deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-30852
Published: 2022-07-08
Description: Known v1.3.1 was discovered to contain an Insecure Direct Object Reference (IDOR).
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-639
References: https://blog.jitendrapatro.me/multiple-vulnerabilities-in-idno-known-php-cms-software/; https://github.com/idno/known; https://withknown.com/
CVE: CVE-2022-31290
Published: 2022-07-08
Description: A cross-site scripting (XSS) vulnerability in Known v1.2.2[PII_REDACTED] allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Your Name text field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://docs.withknown.com/en/latest/install/index.html; https://blog.jitendrapatro.me/multiple-vulnerabilities-in-idno-known-php-cms-software/; https://github.com/idno/known
CVE: CVE-2022-32115
Published: 2022-07-08
Description: An issue in the isSVG() function of Known v1.2.2[PII_REDACTED] allows attackers to execute arbitrary code via a crafted SVG file.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://blog.jitendrapatro.me/multiple-vulnerabilities-in-idno-known-php-cms-software/; https://github.com/idno/known; https://withknown.com/
CVE: CVE-2022-33011
Published: 2022-07-08
Description: Known v1.3.1[PII_REDACTED] was discovered to allow attackers to perform an account takeover via a host header injection attack.
CVSS Score: 8.8 (HIGH)
CWE: CWE-74
References: https://blog.jitendrapatro.me/multiple-vulnerabilities-in-idno-known-php-cms-software/; https://github.com/idno/known; https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Account%20Takeover#account-takeover-through-password-reset-poisoning
CVE: CVE-2022-28623
Published: 2022-07-08
Description: Security vulnerabilities in HPE IceWall SSO 10.0 certd could be exploited remotely to allow SQL injection or unauthorized data injection. HPE has provided the following updated modules to resolve these vulnerabilities. HPE IceWall SSO version 10.0 certd library Patch 9 for RHEL and HPE IceWall SSO version 10.0 certd library Patch 9 for HP-UX.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbmu04330en_us; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbmu04330en_us
CVE: CVE-2022-28624
Published: 2022-07-08
Description: A potential security vulnerability has been identified in certain HPE FlexNetwork and FlexFabric switch products. The vulnerability could be remotely exploited to allow cross site scripting (XSS). HPE has made the following software updates to resolve the vulnerability. HPE FlexNetwork 5130EL_7.10.R3507P02 and HPE FlexFabric 5945_7.10.R6635.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbnw04265en_us; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbnw04265en_us
CVE: CVE-2022-35406
Published: 2022-07-08
Description: A URL disclosure issue was discovered in Burp Suite before 2022.6. If a user views a crafted response in the Repeater or Intruder, it may be incorrectly interpreted as a redirect.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-601
References: https://portswigger.net/burp/releases/professional-community-2022-6?requestededition=professional; https://portswigger.net/burp/releases/professional-community-2022-6?requestededition=professional
CVE: CVE-2022-34160
Published: 2022-07-08
Description: IBM CICS TX Standard and Advanced 11.1 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site. IBM X-Force ID: 229330.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/229330; https://www.ibm.com/support/pages/node/6601553; https://www.ibm.com/support/pages/node/6601555
CVE: CVE-2022-34166
Published: 2022-07-08
Description: IBM CICS TX Standard and Advanced 11.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 229430.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/229430; https://www.ibm.com/support/pages/node/6601579; https://www.ibm.com/support/pages/node/6601609
CVE: CVE-2022-34167
Published: 2022-07-08
Description: IBM CICS TX Standard and Advanced 11.1 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 229432.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/229432; https://www.ibm.com/support/pages/node/6601655; https://www.ibm.com/support/pages/node/6601657
CVE: CVE-2022-34306
Published: 2022-07-08
Description: IBM CICS TX Standard and Advanced 11.1 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking. IBM X-Force ID: 229435.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/229435; https://www.ibm.com/support/pages/node/6601659; https://www.ibm.com/support/pages/node/6601663
CVE: CVE-2015-0256
Published: 2022-07-08
