rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-0652 
Confd log files contain local users', including root’s, SHA512crypt password hashes with insecure access permissions. This allows a local attacker to attempt off-line brute-force attacks against these password hashes in Sophos UTM before version 9.710.
Problem types: description: n/a
Affected products: vendor: Sophos
product: Sophos UTM
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 3.3
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Published: 2022-03-21T23:45:15.000Z
CVE-2022-0653 Profile Builder – User Profile & User Registration Forms <= 3.6.1 Reflected Cross-Site Scripting
The Profile Builder – User Profile & User Registration Forms WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the site_url parameter found in the ~/assets/misc/fallback-page.php file which allows attackers to inject arbitrary web scripts onto a pages that executes whenever a user clicks on a specially crafted link by an attacker. This affects versions up to and including 3.6.1.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Cozmoslabs
product: Profile Builder – User Profile & User Registration Forms
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.1
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: Chloe Chamberland, Wordfence
Published: 2022-02-24T18:27:05.000Z
CVE-2022-0654 Exposure of Sensitive Information to an Unauthorized Actor in fgribreau/node-request-retry
Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository fgribreau/node-request-retry prior to 7.0.0.
Problem types: cwe_id: CWE-200
description: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: fgribreau
product: fgribreau/node-request-retry
Published: 2022-02-22T23:30:11.000Z
CVE-2022-0656 uDraw < 3.3.3 - Unauthenticated Arbitrary File Access
The Web To Print Shop : uDraw WordPress plugin before 3.3.3 does not validate the url parameter in its udraw_convert_url_to_base64 AJAX action (available to both unauthenticated and authenticated users) before using it in the file_get_contents function and returning its content base64 encoded in the response. As a result, unauthenticated users could read arbitrary files on the web server (such as /etc/passwd, wp-config.php etc)
Problem types: cwe_id: CWE-552
description: CWE-552 Files or Directories Accessible to External Parties
Affected products: vendor: Unknown
product: Web To Print Shop : uDraw
Credits: lang: en
value: cydave
Published: 2022-04-25T15:51:03.000Z
CVE-2022-0657 5 Stars Rating Funnel < 1.2.53 - Unauthenticated SQLi
The 5 Stars Rating Funnel WordPress Plugin | RRatingg WordPress plugin before 1.2.54 does not properly sanitise, validate and escape lead ids before using them in a SQL statement via the rrtngg_delete_leads AJAX action, available to unauthenticated users, leading to an unauthenticated SQL injection issue. There is an attempt to sanitise the input, using sanitize_text_field(), however such function is not intended to prevent SQL injections.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: 5 Stars Rating Funnel WordPress Plugin | RRatingg
Credits: lang: en
value: cydave
Published: 2022-04-25T15:51:04.000Z
CVE-2022-0658 CommonsBooking < 2.6.8 - Unauthenticated SQL Injection
The CommonsBooking WordPress plugin before 2.6.8 does not sanitise and escape the location parameter of the calendar_data AJAX action (available to unauthenticated users) before it is used in dynamically constructed SQL queries, leading to an unauthenticated SQL injection
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: CommonsBooking
Credits: lang: en
value: cydave
Published: 2022-03-14T14:41:41.000Z
CVE-2022-0659 Sync iCloud COS < 2.0.1 - Admin+ Stored Cross-Site Scripting
The Sync QCloud COS WordPress plugin before 2.0.1 does not escape some of its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Sync QCloud COS
Credits: lang: en
value: fuzzyap1
Published: 2022-03-14T14:41:42.000Z
CVE-2022-0660 Generation of Error Message Containing Sensitive Information in microweber/microweber
Generation of Error Message Containing Sensitive Information in Packagist microweber/microweber prior to 1.2.11.
Problem types: cwe_id: CWE-209
description: CWE-209 Generation of Error Message Containing Sensitive Information
Affected products: vendor: microweber
product: microweber/microweber
Published: 2022-02-18T11:10:10.000Z
CVE-2022-0661 Ad Injection <= 1.2.0.19 - Admin+ Stored Cross-Site Scripting & RCE
The Ad Injection WordPress plugin through 1.2.0.19 does not properly sanitize the body of the adverts injected into the pages, allowing a high privileged user (Admin+) to inject arbitrary HTML or javascript even with unfiltered_html disallowed, leading to a stored cross-site scripting (XSS) vulnerability. Further it is also possible to inject PHP code, leading to a Remote Code execution (RCE) vulnerability, even if the DISALLOW_FILE_EDIT and DISALLOW_FILE_MOD constants are both set.
