rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-1198 
A use-after-free vulnerabilitity was discovered in drivers/net/hamradio/6pack.c of linux that allows an attacker to crash linux kernel by simulating ax25 device using 6pack driver from user space.
Problem types: cwe_id: CWE-416
description: CWE-416 - Use After Free
Affected products: vendor: n/a
product: kernel
Published: 2022-08-29T14:03:07.000Z
CVE-2022-1199 
A flaw was found in the Linux kernel. This flaw allows an attacker to crash the Linux kernel by simulating amateur radio from the user space, resulting in a null-ptr-deref vulnerability and a use-after-free vulnerability.
Problem types: cwe_id: CWE-416
description: CWE-416 - Use After Free, CWE-476 - NULL Pointer Dereference.
Affected products: vendor: n/a
product: Kernel
Published: 2022-08-29T00:00:00.000Z
CVE-2022-1201 NULL Pointer Dereference in mrb_vm_exec with super in mruby/mruby
NULL Pointer Dereference in mrb_vm_exec with super in GitHub repository mruby/mruby prior to 3.2. This vulnerability is capable of making the mruby interpreter crash, thus affecting the availability of the system.
Problem types: cwe_id: CWE-476
description: CWE-476 NULL Pointer Dereference
Affected products: vendor: mruby
product: mruby/mruby
Published: 2022-04-02T07:45:34.000Z
CVE-2022-1202 WP-CRM <= 1.2.1 - CSV Injection
The WP-CRM WordPress plugin through 1.2.1 does not validate and sanitise fields when exporting people to a CSV file, leading to a CSV injection vulnerability.
Problem types: cwe_id: CWE-1236
description: CWE-1236 Improper Neutralization of Formula Elements in a CSV File
Affected products: vendor: Unknown
product: WP-CRM – Customer Relations Management for WordPress
Credits: lang: en
value: Ankur Bakre
Published: 2022-06-13T12:41:41.000Z
CVE-2022-1203 Content Mask < 1.8.4.1 - Subscriber+ Arbitrary Options Update
The Content Mask WordPress plugin before 1.8.4.1 does not have authorisation and CSRF checks in various AJAX actions, as well as does not validate the option to be updated to ensure it belongs to the plugin. As a result, any authenticated user, such as subscriber could modify arbitrary blog options
Problem types: description: CWE-862 Missing Authorization
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: Content Mask
default_status: unaffected
Credits: lang: en
value: ptsfence
lang: en
value: WPScan
Published: 2022-05-30T00:00:00.000Z
CVE-2022-1204 
A use-after-free flaw was found in the Linux kernel’s Amateur Radio AX.25 protocol functionality in the way a user connects with the protocol. This flaw allows a local user to crash the system.
Problem types: cwe_id: CWE-416
description: CWE-416 - Use After Free.
Affected products: vendor: n/a
product: Kernel
Published: 2022-08-29T14:03:07.000Z
CVE-2022-1205 
A NULL pointer dereference flaw was found in the Linux kernel’s Amateur Radio AX.25 protocol functionality in the way a user connects with the protocol. This flaw allows a local user to crash the system.
Problem types: cwe_id: CWE-416
description: CWE-416 - Use After Free, CWE-476 - NULL Pointer Dereference.
Affected products: vendor: n/a
product: Kernel
Published: 2022-08-31T15:32:59.000Z
CVE-2022-1206 AdRotate – Ad manager & AdSense Ads <= 5.13.2 - Authenticated (Admin+) Double Extension Arbitrary File Upload
The AdRotate Banner Manager – The only ad manager you'll need plugin for WordPress is vulnerable to arbitrary file uploads due to missing file extension sanitization in the adrotate_insert_media() function in all versions up to, and including, 5.13.2. This makes it possible for authenticated attackers, with administrator-level access and above, to upload arbitrary files with double extensions on the affected site's server which may make remote code execution possible. This is only exploitable on select instances where the configuration will execute the first extension present.
Problem types: cwe_id: CWE-434
description: CWE-434 Unrestricted Upload of File with Dangerous Type
Affected products: vendor: adegans
product: AdRotate Banner Manager
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
baseScore: 7.2
baseSeverity: HIGH
Credits: lang: en
value: Jörg Steinsträter
Published: 2024-08-20T03:21:11.012Z
CVE-2022-1207 Out-of-bounds read  in radareorg/radare2
Out-of-bounds read in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability allows attackers to read sensitive information from outside the allocated buffer boundary.
