deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-32868
Published: 2022-09-20
Description: A logic issue was addressed with improved state management. This issue is fixed in Safari 16, iOS 16, iOS 15.7 and iPadOS 15.7. A website may be able to track users through Safari web extensions.
CVSS Score: 4.3 (MEDIUM)
References: http://seclists.org/fulldisclosure/2022/Oct/39; http://seclists.org/fulldisclosure/2022/Oct/40; http://seclists.org/fulldisclosure/2022/Oct/50
CVE: CVE-2022-32872
Published: 2022-09-20
Description: A logic issue was addressed with improved restrictions. This issue is fixed in iOS 16, iOS 15.7 and iPadOS 15.7. A person with physical access to an iOS device may be able to access photos from the lock screen.
CVSS Score: 2.4 (LOW)
CWE: CWE-284
References: http://seclists.org/fulldisclosure/2022/Oct/39; http://seclists.org/fulldisclosure/2022/Oct/40; https://support.apple.com/en-us/HT213445
CVE: CVE-2022-32880
Published: 2022-09-20
Description: This issue was addressed by enabling hardened runtime. This issue is fixed in macOS Monterey 12.5. An app may be able to access user-sensitive data.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: https://support.apple.com/en-us/HT213345; https://support.apple.com/en-us/HT213345
CVE: CVE-2022-32882
Published: 2022-09-20
Description: This issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.4, macOS Big Sur 11.6.6. An app may be able to bypass Privacy preferences.
CVSS Score: 9.8 (CRITICAL)
References: https://support.apple.com/en-us/HT213256; https://support.apple.com/en-us/HT213257; https://support.apple.com/en-us/HT213256
CVE: CVE-2022-32883
Published: 2022-09-20
Description: A logic issue was addressed with improved restrictions. This issue is fixed in macOS Monterey 12.6, iOS 15.7 and iPadOS 15.7, iOS 16, macOS Big Sur 11.7. An app may be able to read sensitive location information.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-284
References: http://seclists.org/fulldisclosure/2022/Oct/28; http://seclists.org/fulldisclosure/2022/Oct/39; http://seclists.org/fulldisclosure/2022/Oct/40
CVE: CVE-2022-32886
Published: 2022-09-20
Description: A buffer overflow issue was addressed with improved memory handling. This issue is fixed in Safari 16, iOS 16, iOS 15.7 and iPadOS 15.7. Processing maliciously crafted web content may lead to arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: http://seclists.org/fulldisclosure/2022/Oct/28; http://seclists.org/fulldisclosure/2022/Oct/39; http://seclists.org/fulldisclosure/2022/Oct/41
CVE: CVE-2022-32908
Published: 2022-09-20
Description: A memory corruption issue was addressed with improved input validation. This issue is fixed in macOS Monterey 12.6, iOS 15.7 and iPadOS 15.7, iOS 16, macOS Big Sur 11.7. A user may be able to elevate privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: http://seclists.org/fulldisclosure/2022/Oct/28; http://seclists.org/fulldisclosure/2022/Oct/39; http://seclists.org/fulldisclosure/2022/Oct/41
CVE: CVE-2022-32911
Published: 2022-09-20
Description: The issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.6, iOS 15.7 and iPadOS 15.7, iOS 16, macOS Big Sur 11.7. An app may be able to execute arbitrary code with kernel privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: http://seclists.org/fulldisclosure/2022/Oct/28; http://seclists.org/fulldisclosure/2022/Oct/39; http://seclists.org/fulldisclosure/2022/Oct/41
CVE: CVE-2022-32912
Published: 2022-09-20
Description: An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in Safari 16, iOS 16, iOS 15.7 and iPadOS 15.7. Processing maliciously crafted web content may lead to arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-125, CWE-125
References: http://seclists.org/fulldisclosure/2022/Oct/28; http://seclists.org/fulldisclosure/2022/Oct/39; http://seclists.org/fulldisclosure/2022/Oct/40
CVE: CVE-2022-32917
Published: 2022-09-20
Description: The issue was addressed with improved bounds checks. This issue is fixed in macOS Monterey 12.6, iOS 15.7 and iPadOS 15.7, iOS 16, macOS Big Sur 11.7. An application may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may have been actively exploited..
