deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-39366
Published: 2022-10-28
Description: DataHub is an open-source metadata platform. Prior to version 0.8.45, the `StatelessTokenService` of the DataHub metadata service (GMS) does not verify the signature of JWT tokens. This allows an attacker to connect to DataHub instances as any user if Metadata Service authentication is enabled. This vulnerability occurs because the `StatelessTokenService` of the Metadata service uses the `parse` method of `io.jsonwebtoken.JwtParser`, which does not perform a verification of the cryptographic token signature. This means that JWTs are accepted regardless of the used algorithm. This issue may lead to an authentication bypass. Version 0.8.45 contains a patch for the issue. There are no known workarounds.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-287, CWE-303, CWE-347
References: https://codeql.github.com/codeql-query-help/java/java-missing-jwt-signature-check/; https://github.com/datahub-project/datahub/blob/aa146db611e3a4ca3aa17bb740783f789d4444d3/metadata-service/auth-impl/src/main/java/com/datahub/authentication/token/StatelessTokenService.java#L134; https://github.com/datahub-project/datahub/blob/aa146db611e3a4ca3aa17bb740783f789d4444d3/metadata-service/auth-impl/src/main/java/com/datahub/authentication/token/StatelessTokenService.java#L30
CVE: CVE-2022-3400
Published: 2022-10-28
Description: The Bricks theme for WordPress is vulnerable to authorization bypass due to a missing capability check on the bricks_save_post AJAX action in versions 1.0 to 1.5.3. This makes it possible for authenticated attackers with minimal permissions, such as a subscriber, to edit any page, post, or template on the vulnerable WordPress website.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://bricksbuilder.io/; https://www.wordfence.com/vulnerability-advisories-continued/#CVE-2022-3400; https://bricksbuilder.io/
CVE: CVE-2022-43164
Published: 2022-10-28
Description: A stored cross-site scripting (XSS) vulnerability in the Global Lists feature (/index.php?module=global_lists/lists) of Rukovoditel v3.2.1 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter after clicking "Add".
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/anhdq201/rukovoditel/issues/4; https://github.com/anhdq201/rukovoditel/issues/4
CVE: CVE-2022-43165
Published: 2022-10-28
Description: A stored cross-site scripting (XSS) vulnerability in the Global Variables feature (/index.php?module=global_vars/vars) of Rukovoditel v3.2.1 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Value parameter after clicking "Create".
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/anhdq201/rukovoditel/issues/5; https://github.com/anhdq201/rukovoditel/issues/5
CVE: CVE-2022-43166
Published: 2022-10-28
Description: A stored cross-site scripting (XSS) vulnerability in the Global Entities feature (/index.php?module=entities/entities) of Rukovoditel v3.2.1 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter after clicking "Add New Entity".
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/anhdq201/rukovoditel/issues/2; https://github.com/anhdq201/rukovoditel/issues/2
CVE: CVE-2022-43167
Published: 2022-10-28
Description: A stored cross-site scripting (XSS) vulnerability in the Users Alerts feature (/index.php?module=users_alerts/users_alerts) of Rukovoditel v3.2.1 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title parameter after clicking "Add".
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/anhdq201/rukovoditel/issues/7; https://github.com/anhdq201/rukovoditel/issues/7
CVE: CVE-2022-43168
Published: 2022-10-28
Description: Rukovoditel v3.2.1 was discovered to contain a SQL injection vulnerability via the reports_id parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/anhdq201/rukovoditel/issues/1; https://github.com/anhdq201/rukovoditel/issues/1
CVE: CVE-2022-43169
Published: 2022-10-28
Description: A stored cross-site scripting (XSS) vulnerability in the Users Access Groups feature (/index.php?module=users_groups/users_groups) of Rukovoditel v3.2.1 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter after clicking "Add New Group".
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/anhdq201/rukovoditel/issues/3; https://github.com/anhdq201/rukovoditel/issues/3
CVE: CVE-2022-43170
Published: 2022-10-28
Description: A stored cross-site scripting (XSS) vulnerability in the Dashboard Configuration feature (index.php?module=dashboard_configure/index) of Rukovoditel v3.2.1 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title parameter after clicking "Add info block".
