[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2022-1861.

[Assistant] Use after free in Sharing in Google Chrome on Chrome OS prior to 102.0.5005.61 allowed a remote attacker who convinced a user to enage in specific user interactions to potentially exploit heap corruption via specific user interaction.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2022-1861?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2022-1861?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2022-1862 mean in the context of cybersecurity?

[Assistant] CVE-2022-1862


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2022-1862.

[Assistant] Inappropriate implementation in Extensions in Google Chrome prior to 102.0.5005.61 allowed an attacker who convinced a user to install a malicious extension to bypass profile restrictions via a crafted HTML page.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2022-1862?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2022-1862?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2022-1863 mean in the context of cybersecurity?

[Assistant] CVE-2022-1863


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2022-1863.

[Assistant] Use after free in Tab Groups in Google Chrome prior to 102.0.5005.61 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension and specific user interaction.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2022-1863?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2022-1863?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2022-1864 mean in the context of cybersecurity?

[Assistant] CVE-2022-1864


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2022-1864.

[Assistant] Use after free in WebApp Installs in Google Chrome prior to 102.0.5005.61 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension and specific user interaction.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2022-1864?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2022-1864?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2022-1865 mean in the context of cybersecurity?

[Assistant] CVE-2022-1865


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2022-1865.

[Assistant] Use after free in Bookmarks in Google Chrome prior to 102.0.5005.61 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension and specific user interaction.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2022-1865?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2022-1865?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2022-1866 mean in the context of cybersecurity?

[Assistant] CVE-2022-1866


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2022-1866.

[Assistant] Use after free in Tablet Mode in Google Chrome on Chrome OS prior to 102.0.5005.61 allowed a remote attacker who convinced a user to engage in specific user interactions to potentially exploit heap corruption via specific user interactions.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2022-1866?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2022-1866?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2022-1867 mean in the context of cybersecurity?

[Assistant] CVE-2022-1867


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2022-1867.

[Assistant] Insufficient validation of untrusted input in Data Transfer in Google Chrome prior to 102.0.5005.61 allowed a remote attacker to bypass same origin policy via a crafted clipboard content.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2022-1867?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2022-1867?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2022-1868 mean in the context of cybersecurity?

[Assistant] CVE-2022-1868


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2022-1868.

[Assistant] Inappropriate implementation in Extensions API in Google Chrome prior to 102.0.5005.61 allowed an attacker who convinced a user to install a malicious extension to bypass navigation restrictions via a crafted HTML page.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2022-1868?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2022-1868?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2022-1869 mean in the context of cybersecurity?

[Assistant] CVE-2022-1869


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2022-1869.

[Assistant] Type Confusion in V8 in Google Chrome prior to 102.0.5005.61 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2022-1869?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2022-1869?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2022-1870 mean in the context of cybersecurity?

[Assistant] CVE-2022-1870


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2022-1870.

[Assistant] Use after free in App Service in Google Chrome prior to 102.0.5005.61 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2022-1870?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2022-1870?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2022-1871 mean in the context of cybersecurity?

[Assistant] CVE-2022-1871


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2022-1871.

[Assistant] Insufficient policy enforcement in File System API in Google Chrome prior to 102.0.5005.61 allowed an attacker who convinced a user to install a malicious extension to bypass file system policy via a crafted HTML page.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2022-1871?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2022-1871?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2022-1872 mean in the context of cybersecurity?

[Assistant] CVE-2022-1872


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2022-1872.

[Assistant] Insufficient policy enforcement in Extensions API in Google Chrome prior to 102.0.5005.61 allowed an attacker who convinced a user to install a malicious extension to bypass downloads policy via a crafted HTML page.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2022-1872?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2022-1872?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2022-1873 mean in the context of cybersecurity?

[Assistant] CVE-2022-1873


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2022-1873.

[Assistant] Insufficient policy enforcement in COOP in Google Chrome prior to 102.0.5005.61 allowed a remote attacker to leak cross-origin data via a crafted HTML page.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2022-1873?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2022-1873?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2022-1874 mean in the context of cybersecurity?

[Assistant] CVE-2022-1874


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2022-1874.

[Assistant] Insufficient policy enforcement in Safe Browsing in Google Chrome on Mac prior to 102.0.5005.61 allowed a remote attacker to bypass downloads protection policy via a crafted HTML page.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2022-1874?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2022-1874?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2022-1875 mean in the context of cybersecurity?

[Assistant] CVE-2022-1875


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2022-1875.

[Assistant] Inappropriate implementation in PDF in Google Chrome prior to 102.0.5005.61 allowed a remote attacker to leak cross-origin data via a crafted HTML page.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2022-1875?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2022-1875?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2022-1876 mean in the context of cybersecurity?

[Assistant] CVE-2022-1876


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2022-1876.

[Assistant] Heap buffer overflow in DevTools in Google Chrome prior to 102.0.5005.61 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2022-1876?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2022-1876?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2022-1881 mean in the context of cybersecurity?