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: http://seclists.org/fulldisclosure/2022/Oct/39; http://seclists.org/fulldisclosure/2022/Oct/40; http://seclists.org/fulldisclosure/2022/Oct/43
CVE: CVE-2022-40357
Published: 2022-09-20
Description: A security issue was discovered in Z-BlogPHP <= 1.7.2. A Server-Side Request Forgery (SSRF) vulnerability in the zb_users/plugin/UEditor/php/action_crawler.php file allows remote attackers to force the application to make arbitrary requests via injection of arbitrary URLs into the source parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-918, CWE-918
References: https://github.com/zblogcn/zblogphp/issues/336; https://github.com/zblogcn/zblogphp/issues/336
CVE: CVE-2022-39220
Published: 2022-09-20
Description: SFTPGo is an SFTP server written in Go. Versions prior to 2.3.5 are subject to Cross-site scripting (XSS) vulnerabilities in the SFTPGo WebClient, allowing remote attackers to inject malicious code. This issue is patched in version 2.3.5. No known workarounds exist.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/drakkan/sftpgo/security/advisories/GHSA-cf7g-cm7q-rq7f; https://github.com/drakkan/sftpgo/security/advisories/GHSA-cf7g-cm7q-rq7f
CVE: CVE-2022-35957
Published: 2022-09-20
Description: Grafana is an open-source platform for monitoring and observability. Versions prior to 9.1.6 and 8.5.13 are vulnerable to an escalation from admin to server admin when auth proxy is used, allowing an admin to take over the server admin account and gain full control of the grafana instance. All installations should be upgraded as soon as possible. As a workaround deactivate auth proxy following the instructions at: https://grafana.com/docs/grafana/latest/setup-grafana/configure-security/configure-authentication/auth-proxy/
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-290, CWE-290
References: https://github.com/grafana/grafana/security/advisories/GHSA-ff5c-938w-8c9q; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WYU5C2RITLHVZSTCWNGQWA6KSPYNXM2H/; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2022-35085
Published: 2022-09-21
Description: SWFTools commit 772e55a2 was discovered to contain a memory leak via /lib/mem.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401, CWE-401
References: https://github.com/Cvjark/Poc/blob/main/swftools/gif2swf/CVE-2022-35085.md; https://github.com/matthiaskramm/swftools/issues/181; https://github.com/Cvjark/Poc/blob/main/swftools/gif2swf/CVE-2022-35085.md
CVE: CVE-2022-35086
Published: 2022-09-21
Description: SWFTools commit 772e55a2 was discovered to contain a segmentation violation via /multiarch/memmove-vec-unaligned-erms.S.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://github.com/Cvjark/Poc/blob/main/swftools/gif2swf/CVE-2022-35086.md; https://github.com/matthiaskramm/swftools/issues/181; https://github.com/Cvjark/Poc/blob/main/swftools/gif2swf/CVE-2022-35086.md
CVE: CVE-2022-35087
Published: 2022-09-21
Description: SWFTools commit 772e55a2 was discovered to contain a segmentation violation via MovieAddFrame at /src/gif2swf.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-476, CWE-787, CWE-125, CWE-476
References: https://github.com/Cvjark/Poc/blob/main/swftools/gif2swf/CVE-2022-35087.md; https://github.com/matthiaskramm/swftools/issues/181; https://github.com/Cvjark/Poc/blob/main/swftools/gif2swf/CVE-2022-35087.md
CVE: CVE-2022-35088
Published: 2022-09-21
Description: SWFTools commit 772e55a2 was discovered to contain a heap buffer-overflow via getGifDelayTime at /home/bupt/Desktop/swftools/src/src/gif2swf.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://github.com/Cvjark/Poc/blob/main/swftools/gif2swf/CVE-2022-35088.md; https://github.com/matthiaskramm/swftools/issues/181; https://github.com/Cvjark/Poc/blob/main/swftools/gif2swf/CVE-2022-35088.md