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/anhdq201/rukovoditel/issues/6; https://github.com/anhdq201/rukovoditel/issues/6
CVE: CVE-2021-36864
Published: 2022-10-28
Description: Auth. (editor+) Reflected Cross-Site Scripting (XSS) vulnerability in ExpressTech Quiz And Survey Master plugin <= 7.3.4 on WordPress.
CVSS Score: 3.4 (LOW)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/quiz-master-next/wordpress-quiz-and-survey-master-plugin-7-3-4-auth-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://wordpress.org/plugins/quiz-master-next/#developers; https://patchstack.com/database/vulnerability/quiz-master-next/wordpress-quiz-and-survey-master-plugin-7-3-4-auth-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2021-36898
Published: 2022-10-28
Description: Auth. SQL Injection (SQLi) vulnerability in Quiz And Survey Master plugin <= 7.3.4 on WordPress.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89, CWE-89
References: https://patchstack.com/database/vulnerability/quiz-master-next/wordpress-quiz-and-survey-master-plugin-7-3-4-auth-sql-injection-sqli-vulnerability?_s_id=cve; https://wordpress.org/plugins/quiz-master-next/#developers; https://patchstack.com/database/vulnerability/quiz-master-next/wordpress-quiz-and-survey-master-plugin-7-3-4-auth-sql-injection-sqli-vulnerability?_s_id=cve
CVE: CVE-2022-2474
Published: 2022-10-28
Description: Authentication is currently unsupported in Haas Controller version 100.20.000.1110 when using the “Ethernet Q Commands” service, which allows any user on the same network segment as the controller (even while connected remotely) to access the service and write unauthorized macros to the device.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306, CWE-306
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-298-01; https://www.cisa.gov/uscert/ics/advisories/icsa-22-298-01
CVE: CVE-2022-2475
Published: 2022-10-28
Description: Haas Controller version 100.20.000.1110 has insufficient granularity of access control when using the "Ethernet Q Commands" service. Any user is able to write macros into registers outside of the authorized accessible range. This could allow a user to access privileged resources or resources out of context.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1220
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-298-01; https://www.cisa.gov/uscert/ics/advisories/icsa-22-298-01
CVE: CVE-2022-3228
Published: 2022-10-28
Description: Using custom code, an attacker can write into name or description fields larger than the appropriate buffer size causing a stack-based buffer overflow on Host Engineering H0-ECOM100 Communications Module Firmware versions v5.0.155 and prior. This may allow an attacker to crash the affected device or cause it to become unresponsive.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-121, CWE-787
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-263-04; https://www.cisa.gov/uscert/ics/advisories/icsa-22-263-04
CVE: CVE-2022-41636
Published: 2022-10-28
Description: Communication traffic involving "Ethernet Q Commands" service of Haas Controller version 100.20.000.1110 is transmitted in cleartext. This allows an attacker to obtain sensitive information being passed to and from the controller.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-319, CWE-319
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-298-01; https://www.cisa.gov/uscert/ics/advisories/icsa-22-298-01
CVE: CVE-2022-41648
Published: 2022-10-28
Description: The HEIDENHAIN Controller TNC 640 NC software Version 340590 07 SP5, is vulnerable to improper authentication in its DNC communication for CNC machines. Authentication is not enabled by default for DNC communication. This vulnerability may allow an attacker to deny service on the production line, steal sensitive data from the production line, and alter any products created by the production line. Note: CNC machines running the TNC 640 controller require DNC to be enabled for DNC communication to be present.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1188, CWE-287
References: https://www.cisa.gov/news-events/ics-advisories/icsa-22-298-02; https://www.cisa.gov/uscert/ics/advisories/icsa-22-298-02
CVE: CVE-2022-43228
Published: 2022-10-28
