rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-0406 Improper Authorization in janeczku/calibre-web
Improper Authorization in GitHub repository janeczku/calibre-web prior to 0.6.16.
Problem types: cwe_id: CWE-285
description: CWE-285 Improper Authorization
Affected products: vendor: janeczku
product: janeczku/calibre-web
Published: 2022-04-03T19:05:10.000Z
CVE-2022-0407 Heap-based Buffer Overflow in vim/vim
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.
Problem types: cwe_id: CWE-122
description: CWE-122 Heap-based Buffer Overflow
Affected products: vendor: vim
product: vim/vim
Published: 2022-01-30T13:45:52.000Z
CVE-2022-0408 Stack-based Buffer Overflow in vim/vim
Stack-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.
Problem types: cwe_id: CWE-121
description: CWE-121 Stack-based Buffer Overflow
Affected products: vendor: vim
product: vim/vim
Published: 2022-01-30T00:00:00.000Z
CVE-2022-0409 Unrestricted Upload of File with Dangerous Type in star7th/showdoc
Unrestricted Upload of File with Dangerous Type in Packagist showdoc/showdoc prior to 2.10.2.
Problem types: cwe_id: CWE-434
description: CWE-434 Unrestricted Upload of File with Dangerous Type
Affected products: vendor: star7th
product: star7th/showdoc
Published: 2022-02-19T04:35:10.000Z
CVE-2022-0410 WP Visitor Statistics (Real Time Traffic) < 5.6 - Subscriber+ SQL Injection
The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 5.6 does not sanitise and escape the id parameter before using it in a SQL statement via the refUrlDetails AJAX action, available to any authenticated user, leading to a SQL injection
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: WP Visitor Statistics (Real Time Traffic)
Credits: lang: en
value: Krzysztof Zając
Published: 2022-03-07T08:16:31.000Z
CVE-2022-0411 Asgaros Forum < 2.0.0 - Subscriber+ Blind SQL Injection
The Asgaros Forum WordPress plugin before 2.0.0 does not sanitise and escape the post_id parameter before using it in a SQL statement via a REST route of the plugin (accessible to any authenticated user), leading to a SQL injection
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: Asgaros Forum
Credits: lang: en
value: Krzysztof Zając
Published: 2022-02-28T09:06:54.000Z
CVE-2022-0412 TI WooCommerce Wishlist < 1.40.1 - Unauthenticated Blind SQL Injection
The TI WooCommerce Wishlist WordPress plugin before 1.40.1, TI WooCommerce Wishlist Pro WordPress plugin before 1.40.1 do not sanitise and escape the item_id parameter before using it in a SQL statement via the wishlist/remove_product REST endpoint, allowing unauthenticated attackers to perform SQL injection attacks
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: TemplateInvaders
product: TI WooCommerce Wishlist
vendor: TemplateInvaders
product: TI WooCommerce Wishlist Pro
Credits: lang: en
value: Krzysztof Zając
Published: 2022-02-28T09:06:56.000Z
CVE-2022-0413 Use After Free in vim/vim
Use After Free in GitHub repository vim/vim prior to 8.2.
Problem types: cwe_id: CWE-416
description: CWE-416 Use After Free
Affected products: vendor: vim
product: vim/vim
Published: 2022-01-30T00:00:00.000Z
CVE-2022-0414 Improper Validation of Specified Quantity in Input in dolibarr/dolibarr
Improper Validation of Specified Quantity in Input in Packagist dolibarr/dolibarr prior to 16.0.
Problem types: cwe_id: CWE-1284
description: CWE-1284 Improper Validation of Specified Quantity in Input
Affected products: vendor: dolibarr
product: dolibarr/dolibarr
Published: 2022-01-31T00:00:00.000Z
CVE-2022-0415 Remote Command Execution in uploading repository file in gogs/gogs
Remote Command Execution in uploading repository file in GitHub repository gogs/gogs prior to 0.12.6.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: gogs
product: gogs/gogs
Published: 2022-03-21T10:45:13.000Z
CVE-2022-0417 Heap-based Buffer Overflow in vim/vim
Heap-based Buffer Overflow GitHub repository vim/vim prior to 8.2.
