deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2014-125041
Published: 2023-01-05
Description: A vulnerability classified as critical was found in Miccighel PR-CWT. This vulnerability affects unknown code. The manipulation leads to sql injection. The patch is identified as e412127d07004668e5a213932c94807d87067a1f. It is recommended to apply a patch to fix this issue. VDB-217486 is the identifier assigned to this vulnerability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/Miccighel/PR-CWT/commit/e412127d07004668e5a213932c94807d87067a1f; https://vuldb.com/?ctiid.217486; https://vuldb.com/?id.217486
CVE: CVE-2015-10015
Published: 2023-01-05
Description: A vulnerability, which was classified as critical, has been found in glidernet ogn-live. This issue affects some unknown processing. The manipulation leads to sql injection. The patch is named bc0f19965f[PII_REDACTED]83b7624d66a260946e01. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217487.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/glidernet/ogn-live/commit/bc0f19965f[PII_REDACTED]83b7624d66a260946e01; https://github.com/glidernet/ogn-live/pull/11; https://vuldb.com/?ctiid.217487
CVE: CVE-2022-3715
Published: 2023-01-05
Description: A flaw was found in the bash package, where a heap-buffer overflow can occur in valid parameter_transform. This issue may lead to memory problems.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-787
References: https://bugzilla.redhat.com/show_bug.cgi?id=2126720; https://bugzilla.redhat.com/show_bug.cgi?id=2126720; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2022-46489
Published: 2023-01-05
Description: GPAC version 2.1-DEV-rev505-gb9577e6ad-master was discovered to contain a memory leak via the gf_isom_box_parse_ex function at box_funcs.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401, CWE-401
References: https://github.com/gpac/gpac/issues/2328; https://github.com/gpac/gpac/issues/2328
CVE: CVE-2022-46490
Published: 2023-01-05
Description: GPAC version 2.1-DEV-rev505-gb9577e6ad-master was discovered to contain a memory leak via the afrt_box_read function at box_code_adobe.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401, CWE-401
References: https://github.com/gpac/gpac/issues/2327; https://github.com/gpac/gpac/issues/2327
CVE: CVE-2022-47086
Published: 2023-01-05
Description: GPAC MP4Box v2.1-DEV-rev574-g9d5bb184b contains a segmentation violation via the function gf_sm_load_init_swf at scene_manager/swf_parse.c
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://github.com/gpac/gpac/issues/2337; https://www.debian.org/security/2023/dsa-5411; https://github.com/gpac/gpac/issues/2337
CVE: CVE-2022-47087
Published: 2023-01-05
Description: GPAC MP4box 2.1-DEV-rev574-g9d5bb184b has a Buffer overflow in gf_vvc_read_pps_bs_internal function of media_tools/av_parsers.c
CVSS Score: 7.8 (HIGH)
CWE: CWE-120, CWE-120
References: https://github.com/gpac/gpac/issues/2339; https://github.com/gpac/gpac/issues/2339
CVE: CVE-2022-47088
Published: 2023-01-05
Description: GPAC MP4box 2.1-DEV-rev574-g9d5bb184b is vulnerable to Buffer Overflow.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120, CWE-120
References: https://github.com/gpac/gpac/issues/2340; https://github.com/gpac/gpac/issues/2340
CVE: CVE-2022-47089
Published: 2023-01-05
Description: GPAC MP4box 2.1-DEV-rev574-g9d5bb184b is vulnerable to Buffer Overflow via gf_vvc_read_sps_bs_internal function of media_tools/av_parsers.c
CVSS Score: 7.8 (HIGH)
CWE: CWE-120, CWE-120
References: https://github.com/gpac/gpac/issues/2338; https://github.com/gpac/gpac/issues/2338
CVE: CVE-2022-47091