[Assistant] CVE-2022-1881


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2022-1881.

[Assistant] In affected versions of Octopus Server an Insecure Direct Object Reference vulnerability exists where it is possible for a user to download Project Exports from a Project they do not have permissions to access. This vulnerability only impacts projects within the same Space.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2022-1881?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2022-1881?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2022-1882 mean in the context of cybersecurity?

[Assistant] CVE-2022-1882


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2022-1882.

[Assistant] A use-after-free flaw was found in the Linux kernel’s pipes functionality in how a user performs manipulations with the pipe post_one_notification() after free_pipe_info() that is already called. This flaw allows a local user to crash or potentially escalate their privileges on the system.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2022-1882?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2022-1882?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2022-1883 mean in the context of cybersecurity?

[Assistant] CVE-2022-1883


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2022-1883.

[Assistant] SQL Injection in GitHub repository camptocamp/terraboard prior to 2.2.0.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2022-1883?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2022-1883?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2022-1884 mean in the context of cybersecurity?

[Assistant] CVE-2022-1884


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2022-1884.

[Assistant] A remote command execution vulnerability exists in gogs/gogs versions <=0.12.7 when deployed on a Windows server. The vulnerability arises due to improper validation of the `tree_path` parameter during file uploads. An attacker can set `tree_path=.git.` to upload a file into the .git directory, allowing them to write or rewrite the `.git/config` file. If the `core.sshCommand` is set, this can lead to remote command execution.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2022-1884?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2022-1884?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2022-1885 mean in the context of cybersecurity?

[Assistant] CVE-2022-1885


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2022-1885.

[Assistant] The Cimy Header Image Rotator WordPress plugin through 6.1.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2022-1885?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2022-1885?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2022-1886 mean in the context of cybersecurity?

[Assistant] CVE-2022-1886


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2022-1886.

[Assistant] Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2022-1886?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2022-1886?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2022-1887 mean in the context of cybersecurity?

[Assistant] CVE-2022-1887


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2022-1887.

[Assistant] The search term could have been specified externally to trigger SQL injection. This vulnerability affects Firefox for iOS < 101.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2022-1887?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2022-1887?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2022-1888 mean in the context of cybersecurity?

[Assistant] CVE-2022-1888


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2022-1888.

[Assistant] Alpha7 PC Loader (All versions) is vulnerable to a stack-based buffer overflow while processing a specifically crafted project file, which may allow an attacker to execute arbitrary code.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2022-1888?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2022-1888?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2022-1889 mean in the context of cybersecurity?

[Assistant] CVE-2022-1889


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2022-1889.

[Assistant] The Newsletter WordPress plugin before 7.4.6 does not escape and sanitise the preheader_text setting, which could allow high privilege users to perform Stored Cross-Site Scripting attacks when the unfilteredhtml is disallowed


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2022-1889?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2022-1889?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2022-1890 mean in the context of cybersecurity?

[Assistant] CVE-2022-1890


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2022-1890.

[Assistant] A buffer overflow in the ReadyBootDxe driver in some Lenovo Notebook products may allow an attacker with local privileges to execute arbitrary code.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2022-1890?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2022-1890?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2022-1891 mean in the context of cybersecurity?

[Assistant] CVE-2022-1891


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2022-1891.

[Assistant] A buffer overflow in the SystemLoadDefaultDxe driver in some Lenovo Notebook products may allow an attacker with local privileges to execute arbitrary code.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2022-1891?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2022-1891?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2022-1892 mean in the context of cybersecurity?

[Assistant] CVE-2022-1892


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2022-1892.

[Assistant] A buffer overflow in the SystemBootManagerDxe driver in some Lenovo Notebook products may allow an attacker with local privileges to execute arbitrary code.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2022-1892?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2022-1892?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2022-1893 mean in the context of cybersecurity?

[Assistant] CVE-2022-1893


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2022-1893.

[Assistant] Improper Removal of Sensitive Information Before Storage or Transfer in GitHub repository polonel/trudesk prior to 1.2.3.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2022-1893?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2022-1893?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2022-1894 mean in the context of cybersecurity?

[Assistant] CVE-2022-1894


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2022-1894.

[Assistant] The Popup Builder WordPress plugin before 4.1.11 does not escape and sanitize some settings, which could allow high privilege users to perform Stored Cross-Site Scripting attacks when the unfiltred_html is disallowed


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2022-1894?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2022-1894?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2022-1895 mean in the context of cybersecurity?

[Assistant] CVE-2022-1895


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2022-1895.

[Assistant] The underConstruction WordPress plugin before 1.20 does not have CSRF check in place when deactivating the construction mode, which could allow attackers to make a logged in admin perform such action via a CSRF attack


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2022-1895?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2022-1895?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2022-1896 mean in the context of cybersecurity?

[Assistant] CVE-2022-1896


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2022-1896.