CVE: CVE-2022-35089
Published: 2022-09-21
Description: SWFTools commit 772e55a2 was discovered to contain a heap-buffer-overflow via getTransparentColor at /home/bupt/Desktop/swftools/src/gif2swf.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-770, CWE-770
References: https://github.com/Cvjark/Poc/blob/main/swftools/gif2swf/CVE-2022-35089.md; https://github.com/matthiaskramm/swftools/issues/181; https://github.com/Cvjark/Poc/blob/main/swftools/gif2swf/CVE-2022-35089.md
CVE: CVE-2022-35090
Published: 2022-09-21
Description: SWFTools commit 772e55a2 was discovered to contain a heap-buffer overflow via __asan_memcpy at /asan/asan_interceptors_memintrinsics.cpp:.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://github.com/Cvjark/Poc/blob/main/swftools/gif2swf/CVE-2022-35090.md; https://github.com/matthiaskramm/swftools/issues/181; https://github.com/Cvjark/Poc/blob/main/swftools/gif2swf/CVE-2022-35090.md
CVE: CVE-2022-38619
Published: 2022-09-21
Description: SmartVista SVFE2 v2.2.22 was discovered to contain a SQL injection vulnerability via the UserForm:j_id90 parameter at /SVFE2/pages/feegroups/mcc_group.jsf.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: http://bpcbt.com; http://smartvista.com; https://dtro.gitbook.io/note_cve/sql-injection-in-terminal-mcc-group-feature-of-smartvista-svfe2-version-2.2.22-cve-2022-38619
CVE: CVE-2022-39221
Published: 2022-09-21
Description: McWebserver mod runs a simple HTTP server alongside the Minecraft server in seperate threads. Path traversal in McWebserver Minecraft Mod for Fabric and Quilt up to and including 0.1.2.1 and McWebserver Minecraft Mod for Forge up to and including 0.1.1 allows all files, accessible by the program, to be read by anyone via HTTP request. Version 0.2.0 with patches are released to both platforms (Fabric and Quilt, Forge). As a workaround, the McWebserver mod can be disabled by removing the file from the `mods` directory.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://github.com/J-onasJones/McWebserver/pull/1; https://github.com/J-onasJones/McWebserver/security/advisories/GHSA-gcvq-42cx-r46q; https://github.com/J-onasJones/McWebserver/pull/1
CVE: CVE-2022-41218
Published: 2022-09-21
Description: In drivers/media/dvb-core/dmxdev.c in the Linux kernel through 5.19.10, there is a use-after-free caused by refcount races, affecting dvb_demux_open and dvb_dmxdev_release.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416, CWE-416
References: http://www.openwall.com/lists/oss-security/2022/09/23/4; http://www.openwall.com/lists/oss-security/2022/09/24/1; http://www.openwall.com/lists/oss-security/2022/09/24/2
CVE: CVE-2022-41220
Published: 2022-09-21
Description: md2roff 1.9 has a stack-based buffer overflow via a Markdown file, a different vulnerability than CVE-2022-34913. NOTE: the vendor's position is that the product is not intended for untrusted input
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://github.com/nereusx/md2roff/issues/5; https://github.com/nereusx/md2roff/issues/5
CVE: CVE-2022-2315
Published: 2022-09-21
Description: Database Software Accreditation Tracking/Presentation Module product before version 2 has an unauthenticated SQL Injection vulnerability. This is fixed in version 2.
CVSS Score: 9.4 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://www.usom.gov.tr/bildirim/tr-22-0634; https://www.usom.gov.tr/bildirim/tr-22-0634
CVE: CVE-2022-40604
Published: 2022-09-21
Description: In Apache Airflow 2.3.0 through 2.3.4, part of a url was unnecessarily formatted, allowing for possible information extraction.