Published: 2023-01-05
Description: GPAC MP4box 2.1-DEV-rev574-g9d5bb184b is vulnerable to Buffer Overflow in gf_text_process_sub function of filters/load_text.c
CVSS Score: 7.8 (HIGH)
CWE: CWE-120, CWE-120
References: https://github.com/gpac/gpac/issues/2343; https://www.debian.org/security/2023/dsa-5411; https://github.com/gpac/gpac/issues/2343
CVE: CVE-2022-47092
Published: 2023-01-05
Description: GPAC MP4box 2.1-DEV-rev574-g9d5bb184b is contains an Integer overflow vulnerability in gf_hevc_read_sps_bs_internal function of media_tools/av_parsers.c:8316
CVSS Score: 7.1 (HIGH)
CWE: CWE-190, CWE-190
References: https://github.com/gpac/gpac/issues/2347; https://github.com/gpac/gpac/issues/2347
CVE: CVE-2022-47093
Published: 2023-01-05
Description: GPAC MP4box 2.1-DEV-rev574-g9d5bb184b is vulnerable to heap use-after-free via filters/dmx_m2ts.c:470 in m2tsdmx_declare_pid
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://github.com/gpac/gpac/issues/2344; https://github.com/gpac/gpac/issues/2344
CVE: CVE-2022-47094
Published: 2023-01-05
Description: GPAC MP4box 2.1-DEV-rev574-g9d5bb184b is vulnerable to Null pointer dereference via filters/dmx_m2ts.c:343 in m2tsdmx_declare_pid
CVSS Score: 7.8 (HIGH)
CWE: CWE-476, CWE-476
References: https://github.com/gpac/gpac/issues/2345; https://www.debian.org/security/2023/dsa-5411; https://github.com/gpac/gpac/issues/2345
CVE: CVE-2022-47095
Published: 2023-01-05
Description: GPAC MP4box 2.1-DEV-rev574-g9d5bb184b is vulnerable to Buffer overflow in hevc_parse_vps_extension function of media_tools/av_parsers.c
CVSS Score: 7.8 (HIGH)
CWE: CWE-120, CWE-120
References: https://github.com/gpac/gpac/issues/2346; https://www.debian.org/security/2023/dsa-5411; https://github.com/gpac/gpac/issues/2346
CVE: CVE-2022-47653
Published: 2023-01-05
Description: GPAC MP4box 2.1-DEV-rev593-g007bf61a0 is vulnerable to Buffer Overflow in eac3_update_channels function of media_tools/av_parsers.c:9113
CVSS Score: 7.8 (HIGH)
CWE: CWE-120, CWE-120
References: https://github.com/gpac/gpac/issues/2349; https://github.com/gpac/gpac/issues/2349
CVE: CVE-2022-47654
Published: 2023-01-05
Description: GPAC MP4box 2.1-DEV-rev593-g007bf61a0 is vulnerable to Buffer Overflow in gf_hevc_read_sps_bs_internal function of media_tools/av_parsers.c:8261
CVSS Score: 7.8 (HIGH)
CWE: CWE-120, CWE-120
References: https://github.com/gpac/gpac/issues/2350; https://github.com/gpac/gpac/issues/2350
CVE: CVE-2022-47655
Published: 2023-01-05
Description: Libde265 1.0.9 is vulnerable to Buffer Overflow in function void put_qpel_fallback<unsigned short>
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://github.com/strukturag/libde265/issues/367; https://lists.debian.org/debian-lts-announce/2023/01/msg00020.html; https://www.debian.org/security/2023/dsa-5346
CVE: CVE-2022-47656
Published: 2023-01-05
Description: GPAC MP4box 2.1-DEV-rev617-g85ce76efd is vulnerable to Buffer Overflow in gf_hevc_read_sps_bs_internal function of media_tools/av_parsers.c:8273
CVSS Score: 7.8 (HIGH)
CWE: CWE-120, CWE-120
References: https://github.com/gpac/gpac/issues/2353; https://github.com/gpac/gpac/issues/2353
CVE: CVE-2022-47657
Published: 2023-01-05
Description: GPAC MP4Box 2.1-DEV-rev644-g5c4df2a67 is vulnerable to buffer overflow in function hevc_parse_vps_extension of media_tools/av_parsers.c:7662
CVSS Score: 7.8 (HIGH)
CWE: CWE-120, CWE-120
References: https://github.com/gpac/gpac/issues/2355; https://www.debian.org/security/2023/dsa-5411; https://github.com/gpac/gpac/issues/2355
CVE: CVE-2022-47658
Published: 2023-01-05
Description: GPAC MP4Box 2.1-DEV-rev644-g5c4df2a67 is vulnerable to buffer overflow in function gf_hevc_read_vps_bs_internal of media_tools/av_parsers.c:8039