Problem types: cwe_id: CWE-125
description: CWE-125 Out-of-bounds Read
Affected products: vendor: radareorg
product: radareorg/radare2
Published: 2022-04-01T19:10:10.000Z
CVE-2022-1208 Ultimate Member <= 2.3.2 - Stored Cross-Site Scripting
The Ultimate Member plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Biography field featured on individual user profile pages due to insufficient input sanitization and output escaping that allows users to encode malicious web scripts with HTML encoding that is reflected back on the page. This affects versions up to, and including, 2.3.2. Please note this issue was only partially fixed in version 2.3.2.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: ultimatemember
product: Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
baseScore: 6.4
baseSeverity: MEDIUM
Credits: lang: en
value: Ruijie Li
Published: 2022-06-13T12:43:38.000Z
CVE-2022-1209 Ultimate Member <= 2.3.1 - Arbitrary Redirect
The Ultimate Member plugin for WordPress is vulnerable to arbitrary redirects due to insufficient validation on supplied URLs in the social fields of the Profile Page, which makes it possible for attackers to redirect unsuspecting victims in versions up to, and including, 2.3.1.
Problem types: cwe_id: CWE-601
description: CWE-601 URL Redirection to Untrusted Site ('Open Redirect')
Affected products: vendor: ultimatemember
product: Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
baseScore: 4.3
baseSeverity: MEDIUM
Credits: lang: en
value: Ruijie Li
Published: 2022-05-10T19:34:42.000Z
CVE-2022-1210 LibTIFF tiff2ps resource consumption
A vulnerability classified as problematic was found in LibTIFF 4.3.0. Affected by this vulnerability is the TIFF File Handler of tiff2ps. Opening a malicious file leads to a denial of service. The attack can be launched remotely but requires user interaction. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-400
description: CWE-400 Resource Consumption
Affected products: vendor: unspecified
product: LibTIFF
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: LOW
baseScore: 4.3
baseSeverity: MEDIUM
Credits: lang: en
value: mqrsv
Published: 2022-04-03T00:00:00.000Z
CVE-2022-1211 tildearrow Furnace FUR to VGM Converter stack-based overflow
A vulnerability classified as critical has been found in tildearrow Furnace dev73. This affects the FUR to VGM converter in console mode which causes stack-based overflows and crashes. It is possible to initiate the attack remotely but it requires user-interaction. A POC has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-121
description: CWE-121 Stack-based Buffer Overflow
Affected products: vendor: tildearrow
product: Furnace
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
version: 3.1
Published: 2022-04-03T12:10:11.000Z
CVE-2022-1212 Use-After-Free in str_escape in mruby/mruby in mruby/mruby
Use-After-Free in str_escape in mruby/mruby in GitHub repository mruby/mruby prior to 3.2. Possible arbitrary code execution if being exploited.
Problem types: cwe_id: CWE-416
description: CWE-416 Use After Free
Affected products: vendor: mruby
product: mruby/mruby
Published: 2022-04-05T03:45:19.000Z
CVE-2022-1213 SSRF filter bypass port 80, 433 in livehelperchat/livehelperchat
SSRF filter bypass port 80, 433 in GitHub repository livehelperchat/livehelperchat prior to 3.67v. An attacker could make the application perform arbitrary requests, bypass CVE-2022-1191
Problem types: cwe_id: CWE-918
description: CWE-918 Server-Side Request Forgery (SSRF)
Affected products: vendor: livehelperchat
product: livehelperchat/livehelperchat
Published: 2022-04-05T03:45:13.000Z
CVE-2022-1215 
A format string vulnerability was found in libinput
Problem types: cwe_id: CWE-134
description: CWE-134
Affected products: vendor: n/a
product: libinput
Published: 2022-05-31T00:00:00.000Z
CVE-2022-1216 Advanced Image Sitemap <= 1.2 - Reflected Cross-Site Scripting
The Advanced Image Sitemap WordPress plugin through 1.2 does not sanitise and escape the PHP_SELF PHP variable before outputting it back in an attribute in an admin page, leading to Reflected Cross-Site Scripting.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Advanced Image Sitemap
Credits: lang: en
value: p7e4
Published: 2022-05-16T14:30:40.000Z
CVE-2022-1217 Custom TinyMCE Shortcode Button <= 1.1 - Reflected Cross-Site Scripting