CVSS Score: 7.5 (HIGH)
CWE: CWE-134, CWE-134
References: https://github.com/apache/airflow/pull/26337; https://lists.apache.org/thread/z20x8m16fnhxdkoollv53w1ybsts687t; https://github.com/apache/airflow/pull/26337
CVE: CVE-2022-40754
Published: 2022-09-21
Description: In Apache Airflow 2.3.0 through 2.3.4, there was an open redirect in the webserver's `/confirm` endpoint.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601, CWE-601
References: https://github.com/apache/airflow/pull/26409; https://lists.apache.org/thread/cn098dcp5x3c402xrb06p3l7nz5goffm; https://github.com/apache/airflow/pull/26409
CVE: CVE-2022-41222
Published: 2022-09-21
Description: mm/mremap.c in the Linux kernel before 5.13.3 has a use-after-free via a stale TLB because an rmap lock is not held during a PUD move.
CVSS Score: 7.0 (HIGH)
CWE: CWE-416, CWE-416
References: http://packetstormsecurity.com/files/168466/Linux-Stable-5.4-5.10-Use-After-Free-Race-Condition.html; http://packetstormsecurity.com/files/171005/Kernel-Live-Patch-Security-Notice-LNS-0091-1.html; https://bugs.chromium.org/p/project-zero/issues/detail?id=2347
CVE: CVE-2022-0495
Published: 2022-09-21
Description: The library automation system product KOHA developed by Parantez Teknoloji before version 19.05.03 has an unauthenticated SQL Injection vulnerability. This has been fixed in the version 19.05.03.01.
CVSS Score: 9.4 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://www.usom.gov.tr/bildirim/tr-22-0635; https://www.usom.gov.tr/bildirim/tr-22-0635
CVE: CVE-2022-2872
Published: 2022-09-21
Description: Unrestricted Upload of File with Dangerous Type in GitHub repository octoprint/octoprint prior to 1.8.3.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-434
References: https://github.com/octoprint/octoprint/commit/3e3c11811e216fb371a33e28412df83f9701e5b0; https://huntr.dev/bounties/b966c74d-6f3f-49fe-b40a-eaf25e362c56; https://github.com/octoprint/octoprint/commit/3e3c11811e216fb371a33e28412df83f9701e5b0
CVE: CVE-2022-2795
Published: 2022-09-21
Description: By flooding the target resolver with queries exploiting this flaw an attacker can significantly impair the resolver's performance, effectively denying legitimate clients access to the DNS resolution service.
CVSS Score: 5.3 (MEDIUM)
References: http://www.openwall.com/lists/oss-security/2022/09/21/3; https://kb.isc.org/docs/cve-2022-2795; https://lists.debian.org/debian-lts-announce/2022/10/msg00007.html
CVE: CVE-2022-2881
Published: 2022-09-21
Description: The underlying bug might cause read past end of the buffer and either read memory it should not read, or crash the process.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: http://www.openwall.com/lists/oss-security/2022/09/21/3; https://kb.isc.org/docs/cve-2022-2881; https://security.gentoo.org/glsa/202210-25
CVE: CVE-2022-2906
Published: 2022-09-21
Description: An attacker can leverage this flaw to gradually erode available memory to the point where named crashes for lack of resources. Upon restart the attacker would have to begin again, but nevertheless there is the potential to deny service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-401, CWE-401
References: http://www.openwall.com/lists/oss-security/2022/09/21/3; https://kb.isc.org/docs/cve-2022-2906; https://security.gentoo.org/glsa/202210-25
CVE: CVE-2022-38177
Published: 2022-09-21
Description: By spoofing the target resolver with responses that have a malformed ECDSA signature, an attacker can trigger a small memory leak. It is possible to gradually erode available memory to the point where named crashes for lack of resources.
CVSS Score: 7.5 (HIGH)
CWE: CWE-401, CWE-401
References: http://www.openwall.com/lists/oss-security/2022/09/21/3; https://kb.isc.org/docs/cve-2022-38177; https://lists.debian.org/debian-lts-announce/2022/10/msg00007.html
CVE: CVE-2022-38178
Published: 2022-09-21
Description: By spoofing the target resolver with responses that have a malformed EdDSA signature, an attacker can trigger a small memory leak. It is possible to gradually erode available memory to the point where named crashes for lack of resources.
