deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-46692
Published: 2022-12-15
Description: A logic issue was addressed with improved state management. This issue is fixed in Safari 16.2, tvOS 16.2, iCloud for Windows 14.1, iOS 15.7.2 and iPadOS 15.7.2, macOS Ventura 13.1, iOS 16.2 and iPadOS 16.2, watchOS 9.2. Processing maliciously crafted web content may bypass Same Origin Policy.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-345
References: http://seclists.org/fulldisclosure/2022/Dec/20; http://seclists.org/fulldisclosure/2022/Dec/21; http://seclists.org/fulldisclosure/2022/Dec/23
CVE: CVE-2022-46693
Published: 2022-12-15
Description: An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in tvOS 16.2, iCloud for Windows 14.1, macOS Ventura 13.1, iOS 16.2 and iPadOS 16.2, watchOS 9.2. Processing a maliciously crafted file may lead to arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: http://seclists.org/fulldisclosure/2022/Dec/20; http://seclists.org/fulldisclosure/2022/Dec/23; http://seclists.org/fulldisclosure/2022/Dec/26
CVE: CVE-2022-46694
Published: 2022-12-15
Description: An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in iOS 16.2 and iPadOS 16.2, iOS 15.7.2 and iPadOS 15.7.2, tvOS 16.2, watchOS 9.2. Parsing a maliciously crafted video file may lead to kernel code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: http://seclists.org/fulldisclosure/2022/Dec/20; http://seclists.org/fulldisclosure/2022/Dec/21; http://seclists.org/fulldisclosure/2022/Dec/26
CVE: CVE-2022-46695
Published: 2022-12-15
Description: A spoofing issue existed in the handling of URLs. This issue was addressed with improved input validation. This issue is fixed in tvOS 16.2, macOS Ventura 13.1, iOS 15.7.2 and iPadOS 15.7.2, iOS 16.2 and iPadOS 16.2, watchOS 9.2. Visiting a website that frames malicious content may lead to UI spoofing.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-1021, CWE-1021
References: http://seclists.org/fulldisclosure/2022/Dec/20; http://seclists.org/fulldisclosure/2022/Dec/21; http://seclists.org/fulldisclosure/2022/Dec/23
CVE: CVE-2022-46696
Published: 2022-12-15
Description: A memory corruption issue was addressed with improved input validation. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 16.2 and iPadOS 16.2, watchOS 9.2. Processing maliciously crafted web content may lead to arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: http://seclists.org/fulldisclosure/2022/Dec/20; http://seclists.org/fulldisclosure/2022/Dec/23; http://seclists.org/fulldisclosure/2022/Dec/26
CVE: CVE-2022-46697
Published: 2022-12-15
Description: An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in macOS Ventura 13.1. An app may be able to execute arbitrary code with kernel privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: http://seclists.org/fulldisclosure/2022/Dec/23; https://support.apple.com/en-us/HT213532; http://seclists.org/fulldisclosure/2022/Dec/23
CVE: CVE-2022-46698
Published: 2022-12-15
Description: A logic issue was addressed with improved checks. This issue is fixed in Safari 16.2, tvOS 16.2, iCloud for Windows 14.1, macOS Ventura 13.1, iOS 16.2 and iPadOS 16.2, watchOS 9.2. Processing maliciously crafted web content may disclose sensitive user information.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-693
References: http://seclists.org/fulldisclosure/2022/Dec/20; http://seclists.org/fulldisclosure/2022/Dec/23; http://seclists.org/fulldisclosure/2022/Dec/26
CVE: CVE-2022-46699
Published: 2022-12-15
Description: A memory corruption issue was addressed with improved state management. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 16.2 and iPadOS 16.2, watchOS 9.2. Processing maliciously crafted web content may lead to arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: http://seclists.org/fulldisclosure/2022/Dec/20; http://seclists.org/fulldisclosure/2022/Dec/23; http://seclists.org/fulldisclosure/2022/Dec/26
CVE: CVE-2022-46700
Published: 2022-12-15
Description: A memory corruption issue was addressed with improved input validation. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 15.7.2 and iPadOS 15.7.2, iOS 16.2 and iPadOS 16.2, watchOS 9.2. Processing maliciously crafted web content may lead to arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: http://seclists.org/fulldisclosure/2022/Dec/20; http://seclists.org/fulldisclosure/2022/Dec/21; http://seclists.org/fulldisclosure/2022/Dec/23
CVE: CVE-2022-46701
Published: 2022-12-15