[Assistant] The underConstruction WordPress plugin before 1.21 does not sanitise or escape the "Display a custom page using your own HTML" setting before outputting it, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiletred_html capability is disallowed.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2022-1896?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2022-1896?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2022-1897 mean in the context of cybersecurity?

[Assistant] CVE-2022-1897


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2022-1897.

[Assistant] Out-of-bounds Write in GitHub repository vim/vim prior to 8.2.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2022-1897?

[Assistant]
20221030 APPLE-SA-2022-10-27-5 Additional information for APPLE-SA-2022-10-24-2 macOS Ventura 13

[debian-lts-announce] 20221124 [SECURITY] [DLA 3204-1] vim security update


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2022-1897?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2022-1898 mean in the context of cybersecurity?

[Assistant] CVE-2022-1898


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2022-1898.

[Assistant] Use After Free in GitHub repository vim/vim prior to 8.2.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2022-1898?

[Assistant]
[debian-lts-announce] 20220620 [SECURITY] [DLA 3053-1] vim security update

20221030 APPLE-SA-2022-10-27-5 Additional information for APPLE-SA-2022-10-24-2 macOS Ventura 13

[debian-lts-announce] 20221108 [SECURITY] [DLA 3182-1] vim security update


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2022-1898?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2022-1899 mean in the context of cybersecurity?

[Assistant] CVE-2022-1899


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2022-1899.

[Assistant] Out-of-bounds Read in GitHub repository radareorg/radare2 prior to 5.7.0.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2022-1899?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2022-1899?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2022-1900 mean in the context of cybersecurity?

[Assistant] CVE-2022-1900


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2022-1900.

[Assistant] The Copify plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.0. This is due to missing nonce validation on the CopifySettings page. This makes it possible for unauthenticated attackers to update the plugins settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2022-1900?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2022-1900?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2022-1901 mean in the context of cybersecurity?

[Assistant] CVE-2022-1901


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2022-1901.

[Assistant] In affected versions of Octopus Deploy it is possible to unmask sensitive variables by using variable preview.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2022-1901?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2022-1901?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2022-1902 mean in the context of cybersecurity?

[Assistant] CVE-2022-1902


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2022-1902.

[Assistant] A flaw was found in the Red Hat Advanced Cluster Security for Kubernetes. Notifier secrets were not properly sanitized in the GraphQL API. This flaw allows authenticated ACS users to retrieve Notifiers from the GraphQL API, revealing secrets that can escalate their privileges.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2022-1902?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2022-1902?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2022-1903 mean in the context of cybersecurity?

[Assistant] CVE-2022-1903


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2022-1903.

[Assistant] The ARMember WordPress plugin before 3.4.8 is vulnerable to account takeover (even the administrator) due to missing nonce and authorization checks in an AJAX action available to unauthenticated users, allowing them to change the password of arbitrary users by knowing their username


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2022-1903?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2022-1903?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2022-1904 mean in the context of cybersecurity?

[Assistant] CVE-2022-1904


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2022-1904.

[Assistant] The Pricing Tables WordPress Plugin WordPress plugin before 3.2.1 does not sanitise and escape parameter before outputting it back in a page available to any user (both authenticated and unauthenticated) when a specific setting is enabled, leading to a Reflected Cross-Site Scripting


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2022-1904?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2022-1904?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2022-1905 mean in the context of cybersecurity?

[Assistant] CVE-2022-1905


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2022-1905.

[Assistant] The Events Made Easy WordPress plugin before 2.2.81 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2022-1905?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2022-1905?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2022-1906 mean in the context of cybersecurity?

[Assistant] CVE-2022-1906


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2022-1906.

[Assistant] The Copyright Proof WordPress plugin through 4.16 does not sanitise and escape a parameter before outputting it back via an AJAX action available to both unauthenticated and authenticated users, leading to a Reflected Cross-Site Scripting when a specific setting is enabled.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2022-1906?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2022-1906?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2022-1907 mean in the context of cybersecurity?

[Assistant] CVE-2022-1907


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2022-1907.

[Assistant] Buffer Over-read in GitHub repository bfabiszewski/libmobi prior to 0.11.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2022-1907?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2022-1907?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2022-1908 mean in the context of cybersecurity?

[Assistant] CVE-2022-1908


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2022-1908.

[Assistant] Buffer Over-read in GitHub repository bfabiszewski/libmobi prior to 0.11.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2022-1908?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2022-1908?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2022-1909 mean in the context of cybersecurity?

[Assistant] CVE-2022-1909


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2022-1909.

[Assistant] Cross-site Scripting (XSS) - Stored in GitHub repository causefx/organizr prior to 2.1.2200.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2022-1909?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2022-1909?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2022-1910 mean in the context of cybersecurity?

[Assistant] CVE-2022-1910


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2022-1910.

[Assistant] The Shortcodes and extra features for Phlox WordPress plugin before 2.9.8 does not sanitise and escape a parameter before outputting it back in the response, leading to a Reflected Cross-Site Scripting


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2022-1910?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2022-1910?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2022-1911 mean in the context of cybersecurity?

