rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-26340 
On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all versions of 12.1.x and 11.6.x, and F5 BIG-IQ Centralized Management all versions of 8.x and 7.x, an authenticated, high-privileged attacker with no bash access may be able to access Certificate and Key files using Secure Copy (SCP) protocol from a remote system. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
Problem types: cwe_id: CWE-732
description: CWE-732 Incorrect Permission Assignment for Critical Resource
Affected products: vendor: F5
product: BIG-IP
vendor: F5
product: BIG-IQ Centralized Management
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.9
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: This issue was reported to F5 by a source that chooses to remain anonymous.
Published: 2022-05-05T16:24:57.907Z
CVE-2022-26341 
Insufficiently protected credentials in software in Intel(R) AMT SDK before version 16.0.4.1, Intel(R) EMA before version 1.7.1 and Intel(R) MC before version 2.3.2 may allow an authenticated user to potentially enable escalation of privilege via network access.
Problem types: description: escalation of privilege
Affected products: vendor: n/a
product: Intel(R) AMT SDK, Intel(R) EMA and Intel(R) MC
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 8.2
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
Published: 2022-11-11T15:47:12.330Z
CVE-2022-26342 
A buffer overflow vulnerability exists in the confsrv ucloud_set_node_location functionality of TCL LinkHub Mesh Wi-Fi MS1G_00_01.00_14. A specially-crafted network packet can lead to a buffer overflow. An attacker can send a malicious packet to trigger this vulnerability.
Problem types: cwe_id: CWE-120
description: CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Affected products: vendor: TCL
product: LinkHub Mesh Wifi
Published: 2022-08-05T21:18:19.939Z
CVE-2022-26343 
Improper access control in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access.
Problem types: description: escalation of privilege
Affected products: vendor: n/a
product: Intel(R) Processors
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 8.2
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
Published: 2023-02-16T19:59:56.353Z
CVE-2022-26344 
Incorrect default permissions in the installation binaries for Intel(R) SEAPI all versions may allow an authenticated user to potentially enable escalation of privilege via local access.
Problem types: description: escalation of privilege
Affected products: vendor: n/a
product: version
Published: 2022-08-18T19:58:58.000Z
CVE-2022-26345 
Uncontrolled search path element in the Intel(R) oneAPI Toolkit OpenMP before version 2022.1 may allow an authenticated user to potentially enable escalation of privilege via local access.
Problem types: description: escalation of privilege
Affected products: vendor: n/a
product: Intel(R) oneAPI Toolkit OpenMP
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 6.7
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: LOW
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
Published: 2023-02-16T19:59:46.108Z
CVE-2022-26346 
A denial of service vulnerability exists in the ucloud_del_node functionality of TCL LinkHub Mesh Wi-Fi MS1G_00_01.00_14. A specially-crafted network packet can lead to denial of service. An attacker can send packets to trigger this vulnerability.
Problem types: cwe_id: CWE-284
description: CWE-284: Improper Access Control
Affected products: vendor: TCL
product: LinkHub Mesh Wifi
Published: 2022-08-05T21:18:33.440Z
CVE-2022-26348 
Command Centre Server is vulnerable to SQL Injection via Windows Registry settings for date fields on the server. The Windows Registry setting allows an attacker using the Visitor Management Kiosk, an application designed for public use, to invoke an arbitrary SQL query that has been preloaded into the registry of the Windows Server to obtain sensitive information. This issue affects: Gallagher Command Centre 8.60 versions prior to 8.60.1652; 8.50 versions prior to 8.50.2245; 8.40 versions prior to 8.40.2216; 8.30 versions prior to 8.30.1470; version 8.20 and prior versions.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Gallagher
product: Command Centre
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 8.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Published: 2022-07-06T16:29:59.000Z
CVE-2022-26349 Delta Electronics DIAEnergie SQL Injection in DIAE_eccoefficientHandler.ashx
Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability that exists in DIAE_eccoefficientHandler.ashx. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database contents, and execute system commands.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Delta Electronics
product: DIAEnergie
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Michael Heinzl and Dusan Stevanovic of Trend Micro’s Zero Day Initiative reported these vulnerabilities to CISA.
Published: 2022-03-29T16:37:08.970Z
CVE-2022-26352 
An issue was discovered in the ContentResource API in dotCMS 3.0 through 22.02. Attackers can craft a multipart form request to post a file whose filename is not initially sanitized. This allows directory traversal, in which the file is saved outside of the intended storage location. If anonymous content creation is enabled, this allows an unauthenticated attacker to upload an executable file, such as a .jsp file, that can lead to remote code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-17T21:54:53.000Z
CVE-2022-26353 
A flaw was found in the virtio-net device of QEMU. This flaw was inadvertently introduced with the fix for CVE-2021-3748, which forgot to unmap the cached virtqueue elements on error, leading to memory leakage and other unexpected results. Affected QEMU version: 6.2.0.