Problem types: cwe_id: CWE-122
description: CWE-122 Heap-based Buffer Overflow
Affected products: vendor: vim
product: vim/vim
Published: 2022-02-01T00:00:00.000Z
CVE-2022-0418 Event List < 0.8.8 - Admin+ Stored Cross-Site Scripting
The Event List WordPress plugin before 0.8.8 does not sanitise and escape some of its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks against other admin even when the unfiltered_html is disallowed
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Event List
Credits: lang: en
value: Akash Rajendra Patil
Published: 2022-05-02T16:05:36.000Z
CVE-2022-0419 NULL Pointer Dereference in radareorg/radare2
NULL Pointer Dereference in GitHub repository radareorg/radare2 prior to 5.6.0.
Problem types: cwe_id: CWE-476
description: CWE-476 NULL Pointer Dereference
Affected products: vendor: radareorg
product: radareorg/radare2
Published: 2022-02-01T10:38:32.000Z
CVE-2022-0420 RegistrationMagic < 5.0.2.2 - Admin+ SQL Injection
The RegistrationMagic WordPress plugin before 5.0.2.2 does not sanitise and escape the rm_form_id parameter before using it in a SQL statement in the Automation admin dashboard, allowing high privilege users to perform SQL injection attacks
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: RegistrationMagic – Custom Registration Forms, User Registration and User Login Plugin
Credits: lang: en
value: qerogram
Published: 2022-03-07T08:16:33.000Z
CVE-2022-0421 Five Star Restaurant Reservations < 2.4.12 - Unauthenticated Arbitrary Payment Status Update to Stored XSS
The Five Star Restaurant Reservations WordPress plugin before 2.4.12 does not have authorisation when changing whether a payment was successful or failed, allowing unauthenticated users to change the payment status of arbitrary bookings. Furthermore, due to the lack of sanitisation and escaping, attackers could perform Cross-Site Scripting attacks against a logged in admin viewing the failed payments
Problem types: description: CWE-116 Improper Encoding or Escaping of Output
Affected products: vendor: Unknown
product: Five Star Restaurant Reservations
default_status: unaffected
Credits: lang: en
value: Krzysztof Zając
lang: en
value: WPScan
Published: 2022-11-21T00:00:00.000Z
CVE-2022-0422 White Label MS < 2.2.9 - Reflected Cross-Site Scripting
The White Label CMS WordPress plugin before 2.2.9 does not sanitise and validate the wlcms[_login_custom_js] parameter before outputting it back in the response while previewing, leading to a Reflected Cross-Site Scripting issue
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: White Label CMS
Credits: lang: en
value: Krzysztof Zając
Published: 2022-03-07T08:16:34.000Z
CVE-2022-0423 3D FlipBook < 1.12.1 - Subscriber+ Stored Cross-Site Scripting
The 3D FlipBook WordPress plugin before 1.12.1 does not have authorisation and CSRF checks when updating its settings, and does not have any sanitisation/escaping, allowing any authenticated users, such as subscriber to put Cross-Site Scripting payloads in all pages with a 3d flipbook.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: 3D FlipBook – PDF Flipbook Viewer, Flipbook Image Gallery
Credits: lang: en
value: Krzysztof Zając
Published: 2022-03-21T18:55:45.000Z
CVE-2022-0424 Popup by Supsystic < 1.10.9 - Unauthenticated Subscriber Email Addresses Disclosure
The Popup by Supsystic WordPress plugin before 1.10.9 does not have any authentication and authorisation in an AJAX action, allowing unauthenticated attackers to call it and get the email addresses of subscribed users
Problem types: cwe_id: CWE-306
description: CWE-306 Missing Authentication for Critical Function
Affected products: vendor: Unknown
product: Popup by Supsystic
Credits: lang: en
value: Felipe de Avila
Published: 2022-05-09T16:50:28.000Z
CVE-2022-0425 
A DNS rebinding vulnerability in the Irker IRC Gateway integration in all versions of GitLab CE/EE since version 7.9 allows an attacker to trigger Server Side Request Forgery (SSRF) attacks.
