Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-23037 State: PUBLISHED Published: 2022-03-10T19:20:16 Last Updated: 2024-08-03T03:28:43.061Z Vendors: unspecified Products: unspecified Problem Types: unknown Description: Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Several Linux PV device frontends are using the grant table interfaces for removing access rights of the backends in ways being subject to race conditions, resulting in potential data leaks, data corruption by malicious backends, and denial of service triggered by malicious backends: blkfront, netfront, scsifront and the
CVE ID: CVE-2022-23038 State: PUBLISHED Published: 2022-03-10T19:20:18 Last Updated: 2024-08-03T03:28:43.103Z Vendors: unspecified Products: unspecified Problem Types: unknown Description: Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Several Linux PV device frontends are using the grant table interfaces for removing access rights of the backends in ways being subject to race conditions, resulting in potential data leaks, data corruption by malicious backends, and denial of service triggered by malicious backends: blkfront, netfront, scsifront and the
CVE ID: CVE-2022-23039 State: PUBLISHED Published: 2022-03-10T19:20:19 Last Updated: 2024-08-03T03:28:42.973Z Vendors: unspecified Products: unspecified Problem Types: unknown Description: Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Several Linux PV device frontends are using the grant table interfaces for removing access rights of the backends in ways being subject to race conditions, resulting in potential data leaks, data corruption by malicious backends, and denial of service triggered by malicious backends: blkfront, netfront, scsifront and the
CVE ID: CVE-2022-23040 State: PUBLISHED Published: 2022-03-10T19:20:21 Last Updated: 2024-08-03T03:28:42.981Z Vendors: unspecified Products: unspecified Problem Types: unknown Description: Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Several Linux PV device frontends are using the grant table interfaces for removing access rights of the backends in ways being subject to race conditions, resulting in potential data leaks, data corruption by malicious backends, and denial of service triggered by malicious backends: blkfront, netfront, scsifront and the
CVE ID: CVE-2022-23041 State: PUBLISHED Published: 2022-03-10T19:20:22 Last Updated: 2024-08-03T03:28:42.964Z Vendors: unspecified Products: unspecified Problem Types: unknown Description: Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Several Linux PV device frontends are using the grant table interfaces for removing access rights of the backends in ways being subject to race conditions, resulting in potential data leaks, data corruption by malicious backends, and denial of service triggered by malicious backends: blkfront, netfront, scsifront and the
CVE ID: CVE-2022-23042 State: PUBLISHED Published: 2022-03-10T19:20:24 Last Updated: 2024-08-03T03:28:42.974Z Vendors: unspecified Products: unspecified Problem Types: unknown Description: Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Several Linux PV device frontends are using the grant table interfaces for removing access rights of the backends in ways being subject to race conditions, resulting in potential data leaks, data corruption by malicious backends, and denial of service triggered by malicious backends: blkfront, netfront, scsifront and the
CVE ID: CVE-2022-23043 State: PUBLISHED Published: 2022-02-22T18:21:02 Last Updated: 2024-08-03T03:28:43.235Z Vendors: n/a Products: Zenario CMS Problem Types: Insecure file upload (RCE) Description: Zenario CMS 9.2 allows an authenticated admin user to bypass the file upload restriction by creating a new 'File/MIME Types' using the '.phar' extension. Then an attacker can upload a malicious file, intercept the request and change the extension to '.phar' in order to run commands on the server. Additional Analyst Notes: - CVE Program Container: References: - https://fluidattacks.com/advisories/simone/ - https://github.com/TribalSystems/Zenario/releases/tag/9.2.55826