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2015. Notes: none
CVE: CVE-2015-0280
Published: 2022-07-08
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2015. Notes: none
CVE: CVE-2015-0281
Published: 2022-07-08
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2015. Notes: none
CVE: CVE-2015-1837
Published: 2022-07-08
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2015. Notes: none
CVE: CVE-2015-1871
Published: 2022-07-08
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2015. Notes: none
CVE: CVE-2015-2236
Published: 2022-07-08
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2015. Notes: none
CVE: CVE-2015-2671
Published: 2022-07-08
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2015. Notes: none
CVE: CVE-2015-3260
Published: 2022-07-08
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2015. Notes: none
CVE: CVE-2015-3261
Published: 2022-07-08
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2015. Notes: none
CVE: CVE-2015-3262
Published: 2022-07-08
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2015. Notes: none
CVE: CVE-2015-3263
Published: 2022-07-08
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2015. Notes: none
CVE: CVE-2015-3264
Published: 2022-07-08
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2015. Notes: none
CVE: CVE-2015-3265
Published: 2022-07-08
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2015. Notes: none
CVE: CVE-2015-3266
Published: 2022-07-08
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2015. Notes: none
CVE: CVE-2015-3377
Published: 2022-07-08
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2015. Notes: none
CVE: CVE-2015-4101
Published: 2022-07-08
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2015. Notes: none
CVE: CVE-2015-4102
Published: 2022-07-08
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2015. Notes: none
CVE: CVE-2015-4169
Published: 2022-07-08
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2015. Notes: none
CVE: CVE-2015-4332
Published: 2022-07-08
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2015. Notes: none
CVE: CVE-2015-5328
Published: 2022-07-08
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2015. Notes: none
CVE: CVE-2015-5596
Published: 2022-07-08
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2015. Notes: none
CVE: CVE-2015-5597
Published: 2022-07-08
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2015. Notes: none
CVE: CVE-2015-5598
Published: 2022-07-08
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2015. Notes: none
CVE: CVE-2015-7800
Published: 2022-07-08
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2015. Notes: none
CVE: CVE-2015-8819
Published: 2022-07-08
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2015. Notes: none
CVE: CVE-2022-22370
Published: 2022-07-08
Description: IBM Security Verify Access 10.0.0.0, 10.0.1.0, 10.0.2.0, and 10.0.3.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 221194.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/221194; https://www.ibm.com/support/pages/node/6601725; https://exchange.xforce.ibmcloud.com/vulnerabilities/221194
CVE: CVE-2022-22463
Published: 2022-07-08
Description: IBM Security Access Manager Appliance 10.0.0.0, 10.0.1.0, 10.0.2.0, and 10.0.3.0 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 225079.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/225079; https://www.ibm.com/support/pages/node/6601729; https://exchange.xforce.ibmcloud.com/vulnerabilities/225079
CVE: CVE-2022-22464
Published: 2022-07-08
Description: IBM Security Access Manager Appliance 10.0.0.0, 10.0.1.0, 10.0.2.0, and 10.0.3.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 225081.
CVSS Score: 7.5 (HIGH)
CWE: CWE-326
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/225081; https://www.ibm.com/support/pages/node/6601729; https://exchange.xforce.ibmcloud.com/vulnerabilities/225081
CVE: CVE-2022-22465
Published: 2022-07-08
Description: IBM Security Access Manager Appliance 10.0.0.0, 10.0.1.0, 10.0.2.0, and 10.0.3.0 could allow a local user to obtain elevated privileges due to improper access permissions. IBM X-Force ID: 225082.
CVSS Score: 7.8 (HIGH)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/225082; https://www.ibm.com/support/pages/node/6601729; https://exchange.xforce.ibmcloud.com/vulnerabilities/225082
CVE: CVE-2022-22476
Published: 2022-07-08
Description: IBM WebSphere Application Server Liberty 17.0.0.3 through 22.0.0.7 and Open Liberty are vulnerable to identity spoofing by an authenticated user using a specially crafted request. IBM X-Force ID: 225604.