CVSS Score: 7.8 (HIGH)
CWE: CWE-120, CWE-120
References: https://github.com/gpac/gpac/issues/2356; https://github.com/gpac/gpac/issues/2356
CVE: CVE-2022-47659
Published: 2023-01-05
Description: GPAC MP4box 2.1-DEV-rev644-g5c4df2a67 is vulnerable to Buffer Overflow in gf_bs_read_data
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://github.com/gpac/gpac/issues/2354; https://www.debian.org/security/2023/dsa-5411; https://github.com/gpac/gpac/issues/2354
CVE: CVE-2022-47660
Published: 2023-01-05
Description: GPAC MP4Box 2.1-DEV-rev644-g5c4df2a67 is has an integer overflow in isomedia/isom_write.c
CVSS Score: 7.8 (HIGH)
CWE: CWE-190, CWE-190
References: https://github.com/gpac/gpac/issues/2357; https://www.debian.org/security/2023/dsa-5411; https://github.com/gpac/gpac/issues/2357
CVE: CVE-2022-47661
Published: 2023-01-05
Description: GPAC MP4Box 2.1-DEV-rev649-ga8f438d20 is vulnerable to Buffer Overflow via media_tools/av_parsers.c:4988 in gf_media_nalu_add_emulation_bytes
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://github.com/gpac/gpac/issues/2358; https://www.debian.org/security/2023/dsa-5411; https://github.com/gpac/gpac/issues/2358
CVE: CVE-2022-47662
Published: 2023-01-05
Description: GPAC MP4Box 2.1-DEV-rev649-ga8f438d20 has a segment fault (/stack overflow) due to infinite recursion in Media_GetSample isomedia/media.c:662
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-674, CWE-674
References: https://github.com/gpac/gpac/issues/2359; https://www.debian.org/security/2023/dsa-5411; https://github.com/gpac/gpac/issues/2359
CVE: CVE-2022-47663
Published: 2023-01-05
Description: GPAC MP4box 2.1-DEV-rev649-ga8f438d20 is vulnerable to buffer overflow in h263dmx_process filters/reframe_h263.c:609
CVSS Score: 7.8 (HIGH)
CWE: CWE-120, CWE-120
References: https://github.com/gpac/gpac/issues/2360; https://www.debian.org/security/2023/dsa-5411; https://github.com/gpac/gpac/issues/2360
CVE: CVE-2022-4378
Published: 2023-01-05
Description: A stack overflow flaw was found in the Linux kernel's SYSCTL subsystem in how a user changes certain kernel parameters and variables. This flaw allows a local user to crash or potentially escalate their privileges on the system.
CVSS Score: 7.8 (HIGH)
CWE: CWE-131, CWE-787
References: http://packetstormsecurity.com/files/171289/Kernel-Live-Patch-Security-Notice-LNS-0092-1.html; https://bugzilla.redhat.com/show_bug.cgi?id=2152548; https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.0/proc-avoid-integer-type-confusion-in-get_proc_long.patch
CVE: CVE-2023-0086
Published: 2023-01-05
Description: The JetWidgets for Elementor plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.12. This is due to missing nonce validation on the save() function. This makes it possible for unauthenticated attackers to to modify the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.  This can be used to enable SVG uploads that could make Cross-Site Scripting possible.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/jetwidgets-for-elementor/trunk/includes/class-jet-widgets-settings.php#L149; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2846332%40jetwidgets-for-elementor&new=2846332%40jetwidgets-for-elementor&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/8de3d3c7-bde2-4455-8d60-20307f0a53ee?source=cve
CVE: CVE-2022-41740
Published: 2023-01-05
Description: 
IBM Robotic Process Automation 20.12 through 21.0.6 could allow an attacker with physical access to the system to obtain highly sensitive information from system memory. IBM X-Force ID: 238053.