CVE ID: CVE-2022-23044 State: PUBLISHED Published: 2022-11-25T00:00:00.000Z Last Updated: 2025-04-25T17:33:39.212Z Vendors: n/a Products: Tiny File Manager Problem Types: Remote command execution Description: Tiny File Manager version 2.4.8 allows an unauthenticated remote attacker to persuade users to perform unintended actions within the application. This is possible because the application is vulnerable to CSRF. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/prasathmani/tinyfilemanager/ - https://fluidattacks.com/advisories/mosey/
CVE ID: CVE-2022-23045 State: PUBLISHED Published: 2022-01-19T20:38:57 Last Updated: 2024-08-03T03:28:43.083Z Vendors: n/a Products: PhpIPAM Problem Types: Stored cross-site scripting (XSS) Description: PhpIPAM v1.4.4 allows an authenticated admin user to inject persistent JavaScript code inside the "Site title" parameter while updating the site settings. The "Site title" setting is injected in several locations which triggers the XSS. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/phpipam/phpipam/releases/tag/v1.4.5 - https://fluidattacks.com/advisories/osbourne/
CVE ID: CVE-2022-23046 State: PUBLISHED Published: 2022-01-19T20:38:56 Last Updated: 2024-08-03T03:28:42.952Z Vendors: n/a Products: PhpIPAM Problem Types: SQL injection Description: PhpIPAM v1.4.4 allows an authenticated admin user to inject SQL sentences in the "subnet" parameter while searching a subnet via app/admin/routing/edit-bgp-mapping-search.php Additional Analyst Notes: - CVE Program Container: References: - https://fluidattacks.com/advisories/mercury/ - https://github.com/phpipam/phpipam/releases/tag/v1.4.5 - http://packetstormsecurity.com/files/165683/PHPIPAM-1.4.4-SQL-Injection.html
CVE ID: CVE-2022-23047 State: PUBLISHED Published: 2022-02-09T22:03:57 Last Updated: 2024-08-03T03:28:43.262Z Vendors: n/a Products: Exponent CMS Problem Types: Stored cross-site scripting (XSS) Description: Exponent CMS 2.6.0patch2 allows an authenticated admin user to inject persistent JavaScript code inside the "Site/Organization Name","Site Title" and "Site Header" parameters while updating the site settings on "/exponentcms/administration/configure_site" Additional Analyst Notes: - CVE Program Container: References: - https://fluidattacks.com/advisories/franklin/ - https://exponentcms.lighthouseapp.com/projects/61783/tickets/1459 - https://github.com/exponentcms/exponent-cms/issues/1546
CVE ID: CVE-2022-23048 State: PUBLISHED Published: 2022-02-09T22:03:58 Last Updated: 2024-08-03T03:28:43.253Z Vendors: n/a Products: Exponent CMS Problem Types: Insecure file upload (RCE) Description: Exponent CMS 2.6.0patch2 allows an authenticated admin user to upload a malicious extension in the format of a ZIP file with a PHP file inside it. After upload it, the PHP file will be placed at "themes/simpletheme/{rce}.php" from where can be accessed in order to execute commands. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/exponentcms/exponent-cms/issues/1546 - https://fluidattacks.com/advisories/dylan/ - https://exponentcms.lighthouseapp.com/projects/6
exponent-cms/issues/1546 - https://fluidattacks.com/advisories/dylan/ - https://exponentcms.lighthouseapp.com/projects/61783/tickets/1460
CVE ID: CVE-2022-23049 State: PUBLISHED Published: 2022-02-09T22:03:59 Last Updated: 2024-08-03T03:28:43.249Z Vendors: n/a Products: Exponent CMS Problem Types: Stored cross-site scripting (XSS) Description: Exponent CMS 2.6.0patch2 allows an authenticated user to inject persistent JavaScript code on the "User-Agent" header when logging in. When an administrator user visits the "User Sessions" tab, the JavaScript will be triggered allowing an attacker to compromise the administrator session. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/exponentcms/exponent-cms/issues/1546 - https://fluidattacks.com/advisories/cobain/ - https://exponentcms.lighthouseapp.