Problem types: cwe_id: CWE-94
description: CWE-94 Improper Control of Generation of Code ('Code Injection')
Affected products: vendor: Unknown
product: Ad Injection
Credits: lang: en
value: Asif Nawaz Minhas
Published: 2022-04-18T17:10:28.000Z
CVE-2022-0662 Adrotate < 5.8.23 - Admin+ XSS via Advert Name
The AdRotate WordPress plugin before 5.8.23 does not sanitise and escape Advert Names which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: AdRotate – Ad manager & AdSense Ads
Credits: lang: en
value: Muhamad Hidayat
Published: 2022-05-02T16:05:40.000Z
CVE-2022-0663 Print, PDF, Email by PrintFriendly < 5.2.3 - Admin+ Stored Cross-Site Scripting
The Print, PDF, Email by PrintFriendly WordPress plugin before 5.2.3 does not sanitise and escape the Custom Button Text settings, which could allow high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Print, PDF, Email by PrintFriendly
Credits: lang: en
value: muhamad hidayat
Published: 2022-06-20T10:25:46.000Z
CVE-2022-0664 Use of Hard-coded Cryptographic Key in gravitl/netmaker
Use of Hard-coded Cryptographic Key in Go github.com/gravitl/netmaker prior to 0.8.5,0.9.4,0.10.0,0.10.1.
Problem types: cwe_id: CWE-321
description: CWE-321 Use of Hard-coded Cryptographic Key
Affected products: vendor: gravitl
product: gravitl/netmaker
Published: 2022-02-18T14:00:13.000Z
CVE-2022-0665 Path Traversal in pimcore/pimcore
Path Traversal in GitHub repository pimcore/pimcore prior to 10.3.2.
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: pimcore
product: pimcore/pimcore
Published: 2022-02-22T14:55:09.000Z
CVE-2022-0666 CRLF Injection leads to Stack Trace Exposure due to lack of filtering at https://demo.microweber.org/ in microweber/microweber
CRLF Injection leads to Stack Trace Exposure due to lack of filtering at https://demo.microweber.org/ in Packagist microweber/microweber prior to 1.2.11.
Problem types: cwe_id: CWE-93
description: CWE-93 Improper Neutralization of CRLF Sequences
Affected products: vendor: microweber
product: microweber/microweber
Published: 2022-02-18T14:55:12.000Z
CVE-2022-0667 Assertion failure on delayed DS lookup
When the vulnerability is triggered the BIND process will exit. BIND 9.18.0
Problem types: description: In BIND 9.18.0 the recursive client code was refactored. This refactoring introduced a "backstop lifetime timer".  While BIND is processing a request for a DS record that needs to be forwarded, it waits until this processing is complete or until the backstop lifetime timer has timed out. When the resume_dslookup() function is called as a result of such a timeout, the function does not test whether the fetch has previously been shut down. This introduces the possibility of triggering an assertion failure, which could cause the BIND process to terminate.  Only the BIND 9.18 branch is affected. BIND 9.18.0
Affected products: vendor: ISC
product: BIND
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2022-03-22T11:15:13.972Z
CVE-2022-0668 
JFrog Artifactory prior to 7.37.13 is vulnerable to Authentication Bypass, which can lead to Privilege Escalation when a specially crafted request is sent by an unauthenticated user.
Problem types: cwe_id: CWE-274
description: CWE-274 Improper Handling of Insufficient Privileges
Affected products: vendor: JFrog
product: JFrog Artifactory
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
Published: 2023-01-08T00:00:00.000Z
CVE-2022-0669 
A flaw was found in dpdk. This flaw allows a malicious vhost-user master to attach an unexpected number of fds as ancillary data to VHOST_USER_GET_INFLIGHT_FD / VHOST_USER_SET_INFLIGHT_FD messages that are not closed by the vhost-user slave. By sending such messages continuously, the vhost-user master exhausts available fd in the vhost-user slave process, leading to a denial of service.
