credits: lang: en
value: Francesco Carlucci
lang: en
value: WPScan
Published: 2022-12-05T16:50:39.205Z
CVE-2022-3908 Helloprint < 1.4.7 - Reflected Cross-Site Scripting
The Helloprint WordPress plugin before 1.4.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Plug your WooCommerce into the largest catalog of customized print products from Helloprint
default_status: unaffected
Credits: lang: en
value: roguethread
Published: 2022-12-12T17:54:33.163Z
CVE-2022-3909 Add Comments <= 1.0.1 - Admin+ Stored XSS
The Add Comments WordPress plugin through 1.0.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Add Comments
default_status: affected
Credits: lang: en
value: roguethread
Published: 2022-12-05T16:50:29.823Z
CVE-2022-3910 Use after free in IO_uring in the Linux Kernel
Use After Free vulnerability in Linux Kernel allows Privilege Escalation. An improper Update of Reference Count in io_uring leads to Use-After-Free and Local Privilege Escalation.
When io_msg_ring was invoked with a fixed file, it called io_fput_file() which improperly decreased its reference count (leading to Use-After-Free and Local Privilege Escalation). Fixed files are permanently registered to the ring, and should not be put separately.

We recommend upgrading past commit  https://github.com/torvalds/linux/commit/fc7222c3a9f56271fba02aabbfbae999042f1679 https://github.com/torvalds/linux/commit/fc7222c3a9f56271fba02aabbfbae999042f1679 

Problem types: cwe_id: CWE-416
description: CWE-416 Use After Free
Affected products: vendor: Linux
product: Linux Kernel
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Bing-Jhong Billy Jheng of Starlabs
Published: 2022-11-22T12:12:16.700Z
CVE-2022-3911 iubenda < 3.3.3 - Subscriber+ Privileges Escalation to Admin
The iubenda WordPress plugin before 3.3.3 does does not have authorisation and CSRF in an AJAX action, and does not ensure that the options to be updated belong to the plugin as long as they are arrays. As a result, any authenticated users, such as subscriber can grant themselves any privileges, such as edit_plugins etc
Problem types: description: CWE-862 Missing Authorization
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more
default_status: unaffected
Credits: lang: en
value: Krzysztof Zajac
lang: en
value: WPScan
Published: 2023-01-02T21:49:36.753Z
CVE-2022-3912 User Registration < 2.2.4.1 - Subscriber+ Arbitrary File Upload
The User Registration WordPress plugin before 2.2.4.1 does not properly restrict the files to be uploaded via an AJAX action available to both unauthenticated and authenticated users, which could allow unauthenticated users to upload PHP files for example.
Problem types: description: CWE-434 Unrestricted Upload of File with Dangerous Type
Affected products: vendor: Unknown
product: User Registration
default_status: unaffected
Credits: lang: en
value: cydave
Published: 2022-12-12T17:54:35.983Z
CVE-2022-3913 Rapid7 Nexpose Certificate Validation Issue
Rapid7 Nexpose and InsightVM versions 6.6.82 through 6.6.177 fail to validate the certificate of the update server when downloading updates. This failure could allow an attacker in a privileged position on the network to provide their own HTTPS endpoint, or intercept communications to the legitimate endpoint. The attacker would need some pre-existing access to at least one node on the network path between the Rapid7-controlled update server and the Nexpose/InsightVM application, and the ability to either spoof the update server's FQDN or redirect legitimate traffic to the attacker's server in order to exploit this vulnerability. Note that even in this scenario, an attacker could not normally replace an update package with a malicious package, since the update process validates a separate, code-signing certificate, distinct from the HTTPS certificate used for communication. This issue was resolved on February 1, 2023 in update 6.6.178 of Nexpose and InsightVM.





Problem types: cwe_id: CWE-295
description: CWE-295 Improper Certificate Validation
Affected products: vendor: Rapid7
product: Nexpose
default_status: unaffected
vendor: Rapid7
product: InsightVM
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: ADJACENT_NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2023-02-01T21:52:21.959Z
CVE-2022-3915 Dokan < 3.7.6 - Unauthenticated SQLi
The Dokan WordPress plugin before 3.7.6 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users
Problem types: description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: Dokan
default_status: unaffected
Credits: lang: en
value: cydave
Published: 2022-12-12T17:54:43.952Z
CVE-2022-3916 Keycloak: session takeover with oidc offline refreshtokens
A flaw was found in the offline_access scope in Keycloak. This issue would affect users of shared computers more (especially if cookies are not cleared), due to a lack of root session validation, and the reuse of session ids across root and user authentication sessions. This enables an attacker to resolve a user session attached to a previously authenticated user; when utilizing the refresh token, they will be issued a token for the original user.