/exponentcms/exponent-cms/issues/1546 - https://fluidattacks.com/advisories/cobain/ - https://exponentcms.lighthouseapp.com/projects/61783/tickets/1461
CVE ID: CVE-2022-23050 State: PUBLISHED Published: 2022-05-24T18:02:05 Last Updated: 2024-08-03T03:28:43.282Z Vendors: n/a Products: ManageEngine AppManager15 Problem Types: DLL Hijacking Description: ManageEngine AppManager15 (Build No:15510) allows an authenticated admin user to upload a DLL file to perform a DLL hijack attack inside the 'working' folder through the 'Upload Files / Binaries' functionality. Additional Analyst Notes: - CVE Program Container: References: - https://fluidattacks.com/advisories/cerati/ - https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2022-23050.html
CVE ID: CVE-2022-23051 State: PUBLISHED Published: 2022-03-03T21:55:05 Last Updated: 2024-08-03T03:28:43.250Z Vendors: n/a Products: PeTeReport Problem Types: Stored cross-site scripting (XSS) Description: PeteReport Version 0.5 allows an authenticated admin user to inject persistent JavaScript code while adding an 'Attack Tree' by modifying the 'svg_file' parameter. Additional Analyst Notes: - CVE Program Container: References: - https://fluidattacks.com/advisories/brown/ - https://github.com/1modm/petereport/issues/36
CVE ID: CVE-2022-23052 State: PUBLISHED Published: 2022-03-03T21:56:33 Last Updated: 2024-08-03T03:28:43.246Z Vendors: n/a Products: PeTeReport Problem Types: Cross-site request forgery Description: PeteReport Version 0.5 contains a Cross Site Request Forgery (CSRF) vulnerability allowing an attacker to trick users into deleting users, products, reports and findings on the application. Additional Analyst Notes: - CVE Program Container: References: - https://fluidattacks.com/advisories/jett/ - https://github.com/1modm/petereport/issues/34
CVE ID: CVE-2022-23053 State: PUBLISHED Published: 2022-02-20T19:00:15 Last Updated: 2024-08-03T03:28:43.252Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: nasa Products: openmct Problem Types: CWE-79 Description: Openmct versions 1.3.0 to 1.7.7 are vulnerable against stored XSS via the “Condition Widget” element, that allows the injection of malicious JavaScript into the ‘URL’ field. This issue affects: nasa openmct 1.7.7 version and prior versions; 1.3.0 version and later versions. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nasa/openmct/commit/abc93d0ec4b104dac1ea5f8a615d06e3ab78934a
CVE ID: CVE-2022-23054 State: PUBLISHED Published: 2022-02-20T19:00:17 Last Updated: 2024-08-03T03:28:43.268Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: nasa Products: openmct Problem Types: CWE-79 Description: Openmct versions 1.3.0 to 1.7.7 are vulnerable against stored XSS via the “Summary Widget” element, that allows the injection of malicious JavaScript into the ‘URL’ field. This issue affects: nasa openmct 1.7.7 version and prior versions; 1.3.0 version and later versions. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nasa/openmct/commit/abc93d0ec4b104dac1ea5f8a615d06e3ab78934a
CVE ID: CVE-2022-23055 State: PUBLISHED Published: 2022-06-22T08:25:10.197361Z Last Updated: 2024-09-16T17:53:19.267Z Vendors: frappe Products: frappe Problem Types: CWE-862 Description: In ERPNext, versions v11.0.0-beta through v13.0.2 are vulnerable to Missing Authorization, in the chat rooms functionality. A low privileged attacker can send a direct message or a group message to any member or group, impersonating themselves as the administrator. The attacker can also read chat messages of groups that they do not belong to, and of other users. Additional Analyst Notes: - CVE Program Container: References: - https://www.mend.io/vulnerability-database/CVE-2022-23055 - https://github.com/frap
CVE Program Container: References: - https://www.mend.io/vulnerability-database/CVE-2022-23055 - https://github.com/frappe/frappe/blob/v13.0.2/frappe/chat/doctype/chat_message/chat_message.py#L134 - https://github.com/frappe/frappe/blob/v13.0.2/frappe/chat/doctype/chat_message/chat_message.py#L155
CVE ID: CVE-2022-23056 State: PUBLISHED Published: 2022-06-22T07:25:16.868936Z Last Updated: 2024-09-17T03:59:39.893Z Vendors: erpnext Products: erpnext Problem Types: CWE-79 Description: In ERPNext, versions v13.0.0-beta.13 through v13.30.0 are vulnerable to Stored XSS at the Patient History page which allows a low privilege user to conduct an account takeover attack. Additional Analyst Notes: - CVE Program Container: References: - https://www.mend.io/vulnerability-database/CVE-2022-23056 - https://github.com/frappe/erpnext/blob/21a3ea462aaf319e466c067c2ec406eb9abe6ed3/erpnext/healthcare/page/patient_history/patient_history.js#L288