[Assistant] CVE-2022-1911


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2022-1911.

[Assistant] Error in parser function in M-Files Server versions before 22.6.11534.1 and before 22.6.11505.0 allowed unauthenticated access to some information of the underlying operating system.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2022-1911?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2022-1911?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2022-1912 mean in the context of cybersecurity?

[Assistant] CVE-2022-1912


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2022-1912.

[Assistant] The Button Widget Smartsoft plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.1. This is due to missing nonce validation on the smartsoftbutton_settings page. This makes it possible for unauthenticated attackers to update the plugins settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2022-1912?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2022-1912?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2022-1913 mean in the context of cybersecurity?

[Assistant] CVE-2022-1913


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2022-1913.

[Assistant] The Add Post URL WordPress plugin through 2.1.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2022-1913?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2022-1913?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2022-1914 mean in the context of cybersecurity?

[Assistant] CVE-2022-1914


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2022-1914.

[Assistant] The Clean-Contact WordPress plugin through 1.6 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and lead to Stored XSS due to the lack of sanitisation and escaping as well


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2022-1914?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2022-1914?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2022-1915 mean in the context of cybersecurity?

[Assistant] CVE-2022-1915


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2022-1915.

[Assistant] The WP Zillow Review Slider WordPress plugin before 2.4 does not escape a settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite)


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2022-1915?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2022-1915?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2022-1916 mean in the context of cybersecurity?

[Assistant] CVE-2022-1916


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2022-1916.

[Assistant] The Active Products Tables for WooCommerce. Professional products tables for WooCommerce store WordPress plugin before 1.0.5 does not sanitise and escape a parameter before outputting it back in the response of an AJAX action (available to both unauthenticated and authenticated users), leading to a Reflected cross-Site Scripting


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2022-1916?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2022-1916?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2022-1918 mean in the context of cybersecurity?

[Assistant] CVE-2022-1918


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2022-1918.

[Assistant] The ToolBar to Share plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0. This is due to missing nonce validation on the plugin_toolbar_comparte page. This makes it possible for unauthenticated attackers to update the plugins settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2022-1918?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2022-1918?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2022-1919 mean in the context of cybersecurity?

[Assistant] CVE-2022-1919


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2022-1919.

[Assistant] Use after free in Codecs in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2022-1919?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2022-1919?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2022-1920 mean in the context of cybersecurity?

[Assistant] CVE-2022-1920


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2022-1920.

[Assistant] Integer overflow in matroskademux element in gst_matroska_demux_add_wvpk_header function which allows a heap overwrite while parsing matroska files. Potential for arbitrary code execution through heap overwrite.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2022-1920?

[Assistant] [debian-lts-announce] 20220809 [SECURITY] [DLA 3069-1] gst-plugins-good1.0 security update


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2022-1920?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2022-1921 mean in the context of cybersecurity?

[Assistant] CVE-2022-1921


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2022-1921.

[Assistant] Integer overflow in avidemux element in gst_avi_demux_invert function which allows a heap overwrite while parsing avi files. Potential for arbitrary code execution through heap overwrite.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2022-1921?

[Assistant] [debian-lts-announce] 20220809 [SECURITY] [DLA 3069-1] gst-plugins-good1.0 security update


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2022-1921?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2022-1922 mean in the context of cybersecurity?

[Assistant] CVE-2022-1922


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2022-1922.

[Assistant] DOS / potential heap overwrite in mkv demuxing using zlib decompression. Integer overflow in matroskademux element in gst_matroska_decompress_data function which causes a segfault, or could cause a heap overwrite, depending on libc and OS. Depending on the libc used, and the underlying OS capabilities, it could be just a segfault or a heap overwrite. If the libc uses mmap for large chunks, and the OS supports mmap, then it is just a segfault (because the realloc before the integer overflow will use mremap to reduce the size of the chunk, and it will start to write to unmapped memory). However, if using a libc implementation that does not use mmap, or if the OS does not support mmap while using libc, then this could result in a heap overwrite.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2022-1922?

[Assistant] [debian-lts-announce] 20220809 [SECURITY] [DLA 3069-1] gst-plugins-good1.0 security update


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2022-1922?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2022-1923 mean in the context of cybersecurity?

[Assistant] CVE-2022-1923


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2022-1923.

[Assistant] DOS / potential heap overwrite in mkv demuxing using bzip decompression. Integer overflow in matroskademux element in bzip decompression function which causes a segfault, or could cause a heap overwrite, depending on libc and OS. Depending on the libc used, and the underlying OS capabilities, it could be just a segfault or a heap overwrite. If the libc uses mmap for large chunks, and the OS supports mmap, then it is just a segfault (because the realloc before the integer overflow will use mremap to reduce the size of the chunk, and it will start to write to unmapped memory). However, if using a libc implementation that does not use mmap, or if the OS does not support mmap while using libc, then this could result in a heap overwrite.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2022-1923?