Description: The issue was addressed with improved bounds checks. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS Ventura 13.1, tvOS 16.2. Connecting to a malicious NFS server may lead to arbitrary code execution with kernel privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20, CWE-20
References: http://seclists.org/fulldisclosure/2022/Dec/20; http://seclists.org/fulldisclosure/2022/Dec/23; http://seclists.org/fulldisclosure/2022/Dec/26
CVE: CVE-2022-46702
Published: 2022-12-15
Description: The issue was addressed with improved memory handling. This issue is fixed in iOS 16.2 and iPadOS 16.2. An app may be able to disclose kernel memory.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://seclists.org/fulldisclosure/2022/Dec/20; https://support.apple.com/en-us/HT213530; http://seclists.org/fulldisclosure/2022/Dec/20
CVE: CVE-2021-4245
Published: 2022-12-15
Description: A vulnerability classified as problematic has been found in chbrown rfc6902. This affects an unknown part of the file pointer.ts. The manipulation leads to improperly controlled modification of object prototype attributes ('prototype pollution'). The exploit has been disclosed to the public and may be used. The name of the patch is c006ce9faa43d31edb34924f1df7b79c137096cf. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-215883.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-74, CWE-1321
References: https://github.com/chbrown/rfc6902/commit/c006ce9faa43d31edb34924f1df7b79c137096cf; https://github.com/chbrown/rfc6902/pull/76; https://vuldb.com/?id.215883
CVE: CVE-2022-4511
Published: 2022-12-15
Description: A vulnerability has been found in RainyGao DocSys and classified as critical. Affected by this vulnerability is an unknown functionality of the component com.DocSystem.controller.UserController#getUserImg. The manipulation leads to path traversal: '../filedir'. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-215851.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://gitee.com/RainyGao/DocSys/issues/I66A3V; https://vuldb.com/?id.215851; https://gitee.com/RainyGao/DocSys/issues/I66A3V
CVE: CVE-2022-4513
Published: 2022-12-15
Description: A vulnerability, which was classified as problematic, has been found in European Environment Agency eionet.contreg. This issue affects some unknown processing. The manipulation of the argument searchTag/resourceUri leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 2022-06-27T0948 is able to address this issue. The name of the patch is a120c2153e263e62c4db34a06ab96a9f1c6bccb6. It is recommended to upgrade the affected component. The identifier VDB-215885 was assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-707, CWE-79
References: https://github.com/eea/eionet.contreg/commit/a120c2153e263e62c4db34a06ab96a9f1c6bccb6; https://github.com/eea/eionet.contreg/releases/tag/2022-06-27T0948; https://vuldb.com/?id.215885
CVE: CVE-2022-4514
Published: 2022-12-15
Description: A vulnerability, which was classified as problematic, was found in Opencaching Deutschland oc-server3. Affected is an unknown function of the file htdocs/lang/de/ocstyle/varset.inc.php. The manipulation of the argument varvalue leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 4bdd6a0e7b7760cea03b91812cbb80d7b16e3b5f. It is recommended to apply a patch to fix this issue. VDB-215886 is the identifier assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-707, CWE-79
References: https://github.com/OpencachingDeutschland/oc-server3/commit/4bdd6a0e7b7760cea03b91812cbb80d7b16e3b5f; https://github.com/OpencachingDeutschland/oc-server3/pull/902; https://vuldb.com/?id.215886
CVE: CVE-2022-4519
Published: 2022-12-15
Description: The WP User plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its settings parameters in versions up to, and including, 7.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/wp-user/#description; https://www.wordfence.com/threat-intel/vulnerabilities/id/8ee21796-5340-4f84-b1c4-a95137a27223?source=cve; https://wordpress.org/plugins/wp-user/#description
CVE: CVE-2022-4520
Published: 2022-12-15
Description: A vulnerability was found in WSO2 carbon-registry up to 4.8.11. It has been rated as problematic. Affected by this issue is some unknown functionality of the file components/registry/org.wso2.carbon.registry.search.ui/src/main/resources/web/search/advancedSearchForm-ajaxprocessor.jsp of the component Advanced Search. The manipulation of the argument mediaType/rightOp/leftOp/rightPropertyValue/leftPropertyValue leads to cross site scripting. The attack may be launched remotely. Upgrading to version 4.8.12 is able to address this issue. The name of the patch is 0c827cc1b14b82d8eb86117ab2e43c34bb91ddb4. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-215900.