Problem types: cwe_id: CWE-772
description: CWE-772
Affected products: vendor: n/a
product: qemu-kvm
Published: 2022-03-16T14:02:33.000Z
CVE-2022-26354 
A flaw was found in the vhost-vsock device of QEMU. In case of error, an invalid element was not detached from the virtqueue before freeing its memory, leading to memory leakage and other unexpected results. Affected QEMU versions <= 6.2.0.
Problem types: cwe_id: CWE-772
description: CWE-772
Affected products: vendor: n/a
product: qemu-kvm
Published: 2022-03-16T14:02:34.000Z
CVE-2022-26355 Citrix Federated Authentication Service (FAS)
Citrix Federated Authentication Service (FAS) 7.17 - 10.6 causes deployments that have been configured to store a registration authority certificate's private key in a Trusted Platform Module (TPM) to incorrectly store that key in the Microsoft Software Key Storage Provider (MSKSP). This issue only occurs if PowerShell was used when configuring FAS to store the registration authority certificate’s private key in the TPM. It does not occur if the TPM was not selected for use or if the FAS administration console was used for configuration.
Problem types: cwe_id: CWE-668
description: CWE-668 Exposure of Resource to Wrong Sphere
Affected products: vendor: Citrix
product: Federated Authentication Service (FAS)
Published: 2022-03-09T14:58:02.000Z
CVE-2022-26356 
Racy interactions between dirty vram tracking and paging log dirty hypercalls Activation of log dirty mode done by XEN_DMOP_track_dirty_vram (was named HVMOP_track_dirty_vram before Xen 4.9) is racy with ongoing log dirty hypercalls. A suitably timed call to XEN_DMOP_track_dirty_vram can enable log dirty while another CPU is still in the process of tearing down the structures related to a previously enabled log dirty mode (XEN_DOMCTL_SHADOW_OP_OFF). This is due to lack of mutually exclusive locking between both operations and can lead to entries being added in already freed slots, resulting in a memory leak.
Problem types: description: unknown
Affected products: vendor: Xen
product: xen
Credits: lang: en
value: {'credit_data': {'description': {'description_data': [{'lang': 'eng', 'value': 'This issue was discovered by Roger Pau Monné of Citrix.'}]}}}
Published: 2022-04-05T00:00:00.000Z
CVE-2022-26357 
race in VT-d domain ID cleanup Xen domain IDs are up to 15 bits wide. VT-d hardware may allow for only less than 15 bits to hold a domain ID associating a physical device with a particular domain. Therefore internally Xen domain IDs are mapped to the smaller value range. The cleaning up of the housekeeping structures has a race, allowing for VT-d domain IDs to be leaked and flushes to be bypassed.
Problem types: description: unknown
Affected products: vendor: Xen
product: xen
Credits: lang: en
value: {'credit_data': {'description': {'description_data': [{'lang': 'eng', 'value': 'This issue was discovered by Jan Beulich of SUSE.'}]}}}
Published: 2022-04-05T00:00:00.000Z
CVE-2022-26358 
IOMMU: RMRR (VT-d) and unity map (AMD-Vi) handling issues T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Certain PCI devices in a system might be assigned Reserved Memory Regions (specified via Reserved Memory Region Reporting, "RMRR") for Intel VT-d or Unity Mapping ranges for AMD-Vi. These are typically used for platform tasks such as legacy USB emulation. Since the precise purpose of these regions is unknown, once a device associated with such a region is active, the mappings of these regions need to remain continuouly accessible by the device. This requirement has been violated. Subsequent DMA or interrupts from the device may have unpredictable behaviour, ranging from IOMMU faults to memory corruption.
Problem types: description: unknown
Affected products: vendor: Xen
product: xen
Credits: lang: en
value: {'credit_data': {'description': {'description_data': [{'lang': 'eng', 'value': 'Aspects of this issue were discovered by Jan Beulich of SUSE and\nRoger Pau Monné of Citrix.'}]}}}
Published: 2022-04-05T00:00:00.000Z
CVE-2022-26359 
IOMMU: RMRR (VT-d) and unity map (AMD-Vi) handling issues T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Certain PCI devices in a system might be assigned Reserved Memory Regions (specified via Reserved Memory Region Reporting, "RMRR") for Intel VT-d or Unity Mapping ranges for AMD-Vi. These are typically used for platform tasks such as legacy USB emulation. Since the precise purpose of these regions is unknown, once a device associated with such a region is active, the mappings of these regions need to remain continuouly accessible by the device. This requirement has been violated. Subsequent DMA or interrupts from the device may have unpredictable behaviour, ranging from IOMMU faults to memory corruption.