Problem types: cwe_id: CWE-400
description: CWE-400 - Uncontrolled Resource Consumption.
Affected products: vendor: n/a
product: DPDK
Published: 2022-08-29T14:03:04.000Z
CVE-2022-0670 
A flaw was found in Openstack manilla owning a Ceph File system "share", which enables the owner to read/write any manilla share or entire file system. The vulnerability is due to a bug in the "volumes" plugin in Ceph Manager. This allows an attacker to compromise Confidentiality and Integrity of a file system. Fixed in RHCS 5.2 and Ceph 17.2.2.
Problem types: cwe_id: CWE-863
description: CWE-863
Affected products: vendor: n/a
product: Ceph
Published: 2022-07-25T13:58:09.000Z
CVE-2022-0671 
A flaw was found in vscode-xml in versions prior to 0.19.0. Schema download could lead to blind SSRF or DoS via a large file.
Problem types: cwe_id: CWE-918
description: CWE-918|CWE-400
Affected products: vendor: n/a
product: vscode-xml
Published: 2022-02-18T17:50:39.000Z
CVE-2022-0672 
A flaw was found in LemMinX in versions prior to 0.19.0. Insecure redirect could allow unauthorized access to sensitive information locally if LemMinX is run under a privileged user.
Problem types: cwe_id: CWE-200
description: CWE-200
Affected products: vendor: n/a
product: LemMinX
Published: 2022-02-18T17:50:40.000Z
CVE-2022-0673 
A flaw was found in LemMinX in versions prior to 0.19.0. Cache poisoning of external schema files due to directory traversal.
Problem types: cwe_id: CWE-22
description: CWE-22
Affected products: vendor: n/a
product: LemMinX
Published: 2022-02-18T17:50:41.000Z
CVE-2022-0674 Kunze Law < 2.1 - Admin+ Stored Cross-Site Scripting
The Kunze Law WordPress plugin before 2.1 does not escape its 'E-Mail Error "From" Address' settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Kunze Law
Credits: lang: en
value: fuzzyap1
Published: 2022-03-14T14:41:44.000Z
CVE-2022-0675 Puppet Firewall Module May Leave Unmanaged Rules
In certain situations it is possible for an unmanaged rule to exist on the target system that has the same comment as the rule specified in the manifest. This could allow for unmanaged rules to exist on the target system and leave the system in an unsafe state.
Problem types: cwe_id: CWE-1289
description: CWE-1289
Affected products: vendor: Puppet
product: Firewall Module
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.6
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
version: 3.1
Published: 2022-03-02T21:00:59.000Z
CVE-2022-0676 Heap-based Buffer Overflow in radareorg/radare2
Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.6.4.
Problem types: cwe_id: CWE-122
description: CWE-122 Heap-based Buffer Overflow
Affected products: vendor: radareorg
product: radareorg/radare2
Published: 2022-02-22T00:05:10.000Z
CVE-2022-0677 Improper Handling of Length Parameter Inconsistency vulnerability in Bitdefender Update Server (VA-10144)
Improper Handling of Length Parameter Inconsistency vulnerability in the Update Server component of Bitdefender Endpoint Security Tools (in relay role), GravityZone (in Update Server role) allows an attacker to cause a Denial-of-Service. This issue affects: Bitdefender Update Server versions prior to 3.4.0.276. Bitdefender GravityZone versions prior to 26.4-1. Bitdefender Endpoint Security Tools for Linux versions prior to 6.2.21.171. Bitdefender Endpoint Security Tools for Windows versions prior to 7.4.1.111.