CVSS Score: 4.6 (MEDIUM)
CWE: CWE-312
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/238053; https://www.ibm.com/support/pages/node/6852657; https://exchange.xforce.ibmcloud.com/vulnerabilities/238053
CVE: CVE-2022-43573
Published: 2023-01-05
Description: IBM Robotic Process Automation 20.12 through 21.0.6 is vulnerable to exposure of the name and email for the creator/modifier of platform level objects.  IBM X-Force ID:  238678.
CVSS Score: 3.1 (LOW)
CWE: CWE-200
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/238678; https://www.ibm.com/support/pages/node/6852655; https://exchange.xforce.ibmcloud.com/vulnerabilities/238678
CVE: CVE-2022-43844
Published: 2023-01-05
Description: IBM Robotic Process Automation for Cloud Pak 20.12 through 21.0.3 is vulnerable to broken access control.   A user is not correctly redirected to the platform log out screen when logging out of IBM RPA for Cloud Pak.  IBM X-Force ID:  239081.
CVSS Score: 8.8 (HIGH)
CWE: CWE-613
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/239081; https://www.ibm.com/support/pages/node/6852663; https://exchange.xforce.ibmcloud.com/vulnerabilities/239081
CVE: CVE-2022-46168
Published: 2023-01-05
Description: Discourse is an option source discussion platform. Prior to version 2.8.14 on the `stable` branch and version 2.9.0.beta15 on the `beta` and `tests-passed` branches, recipients of a group SMTP email could see the email addresses of all other users inside the group SMTP topic. Most of the time this is not an issue as they are likely already familiar with one another's email addresses. This issue is patched in versions 2.8.14 and 2.9.0.beta15. The fix is that someone sending emails out via group SMTP to non-staged users masks those emails with blind carbon copy (BCC). Staged users are ones that have likely only interacted with the group via email, and will likely include other people who were CC'd on the original email to the group. As a workaround, disable group SMTP for any groups that have it enabled.
CVSS Score: 3.5 (LOW)
CWE: CWE-359
References: https://github.com/discourse/discourse/pull/19724; https://github.com/discourse/discourse/security/advisories/GHSA-8p7g-3wm6-p3rm; https://github.com/discourse/discourse/pull/19724
CVE: CVE-2022-4432
Published: 2023-01-05
Description: A buffer over-read vulnerability was reported in the ThinkPadX13s BIOS PersistenceConfigDxe driver that could allow a local attacker with elevated privileges to cause information disclosure.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-126, CWE-125
References: https://support.lenovo.com/us/en/product_security/LEN-103709; https://support.lenovo.com/us/en/product_security/LEN-103709
CVE: CVE-2022-4433
Published: 2023-01-05
Description: A buffer over-read vulnerability was reported in the ThinkPadX13s BIOS LenovoSetupConfigDxe driver that could allow a local attacker with elevated privileges to cause information disclosure.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-126, CWE-125
References: https://support.lenovo.com/us/en/product_security/LEN-103709; https://support.lenovo.com/us/en/product_security/LEN-103709
CVE: CVE-2022-4434
Published: 2023-01-05
Description: A buffer over-read vulnerability was reported in the ThinkPadX13s BIOS driver that could allow a local attacker with elevated privileges to cause information disclosure.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-126, CWE-125
References: https://support.lenovo.com/us/en/product_security/LEN-103709; https://support.lenovo.com/us/en/product_security/LEN-103709
CVE: CVE-2022-4435
Published: 2023-01-05
Description: A buffer over-read vulnerability was reported in the ThinkPadX13s BIOS LenovoRemoteConfigUpdateDxe driver that could allow a local attacker with elevated privileges to cause information disclosure.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-126, CWE-125
References: https://support.lenovo.com/us/en/product_security/LEN-103709; https://support.lenovo.com/us/en/product_security/LEN-103709
CVE: CVE-2022-23546
Published: 2023-01-05