CVSS Score: 7.5 (HIGH)
CWE: CWE-401, CWE-401
References: http://www.openwall.com/lists/oss-security/2022/09/21/3; https://kb.isc.org/docs/cve-2022-38178; https://lists.debian.org/debian-lts-announce/2022/10/msg00007.html
CVE: CVE-2022-3080
Published: 2022-09-21
Description: By sending specific queries to the resolver, an attacker can cause named to crash.
CVSS Score: 7.5 (HIGH)
CWE: CWE-613
References: http://www.openwall.com/lists/oss-security/2022/09/21/3; https://kb.isc.org/docs/cve-2022-3080; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CV4GQWBPF7Y52J2FA24U6UMHQAOXZEF7/
CVE: CVE-2022-2888
Published: 2022-09-21
Description: If an attacker comes into the possession of a victim's OctoPrint session cookie through whatever means, the attacker can use this cookie to authenticate as long as the victim's account exists.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-613
References: https://github.com/octoprint/octoprint/commit/40e6217ac1a85cc5ed592873ae49db01d3005da4; https://huntr.dev/bounties/d27d232b-2578-4b32-b3b4-74aabdadf629; https://github.com/octoprint/octoprint/commit/40e6217ac1a85cc5ed592873ae49db01d3005da4
CVE: CVE-2022-3068
Published: 2022-09-21
Description: Improper Privilege Management in GitHub repository octoprint/octoprint prior to 1.8.3.
CVSS Score: 8.8 (HIGH)
CWE: CWE-269
References: https://github.com/octoprint/octoprint/commit/ef95ef1c101b79394f134e8fce000e6bae046571; https://huntr.dev/bounties/f45c24cb-9104-4c6e-a9e1-5c7e75e83884; https://github.com/octoprint/octoprint/commit/ef95ef1c101b79394f134e8fce000e6bae046571
CVE: CVE-2022-38928
Published: 2022-09-21
Description: XPDF 4.04 is vulnerable to Null Pointer Dereference in FoFiType1C.cc:2393.
CVSS Score: 7.8 (HIGH)
CWE: CWE-476, CWE-476
References: https://forum.xpdfreader.com/viewtopic.php?f=3&t=42325&sid=7b08ba9a518a99ce3c5ff40e53fc6421; https://forum.xpdfreader.com/viewtopic.php?f=3&t=42325&sid=7b08ba9a518a99ce3c5ff40e53fc6421
CVE: CVE-2022-3255
Published: 2022-09-21
Description: If an attacker can control a script that is executed in the victim's browser, then they can typically fully compromise that user. Amongst other things, the attacker can: Perform any action within the application that the user can perform. View any information that the user is able to view. Modify any information that the user is able to modify. Initiate interactions with other application users, including malicious attacks, that will appear to originate from the initial victim user.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/pimcore/pimcore/commit/1e916e7d668c9e47b217e20cc0ea4812f466201b; https://huntr.dev/bounties/0ea45cf9-b256-454c-9[PII_REDACTED]c0902; https://github.com/pimcore/pimcore/commit/1e916e7d668c9e47b217e20cc0ea4812f466201b
CVE: CVE-2022-2265
Published: 2022-09-21
Description: The Identity and Directory Management System developed by Çekino Bilgi Teknolojileri before version 2.1.25 has an unauthenticated Path traversal vulnerability. This has been fixed in the version 2.1.25
CVSS Score: 7.5 (HIGH)
CWE: CWE-35, CWE-22
References: https://www.usom.gov.tr/bildirim/tr-22-0636; https://www.usom.gov.tr/bildirim/tr-22-0636
CVE: CVE-2022-37026
Published: 2022-09-21
Description: In Erlang/OTP before 23.3.4.15, 24.x before 24.3.4.2, and 25.x before 25.0.2, there is a Client Authentication Bypass in certain client-certification situations for SSL, TLS, and DTLS.