CVE ID: CVE-2022-23057 State: PUBLISHED Published: 2022-06-22T07:25:11.161456Z Last Updated: 2024-09-16T17:14:26.886Z Vendors: frappe Products: frappe Problem Types: CWE-79 Description: In ERPNext, versions v12.0.9--v13.0.3 are vulnerable to Stored Cross-Site-Scripting (XSS), due to user input not being validated properly. A low privileged attacker could inject arbitrary code into input fields when editing his profile. Additional Analyst Notes: - CVE Program Container: References: - https://www.mend.io/vulnerability-database/CVE-2022-23057 - https://github.com/frappe/frappe/commit/497ea861f481c6a3c52fe2aed9d0df1b6c99e9d7
CVE ID: CVE-2022-23058 State: PUBLISHED Published: 2022-06-22T07:30:21.429229Z Last Updated: 2024-09-16T17:37:58.854Z Vendors: frappe Products: frappe Problem Types: CWE-79 Description: ERPNext in versions v12.0.9-v13.0.3 are affected by a stored XSS vulnerability that allows low privileged users to store malicious scripts in the ‘username’ field in ‘my settings’ which can lead to full account takeover. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/frappe/frappe/commit/497ea861f481c6a3c52fe2aed9d0df1b6c99e9d7 - https://www.mend.io/vulnerability-database/CVE-2022-23058
CVE ID: CVE-2022-23059 State: PUBLISHED Published: 2022-03-29T10:25:09.479179Z Last Updated: 2024-09-16T23:10:36.059Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: shopizer-ecommerce Products: Shopizer Problem Types: CWE-79 Description: A Stored Cross Site Scripting (XSS) vulnerability exists in Shopizer versions 2.0 through 2.17.0 via the “Manage Images” tab, which allows an attacker to upload a SVG file containing malicious JavaScript code. Additional Analyst Notes: - CVE Program Container: References: - https://www.whitesourcesoftware.com/vulnerability-database/CVE-2022-23059 - https://github.com/shopizer-ecommerce/shopizer/commit/6b9f1ecd303b3b724d96bd
com/vulnerability-database/CVE-2022-23059 - https://github.com/shopizer-ecommerce/shopizer/commit/6b9f1ecd303b3b724d96bd08095c1a751dcc287e
CVE ID: CVE-2022-23060 State: PUBLISHED Published: 2022-05-01T12:40:10.482227Z Last Updated: 2024-09-16T17:17:57.190Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: shopizer-ecommerce Products: Shopizer Problem Types: CWE-79 Description: A Stored Cross Site Scripting (XSS) vulnerability exists in Shopizer versions 2.0 through 2.17.0, where a privileged user (attacker) can inject malicious JavaScript in the filename under the “Manage files” tab Additional Analyst Notes: - CVE Program Container: References: - https://github.com/shopizer-ecommerce/shopizer/commit/6b9f1ecd303b3b724d96bd08095c1a751dcc287e - https://www.whitesourcesoftware.com/vulnerability-datab
merce/shopizer/commit/6b9f1ecd303b3b724d96bd08095c1a751dcc287e - https://www.whitesourcesoftware.com/vulnerability-database/CVE-2022-23060
CVE ID: CVE-2022-23061 State: PUBLISHED Published: 2022-05-01T12:40:12.050961Z Last Updated: 2024-09-17T02:05:46.247Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H) Vendors: shopizer-ecommerce Products: Shopizer Problem Types: CWE-639 Description: In Shopizer versions 2.0 to 2.17.0 a regular admin can permanently delete a superadmin (although this cannot happen according to the documentation) via Insecure Direct Object Reference (IDOR) vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/shopizer-ecommerce/shopizer/commit/6b9f1ecd303b3b724d96bd08095c1a751dcc287e - https://www.whitesourcesoftware.com/vulnerability-databas
rce/shopizer/commit/6b9f1ecd303b3b724d96bd08095c1a751dcc287e - https://www.whitesourcesoftware.com/vulnerability-database/CVE-2022-23061
CVE ID: CVE-2022-23063 State: PUBLISHED Published: 2022-05-03T08:55:09.569345Z Last Updated: 2024-09-16T19:09:20.842Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: shopizer-ecommerce Products: Shopizer Problem Types: CWE-613 Description: In Shopizer versions 2.3.0 to 3.0.1 are vulnerable to Insufficient Session Expiration. When a password has been changed by the user or by an administrator, a user that was already logged in, will still have access to the application even after the password was changed. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/shopizer-ecommerce/shopizer/blob/3.0.1/sm-shop/src/main/java/com/salesmana
m Container: References: - https://github.com/shopizer-ecommerce/shopizer/blob/3.0.1/sm-shop/src/main/java/com/salesmanager/shop/store/api/v1/customer/AuthenticateCustomerApi.java#L213-L237 - https://www.whitesourcesoftware.com/vulnerability-database/CVE-2022-23063
CVE ID: CVE-2022-23064 State: PUBLISHED Published: 2022-05-02T12:30:14.778477Z Last Updated: 2024-09-16T22:39:57.099Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: snipe Products: snipe-it Problem Types: CWE-74 Description: In Snipe-IT, versions v3.0-alpha to v5.3.7 are vulnerable to Host Header Injection. By sending a specially crafted host header in the reset password request, it is possible to send password reset links to users which once clicked lead to an attacker controlled server and thus leading to password reset token leak. This leads to account take over. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/snipe/snip