Problem types: description: Server-side request forgery (ssrf) in GitLab
Affected products: vendor: GitLab
product: GitLab
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: This vulnerability has been discovered internally by the GitLab team
Published: 2022-04-01T22:17:39.000Z
CVE-2022-0426 Product Feed PRO for WooCommerce < 11.2.3 - Reflected Cross-Site Scripting
The Product Feed PRO for WooCommerce WordPress plugin before 11.2.3 does not escape the rowCount parameter before outputting it back in an attribute via the woosea_categories_dropdown AJAX action (available to any authenticated user), leading to a Reflected Cross-Site Scripting
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Product Feed PRO for WooCommerce
Credits: lang: en
value: Krzysztof Zając
Published: 2022-03-07T08:16:36.000Z
CVE-2022-0427 
Missing sanitization of HTML attributes in Jupyter notebooks in all versions of GitLab CE/EE since version 14.5 allows an attacker to perform arbitrary HTTP POST requests on a user's behalf leading to potential account takeover
Problem types: description: Cross-site request forgery (csrf) in GitLab
Affected products: vendor: GitLab
product: GitLab
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.7
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N
version: 3.1
Credits: lang: en
value: Thanks [joaxcar](https://hackerone.com/joaxcar) for reporting this vulnerability through our HackerOne bug bounty program
Published: 2022-03-28T18:53:05.000Z
CVE-2022-0428 Content Egg < 5.3.0 - Reflected Cross-Site Scripting
The Content Egg WordPress plugin before 5.3.0 does not sanitise and escape the page parameter before outputting back in an attribute in the Autoblogging admin dashboard, leading to a Reflected Cross-Site Scripting
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Content Egg
Credits: lang: en
value: Krzysztof Zając
Published: 2022-05-02T16:05:37.000Z
CVE-2022-0429 WP Cerber Security, Anti-spam & Malware Scan < 8.9.6 - Unauthenticated Stored Cross-Site Scripting
The WP Cerber Security, Anti-spam & Malware Scan WordPress plugin before 8.9.6 does not sanitise the $url variable before using it in an attribute in the Activity tab in the plugins dashboard, leading to an unauthenticated stored Cross-Site Scripting vulnerability.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: WP Cerber Security, Anti-spam & Malware Scan
Credits: lang: en
value: Krzysztof Zając
Published: 2022-03-07T08:16:37.000Z
CVE-2022-0430 Exposure of Sensitive Information to an Unauthorized Actor in httpie/httpie
Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository httpie/httpie prior to 3.1.0.
Problem types: cwe_id: CWE-200
description: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: httpie
product: httpie/httpie
Published: 2022-03-15T14:20:16.000Z
CVE-2022-0431 Google Pagespeed Insights < 4.0.4 - Reflected Cross-Site Scripting
The Insights from Google PageSpeed WordPress plugin before 4.0.4 does not sanitise and escape various parameters before outputting them back in attributes in the plugin's settings dashboard, leading to Reflected Cross-Site Scripting
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Insights from Google PageSpeed
Credits: lang: en
value: Krzysztof Zając
Published: 2022-04-04T15:35:44.000Z
CVE-2022-0432 Prototype Pollution in mastodon/mastodon
Prototype Pollution in GitHub repository mastodon/mastodon prior to 3.5.0.
Problem types: cwe_id: CWE-1321
description: CWE-1321 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Affected products: vendor: mastodon
product: mastodon/mastodon
Published: 2022-02-02T20:11:08.000Z
CVE-2022-0433 
A NULL pointer dereference flaw was found in the Linux kernel's BPF subsystem in the way a user triggers the map_get_next_key function of the BPF bloom filter. This flaw allows a local user to crash the system. This flaw affects Linux kernel versions prior to 5.17-rc1.
Problem types: cwe_id: CWE-908
description: CWE-908
Affected products: vendor: n/a
product: kernel
Published: 2022-03-09T16:32:52.000Z
CVE-2022-0434 Page Views Count < 2.4.15 - Unauthenticated SQL Injection
The Page View Count WordPress plugin before 2.4.15 does not sanitise and escape the post_ids parameter before using it in a SQL statement via a REST endpoint, available to both unauthenticated and authenticated users. As a result, unauthenticated attackers could perform SQL injection attacks
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: Page View Count
Credits: lang: en
value: Krzysztof Zając
Published: 2022-03-07T08:16:39.000Z
CVE-2022-0435 
A stack overflow flaw was found in the Linux kernel's TIPC protocol functionality in the way a user sends a packet with malicious content where the number of domain member nodes is higher than the 64 allowed. This flaw allows a remote user to crash the system or possibly escalate their privileges if they have access to the TIPC network.