The Custom TinyMCE Shortcode Button WordPress plugin through 1.1 does not sanitise and escape the PHP_SELF variable before outputting it back in an attribute in an admin page, leading to Reflected Cross-Site Scripting.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Custom TinyMCE Shortcode Button
Credits: lang: en
value: p7e4
Published: 2022-05-16T14:30:42.000Z
CVE-2022-1218 Domain Replace <= 1.3.8 - Reflected Cross-Site Scripting
The Domain Replace WordPress plugin through 1.3.8 does not sanitise and escape a parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Domain Replace
Credits: lang: en
value: p7e4
Published: 2022-05-23T07:15:28.000Z
CVE-2022-1219 SQL injection in RecyclebinController.php in pimcore/pimcore
SQL injection in RecyclebinController.php in GitHub repository pimcore/pimcore prior to 10.3.5. This vulnerability is capable of steal the data
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command
Affected products: vendor: pimcore
product: pimcore/pimcore
Published: 2022-04-08T08:45:18.000Z
CVE-2022-1220 FoxyShop < 4.8.2 - Reflected Cross-Site Scripting
The FoxyShop WordPress plugin before 4.8.2 does not sanitise and escape a parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: FoxyShop
Credits: lang: en
value: p7e4
Published: 2022-07-11T12:55:40.000Z
CVE-2022-1221 Gwyn's Imagemap Selector <= 0.3.3 - Reflected Cross-Site Scripting
The Gwyn's Imagemap Selector WordPress plugin through 0.3.3 does not sanitise and escape some parameters before outputting them back in attributes, leading to a Reflected Cross-Site Scripting.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Gwyn's Imagemap Selector
Credits: lang: en
value: p7e4
Published: 2022-05-23T07:15:29.000Z
CVE-2022-1222 Inf loop in gpac/gpac
Inf loop in GitHub repository gpac/gpac prior to 2.1.0-DEV.
Problem types: cwe_id: CWE-835
description: CWE-835 Loop with Unreachable Exit Condition
Affected products: vendor: gpac
product: gpac/gpac
Published: 2022-04-04T00:00:00.000Z
CVE-2022-1223 Incorrect Authorization in phpipam/phpipam
Incorrect Authorization in GitHub repository phpipam/phpipam prior to 1.4.6.
Problem types: cwe_id: CWE-863
description: CWE-863 Incorrect Authorization
Affected products: vendor: phpipam
product: phpipam/phpipam
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2022-04-04T10:45:20.000Z
CVE-2022-1224 Improper Authorization in phpipam/phpipam
Improper Authorization in GitHub repository phpipam/phpipam prior to 1.4.6.
Problem types: cwe_id: CWE-285
description: CWE-285 Improper Authorization
Affected products: vendor: phpipam
product: phpipam/phpipam
Published: 2022-04-04T10:45:15.000Z
CVE-2022-1225 Incorrect Privilege Assignment in phpipam/phpipam
Incorrect Privilege Assignment in GitHub repository phpipam/phpipam prior to 1.4.6.
Problem types: cwe_id: CWE-266
description: CWE-266 Incorrect Privilege Assignment
Affected products: vendor: phpipam
product: phpipam/phpipam
Published: 2022-04-04T10:50:11.000Z
CVE-2022-1226 Cross-site Scripting (XSS) in phpipam/phpipam
A Cross-Site Scripting (XSS) vulnerability in phpipam/phpipam versions prior to 1.4.7 allows attackers to execute arbitrary JavaScript code in the browser of a victim. This vulnerability affects the import Data set feature via a spreadsheet file upload. The affected endpoints include import-vlan-preview.php, import-subnets-preview.php, import-vrf-preview.php, import-ipaddr-preview.php, import-devtype-preview.php, import-devices-preview.php, and import-l2dom-preview.php. The vulnerability can be exploited by uploading a specially crafted spreadsheet file containing malicious JavaScript payloads, which are then executed in the context of the victim's browser. This can lead to defacement of websites, execution of malicious JavaScript code, stealing of user cookies, and unauthorized access to user accounts.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: phpipam
product: phpipam/phpipam
Published: 2024-11-15T10:57:20.597Z
CVE-2022-1227 
A privilege escalation flaw was found in Podman. This flaw allows an attacker to publish a malicious image to a public registry. Once this image is downloaded by a potential victim, the vulnerability is triggered after a user runs the 'podman top' command. This action gives the attacker access to the host filesystem, leading to information disclosure or denial of service.