[Assistant] [debian-lts-announce] 20220809 [SECURITY] [DLA 3069-1] gst-plugins-good1.0 security update


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2022-1923?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2022-1924 mean in the context of cybersecurity?

[Assistant] CVE-2022-1924


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2022-1924.

[Assistant] DOS / potential heap overwrite in mkv demuxing using lzo decompression. Integer overflow in matroskademux element in lzo decompression function which causes a segfault, or could cause a heap overwrite, depending on libc and OS. Depending on the libc used, and the underlying OS capabilities, it could be just a segfault or a heap overwrite. If the libc uses mmap for large chunks, and the OS supports mmap, then it is just a segfault (because the realloc before the integer overflow will use mremap to reduce the size of the chunk, and it will start to write to unmapped memory). However, if using a libc implementation that does not use mmap, or if the OS does not support mmap while using libc, then this could result in a heap overwrite.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2022-1924?

[Assistant] [debian-lts-announce] 20220809 [SECURITY] [DLA 3069-1] gst-plugins-good1.0 security update


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2022-1924?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2022-1925 mean in the context of cybersecurity?

[Assistant] CVE-2022-1925


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2022-1925.

[Assistant] DOS / potential heap overwrite in mkv demuxing using HEADERSTRIP decompression. Integer overflow in matroskaparse element in gst_matroska_decompress_data function which causes a heap overflow. Due to restrictions on chunk sizes in the matroskademux element, the overflow can't be triggered, however the matroskaparse element has no size checks.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2022-1925?

[Assistant] [debian-lts-announce] 20220809 [SECURITY] [DLA 3069-1] gst-plugins-good1.0 security update


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2022-1925?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2022-1926 mean in the context of cybersecurity?

[Assistant] CVE-2022-1926


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2022-1926.

[Assistant] Integer Overflow or Wraparound in GitHub repository polonel/trudesk prior to 1.2.3.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2022-1926?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2022-1926?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2022-1927 mean in the context of cybersecurity?

[Assistant] CVE-2022-1927


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2022-1927.

[Assistant] Buffer Over-read in GitHub repository vim/vim prior to 8.2.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2022-1927?

[Assistant] 20221030 APPLE-SA-2022-10-27-5 Additional information for APPLE-SA-2022-10-24-2 macOS Ventura 13


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2022-1927?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2022-1928 mean in the context of cybersecurity?

[Assistant] CVE-2022-1928


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2022-1928.

[Assistant] Cross-site Scripting (XSS) - Stored in GitHub repository go-gitea/gitea prior to 1.16.9.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2022-1928?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2022-1928?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2022-1929 mean in the context of cybersecurity?

[Assistant] CVE-2022-1929


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2022-1929.

[Assistant] An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the devcert npm package, when an attacker is able to supply arbitrary input to the certificateFor method


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2022-1929?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2022-1929?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2022-1930 mean in the context of cybersecurity?

[Assistant] CVE-2022-1930


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2022-1930.

[Assistant] An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the eth-account PyPI package, when an attacker is able to supply arbitrary input to the encode_structured_data method


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2022-1930?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2022-1930?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2022-1931 mean in the context of cybersecurity?

[Assistant] CVE-2022-1931


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2022-1931.

[Assistant] Incorrect Synchronization in GitHub repository polonel/trudesk prior to 1.2.3.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2022-1931?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2022-1931?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2022-1932 mean in the context of cybersecurity?

[Assistant] CVE-2022-1932


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2022-1932.

[Assistant] The Rezgo Online Booking WordPress plugin before 4.1.8 does not sanitise and escape some parameters before outputting them back in a page, leading to a Reflected Cross-Site Scripting, which can be exploited either via a LFI in an AJAX action, or direct call to the affected file


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2022-1932?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2022-1932?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2022-1933 mean in the context of cybersecurity?

[Assistant] CVE-2022-1933


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2022-1933.

[Assistant] The CDI WordPress plugin before 5.1.9 does not sanitise and escape a parameter before outputting it back in the response of an AJAX action (available to both unauthenticated and authenticated users), leading to a Reflected Cross-Site Scripting


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2022-1933?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2022-1933?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2022-1934 mean in the context of cybersecurity?

[Assistant] CVE-2022-1934


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2022-1934.

[Assistant] Use After Free in GitHub repository mruby/mruby prior to 3.2.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2022-1934?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2022-1934?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2022-1935 mean in the context of cybersecurity?

[Assistant] CVE-2022-1935


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2022-1935.

[Assistant] Incorrect authorization in GitLab EE affecting all versions from 12.0 before 14.9.5, all versions starting from 14.10 before 14.10.4, all versions starting from 15.0 before 15.0.1 allowed an attacker already in possession of a valid Project Trigger Token to misuse it from any location even when IP address restrictions were configured


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2022-1935?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2022-1935?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2022-1936 mean in the context of cybersecurity?