ads to account take over. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/snipe/snipe-it/commit/0c4768fd2a11ac26a61814cef23a71061bfd8bcc - https://www.whitesourcesoftware.com/vulnerability-database/CVE-2022-23064
CVE ID: CVE-2022-23065 State: PUBLISHED Published: 2022-05-02T12:30:16.462404Z Last Updated: 2024-09-16T17:03:44.763Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: vendure-ecommerce Products: vendure Problem Types: CWE-79 Description: In Vendure versions 0.1.0-alpha.2 to 1.5.1 are affected by Stored XSS vulnerability, where an attacker having catalog permission can upload a SVG file that contains malicious JavaScript into the “Assets” tab. The uploaded file will affect administrators as well as regular users. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/vendure-ecommerce/vendure/commit/69a44869112c0a5b836e2ddd3969ea9b
VE Program Container: References: - https://github.com/vendure-ecommerce/vendure/commit/69a44869112c0a5b836e2ddd3969ea9b533f51f0 - https://www.whitesourcesoftware.com/vulnerability-database/CVE-2022-23065
CVE ID: CVE-2022-23066 State: PUBLISHED Published: 2022-05-09T06:25:09.088116Z Last Updated: 2024-09-16T17:53:00.981Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) Vendors: solana-labs Products: rbpf Problem Types: CWE-682 Description: In Solana rBPF versions 0.2.26 and 0.2.27 are affected by Incorrect Calculation which is caused by improper implementation of sdiv instruction. This can lead to the wrong execution path, resulting in huge loss in specific cases. For example, the result of a sdiv instruction may decide whether to transfer tokens or not. The vulnerability affects both integrity and may cause serious availability problems. Additional Analyst Notes: -
not. The vulnerability affects both integrity and may cause serious availability problems. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/solana-labs/rbpf/commit/e61e045f8c244de978401d186dcfd50838817297 - https://www.whitesourcesoftware.com/vulnerability-database/CVE-2022-23066 - https://blocksecteam.medium.com/how-a-critical-bug-in-solana-network-was-detected-and-timely-patched-a701870e1324
CVE ID: CVE-2022-23067 State: PUBLISHED Published: 2022-05-18T11:45:13.472461Z Last Updated: 2024-09-16T18:13:10.998Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: ToolJet Products: ToolJet Problem Types: CWE-200 Description: ToolJet versions v0.5.0 to v1.2.2 are vulnerable to token leakage via Referer header that leads to account takeover . If the user opens the invite link/signup link and then clicks on any external links within the page, it leaks the password set token/signup token in the referer header. Using these tokens the attacker can access the user’s account. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ToolJe
an access the user’s account. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ToolJet/ToolJet/commit/eacbfc4c9da089ff9cda9edf8a1156390ae8a101 - https://www.whitesourcesoftware.com/vulnerability-database/CVE-2022-23067
CVE ID: CVE-2022-23068 State: PUBLISHED Published: 2022-05-18T11:45:15.156824Z Last Updated: 2024-09-17T03:18:50.675Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: ToolJet Products: ToolJet Problem Types: CWE-74 Description: ToolJet versions v0.6.0 to v1.10.2 are vulnerable to HTML injection where an attacker can inject malicious code inside the first name and last name field while inviting a new user which will be reflected in the invitational e-mail. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ToolJet/ToolJet/commit/431dc961cdfe4d26343d1c1c951ced778fbddb58 - https://www.whitesourcesoftware.com/vulnerability-databas
lJet/ToolJet/commit/431dc961cdfe4d26343d1c1c951ced778fbddb58 - https://www.whitesourcesoftware.com/vulnerability-database/CVE-2022-23068
CVE ID: CVE-2022-23071 State: PUBLISHED Published: 2022-06-19T10:15:14.995455Z Last Updated: 2024-09-17T02:16:41.615Z Vendors: recipes Products: recipes Problem Types: CWE-918 Description: In Recipes, versions 0.9.1 through 1.2.5 are vulnerable to Server Side Request Forgery (SSRF), in the “Import Recipe” functionality. When an attacker enters the localhost URL, a low privileged attacker can access/read the internal file system to access sensitive information. Additional Analyst Notes: - CVE Program Container: References: - https://www.mend.io/vulnerability-database/CVE-2022-23071 - https://github.com/TandoorRecipes/recipes/commit/d48fe26a3529cc1ee903ffb2758dfd8f7efaba8c