Problem types: cwe_id: CWE-281
description: CWE-281
Affected products: vendor: n/a
product: psgo
Published: 2022-04-29T15:45:00.000Z
CVE-2022-1228 Opensea < 1.0.3 - Admin+ Stored XSS
The Opensea WordPress plugin before 1.0.3 does not sanitize and escape some of its settings, like its "Referer address" field, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Opensea
Credits: lang: en
value: Mika
Published: 2022-04-25T15:51:23.000Z
CVE-2022-1229 
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.2.034. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of IFC files. Crafted data in an IFC file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-16581.
Problem types: cwe_id: CWE-787
description: CWE-787: Out-of-bounds Write
Affected products: vendor: Bentley
product: MicroStation CONNECT
Credits: lang: en
value: Anonymous
Published: 2023-03-28T00:00:00.000Z
CVE-2022-1230 
This vulnerability allows local attackers to execute arbitrary code on affected installations of Samsung Galaxy S21 prior to 4.5.40.5 phones. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of redirections. An attacker can force a redirection to a site that serves malicious content. An attacker can leverage this in conjunction with other vulnerabilities to escalate privileges and execute arbitrary code in the context of the current user. Was ZDI-CAN-15918.
Problem types: cwe_id: CWE-601
description: CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
Affected products: vendor: Samsung
product: Galaxy S21
Credits: lang: en
value: Sam Thomas (@_s_n_t) of Pentest Ltd (@pentestltd)
Published: 2023-03-28T00:00:00.000Z
CVE-2022-1231 XSS via Embedded SVG in SVG Diagram Format in plantuml/plantuml
XSS via Embedded SVG in SVG Diagram Format in GitHub repository plantuml/plantuml prior to 1.2022.4. Stored XSS in the context of the diagram embedder. Depending on the actual context, this ranges from stealing secrets to account hijacking or even to code execution for example in desktop applications. Web based applications are the ones most affected. Since the SVG format allows clickable links in diagrams, it is commonly used in plugins for web based projects (like the Confluence plugin, etc. see https://plantuml.com/de/running).
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: plantuml
product: plantuml/plantuml
Published: 2022-04-15T15:05:10.000Z
CVE-2022-1232 
Type confusion in V8 in Google Chrome prior to 100.0.4896.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Problem types: description: Type Confusion
Affected products: vendor: Google
product: Chrome
Published: 2022-07-25T13:39:16.000Z
CVE-2022-1233 URL Confusion When Scheme Not Supplied in medialize/uri.js
URL Confusion When Scheme Not Supplied in GitHub repository medialize/uri.js prior to 1.19.11.
Problem types: cwe_id: CWE-115
description: CWE-115 Misinterpretation of Input
Affected products: vendor: medialize
product: medialize/uri.js
Published: 2022-04-04T19:30:15.000Z
CVE-2022-1234 XSS in livehelperchat in livehelperchat/livehelperchat
XSS in livehelperchat in GitHub repository livehelperchat/livehelperchat prior to 3.97. This vulnerability has the potential to deface websites, result in compromised user accounts, and can run malicious code on web pages, which can lead to a compromise of the user’s device.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: livehelperchat
product: livehelperchat/livehelperchat
Published: 2022-04-06T03:10:15.000Z
CVE-2022-1235 Weak secrethash can be brute-forced in livehelperchat/livehelperchat
Weak secrethash can be brute-forced in GitHub repository livehelperchat/livehelperchat prior to 3.96.
Problem types: cwe_id: CWE-916
description: CWE-916 Use of Password Hash With Insufficient Computational Effort
Affected products: vendor: livehelperchat
product: livehelperchat/livehelperchat
Published: 2022-04-05T06:30:15.000Z
CVE-2022-1236 Weak Password Requirements in weseek/growi
Weak Password Requirements in GitHub repository weseek/growi prior to v5.0.0.