CVSS Score: 3.5 (LOW)
CWE: CWE-707, CWE-79
References: https://github.com/wso2/carbon-registry/commit/0c827cc1b14b82d8eb86117ab2e43c34bb91ddb4; https://github.com/wso2/carbon-registry/pull/404; https://github.com/wso2/carbon-registry/releases/tag/v4.8.12
CVE: CVE-2022-4521
Published: 2022-12-15
Description: A vulnerability classified as problematic has been found in WSO2 carbon-registry up to 4.8.6. This affects an unknown part of the component Request Parameter Handler. The manipulation of the argument parentPath/path/username/path/profile_menu leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 4.8.7 is able to address this issue. The name of the patch is 9f967abfde9317bee2cda469dbc09b57d539f2cc. It is recommended to upgrade the affected component. The identifier VDB-215901 was assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-79
References: https://github.com/wso2/carbon-registry/commit/9f967abfde9317bee2cda469dbc09b57d539f2cc; https://github.com/wso2/carbon-registry/pull/399; https://github.com/wso2/carbon-registry/releases/tag/v4.8.7
CVE: CVE-2022-4522
Published: 2022-12-15
Description: A vulnerability classified as problematic was found in CalendarXP up to 10.0.1. This vulnerability affects unknown code. The manipulation leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 10.0.2 is able to address this issue. The name of the patch is e3715b2228ddefe[PII_REDACTED]9969f9e184836da. It is recommended to upgrade the affected component. VDB-215902 is the identifier assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-707
References: https://github.com/victorwon/calendarxp/commit/e3715b2228ddefe[PII_REDACTED]9969f9e184836da; https://github.com/victorwon/calendarxp/releases/tag/10.0.2; https://vuldb.com/?id.215902
CVE: CVE-2022-4523
Published: 2022-12-15
Description: A vulnerability, which was classified as problematic, has been found in vexim2. This issue affects some unknown processing. The manipulation leads to cross site scripting. The attack may be initiated remotely. The name of the patch is 21c0a60d12e9d587f905cd084b2c70f9b1592065. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-215903.