Problem types: cwe_id: CWE-787
description: CWE-787
Affected products: vendor: n/a
product: kernel
Published: 2022-03-25T00:00:00.000Z
CVE-2022-0436 Path Traversal in gruntjs/grunt
Path Traversal in GitHub repository gruntjs/grunt prior to 1.5.2.
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: gruntjs
product: gruntjs/grunt
Published: 2022-04-12T00:00:00.000Z
CVE-2022-0437 Cross-site Scripting (XSS) - DOM in karma-runner/karma
Cross-site Scripting (XSS) - DOM in NPM karma prior to 6.3.14.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: karma-runner
product: karma-runner/karma
Published: 2022-02-05T01:50:10.000Z
CVE-2022-0439 Email Subscribers & Newsletters < 5.3.2 - Subscriber+ Blind SQL injection
The Email Subscribers & Newsletters WordPress plugin before 5.3.2 does not correctly escape the `order` and `orderby` parameters to the `ajax_fetch_report_list` action, making it vulnerable to blind SQL injection attacks by users with roles as low as Subscriber. Further, it does not have any CSRF protection in place for the action, allowing an attacker to trick any logged in user to perform the action by clicking a link.
Problem types: description: CWE-89 SQL Injection
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: Email Subscribers & Newsletters
default_status: unaffected
Credits: lang: en
value: Krzysztof Zając
lang: en
value: WPScan
Published: 2022-03-07T08:16:41.000Z
CVE-2022-0440 Catch Themes Demo Import < 2.1.1 - Admin+ Remote Code Execution
The Catch Themes Demo Import WordPress plugin before 2.1.1 does not validate one of the file to be imported, which could allow high privivilege admin to upload an arbitrary PHP file and gain RCE even in the case of an hardened blog (ie DISALLOW_UNFILTERED_HTML, DISALLOW_FILE_EDIT and DISALLOW_FILE_MODS constants set to true)
Problem types: cwe_id: CWE-434
description: CWE-434 Unrestricted Upload of File with Dangerous Type
Affected products: vendor: Unknown
product: Catch Themes Demo Import
Credits: lang: en
value: qerogram
Published: 2022-03-07T08:16:42.000Z
CVE-2022-0441 MasterStudy LMS < 2.7.6 - Unauthenticated Admin Account Creation
The MasterStudy LMS WordPress plugin before 2.7.6 does to validate some parameters given when registering a new account, allowing unauthenticated users to register as an admin
Problem types: cwe_id: CWE-269
description: CWE-269 Improper Privilege Management
Affected products: vendor: Unknown
product: MasterStudy LMS – WordPress LMS Plugin
Credits: lang: en
value: Numan Türle
Published: 2022-03-07T08:16:43.000Z
CVE-2022-0442 UsersWP < 1.2.3.1 - Subscriber+ User Avatar Override
The UsersWP WordPress plugin before 1.2.3.1 is missing access controls when updating a user avatar, and does not make sure file names for user avatars are unique, allowing a logged in user to overwrite another users avatar.
Problem types: cwe_id: CWE-639
description: CWE-639 Authorization Bypass Through User-Controlled Key
Affected products: vendor: Unknown
product: UsersWP – User Registration & User Profile
Credits: lang: en
value: Felipe de Avila
Published: 2022-03-07T08:16:45.000Z
CVE-2022-0443 Use After Free in vim/vim
Use After Free in GitHub repository vim/vim prior to 8.2.
Problem types: cwe_id: CWE-416
description: CWE-416 Use After Free
Affected products: vendor: vim
product: vim/vim
Published: 2022-02-02T00:00:00.000Z
CVE-2022-0444 XCloner < 4.3.6 - Plugin Settings Reset
The Backup, Restore and Migrate WordPress Sites With the XCloner Plugin WordPress plugin before 4.3.6 does not have authorisation and CSRF checks when resetting its settings, allowing unauthenticated attackers to reset them, including generating a new backup encryption key.