[Assistant] CVE-2022-1936


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2022-1936.

[Assistant] Incorrect authorization in GitLab EE affecting all versions from 12.0 before 14.9.5, all versions starting from 14.10 before 14.10.4, all versions starting from 15.0 before 15.0.1 allowed an attacker already in possession of a valid Project Deploy Token to misuse it from any location even when IP address restrictions were configured


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2022-1936?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2022-1936?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2022-1937 mean in the context of cybersecurity?

[Assistant] CVE-2022-1937


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2022-1937.

[Assistant] The Awin Data Feed WordPress plugin before 1.8 does not sanitise and escape a parameter before outputting it back via an AJAX action (available to both unauthenticated and authenticated users), leading to a Reflected Cross-Site Scripting


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2022-1937?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2022-1937?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2022-1938 mean in the context of cybersecurity?

[Assistant] CVE-2022-1938


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2022-1938.

[Assistant] The Awin Data Feed WordPress plugin before 1.8 does not sanitise and escape a header when processing request to generate analytics data, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against a logged in admin viewing the plugin's settings


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2022-1938?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2022-1938?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2022-1939 mean in the context of cybersecurity?

[Assistant] CVE-2022-1939


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2022-1939.

[Assistant] The Allow svg files WordPress plugin before 1.1 does not properly validate uploaded files, which could allow high privilege users such as admin to upload PHP files even when they are not allowed to


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2022-1939?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2022-1939?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2022-1940 mean in the context of cybersecurity?

[Assistant] CVE-2022-1940


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2022-1940.

[Assistant] A Stored Cross-Site Scripting vulnerability in Jira integration in GitLab EE affecting all versions from 13.11 prior to 14.9.5, 14.10 prior to 14.10.4, and 15.0 prior to 15.0.1 allows an attacker to execute arbitrary JavaScript code in GitLab on a victim's behalf via specially crafted Jira Issues


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2022-1940?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2022-1940?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2022-1941 mean in the context of cybersecurity?

[Assistant] CVE-2022-1941


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2022-1941.

[Assistant] A parsing vulnerability for the MessageSet type in the ProtocolBuffers versions prior to and including 3.16.1, 3.17.3, 3.18.2, 3.19.4, 3.20.1 and 3.21.5 for protobuf-cpp, and versions prior to and including 3.16.1, 3.17.3, 3.18.2, 3.19.4, 3.20.1 and 4.21.5 for protobuf-python can lead to out of memory failures. A specially crafted message with multiple key-value per elements creates parsing issues, and can lead to a Denial of Service against services receiving unsanitized input. We recommend upgrading to versions 3.18.3, 3.19.5, 3.20.2, 3.21.6 for protobuf-cpp and 3.18.3, 3.19.5, 3.20.2, 4.21.6 for protobuf-python. Versions for 3.16 and 3.17 are no longer updated.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2022-1941?

[Assistant]
[oss-security] 20220927 CVE-2022-1941: Protobuf C++, Python DoS

[debian-lts-announce] 20230418 [SECURITY] [DLA 3393-1] protobuf security update


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2022-1941?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2022-1942 mean in the context of cybersecurity?

[Assistant] CVE-2022-1942


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2022-1942.

[Assistant] Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2022-1942?

[Assistant]
20221030 APPLE-SA-2022-10-27-5 Additional information for APPLE-SA-2022-10-24-2 macOS Ventura 13

[debian-lts-announce] 20221124 [SECURITY] [DLA 3204-1] vim security update


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2022-1942?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2022-1943 mean in the context of cybersecurity?

[Assistant] CVE-2022-1943


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2022-1943.

[Assistant] A flaw out of bounds memory write in the Linux kernel UDF file system functionality was found in the way user triggers some file operation which triggers udf_write_fi(). A local user could use this flaw to crash the system or potentially


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2022-1943?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2022-1943?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2022-1944 mean in the context of cybersecurity?

[Assistant] CVE-2022-1944


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2022-1944.

[Assistant] When the feature is configured, improper authorization in the Interactive Web Terminal in GitLab CE/EE affecting all versions from 11.3 prior to 14.9.5, 14.10 prior to 14.10.4, and 15.0 prior to 15.0.1 allows users with the Developer role to open terminals on other Developers' running jobs


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2022-1944?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2022-1944?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2022-1945 mean in the context of cybersecurity?

[Assistant] CVE-2022-1945


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2022-1945.

[Assistant] The Coming Soon & Maintenance Mode by Colorlib WordPress plugin before 1.0.99 does not sanitize and escape some settings, allowing high privilege users such as admin to perform Stored Cross-Site Scripting when unfiltered_html is disallowed (for example in multisite setup)


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2022-1945?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2022-1945?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2022-1946 mean in the context of cybersecurity?

[Assistant] CVE-2022-1946


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2022-1946.