Description: Barangay Management System v1.0 was discovered to contain a SQL injection vulnerability via the hidden_id parameter at /clearance/clearance.php.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/HKD01l/bug_report/blob/main/vendors/itsourcecode.com/barangay-management-system/SQLi-1.md; https://github.com/HKD01l/bug_report/blob/main/vendors/itsourcecode.com/barangay-management-system/SQLi-1.md
CVE: CVE-2022-43229
Published: 2022-10-28
Description: Simple Cold Storage Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /bookings/update_status.php.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: http://packetstormsecurity.com/files/169605/Simple-Cold-Storage-Management-System-1.0-SQL-Injection.html; https://github.com/HKD01l/bug_report/blob/main/vendors/oretnom23/simple-cold-storage-management-system/SQLi-2.md; http://packetstormsecurity.com/files/169605/Simple-Cold-Storage-Management-System-1.0-SQL-Injection.html
CVE: CVE-2022-43230
Published: 2022-10-28
Description: Simple Cold Storage Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/?page=bookings/view_details.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/HKD01l/bug_report/blob/main/vendors/oretnom23/simple-cold-storage-management-system/SQLi-1.md; https://github.com/HKD01l/bug_report/blob/main/vendors/oretnom23/simple-cold-storage-management-system/SQLi-1.md
CVE: CVE-2022-43231
Published: 2022-10-28
Description: Canteen Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via /youthappam/manage_website.php. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434, CWE-434
References: https://github.com/HKD01l/bug_report/blob/main/vendors/mayuri_k/canteen-management-system/RCE-1.md; https://github.com/HKD01l/bug_report/blob/main/vendors/mayuri_k/canteen-management-system/RCE-1.md
CVE: CVE-2022-43232
Published: 2022-10-28
Description: Canteen Management System v1.0 was discovered to contain a SQL injection vulnerability via the userid parameter at /php_action/fetchOrderData.php.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/HKD01l/bug_report/blob/main/vendors/mayuri_k/canteen-management-system/SQLi-2.md; https://github.com/HKD01l/bug_report/blob/main/vendors/mayuri_k/canteen-management-system/SQLi-2.md
CVE: CVE-2022-43233
Published: 2022-10-28
Description: Canteen Management System v1.0 was discovered to contain a SQL injection vulnerability via the userid parameter at /php_action/fetchSelectedUser.php.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/HKD01l/bug_report/blob/main/vendors/mayuri_k/canteen-management-system/SQLi-1.md; https://github.com/HKD01l/bug_report/blob/main/vendors/mayuri_k/canteen-management-system/SQLi-1.md
CVE: CVE-2022-3401
Published: 2022-10-28
Description: The Bricks theme for WordPress is vulnerable to remote code execution due to the theme allowing site editors to include executable code blocks in website content in versions 1.2 to 1.5.3. This, combined with the missing authorization vulnerability (CVE-2022-3400), makes it possible for authenticated attackers with minimal permissions, such as a subscriber, can edit any page, post, or template on the vulnerable WordPress website and inject a code execution block that can be used to achieve remote code execution.
CVSS Score: 8.8 (HIGH)
References: https://bricksbuilder.io/; https://www.wordfence.com/vulnerability-advisories-continued/#CVE-2022-3401; https://bricksbuilder.io/
CVE: CVE-2022-3402
Published: 2022-10-28
Description: The Log HTTP Requests plugin for WordPress is vulnerable to Stored Cross-Site Scripting via logged HTTP requests in versions up to, and including, 1.3.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers who can trick a site's administrator into performing an action like clicking on a link, or an authenticated user with access to a page that sends a request using user-supplied data via the server, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2770821%40log-http-requests&new=2770821%40log-http-requests&sfp_email=&sfph_mail=; https://wordpress.org/plugins/log-http-requests/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/b12b0a2a-3c3c-4d9c-a404-c8f170638e31?source=cve
CVE: CVE-2022-3708
Published: 2022-10-28
Description: The Web Stories plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including 1.24.0 due to insufficient validation of URLs supplied via the 'url' parameter found via the /v1/hotlink/proxy REST API Endpoint. This makes it possible for authenticated users to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-918, CWE-918, CWE-918
References: https://github.com/GoogleForCreators/web-stories-wp/commit/3ad2099f95155d658624ffac2e34ce0da739e34b; https://github.com/GoogleForCreators/web-stories-wp/compare/v1.24.0...v1.25.0; https://wordpress.org/plugins/web-stories