Problem types: description: CWE-862 Missing Authorization
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: Backup, Restore and Migrate WordPress Sites With the XCloner Plugin
default_status: unaffected
Credits: lang: en
value: Krzysztof Zając
lang: en
value: WPScan
Published: 2022-06-27T08:55:47.000Z
CVE-2022-0445 WordPress Real Cookie Banner < 2.14.2 - Settings Reset via CSRF
The WordPress Real Cookie Banner: GDPR (DSGVO) & ePrivacy Cookie Consent WordPress plugin before 2.14.2 does not have CSRF checks in place when resetting its settings, allowing attackers to make a logged in admin reset them via a CSRF attack
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: WordPress Real Cookie Banner: GDPR (DSGVO) & ePrivacy Cookie Consent
Credits: lang: en
value: Krzysztof Zając
Published: 2022-03-07T08:16:46.000Z
CVE-2022-0446 Simple Banner < 2.12.0 - Admin+ Stored Cross Site Scripting
The Simple Banner WordPress plugin before 2.12.0 does not properly sanitize its "Simple Banner Text" Settings allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Simple Banner
Credits: lang: en
value: Rohan Chaudhari
Published: 2022-08-22T14:57:00.000Z
CVE-2022-0447 Post Grid < 2.1.16 - Reflected Cross-Site Scripting via post_types
The Post Grid WordPress plugin before 2.1.16 does not sanitise and escape the post_types parameter before outputting it back in the response of the post_grid_update_taxonomies_terms_by_posttypes AJAX action, available to any authenticated users, leading to a Reflected Cross-Site Scripting
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Post Grid
Credits: lang: en
value: Krzysztof Zając
Published: 2022-04-11T14:40:44.000Z
CVE-2022-0448 CP Blocks < 1.0.15 - Admin+ Stored Cross-Site Scripting
The CP Blocks WordPress plugin before 1.0.15 does not sanitise and escape its "License ID" settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: CP Blocks
Credits: lang: en
value: Shweta Mahajan
Published: 2022-03-07T08:16:48.000Z
CVE-2022-0449 Flexi - Guest Submit < 4.20 - Reflected Cross-Site Scripting
The Flexi WordPress plugin before 4.20 does not sanitise and escape various parameters before outputting them back in some pages such as the user dashboard, leading to a Reflected Cross-Site Scripting
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Flexi – Guest Submit
Credits: lang: en
value: Felipe Tapia Sasot
Published: 2022-03-14T14:41:32.000Z
CVE-2022-0450 Menu Image, Icons made easy < 3.0.8 - Subscriber+ Stored Cross-Site Scripting
The Menu Image, Icons made easy WordPress plugin before 3.0.6 does not have authorisation and CSRF checks when saving menu settings, and does not validate, sanitise and escape them. As a result, any authenticate users, such as subscriber can update the settings or arbitrary menu and put Cross-Site Scripting payloads in them which will be triggered in the related menu in the frontend
Problem types: description: CWE-116 Improper Encoding or Escaping of Output
Affected products: vendor: Unknown
product: Menu Image, Icons made easy
default_status: unaffected
Credits: lang: en
value: Krzysztof Zając
lang: en
value: WPScan
Published: 2022-03-28T17:22:50.000Z
CVE-2022-0451 Auth bypass in Dark SDK
Dart SDK contains the HTTPClient in dart:io library whcih includes authorization headers when handling cross origin redirects. These headers may be explicitly set and contain sensitive information. By default, HttpClient handles redirection logic. If a request is sent to example.com with authorization header and it redirects to an attackers site, they might not expect attacker site to receive authorization header. We recommend updating the Dart SDK to version 2.16.0 or beyond.
Problem types: cwe_id: CWE-305
description: CWE-305 Authentication Bypass by Primary Weakness
Affected products: vendor: Google LLC
product: Dart SDK
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2022-02-18T13:35:11.903Z
CVE-2022-0452 
Use after free in Safe Browsing in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.
Problem types: description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2022-04-05T00:50:34.000Z
CVE-2022-0453 
Use after free in Reader Mode in Google Chrome prior to 98.0.4758.80 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.
Problem types: description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2022-04-05T00:50:45.000Z
CVE-2022-0454 
Heap buffer overflow in ANGLE in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Problem types: description: Heap buffer overflow
Affected products: vendor: Google
product: Chrome
Published: 2022-04-05T00:51:01.000Z
CVE-2022-0455 
Inappropriate implementation in Full Screen Mode in Google Chrome on Android prior to 98.0.4758.80 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.
Problem types: description: Inappropriate implementation
Affected products: vendor: Google
product: Chrome
Published: 2022-04-05T00:51:17.000Z