CVSS Score: 8.8 (HIGH)
CWE: CWE-290
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/225604; https://www.ibm.com/support/pages/node/6602015; https://exchange.xforce.ibmcloud.com/vulnerabilities/225604
CVE: CVE-2022-2343
Published: 2022-07-08
Description: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0044.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122
References: https://github.com/vim/vim/commit/caea66442d86e7bbba3bf3dc202c3c0d549b9853; https://huntr.dev/bounties/2ecb4345-2fc7-4e7f-adb0-83a20bb458f5; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/43Y3VJPOTTY3NTREDIFUPITM2POG4ZLP/
CVE: CVE-2022-35410
Published: 2022-07-08
Description: mat2 (aka metadata anonymisation toolkit) before 0.13.0 allows ../ directory traversal during the ZIP archive cleaning process. This primarily affects mat2 web instances, in which clients could obtain sensitive information via a crafted archive.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://0xacab.org/jvoisin/mat2/-/commit/beebca4bf1cd3b935824c966ce077e7bcf610385; https://0xacab.org/jvoisin/mat2/-/issues/174; https://dustri.org/b/mat2-0130.html
CVE: CVE-2022-2344
Published: 2022-07-08
Description: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0045.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: https://github.com/vim/vim/commit/baefde14550231f6468ac2ed2ed495bc381c0c92; https://huntr.dev/bounties/4a095ed9-3125-464a-b656-c31b437e1996; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/43Y3VJPOTTY3NTREDIFUPITM2POG4ZLP/
CVE: CVE-2022-34914
Published: 2022-07-08
Description: Webswing before 22.1.3 allows X-Forwarded-For header injection. The client IP address is associated with a variable in the configuration page. The {clientIp} variable can be used as an application startup argument. The X-Forwarded-For header can be manipulated by a client to store an arbitrary value that is used to replace the clientIp variable (without sanitization). A client can thus inject multiple arguments into the session startup. Systems that do not use the clientIP variable in the configuration are not vulnerable. The vulnerability is fixed in these versions: 20.1.16, 20.2.19, 21.1.8, 21.2.12, and 22.1.3.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-74
References: https://www.webswing.org/blog/header-injection-vulnerability-cve-2022-34914; https://www.webswing.org/docs/20.1/faq/client_ip.html; https://www.webswing.org/blog/header-injection-vulnerability-cve-2022-34914
CVE: CVE-2022-35411
Published: 2022-07-08
Description: rpc.py through 0.6.0 allows Remote Code Execution because an unpickle occurs when the "serializer: pickle" HTTP header is sent. In other words, although JSON (not Pickle) is the default data format, an unauthenticated client can cause the data to be processed with unpickle.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-522
References: http://packetstormsecurity.com/files/167872/rpc.py-0.6.0-Remote-Code-Execution.html; https://github.com/abersheeran/rpc.py/commit/491e7a841ed9a754796d6ab047a9fb16e23bf8bd; https://github.com/ehtec/rpcpy-exploit
CVE: CVE-2022-31137
Published: 2022-07-08
Description: Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Versions prior to 6.1.1.0 are subject to a remote code execution vulnerability. System commands can be run remotely via the subprocess_execute function without processing the inputs received from the user in the /app/options.py file. Attackers need not be authenticated to exploit this vulnerability. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-78, CWE-78
References: http://packetstormsecurity.com/files/167805/Roxy-WI-Remote-Command-Execution.html; http://packetstormsecurity.com/files/171648/Roxy-WI-6.1.0.0-Improper-Authentication-Control.html; http://packetstormsecurity.com/files/171652/Roxy-WI-6.1.1.0-Remote-Code-Execution.html
CVE: CVE-2022-35412
Published: 2022-07-08
Description: Digital Guardian Agent 7.7.4.0042 allows an administrator (who ordinarily does not have a supported way to uninstall the product) to disable some of the agent functionality and then exfiltrate files to an external USB device.
CVSS Score: 5.1 (MEDIUM)
References: https://github.com/i014n/DigitalGuardian-DLP-Agent-vulnerability; https://www.tenforums.com/tutorials/46259-block-unblock-legacy-file-system-filter-drivers-windows-10-a.html; https://github.com/i014n/DigitalGuardian-DLP-Agent-vulnerability
CVE: CVE-2022-2345
Published: 2022-07-08
Description: Use After Free in GitHub repository vim/vim prior to 9.0.0046.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://github.com/vim/vim/commit/32acf1f1a72ebb9d8942b9c9d80023bf1bb668ea; https://huntr.dev/bounties/1eed7009-db6d-487b-bc41-8f2fd260483f; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/43Y3VJPOTTY3NTREDIFUPITM2POG4ZLP/
CVE: CVE-2022-2353
Published: 2022-07-09
Description: Prior to microweber/microweber v1.2.20, due to improper neutralization of input, an attacker can steal tokens to perform cross-site request forgery, fetch contents from same-site and redirect a user.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://github.com/microweber/microweber/commit/79c6914bab8c9da07ac950fda17648d08c68b130; https://huntr.dev/bounties/7782c095-9e8c-48b0-a7f5-3a8f52e8af52; https://github.com/microweber/microweber/commit/79c6914bab8c9da07ac950fda17648d08c68b130
CVE: CVE-2022-27910
Published: 2022-07-10
Description: In Joomla component 'Joomlatools - DOCman 3.5.13 (and likely most versions below)' are affected to an reflected Cross-Site Scripting (XSS) in an image upload function
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.joomlatools.com/extensions/docman/changelog/3.5.14; https://www.joomlatools.com/extensions/docman/changelog/3.5.14
CVE: CVE-2022-2365
Published: 2022-07-10
Description: Cross-site Scripting (XSS) - Stored in GitHub repository zadam/trilium prior to 0.53.3.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/zadam/trilium/commit/1dfc37704fdd90ab7afbd8a586bdfc5cfaadeb8a; https://huntr.dev/bounties/34b281cd-ff4a-4ab0-ae25-56aef557682f; https://github.com/zadam/trilium/commit/1dfc37704fdd90ab7afbd8a586bdfc5cfaadeb8a
CVE: CVE-2022-27168
Published: 2022-07-11
Description: Cross-site scripting vulnerability in LiteCart versions prior to 2.4.2 allows a remote attacker to inject an arbitrary script via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/litecart/litecart; https://github.com/litecart/litecart/commit/050fea86cc162f3da2f7824f586602125a0f6d63; https://jvn.jp/en/jp/JVN32625020/index.html
CVE: CVE-2022-29512
Published: 2022-07-11
Description: Exposure of sensitive information to an unauthorized actor issue in multiple applications of Cybozu Garoon 4.0.0 to 5.9.1 allows a remote authenticated attacker to obtain the data without the viewing privilege.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://cs.cybozu.co.jp/2022/007682.html; https://jvn.jp/en/jp/JVN14077132/index.html; https://cs.cybozu.co.jp/2022/007682.html
CVE: CVE-2022-30602
Published: 2022-07-11
Description: Operation restriction bypass in multiple applications of Cybozu Garoon 4.0.0 to 5.9.1 allows a remote authenticated attacker to alter the file information and/or delete the files.