CVE: CVE-2022-37621
Published: 2022-10-28
Description: Prototype pollution vulnerability in function resolveShims in resolve-shims.js in thlorenz browserify-shim 3.8.15 via the fullPath variable in resolve-shims.js.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1321, CWE-1321
References: https://github.com/thlorenz/browserify-shim/blob/464b32bbe142664cd[PII_REDACTED]f6c738ea3de8f/lib/resolve-shims.js#L158; https://github.com/thlorenz/browserify-shim/blob/464b32bbe142664cd[PII_REDACTED]f6c738ea3de8f/lib/resolve-shims.js#L37; https://github.com/thlorenz/browserify-shim/issues/247
CVE: CVE-2022-43280
Published: 2022-10-28
Description: wasm-interp v1.0.29 was discovered to contain an out-of-bounds read via the component OnReturnCallExpr->GetReturnCallDropKeepCount.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125, CWE-125
References: https://github.com/WebAssembly/wabt/issues/1982; https://github.com/WebAssembly/wabt/issues/1982
CVE: CVE-2022-43281
Published: 2022-10-28
Description: wasm-interp v1.0.29 was discovered to contain a heap overflow via the component std::vector<wabt::Type, std::allocator<wabt::Type>>::size() at /bits/stl_vector.h.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://github.com/WebAssembly/wabt/issues/1981; https://github.com/WebAssembly/wabt/issues/1981
CVE: CVE-2022-43282
Published: 2022-10-28
Description: wasm-interp v1.0.29 was discovered to contain an out-of-bounds read via the component OnReturnCallIndirectExpr->GetReturnCallDropKeepCount.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125, CWE-125
References: https://github.com/WebAssembly/wabt/issues/1983; https://github.com/WebAssembly/wabt/issues/1983
CVE: CVE-2022-43283
Published: 2022-10-28
Description: wasm2c v1.0.29 was discovered to contain an abort in CWriter::Write.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-434, CWE-434
References: https://github.com/WebAssembly/wabt/issues/1985; https://github.com/WebAssembly/wabt/issues/1985
CVE: CVE-2022-43284
Published: 2022-10-28
Description: Nginx NJS v0.7.2 to v0.7.4 was discovered to contain a segmentation violation via njs_scope_valid_value at njs_scope.h. NOTE: the vendor disputes the significance of this report because NJS does not operate on untrusted input.
CVSS Score: 7.5 (HIGH)
References: https://github.com/nginx/njs/issues/470; https://github.com/nginx/njs/issues/529; https://github.com/nginx/njs/issues/470
CVE: CVE-2022-43285
Published: 2022-10-28
Description: Nginx NJS v0.7.4 was discovered to contain a segmentation violation in njs_promise_reaction_job. NOTE: the vendor disputes the significance of this report because NJS does not operate on untrusted input.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://github.com/nginx/njs/issues/533; https://github.com/nginx/njs/issues/533
CVE: CVE-2022-43286
Published: 2022-10-28
Description: Nginx NJS v0.7.2 was discovered to contain a heap-use-after-free bug caused by illegal memory copy in the function njs_json_parse_iterator_call at njs_json.c.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416, CWE-416
References: https://github.com/nginx/njs/commit/2ad0ea24a58d570634e09c2e58c3b314505eaa6a; https://github.com/nginx/njs/issues/480; https://github.com/nginx/njs/commit/2ad0ea24a58d570634e09c2e58c3b314505eaa6a
CVE: CVE-2022-2826
Published: 2022-10-28
Description: An issue has been discovered in GitLab affecting all versions starting from 10.0 before 12.9.8, all versions starting from 12.10 before 12.10.7, all versions starting from 13.0 before 13.0.1. TODO
CVSS Score: 2.7 (LOW)
CWE: CWE-79
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2826.json; https://gitlab.com/gitlab-org/gitlab/-/issues/370790; https://hackerone.com/reports/1646633
CVE: CVE-2022-42916
Published: 2022-10-29
Description: In curl before 7.86.0, the HSTS check could be bypassed to trick it into staying with HTTP. Using its HSTS support, curl can be instructed to use HTTPS directly (instead of using an insecure cleartext HTTP step) even when HTTP is provided in the URL. This mechanism could be bypassed if the host name in the given URL uses IDN characters that get replaced with ASCII counterparts as part of the IDN conversion, e.g., using the character UTF-8 U+3002 (IDEOGRAPHIC FULL STOP) instead of the common ASCII full stop of U+002E (.). The earliest affected version is 7.77.0 2021-05-26.