Description: In version 2.9.0.beta14 of Discourse, an open-source discussion platform, maliciously embedded urls can leak an admin's digest of recent topics, possibly exposing private information. A patch is available for version 2.9.0.beta15. There are no known workarounds for this issue.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200, CWE-200
References: https://github.com/discourse/discourse/commit/cf862e736565c6fa905c12b5dbe63d0bd056efb8; https://github.com/discourse/discourse/security/advisories/GHSA-q9jp-xv4g-328f; https://github.com/discourse/discourse/commit/cf862e736565c6fa905c12b5dbe63d0bd056efb8
CVE: CVE-2022-23548
Published: 2023-01-05
Description: Discourse is an option source discussion platform. Prior to version 2.8.14 on the `stable` branch and version 2.9.0.beta16 on the `beta` and `tests-passed` branches, parsing posts can be susceptible to regular expression denial of service (ReDoS) attacks. This issue is patched in versions 2.8.14 and 2.9.0.beta16. There are no known workarounds.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-1333, CWE-1333
References: https://github.com/discourse/discourse/pull/19737; https://github.com/discourse/discourse/security/advisories/GHSA-7rw2-f4x7-7pxf; https://github.com/discourse/discourse/pull/19737
CVE: CVE-2022-23549
Published: 2023-01-05
Description: Discourse is an option source discussion platform. Prior to version 2.8.14 on the `stable` branch and version 2.9.0.beta16 on the `beta` and `tests-passed` branches, users can create posts with raw body longer than the `max_length` site setting by including html comments that are not counted toward the character limit. This issue is patched in versions 2.8.14 and 2.9.0.beta16. There are no known workarounds.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-20
References: https://github.com/discourse/discourse/commit/bf6b08670a927cc80bb090b7a2e710b4b554e6a8; https://github.com/discourse/discourse/security/advisories/GHSA-p47g-v5wr-p4xp; https://github.com/discourse/discourse/commit/bf6b08670a927cc80bb090b7a2e710b4b554e6a8
CVE: CVE-2023-0087
Published: 2023-01-05
Description: The Swifty Page Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘spm_plugin_options_page_tree_max_width’ parameter in versions up to, and including, 3.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/swifty-page-manager/trunk/view/page_tree.php?rev=1555394#L174; https://www.wordfence.com/threat-intel/vulnerabilities/id/8550a405-9fa2-41a3-b556-05ff9f577ce4?source=cve; https://plugins.trac.wordpress.org/browser/swifty-page-manager/trunk/view/page_tree.php?rev=1555394#L174
CVE: CVE-2023-0088
Published: 2023-01-05
Description: The Swifty Page Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.0.1. This is due to missing or incorrect nonce validation on several AJAX actions handling page creation and deletion among other things. This makes it possible for unauthenticated attackers to invoke those functions, via forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://plugins.trac.wordpress.org/browser/swifty-page-manager/trunk/swifty-page-manager.php?rev=1555394#L994; https://www.wordfence.com/threat-intel/vulnerabilities/id/75b8f71d-9f75-4b42-ac5f-c6ffb476aae4?source=cve; https://plugins.trac.wordpress.org/browser/swifty-page-manager/trunk/swifty-page-manager.php?rev=1555394#L994
CVE: CVE-2014-125042
Published: 2023-01-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2014-125043
Published: 2023-01-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2014-125044
Published: 2023-01-05
Description: A vulnerability, which was classified as critical, was found in soshtolsus wing-tight. This affects an unknown part of the file index.php. The manipulation of the argument p leads to file inclusion. It is possible to initiate the attack remotely. Upgrading to version 1.0.0 is able to address this issue. The patch is named 567bc33e6ed82b0d0179c9add707ac2b257aeaf2. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-217515.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-73, CWE-610