[Assistant] The Gallery WordPress plugin before 2.0.0 does not sanitise and escape a parameter before outputting it back in the response of an AJAX action (available to both unauthenticated and authenticated users), leading to a Reflected Cross-Site Scripting issue


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2022-1946?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2022-1946?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2022-1947 mean in the context of cybersecurity?

[Assistant] CVE-2022-1947


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2022-1947.

[Assistant] Use of Incorrect Operator in GitHub repository polonel/trudesk prior to 1.2.3.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2022-1947?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2022-1947?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2022-1948 mean in the context of cybersecurity?

[Assistant] CVE-2022-1948


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2022-1948.

[Assistant] An issue has been discovered in GitLab affecting all versions starting from 15.0 before 15.0.1. Missing validation of input used in quick actions allowed an attacker to exploit XSS by injecting HTML in contact details.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2022-1948?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2022-1948?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2022-1949 mean in the context of cybersecurity?

[Assistant] CVE-2022-1949


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2022-1949.

[Assistant] An access control bypass vulnerability found in 389-ds-base. That mishandling of the filter that would yield incorrect results, but as that has progressed, can be determined that it actually is an access control bypass. This may allow any remote unauthenticated user to issue a filter that allows searching for database items they do not have access to, including but not limited to potentially userPassword hashes and other sensitive data.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2022-1949?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2022-1949?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2022-1950 mean in the context of cybersecurity?

[Assistant] CVE-2022-1950


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2022-1950.

[Assistant] The Youzify WordPress plugin before 1.2.0 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to an unauthenticated SQL injection


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2022-1950?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2022-1950?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2022-1951 mean in the context of cybersecurity?

[Assistant] CVE-2022-1951


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2022-1951.

[Assistant] The core plugin for kitestudio WordPress plugin before 2.3.1 does not sanitise and escape some parameters before outputting them back in a response of an AJAX action, available to both unauthenticated and authenticated users when a premium theme from the vendor is active, leading to a Reflected Cross-Site Scripting.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2022-1951?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2022-1951?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2022-1952 mean in the context of cybersecurity?

[Assistant] CVE-2022-1952


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2022-1952.

[Assistant] The Free Booking Plugin for Hotels, Restaurant and Car Rental WordPress plugin before 1.1.16 suffers from insufficient input validation which leads to arbitrary file upload and subsequently to remote code execution. An AJAX action accessible to unauthenticated users is affected by this issue. An allowlist of valid file extensions is defined but is not used during the validation steps.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2022-1952?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2022-1952?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2022-1953 mean in the context of cybersecurity?

[Assistant] CVE-2022-1953


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2022-1953.

[Assistant] The Product Configurator for WooCommerce WordPress plugin before 1.2.32 suffers from an arbitrary file deletion vulnerability via an AJAX action, accessible to unauthenticated users, which accepts user input that is being used in a path and passed to unlink() without validation first


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2022-1953?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2022-1953?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2022-1954 mean in the context of cybersecurity?

[Assistant] CVE-2022-1954


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2022-1954.

[Assistant] A Regular Expression Denial of Service vulnerability in GitLab CE/EE affecting all versions from 1.0.2 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1 allows an attacker to make a GitLab instance inaccessible via specially crafted web server response headers


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2022-1954?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2022-1954?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2022-1955 mean in the context of cybersecurity?

[Assistant] CVE-2022-1955


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2022-1955.

[Assistant] Session 1.13.0 allows an attacker with physical access to the victim's device to bypass the application's password/pin lock to access user data. This is possible due to lack of adequate security controls to prevent dynamic code manipulation.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2022-1955?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2022-1955?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2022-1956 mean in the context of cybersecurity?

[Assistant] CVE-2022-1956


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2022-1956.

[Assistant] The Shortcut Macros WordPress plugin through 1.3 does not have authorisation and CSRF checks in place when updating its settings, which could allow any authenticated users, such as subscriber, to update them.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2022-1956?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2022-1956?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2022-1957 mean in the context of cybersecurity?

[Assistant] CVE-2022-1957


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2022-1957.

[Assistant] The Comment License WordPress plugin before 1.4.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2022-1957?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2022-1957?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2022-1958 mean in the context of cybersecurity?

[Assistant] CVE-2022-1958


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2022-1958.

[Assistant] A vulnerability classified as critical has been found in FileCloud. Affected is an unknown function of the component NTFS Handler. The manipulation leads to improper access controls. It is possible to launch the attack remotely. Upgrading to version 21.3.5.18513 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-201960.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2022-1958?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2022-1958?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2022-1959 mean in the context of cybersecurity?

[Assistant] CVE-2022-1959


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2022-1959.

[Assistant] AppLock version 7.9.29 allows an attacker with physical access to the device to bypass biometric authentication. This is possible because the application did not correctly implement fingerprint validations.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2022-1959?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2022-1959?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2022-1960 mean in the context of cybersecurity?

[Assistant] CVE-2022-1960


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2022-1960.