CVSS Score: 7.5 (HIGH)
CWE: CWE-319, CWE-319
References: http://seclists.org/fulldisclosure/2023/Jan/19; http://seclists.org/fulldisclosure/2023/Jan/20; http://www.openwall.com/lists/oss-security/2022/12/21/1
CVE: CVE-2022-3754
Published: 2022-10-29
Description: Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.8.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-521, CWE-521
References: https://github.com/thorsten/phpmyfaq/commit/d7a87d[PII_REDACTED]c70401ca8976ef531fbc77ea; https://huntr.dev/bounties/f4711d7f-1368-48ab-9bef-45f32e356c47; https://github.com/thorsten/phpmyfaq/commit/d7a87d[PII_REDACTED]c70401ca8976ef531fbc77ea
CVE: CVE-2021-42777
Published: 2022-10-29
Description: Stimulsoft (aka Stimulsoft Reports) 2013.1.1600.0, when Compilation Mode is used, allows an attacker to execute arbitrary C# code on any machine that renders a report, including the application server or a user's local machine, as demonstrated by System.Diagnostics.Process.Start.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-209, CWE-209
References: http://burninatorsec.blogspot.com/2022/04/library-rce-object-chaining-cve-2021.html; http://burninatorsec.blogspot.com/2022/04/library-rce-object-chaining-cve-2021.html
CVE: CVE-2022-3755
Published: 2022-10-29
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2022-3756
Published: 2022-10-29
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2022-3757
Published: 2022-10-29
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2022-41973
Published: 2022-10-29
Description: multipath-tools 0.7.7 through 0.9.x before 0.9.2 allows local users to obtain root access, as exploited in conjunction with CVE-2022-41974. Local users able to access /dev/shm can change symlinks in multipathd due to incorrect symlink handling, which could lead to controlled file writes outside of the /dev/shm directory. This could be used indirectly for local privilege escalation to root.
CVSS Score: 7.8 (HIGH)
CWE: CWE-59
References: http://packetstormsecurity.com/files/169611/Leeloo-Multipath-Authorization-Bypass-Symlink-Attack.html; http://packetstormsecurity.com/files/170176/snap-confine-must_mkdir_and_open_with_perms-Race-Condition.html; http://seclists.org/fulldisclosure/2022/Dec/4
CVE: CVE-2022-41974
Published: 2022-10-29
Description: multipath-tools 0.7.0 through 0.9.x before 0.9.2 allows local users to obtain root access, as exploited alone or in conjunction with CVE-2022-41973. Local users able to write to UNIX domain sockets can bypass access controls and manipulate the multipath setup. This can lead to local privilege escalation to root. This occurs because an attacker can repeat a keyword, which is mishandled because arithmetic ADD is used instead of bitwise OR.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: http://packetstormsecurity.com/files/169611/Leeloo-Multipath-Authorization-Bypass-Symlink-Attack.html; http://packetstormsecurity.com/files/170176/snap-confine-must_mkdir_and_open_with_perms-Race-Condition.html; http://seclists.org/fulldisclosure/2022/Dec/4
CVE: CVE-2022-42915
Published: 2022-10-29
Description: curl before 7.86.0 has a double free. If curl is told to use an HTTP proxy for a transfer with a non-HTTP(S) URL, it sets up the connection to the remote server by issuing a CONNECT request to the proxy, and then tunnels the rest of the protocol through. An HTTP proxy might refuse this request (HTTP proxies often only allow outgoing connections to specific port numbers, like 443 for HTTPS) and instead return a non-200 status code to the client. Due to flaws in the error/cleanup handling, this could trigger a double free in curl if one of the following schemes were used in the URL for the transfer: dict, gopher, gophers, ldap, ldaps, rtmp, rtmps, or telnet. The earliest affected version is 7.77.0.
CVSS Score: 8.1 (HIGH)
CWE: CWE-415, CWE-415
References: http://seclists.org/fulldisclosure/2023/Jan/19; http://seclists.org/fulldisclosure/2023/Jan/20; https://curl.se/docs/CVE-2022-42915.html
CVE: CVE-2022-44019
Published: 2022-10-30
Description: In Total.js 4 before 0e5ace7, /api/common/ping can achieve remote command execution via shell metacharacters in the host parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://github.com/totaljs/code/issues/12; https://www.edoardoottavianelli.it/CVE-2022-44019/; https://www.youtube.com/watch?v=x-u3eS8-xJg