Problem types: cwe_id: CWE-384
description: Session Fixation
Affected products: vendor: Red Hat
product: Red Hat Single Sign-On 7
cpes: cpe:/a:redhat:red_hat_single_sign_on:7.6
default_status: unaffected
vendor: Red Hat
product: Red Hat Single Sign-On 7.6.1
cpes: cpe:/a:redhat:red_hat_single_sign_on:7.6.1
default_status: unaffected
vendor: Red Hat
product: Red Hat Single Sign-On 7.6 for RHEL 7
cpes: cpe:/a:redhat:red_hat_single_sign_on:7.6::el7
default_status: affected
vendor: Red Hat
product: Red Hat Single Sign-On 7.6 for RHEL 7
cpes: cpe:/a:redhat:red_hat_single_sign_on:7.6::el7
default_status: affected
vendor: Red Hat
product: Red Hat Single Sign-On 7.6 for RHEL 8
cpes: cpe:/a:redhat:red_hat_single_sign_on:7.6::el8
default_status: affected
vendor: Red Hat
product: Red Hat Single Sign-On 7.6 for RHEL 8
cpes: cpe:/a:redhat:red_hat_single_sign_on:7.6::el8
default_status: affected
vendor: Red Hat
product: Red Hat Single Sign-On 7.6 for RHEL 9
cpes: cpe:/a:redhat:red_hat_single_sign_on:7.6::el9
default_status: affected
vendor: Red Hat
product: Red Hat Single Sign-On 7.6 for RHEL 9
cpes: cpe:/a:redhat:red_hat_single_sign_on:7.6::el9
default_status: affected
vendor: Red Hat
product: RHEL-8 based Middleware Containers
cpes: cpe:/a:redhat:rhosemc:1.0::el8
default_status: affected
vendor: Red Hat
product: RHEL-8 based Middleware Containers
cpes: cpe:/a:redhat:rhosemc:1.0::el8
default_status: affected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.8
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
version: 3.1
Credits: lang: en
value: Red Hat would like to thank Peter Flintholm (Trifork) for reporting this issue.
Published: 2023-09-20T14:28:52.089Z
CVE-2022-3917 
Improper access control of bootloader function was discovered in Motorola Mobility Motorola e20 prior to version RONS31.267-38-8 allows attacker with local access to read partition or RAM data.
Problem types: cwe_id: CWE-200
description: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: Motorola
product: Moto e20
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: PHYSICAL
availabilityImpact: NONE
baseScore: 4.6
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Motorola Mobility thanks David Lodge from Pen Test Partners for reporting this issue
Published: 2022-12-14T21:06:56.816Z
CVE-2022-3918 
A program using FoundationNetworking in swift-corelibs-foundation is potentially vulnerable to CRLF ( ) injection in URLRequest headers. In this vulnerability, a client can insert one or several CRLF sequences into a URLRequest header value. When that request is sent via URLSession to an HTTP server, the server may interpret the content after the CRLF as extra headers, or even a second request. For example, consider a URLRequest to http://example.com/ with the GET method. Suppose we set the URLRequest header "Foo" to the value "Bar Extra-Header: Added GET /other HTTP/1.1". When this request is sent, it will appear to the server as two requests: GET / HTTP/1.1 Foo: Bar Extra-Header: Added GET /other HTTP/1.1 In this manner, the client is able to inject extra headers and craft an entirely new request to a separate path, despite only making one API call in URLSession. If a developer has total control over the request and its headers, this vulnerability may not pose a threat. However, this vulnerability escalates if un-sanitized user input is placed in header values. If so, a malicious user could inject new headers or requests to an intermediary or backend server. Developers should be especially careful to sanitize user input in this case, or upgrade their version of swift-corelibs-foundation to include the patch below.