Problem types: description: unknown
Affected products: vendor: Xen
product: xen
Credits: lang: en
value: {'credit_data': {'description': {'description_data': [{'lang': 'eng', 'value': 'Aspects of this issue were discovered by Jan Beulich of SUSE and\nRoger Pau Monné of Citrix.'}]}}}
Published: 2022-04-05T00:00:00.000Z
CVE-2022-26360 
IOMMU: RMRR (VT-d) and unity map (AMD-Vi) handling issues T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Certain PCI devices in a system might be assigned Reserved Memory Regions (specified via Reserved Memory Region Reporting, "RMRR") for Intel VT-d or Unity Mapping ranges for AMD-Vi. These are typically used for platform tasks such as legacy USB emulation. Since the precise purpose of these regions is unknown, once a device associated with such a region is active, the mappings of these regions need to remain continuouly accessible by the device. This requirement has been violated. Subsequent DMA or interrupts from the device may have unpredictable behaviour, ranging from IOMMU faults to memory corruption.
Problem types: description: unknown
Affected products: vendor: Xen
product: xen
Credits: lang: en
value: {'credit_data': {'description': {'description_data': [{'lang': 'eng', 'value': 'Aspects of this issue were discovered by Jan Beulich of SUSE and\nRoger Pau Monné of Citrix.'}]}}}
Published: 2022-04-05T00:00:00.000Z
CVE-2022-26361 
IOMMU: RMRR (VT-d) and unity map (AMD-Vi) handling issues T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Certain PCI devices in a system might be assigned Reserved Memory Regions (specified via Reserved Memory Region Reporting, "RMRR") for Intel VT-d or Unity Mapping ranges for AMD-Vi. These are typically used for platform tasks such as legacy USB emulation. Since the precise purpose of these regions is unknown, once a device associated with such a region is active, the mappings of these regions need to remain continuouly accessible by the device. This requirement has been violated. Subsequent DMA or interrupts from the device may have unpredictable behaviour, ranging from IOMMU faults to memory corruption.
Problem types: description: unknown
Affected products: vendor: Xen
product: xen
Credits: lang: en
value: {'credit_data': {'description': {'description_data': [{'lang': 'eng', 'value': 'Aspects of this issue were discovered by Jan Beulich of SUSE and\nRoger Pau Monné of Citrix.'}]}}}
Published: 2022-04-05T00:00:00.000Z
CVE-2022-26362 
x86 pv: Race condition in typeref acquisition Xen maintains a type reference count for pages, in addition to a regular reference count. This scheme is used to maintain invariants required for Xen's safety, e.g. PV guests may not have direct writeable access to pagetables; updates need auditing by Xen. Unfortunately, the logic for acquiring a type reference has a race condition, whereby a safely TLB flush is issued too early and creates a window where the guest can re-establish the read/write mapping before writeability is prohibited.
Problem types: description: unknown
Affected products: vendor: Xen
product: xen
Credits: lang: en
value: {'credit_data': {'description': {'description_data': [{'lang': 'eng', 'value': 'This issue was discovered by Jann Horn of Google Project Zero.'}]}}}
Published: 2022-06-09T12:50:19.000Z
CVE-2022-26363 
x86 pv: Insufficient care with non-coherent mappings T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Xen maintains a type reference count for pages, in addition to a regular reference count. This scheme is used to maintain invariants required for Xen's safety, e.g. PV guests may not have direct writeable access to pagetables; updates need auditing by Xen. Unfortunately, Xen's safety logic doesn't account for CPU-induced cache non-coherency; cases where the CPU can cause the content of the cache to be different to the content in main memory. In such cases, Xen's safety logic can incorrectly conclude that the contents of a page is safe.
Problem types: description: unknown
Affected products: vendor: Xen
product: xen
Credits: lang: en
value: {'credit_data': {'description': {'description_data': [{'lang': 'eng', 'value': 'This issue was discovered by Jann Horn of Google Project Zero.'}]}}}
Published: 2022-06-09T12:50:13.000Z
CVE-2022-26364 
x86 pv: Insufficient care with non-coherent mappings T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Xen maintains a type reference count for pages, in addition to a regular reference count. This scheme is used to maintain invariants required for Xen's safety, e.g. PV guests may not have direct writeable access to pagetables; updates need auditing by Xen. Unfortunately, Xen's safety logic doesn't account for CPU-induced cache non-coherency; cases where the CPU can cause the content of the cache to be different to the content in main memory. In such cases, Xen's safety logic can incorrectly conclude that the contents of a page is safe.