CVSS Score: 8.1 (HIGH)
References: https://cs.cybozu.co.jp/2022/007682.html; https://jvn.jp/en/jp/JVN14077132/index.html; https://cs.cybozu.co.jp/2022/007682.html
CVE: CVE-2022-30943
Published: 2022-07-11
Description: Browsing restriction bypass vulnerability in Bulletin of Cybozu Garoon 4.0.0 to 5.9.1 allows a remote authenticated attacker to obtain the data of Bulletin.
CVSS Score: 4.3 (MEDIUM)
References: https://cs.cybozu.co.jp/2022/007682.html; https://jvn.jp/en/jp/JVN14077132/index.html; https://cs.cybozu.co.jp/2022/007682.html
CVE: CVE-2022-31472
Published: 2022-07-11
Description: Browse restriction bypass vulnerability in Cabinet of Cybozu Garoon 4.0.0 to 5.5.1 allows a remote authenticated attacker to obtain the data of Cabinet.
CVSS Score: 4.3 (MEDIUM)
References: https://cs.cybozu.co.jp/2022/007429.html; https://jvn.jp/en/jp/JVN73897863/index.html; https://cs.cybozu.co.jp/2022/007429.html
CVE: CVE-2022-31501
Published: 2022-07-11
Description: The ChaoticOnyx/OnyxForum repository before 2022-05-04 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-22
References: https://github.com/ChaoticOnyx/OnyxForum/commit/f25543dfc62a9694d7e4f67eebfa45e3de916053; https://github.com/github/securitylab/issues/669#issuecomment[PII_REDACTED]; https://github.com/ChaoticOnyx/OnyxForum/commit/f25543dfc62a9694d7e4f67eebfa45e3de916053
CVE: CVE-2022-31502
Published: 2022-07-11
Description: The operatorequals/wormnest repository through 0.4.7 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-22
References: https://github.com/github/securitylab/issues/669#issuecomment[PII_REDACTED]; https://github.com/operatorequals/wormnest/commit/2dfe96fc2570586ac487b399ac20d41b3c114861; https://github.com/github/securitylab/issues/669#issuecomment[PII_REDACTED]
CVE: CVE-2022-31503
Published: 2022-07-11
Description: The orchest/orchest repository before 2022.05.0 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-22
References: https://github.com/github/securitylab/issues/669#issuecomment[PII_REDACTED]; https://github.com/orchest/orchest/pull/913; https://github.com/orchest/orchest/releases/tag/v2022.05.0
CVE: CVE-2022-31504
Published: 2022-07-11
Description: The ChangeWeDer/BaiduWenkuSpider_flaskWeb repository before 2021-11-29 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-22
References: https://github.com/ChangeWeDer/BaiduWenkuSpider_flaskWeb/pull/3; https://github.com/github/securitylab/issues/669#issuecomment[PII_REDACTED]; https://github.com/ChangeWeDer/BaiduWenkuSpider_flaskWeb/pull/3
CVE: CVE-2022-31505
Published: 2022-07-11
Description: The cheo0/MercadoEnLineaBack repository through 2022-05-04 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-22
References: https://github.com/github/securitylab/issues/669#issuecomment[PII_REDACTED]; https://github.com/github/securitylab/issues/669#issuecomment[PII_REDACTED]