Problem types: cwe_id: CWE-130
description: CWE-130 Improper Handling of Length Parameter Inconsistency
Affected products: vendor: Bitdefender
product: Update Server
vendor: Bitdefender
product: GravityZone
vendor: Bitdefender
product: Endpoint Security Tools for Linux
vendor: Bitdefender
product: Endpoint Security Tools for Windows
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2022-04-07T18:21:34.788Z
CVE-2022-0678 Cross-site Scripting (XSS) - Reflected in microweber/microweber
Cross-site Scripting (XSS) - Reflected in Packagist microweber/microweber prior to 1.2.11.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: microweber
product: microweber/microweber
Published: 2022-02-19T10:50:09.000Z
CVE-2022-0679 Narnoo Distributor <= 2.5.1 - Unauthenticated LFI to Arbitrary File Read / RCE
The Narnoo Distributor WordPress plugin through 2.5.1 fails to validate and sanitize the lib_path parameter before it is passed into a call to require() via the narnoo_distributor_lib_request AJAX action (available to both unauthenticated and authenticated users) which results in the disclosure of arbitrary files as the content of the file is then displayed in the response as JSON data. This could also lead to RCE with various tricks but depends on the underlying system and it's configuration.
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: Unknown
product: Narnoo Distributor
Credits: lang: en
value: cydave
Published: 2022-03-28T17:23:14.000Z
CVE-2022-0680 Plezi < 1.0.3 - Unauthenticated Stored XSS
The Plezi WordPress plugin before 1.0.3 has a REST endpoint allowing unauthenticated users to update the plz_configuration_tracker_enable option, which is then displayed in the admin panel without sanitisation and escaping, leading to a Stored Cross-Site Scripting issue
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Plezi
Credits: lang: en
value: Brandon James Roldan
Published: 2022-03-28T17:23:16.000Z
CVE-2022-0681 Simple Membership < 4.1.0 - Arbitrary Transaction Deletion via CSRF
The Simple Membership WordPress plugin before 4.1.0 does not have CSRF check in place when deleting Transactions, which could allow attackers to make a logged in admin delete arbitrary transactions via a CSRF attack
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: Simple Membership
Credits: lang: en
value: muhamad hidayat
Published: 2022-03-21T18:55:56.000Z
CVE-2022-0683 Essential Addons for Elementor Lite <= 5.0.8 Reflected Cross-Site Scripting
The Essential Addons for Elementor Lite WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the settings parameter found in the ~/includes/Traits/Helper.php file which allows attackers to inject arbitrary web scripts onto a pages that executes whenever a user clicks on a specially crafted link by an attacker. This affects versions up to and including 5.0.8.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Essential Addons for Elementor Lite 
product: Essential Addons for Elementor Lite 
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.1
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: Pham Van Khanh (rskvp93) from VCSLab of Viettel Cyber Security & Nguyen Dinh Bien (biennd4) from VCSLab of Viettel Cyber Security
Published: 2022-02-24T18:27:08.000Z
CVE-2022-0684 WP Home Page Menu < 3.1 - Admin+ Stored Cross-Site Scripting
The WP Home Page Menu WordPress plugin before 3.1 does not sanitise and escape its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: WP Home Page Menu
Credits: lang: en
value: fuzzyap1
Published: 2022-03-14T14:41:45.000Z
CVE-2022-0685 Use of Out-of-range Pointer Offset in vim/vim
Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4418.
Problem types: cwe_id: CWE-823
description: CWE-823 Use of Out-of-range Pointer Offset
Affected products: vendor: vim
product: vim/vim
Published: 2022-02-20T00:00:00.000Z
CVE-2022-0686 Authorization Bypass Through User-Controlled Key in unshiftio/url-parse
Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.8.
Problem types: cwe_id: CWE-639
description: CWE-639 Authorization Bypass Through User-Controlled Key
Affected products: vendor: unshiftio
product: unshiftio/url-parse
Published: 2022-02-20T00:00:00.000Z
CVE-2022-0687 Amelia < 1.0.46 - Manager+ RCE
The Amelia WordPress plugin before 1.0.47 stores image blobs into actual files whose extension is controlled by the user, which may lead to PHP backdoors being uploaded onto the site. This vulnerability can be exploited by logged-in users with the custom "Amelia Manager" role.
Problem types: cwe_id: CWE-434
description: CWE-434 Unrestricted Upload of File with Dangerous Type
Affected products: vendor: Unknown
product: Amelia – Events & Appointments Booking Calendar
Credits: lang: en
value: qerogram
Published: 2022-03-21T18:55:57.000Z
CVE-2022-0688 Business Logic Errors in microweber/microweber
Business Logic Errors in Packagist microweber/microweber prior to 1.2.11.