Problem types: description: unknown
Affected products: vendor: Xen
product: xen
Credits: lang: en
value: {'credit_data': {'description': {'description_data': [{'lang': 'eng', 'value': 'This issue was discovered by Jann Horn of Google Project Zero.'}]}}}
Published: 2022-06-09T12:50:14.000Z
CVE-2022-26365 
Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Linux Block and Network PV device frontends don't zero memory regions before sharing them with the backend (CVE-2022-26365, CVE-2022-33740). Additionally the granularity of the grant table doesn't allow sharing less than a 4K page, leading to unrelated data residing in the same 4K page as data shared with a backend being accessible by such backend (CVE-2022-33741, CVE-2022-33742).
Problem types: description: unknown
Affected products: vendor: Linux
product: Linux
vendor: Xen
product: xen
Credits: lang: en
value: {'credit_data': {'description': {'description_data': [{'lang': 'eng', 'value': 'The issue related to not zeroing memory areas used for shared communications\nwas discovered by Roger Pau Monné of Citrix.\n\nThe issue related to leaking contiguous data in granted pages was disclosed\npublicly.'}]}}}
Published: 2022-07-05T12:50:28.000Z
CVE-2022-26366 WordPress AdRotate Banner Manager Plugin <= 5.9 is vulnerable to Cross Site Request Forgery (CSRF)
Cross-Site Request Forgery (CSRF) in AdRotate Banner Manager Plugin <= 5.9 on WordPress.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Arnan de Gans
product: AdRotate Banner Manager (WordPress plugin)
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
version: 3.1
Credits: lang: en
value: Muhammad Daffa (Patchstack Alliance)
Published: 2022-11-30T12:30:08.000Z
CVE-2022-26367 
Improper buffer restrictions in some Intel(R) XMM(TM) 7560 Modem software before version M2_7560_R_01.2146.00 may allow a privileged user to potentially enable escalation of privilege via local access.
Problem types: description: escalation of privilege
Affected products: vendor: n/a
product: Intel(R) XMM(TM) 7560 Modem software
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 6
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
Published: 2022-11-11T15:48:47.217Z
CVE-2022-26368 
Browse restriction bypass and operation restriction bypass vulnerability in Cabinet of Cybozu Garoon 4.0.0 to 5.5.1 allows a remote authenticated attacker to alter and/or obtain the data of Cabinet.
Problem types: description: Improper Authorization
Affected products: vendor: Cybozu, Inc.
product: Cybozu Garoon
Published: 2022-07-04T06:55:44.000Z
CVE-2022-26369 
Out-of-bounds read in some Intel(R) XMM(TM) 7560 Modem software before version M2_7560_R_01.2146.00 may allow a privileged user to potentially enable escalation of privilege via adjacent access.
Problem types: description: escalation of privilege
Affected products: vendor: n/a
product: Intel(R) XMM(TM) 7560 Modem software
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 6.2
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
Published: 2022-11-11T15:48:46.271Z
CVE-2022-26370 
On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5, and 14.1.x versions prior to 14.1.4.6, when a Session Initiation Protocol (SIP) message routing framework (MRF) application layer gateway (ALG) profile is configured on a Message Routing virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
Problem types: cwe_id: CWE-908
description: CWE-908 Use of Uninitialized Resource
Affected products: vendor: F5
product: BIG-IP
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 5.9
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2022-05-05T16:25:45.545Z
CVE-2022-26372 
On F5 BIG-IP 15.1.x versions prior to 15.1.0.2, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all versions of 12.1.x and 11.6.x, when a DNS listener is configured on a virtual server with DNS queueing (default), undisclosed requests can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Problem types: cwe_id: CWE-400
description: CWE-400 Uncontrolled Resource Consumption
Affected products: vendor: F5
product: BIG-IP
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2022-05-05T16:26:37.047Z
CVE-2022-26373 
Non-transparent sharing of return predictor targets between contexts in some Intel(R) Processors may allow an authorized user to potentially enable information disclosure via local access.
Problem types: description: information disclosure
Affected products: vendor: n/a
product: Intel(R) Processors
Published: 2022-08-18T00:00:00.000Z
CVE-2022-26374 
Uncontrolled search path in the installation binaries for Intel(R) SEAPI all versions may allow an authenticated user to potentially enable escalation of privilege via local access.
Problem types: description: escalation of privilege
Affected products: vendor: n/a
product: version
Published: 2022-08-18T19:59:11.000Z
CVE-2022-26375 WordPress AB Press Optimizer plugin <= 1.1.1 - Auth. Stored Cross-Site Scripting (XSS) vulnerability
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Mammothology AB Press Optimizer plugin <= 1.1.1 on WordPress.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Mammothology
product: AB Press Optimizer (WordPress plugin)
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.8
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: HIGH
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: Vulnerability discovered by ptsfence (Patchstack Alliance)
Published: 2022-10-17T17:03:21.637Z