[Assistant] The MyCSS WordPress plugin through 1.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2022-1960?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2022-1960?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2022-1961 mean in the context of cybersecurity?

[Assistant] CVE-2022-1961


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2022-1961.

[Assistant] The Google Tag Manager for WordPress (GTM4WP) plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping via the `gtm4wp-options[scroller-contentid]` parameter found in the `~/public/frontend.php` file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 1.15.1. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2022-1961?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2022-1961?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2022-1962 mean in the context of cybersecurity?

[Assistant] CVE-2022-1962


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2022-1962.

[Assistant] Uncontrolled recursion in the Parse functions in go/parser before Go 1.17.12 and Go 1.18.4 allow an attacker to cause a panic due to stack exhaustion via deeply nested types or declarations.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2022-1962?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2022-1962?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2022-1963 mean in the context of cybersecurity?

[Assistant] CVE-2022-1963


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2022-1963.

[Assistant] An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.4 before 14.10.5, all versions starting from 15.0 before 15.0.4, all versions starting from 15.1 before 15.1.1. GitLab reveals if a user has enabled two-factor authentication on their account in the HTML source, to unauthenticated users.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2022-1963?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2022-1963?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2022-1964 mean in the context of cybersecurity?

[Assistant] CVE-2022-1964


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2022-1964.

[Assistant] The Easy SVG Support WordPress plugin before 3.3.0 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2022-1964?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2022-1964?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2022-1965 mean in the context of cybersecurity?

[Assistant] CVE-2022-1965


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2022-1965.

[Assistant] Multiple products of CODESYS implement a improper error handling. A low privilege remote attacker may craft a request, which is not properly processed by the error handling. In consequence, the file referenced by the request could be deleted. User interaction is not required.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2022-1965?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2022-1965?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2022-1966 mean in the context of cybersecurity?

[Assistant] CVE-2022-1966


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2022-1966.

[Assistant] N\A


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2022-1966?

[Assistant] N\A


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2022-1966?

[Assistant] REJECTED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2022-1967 mean in the context of cybersecurity?

[Assistant] CVE-2022-1967


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2022-1967.

[Assistant] The WP Championship WordPress plugin before 9.3 is lacking CSRF checks in various places, allowing attackers to make a logged in admin perform unwanted actions, such as create and delete arbitrary teams as well as update the plugin's settings. Due to the lack of sanitisation and escaping, it could also lead to Stored Cross-Site Scripting issues


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2022-1967?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2022-1967?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2022-1968 mean in the context of cybersecurity?

[Assistant] CVE-2022-1968


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2022-1968.

[Assistant] Use After Free in GitHub repository vim/vim prior to 8.2.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2022-1968?

[Assistant]
[debian-lts-announce] 20220620 [SECURITY] [DLA 3053-1] vim security update

20221030 APPLE-SA-2022-10-27-5 Additional information for APPLE-SA-2022-10-24-2 macOS Ventura 13

[debian-lts-announce] 20221108 [SECURITY] [DLA 3182-1] vim security update


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2022-1968?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2022-1969 mean in the context of cybersecurity?

[Assistant] CVE-2022-1969


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2022-1969.

[Assistant] The Mobile browser color select plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.1. This is due to missing or incorrect nonce validation on the admin_update_data() function. This makes it possible for unauthenticated attackers to inject malicious web scripts via forged request granted they can trick a site administrator into performing an action such as clicking on a link.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2022-1969?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2022-1969?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2022-1970 mean in the context of cybersecurity?

[Assistant] CVE-2022-1970


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2022-1970.

[Assistant] N\A


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2022-1970?

[Assistant] N\A


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2022-1970?

[Assistant] REJECTED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2022-1971 mean in the context of cybersecurity?

[Assistant] CVE-2022-1971


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2022-1971.

[Assistant] The NextCellent Gallery WordPress plugin through 1.9.35 does not sanitise and escape some of its image settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2022-1971?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2022-1971?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2022-1972 mean in the context of cybersecurity?

[Assistant] CVE-2022-1972


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2022-1972.

[Assistant] N\A


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2022-1972?

[Assistant] N\A


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2022-1972?

[Assistant] REJECTED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2022-1973 mean in the context of cybersecurity?

[Assistant] CVE-2022-1973


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2022-1973.

[Assistant] A use-after-free flaw was found in the Linux kernel in log_replay in fs/ntfs3/fslog.c in the NTFS journal. This flaw allows a local attacker to crash the system and leads to a kernel information leak problem.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2022-1973?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2022-1973?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2022-1974 mean in the context of cybersecurity?

[Assistant] CVE-2022-1974


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2022-1974.

[Assistant] A use-after-free flaw was found in the Linux kernel's NFC core functionality due to a race condition between kobject creation and delete. This vulnerability allows a local attacker with CAP_NET_ADMIN privilege to leak kernel information.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2022-1974?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2022-1974?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2022-1975 mean in the context of cybersecurity?

[Assistant] CVE-2022-1975