References: https://github.com/soshtolsus/wing-tight/commit/567bc33e6ed82b0d0179c9add707ac2b257aeaf2; https://github.com/soshtolsus/wing-tight/releases/tag/1.0.0; https://vuldb.com/?ctiid.217515
CVE: CVE-2017-20163
Published: 2023-01-05
Description: A vulnerability has been found in Red Snapper NView and classified as critical. This vulnerability affects the function mutate of the file src/Session.php. The manipulation of the argument session leads to sql injection. The name of the patch is cbd255f55d476b29e5680f66f48c73ddb3d416a8. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-217516.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/RedSnapper/NView/commit/cbd255f55d476b29e5680f66f48c73ddb3d416a8; https://vuldb.com/?ctiid.217516; https://vuldb.com/?id.217516
CVE: CVE-2022-46177
Published: 2023-01-05
Description: Discourse is an option source discussion platform. Prior to version 2.8.14 on the `stable` branch and version 3.0.0.beta16 on the `beta` and `tests-passed` branches, when a user requests for a password reset link email, then changes their primary email, the old reset email is still valid. When the old reset email is used to reset the password, the Discourse account's primary email would be re-linked to the old email. If the old email address is compromised or has transferred ownership, this leads to an account takeover. This is however mitigated by the SiteSetting `email_token_valid_hours` which is currently 48 hours. Users should upgrade to versions 2.8.14 or 3.0.0.beta15 to receive a patch. As a workaround, lower `email_token_valid_hours ` as needed.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-613
References: https://github.com/discourse/discourse/commit/4bf306f0e3bf54a9ef9c5886bf1cfb85c20da570; https://github.com/discourse/discourse/commit/83944213b2b2454af80d0407f60d67641b1f0b38; https://github.com/discourse/discourse/security/advisories/GHSA-5www-jxvf-vrc3
CVE: CVE-2023-22453
Published: 2023-01-05
Description: Discourse is an option source discussion platform. Prior to version 2.8.14 on the `stable` branch and version 3.0.0.beta16 on the `beta` and `tests-passed` branches, the number of times a user posted in an arbitrary topic is exposed to unauthorized users through the `/u/username.json` endpoint. The issue is patched in version 2.8.14 and 3.0.0.beta16. There is no known workaround.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://github.com/discourse/discourse/commit/cbcf8a064b4889a19c991641e09c399bfa1ef2ad; https://github.com/discourse/discourse/security/advisories/GHSA-xx97-6494-p2rv; https://github.com/discourse/discourse/commit/cbcf8a064b4889a19c991641e09c399bfa1ef2ad
CVE: CVE-2023-22454
Published: 2023-01-05
Description: Discourse is an option source discussion platform. Prior to version 2.8.14 on the `stable` branch and version 3.0.0.beta16 on the `beta` and `tests-passed` branches, pending post titles can be used for cross-site scripting attacks. Pending posts can be created by unprivileged users when a category has the "require moderator approval of all new topics" setting set. This vulnerability can lead to a full XSS on sites which have modified or disabled Discourse’s default Content Security Policy. A patch is available in versions 2.8.14 and 3.0.0.beta16.
CVSS Score: 8.0 (HIGH)
CWE: CWE-79
References: https://github.com/discourse/discourse/commit/c0e2d7badac276d82a4056a994b48d68a8993a12; https://github.com/discourse/discourse/security/advisories/GHSA-ggq4-4qxc-c462; https://github.com/discourse/discourse/commit/c0e2d7badac276d82a4056a994b48d68a8993a12
CVE: CVE-2022-47543
Published: 2023-01-05
Description: An issue was discovered in Siren Investigate before 12.1.7. There is an ACL bypass on global objects.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-284
References: https://docs.support.siren.io/siren-platform-user-guide/12.1/release-notes.html; https://docs.support.siren.io/siren-platform-user-guide/13.0/release-notes.html; https://docs.support.siren.io/siren-platform-user-guide/12.1/release-notes.html