Problem types: cwe_id: CWE-521
description: CWE-521 Weak Password Requirements
Affected products: vendor: weseek
product: weseek/growi
Published: 2022-04-05T08:25:10.000Z
CVE-2022-1237 Improper Validation of Array Index in radareorg/radare2
Improper Validation of Array Index in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability is heap overflow and may be exploitable. For more general description of heap buffer overflow, see [CWE](https://cwe.mitre.org/data/definitions/122.html).
Problem types: cwe_id: CWE-129
description: CWE-129 Improper Validation of Array Index
Affected products: vendor: radareorg
product: radareorg/radare2
Published: 2022-04-06T09:35:11.000Z
CVE-2022-1238 Out-of-bounds Write in libr/bin/format/ne/ne.c in radareorg/radare2
Out-of-bounds Write in libr/bin/format/ne/ne.c in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability is heap overflow and may be exploitable. For more general description of heap buffer overflow, see [CWE](https://cwe.mitre.org/data/definitions/122.html).
Problem types: cwe_id: CWE-787
description: CWE-787 Out-of-bounds Write
Affected products: vendor: radareorg
product: radareorg/radare2
Published: 2022-04-06T00:00:00.000Z
CVE-2022-1239 HubSpot < 8.8.15 - Contributor+ Blind SSRF
The HubSpot WordPress plugin before 8.8.15 does not validate the proxy URL given to the proxy REST endpoint, which could allow users with the edit_posts capability (by default contributor and above) to perform SSRF attacks
Problem types: cwe_id: CWE-918
description: CWE-918 Server-Side Request Forgery (SSRF)
Affected products: vendor: Unknown
product: HubSpot – CRM, Email Marketing, Live Chat, Forms & Analytics
Credits: lang: en
value: Brandon Roldan
Published: 2022-05-02T16:05:49.000Z
CVE-2022-1240 Heap buffer overflow in libr/bin/format/mach0/mach0.c in radareorg/radare2
Heap buffer overflow in libr/bin/format/mach0/mach0.c in GitHub repository radareorg/radare2 prior to 5.8.6. If address sanitizer is disabled during the compiling, the program should executes into the `r_str_ncpy` function. Therefore I think it is very likely to be exploitable. For more general description of heap buffer overflow, see [CWE](https://cwe.mitre.org/data/definitions/122.html).
Problem types: cwe_id: CWE-122
description: CWE-122 Heap-based Buffer Overflow
Affected products: vendor: radareorg
product: radareorg/radare2
Published: 2022-04-06T10:15:15.000Z
CVE-2022-1241 Ask Me < 6.8.2 - Reflected Cross-Site Scripting
The Ask me WordPress theme before 6.8.2 does not properly sanitise and escape several of the fields in the Edit Profile page, leading to Reflected Cross-Site Scripting issues
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Ask me
Credits: lang: en
value: Veshraj Ghimire
Published: 2022-06-06T08:50:54.000Z
CVE-2022-1242 
Apport can be tricked into connecting to arbitrary sockets as the root user
Affected products: vendor: Canonical Ltd.
product: Apport
Credits: lang: en
value: Gerrit Venema
Published: 2024-06-03T18:48:02.281Z
CVE-2022-1243 CRHTLF can lead to invalid protocol extraction potentially leading to XSS in medialize/uri.js
CRHTLF can lead to invalid protocol extraction potentially leading to XSS in GitHub repository medialize/uri.js prior to 1.19.11.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: medialize
product: medialize/uri.js
Published: 2022-04-05T15:05:18.000Z
CVE-2022-1244 heap-buffer-overflow in radareorg/radare2
heap-buffer-overflow in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability is capable of inducing denial of service.
Problem types: cwe_id: CWE-122
description: CWE-122 Heap-based Buffer Overflow
Affected products: vendor: radareorg
product: radareorg/radare2
Published: 2022-04-05T17:55:09.000Z
CVE-2022-1245 
A privilege escalation flaw was found in the token exchange feature of keycloak. Missing authorization allows a client application holding a valid access token to exchange tokens for any target client by passing the client_id of the target. This could allow a client to gain unauthorized access to additional services.
Problem types: cwe_id: CWE-862
description: CWE-862->CWE-863
Affected products: vendor: n/a
product: keycloak
Published: 2022-07-07T23:39:22.000Z