Problem types: description: CWE 113: Improper Neutralization of CRLF Sequences in HTTP Headers
Affected products: vendor: Swift Project
product: Swift Foundation
Published: 2023-01-20T00:00:00.000Z
CVE-2022-3919 Jetpack CRM < 5.4.3 - Admin+ Cross-Site Scripting
The Jetpack CRM WordPress plugin before 5.4.3 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Jetpack CRM
default_status: unaffected
Credits: lang: en
value: zhangyunpei
Published: 2022-12-12T17:54:41.219Z
CVE-2022-3920 Consul Peering Imported Nodes/Services Leak
HashiCorp Consul and Consul Enterprise 1.13.0 up to 1.13.3 do not filter cluster filtering's imported nodes and services for HTTP or RPC endpoints used by the UI. Fixed in 1.14.0.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: HashiCorp
product: Consul
default_status: unaffected
vendor: HashiCorp
product: Consul Enterprise
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: NONE
baseSeverity: MEDIUM
baseScore: 5.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Published: 2022-11-15T23:25:30.161Z
CVE-2022-3921 Listingo < 3.2.7 - Unauthenticated Arbitrary File Upload
The Listingo WordPress theme before 3.2.7 does not validate files to be uploaded via an AJAX action available to unauthenticated users, which could allow them to upload arbitrary files and lead to RCE
Problem types: description: CWE-434 Unrestricted Upload of File with Dangerous Type
Affected products: vendor: Unknown
product: Listingo
default_status: unaffected
Credits: lang: en
value: Fioravante Souza
Published: 2022-12-12T17:57:09.917Z
CVE-2022-3922 Broken Link Checker < 1.11.20 - Admin+ Cross-Site Scripting
The Broken Link Checker WordPress plugin before 1.11.20 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Broken Link Checker
default_status: unaffected
Credits: lang: en
value: Jihoon Lee (AhnLab)
Published: 2022-12-28T10:37:25.022Z
CVE-2022-3923 ActiveCampaign for WooCommerce < 1.9.8 - Subscriber+ Error Log Cleanup
The ActiveCampaign for WooCommerce WordPress plugin before 1.9.8 does not have authorisation check when cleaning up its error logs via an AJAX action, which could allow any authenticated users, such as subscriber to call it and remove error logs.
Problem types: description: CWE-862 Missing Authorization
Affected products: vendor: Unknown
product: ActiveCampaign for WooCommerce
default_status: unaffected
Credits: lang: en
value: Lana Codes
lang: en
value: WPScan
Published: 2023-01-09T22:13:35.534Z
CVE-2022-3924 named configured to answer from stale cache may terminate unexpectedly at recursive-clients soft quota
This issue can affect BIND 9 resolvers with `stale-answer-enable yes;` that also make use of the option `stale-answer-client-timeout`, configured with a value greater than zero.

If the resolver receives many queries that require recursion, there will be a corresponding increase in the number of clients that are waiting for recursion to complete. If there are sufficient clients already waiting when a new client query is received so that it is necessary to SERVFAIL the longest waiting client (see BIND 9 ARM `recursive-clients` limit and soft quota), then it is possible for a race to occur between providing a stale answer to this older client and sending an early timeout SERVFAIL, which may cause an assertion failure.
This issue affects BIND 9 versions 9.16.12 through 9.16.36, 9.18.0 through 9.18.10, 9.19.0 through 9.19.8, and 9.16.12-S1 through 9.16.36-S1.
Problem types: description: n/a
Affected products: vendor: ISC
product: BIND 9
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
baseScore: 7.5
baseSeverity: HIGH
Credits: lang: en
value: ISC would like to thank Maksym Odinintsev from AWS for bringing this vulnerability to our attention.
Published: 2023-01-25T21:39:49.110Z
CVE-2022-3925 Buddybadges <= 1.0.0 - Admin+ SQLi
The buddybadges WordPress plugin through 1.0.0 does not sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users
Problem types: description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: buddybadges
default_status: affected
Credits: lang: en
value: Kunal Sharma (University of Kaiserslautern)
lang: en
value: Daniel Krohmer (Fraunhofer IESE)
Published: 2022-12-12T17:54:38.632Z
CVE-2022-3926 WP OAuth Server < 3.4.2 - Client Secret Regeneration via CSRF
The WP OAuth Server (OAuth Authentication) WordPress plugin before 3.4.2 does not have CSRF check when regenerating secrets, which could allow attackers to make logged in admins regenerate the secret of an arbitrary client given they know the client ID
Problem types: description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: WP OAuth Server (OAuth Authentication)
default_status: unaffected
Credits: lang: en
value: Lana Codes
Published: 2022-12-05T16:50:35.245Z