Problem types: cwe_id: CWE-840
description: CWE-840 Business Logic Errors
Affected products: vendor: microweber
product: microweber/microweber
Published: 2022-02-20T14:45:11.000Z
CVE-2022-0689 Use multiple time the one-time coupon  in microweber/microweber
Use multiple time the one-time coupon in Packagist microweber/microweber prior to 1.2.11.
Problem types: cwe_id: CWE-840
description: CWE-840 Business Logic Errors
Affected products: vendor: microweber
product: microweber/microweber
Published: 2022-02-19T15:45:10.000Z
CVE-2022-0690 Cross-site Scripting (XSS) - Reflected in microweber/microweber
Cross-site Scripting (XSS) - Reflected in Packagist microweber/microweber prior to 1.2.11.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: microweber
product: microweber/microweber
Published: 2022-02-19T16:00:11.000Z
CVE-2022-0691 Authorization Bypass Through User-Controlled Key in unshiftio/url-parse
Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.9.
Problem types: cwe_id: CWE-639
description: CWE-639 Authorization Bypass Through User-Controlled Key
Affected products: vendor: unshiftio
product: unshiftio/url-parse
Published: 2022-02-21T00:00:00.000Z
CVE-2022-0692 Open Redirect on Rudloff/alltube in rudloff/alltube
Open Redirect on Rudloff/alltube in Packagist rudloff/alltube prior to 3.0.1.
Problem types: cwe_id: CWE-601
description: CWE-601 URL Redirection to Untrusted Site
Affected products: vendor: rudloff
product: rudloff/alltube
Published: 2022-02-21T12:30:12.000Z
CVE-2022-0693 Master Elements <= 8.0 - Unauthenticated SQLi
The Master Elements WordPress plugin through 8.0 does not validate and escape the meta_ids parameter of its remove_post_meta_condition AJAX action (available to both unauthenticated and authenticated users) before using it in a SQL statement, leading to an unauthenticated SQL Injection
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: Master Elements
Credits: lang: en
value: cydave
Published: 2022-04-25T15:51:06.000Z
CVE-2022-0694 Advanced Booking Calendar < 1.7.0 - Unauthenticated SQL Injection
The Advanced Booking Calendar WordPress plugin before 1.7.0 does not validate and escape the calendar parameter before using it in a SQL statement via the abc_booking_getSingleCalendar AJAX action (available to both unauthenticated and authenticated users), leading to an unauthenticated SQL injection
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: Advanced Booking Calendar
Credits: lang: en
value: cydave
Published: 2022-03-21T18:55:59.000Z
CVE-2022-0695 Denial of Service in radareorg/radare2
Denial of Service in GitHub repository radareorg/radare2 prior to 5.6.4.
Problem types: cwe_id: CWE-400
description: CWE-400 Uncontrolled Resource Consumption
Affected products: vendor: radareorg
product: radareorg/radare2
Published: 2022-02-24T12:25:10.000Z
CVE-2022-0696 NULL Pointer Dereference in vim/vim
NULL Pointer Dereference in GitHub repository vim/vim prior to 8.2.4428.
Problem types: cwe_id: CWE-476
description: CWE-476 NULL Pointer Dereference
Affected products: vendor: vim
product: vim/vim
Published: 2022-02-21T00:00:00.000Z
CVE-2022-0697 Open Redirect in archivy/archivy
Open Redirect in GitHub repository archivy/archivy prior to 1.7.0.
Problem types: cwe_id: CWE-601
description: CWE-601 URL Redirection to Untrusted Site
Affected products: vendor: archivy
product: archivy/archivy
Published: 2022-03-06T22:50:08.000Z
CVE-2022-0698 
Microweber version 1.3.1 allows an unauthenticated user to perform an account takeover via an XSS on the 'select-file' parameter.
Problem types: description: DOM-Based cross-site scripting (XSS)
Affected products: vendor: n/a
product: Microweber
Published: 2022-11-25T00:00:00.000Z