CVSS Score: 9.8 (CRITICAL)
References: https://erlangforums.com/c/erlang-news-announcements/91; https://erlangforums.com/t/otp-25-1-released/1854; https://github.com/erlang/otp/compare/OTP-23.3.4.14...OTP-23.3.4.15
CVE: CVE-2019-5641
Published: 2022-09-21
Description: Rapid7 InsightVM suffers from an information exposure issue whereby, when the user's session has ended due to inactivity, an attacker can use the Inspect Element browser feature to remove the login panel and view the details available in the last webpage visited by previous user
CVSS Score: 3.3 (LOW)
CWE: CWE-200, CWE-613
References: https://docs.rapid7.com/release-notes/insightvm/20220830/; https://docs.rapid7.com/release-notes/insightvm/20220830/
CVE: CVE-2022-37246
Published: 2022-09-21
Description: Craft CMS 4.2.0.1 is affected by Cross Site Scripting (XSS) in the file src/web/assets/cp/src/js/BaseElementSelectInput.js and in specific on the line label: elementInfo.label.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/craftcms/cms/commit/1d5fdba23c84d6d09a8a980c7b6fc52fb93b679b; https://labs.integrity.pt/advisories/cve-2022-37246/; https://github.com/craftcms/cms/commit/1d5fdba23c84d6d09a8a980c7b6fc52fb93b679b
CVE: CVE-2022-41224
Published: 2022-09-21
Description: Jenkins 2.367 through 2.369 (both inclusive) does not escape tooltips of the l:helpIcon UI component used for some help icons on the Jenkins web UI, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control tooltips for this component.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.jenkins.io/security/advisory/2022-09-21/#SECURITY-2886; https://www.jenkins.io/security/advisory/2022-09-21/#SECURITY-2886
CVE: CVE-2022-41225
Published: 2022-09-21
Description: Jenkins Anchore Container Image Scanner Plugin 1.0.24 and earlier does not escape content provided by the Anchore engine API, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control API responses by Anchore engine.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.jenkins.io/security/advisory/2022-09-21/#SECURITY-2821; https://www.jenkins.io/security/advisory/2022-09-21/#SECURITY-2821
CVE: CVE-2022-41226
Published: 2022-09-21
Description: Jenkins Compuware Common Configuration Plugin 1.0.14 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-611, CWE-611
References: https://www.jenkins.io/security/advisory/2022-09-21/#SECURITY-2832; https://www.jenkins.io/security/advisory/2022-09-21/#SECURITY-2832
CVE: CVE-2022-41227
Published: 2022-09-21
Description: A cross-site request forgery (CSRF) vulnerability in Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.129 and earlier allows attackers to connect to an attacker-specified webserver using attacker-specified credentials.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://www.jenkins.io/security/advisory/2022-09-21/#SECURITY-2737; https://www.jenkins.io/security/advisory/2022-09-21/#SECURITY-2737
CVE: CVE-2022-41228
Published: 2022-09-21
Description: A missing permission check in Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.129 and earlier allows attackers with Overall/Read permissions to connect to an attacker-specified webserver using attacker-specified credentials.
CVSS Score: 8.8 (HIGH)
CWE: CWE-862, CWE-862
References: https://www.jenkins.io/security/advisory/2022-09-21/#SECURITY-2737; https://www.jenkins.io/security/advisory/2022-09-21/#SECURITY-2737
CVE: CVE-2022-41229
Published: 2022-09-21
Description: Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.134 and earlier does not escape configuration options of the Execute NetStorm/NetCloud Test build step, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.jenkins.io/security/advisory/2022-09-21/#SECURITY-2858; https://www.jenkins.io/security/advisory/2022-09-21/#SECURITY-2858
CVE: CVE-2022-41230
Published: 2022-09-21
Description: Jenkins Build-Publisher Plugin 1.22 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to obtain names and URLs of Jenkins servers that the plugin is configured to publish builds to, as well as builds pending for publication to those Jenkins servers.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://www.jenkins.io/security/advisory/2022-09-21/#SECURITY-1994; https://www.jenkins.io/security/advisory/2022-09-21/#SECURITY-1994