CVSS Score: 3.5 (LOW)
CWE: CWE-707, CWE-79
References: https://github.com/vexim/vexim2/commit/21c0a60d12e9d587f905cd084b2c70f9b1592065; https://github.com/vexim/vexim2/pull/274; https://vuldb.com/?id.215903
CVE: CVE-2022-4524
Published: 2022-12-15
Description: A vulnerability, which was classified as problematic, was found in Roots soil Plugin up to 4.0.x. Affected is the function language_attributes of the file src/Modules/CleanUpModule.php. The manipulation of the argument language leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 4.1.0 is able to address this issue. The name of the patch is 0c9151e00ab047da253e5cdbfccb204dd423269d. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-215904.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/roots/soil/commit/0c9151e00ab047da253e5cdbfccb204dd423269d; https://github.com/roots/soil/pull/285; https://github.com/roots/soil/releases/tag/4.1.0
CVE: CVE-2022-4525
Published: 2022-12-15
Description: A vulnerability has been found in National Sleep Research Resource sleepdata.org up to 58.x and classified as problematic. Affected by this vulnerability is an unknown functionality. The manipulation leads to cross site scripting. The attack can be launched remotely. Upgrading to version 59.0.0.rc is able to address this issue. The name of the patch is da44a3893b407087829b006d[PII_REDACTED]9714cd. It is recommended to upgrade the affected component. The identifier VDB-215905 was assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-79
References: https://github.com/nsrr/sleepdata.org/commit/da44a3893b407087829b006d[PII_REDACTED]9714cd; https://github.com/nsrr/sleepdata.org/releases/tag/59.0.0.rc; https://vuldb.com/?id.215905
CVE: CVE-2022-4526
Published: 2022-12-15
Description: A vulnerability was found in django-photologue up to 3.15.1 and classified as problematic. Affected by this issue is some unknown functionality of the file photologue/templates/photologue/photo_detail.html of the component Default Template Handler. The manipulation of the argument object.caption leads to cross site scripting. The attack may be launched remotely. Upgrading to version 3.16 is able to address this issue. The name of the patch is 960cb060ce5e2964e6d716ff787c72fc18a371e7. It is recommended to apply a patch to fix this issue. VDB-215906 is the identifier assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-707, CWE-79
References: https://github.com/richardbarran/django-photologue/commit/960cb060ce5e2964e6d716ff787c72fc18a371e7; https://github.com/richardbarran/django-photologue/issues/223; https://vuldb.com/?id.215906
CVE: CVE-2022-4527
Published: 2022-12-15
Description: A vulnerability was found in collective.task up to 3.0.8. It has been classified as problematic. This affects the function renderCell/AssignedGroupColumn of the file src/collective/task/browser/table.py. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 3.0.9 is able to address this issue. The name of the patch is 1aac7f83fa2c2b41d59ba[PII_REDACTED]3461f3fac. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-215907.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-79
References: https://github.com/collective/collective.task/commit/1aac7f83fa2c2b41d59ba[PII_REDACTED]3461f3fac; https://github.com/collective/collective.task/releases/tag/3.0.9; https://vuldb.com/?id.215907
CVE: CVE-2022-46631
Published: 2022-12-15
Description: TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the wscDisabled parameter in the setting/setWiFiSignalCfg function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://github.com/EPhaha/IOT_vuln/tree/main/TOTOLink/A7100RU/6; https://github.com/EPhaha/IOT_vuln/tree/main/TOTOLink/A7100RU/6
CVE: CVE-2022-46634
Published: 2022-12-15
Description: TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the wscDisabled parameter in the setting/setWiFiWpsCfg function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://github.com/EPhaha/IOT_vuln/tree/main/TOTOLink/A7100RU/7; https://github.com/EPhaha/IOT_vuln/tree/main/TOTOLink/A7100RU/7
CVE: CVE-2022-40004
Published: 2022-12-15
Description: Cross Site Scripting (XSS) vulnerability in Things Board 3.4.1 allows remote attackers to escalate privilege via crafted URL to the Audit Log.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-79, CWE-79
References: https://gist.github.com/s3d113/bba63da007fcbe243615dd2a81690ffb; https://gist.github.com/s3d113/bba63da007fcbe243615dd2a81690ffb
CVE: CVE-2022-45338
Published: 2022-12-15
Description: An arbitrary file upload vulnerability in the profile picture upload function of Exact Synergy Enterprise 267 before 267SP13 and Exact Synergy Enterprise 500 before 500SP6 allows attackers to execute arbitrary code via a crafted SVG file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-434, CWE-434
References: https://gist.github.com/MaxRozendaal/633b34a4675b60caed736e5ffe28f272; https://gist.github.com/MaxRozendaal/633b34a4675b60caed736e5ffe28f272
CVE: CVE-2022-45969
Published: 2022-12-15
Description: Alist v3.4.0 is vulnerable to Directory Traversal,
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22, CWE-22
References: https://github.com/alist-org/alist/issues/2449; https://github.com/alist-org/alist/issues/2449
CVE: CVE-2022-46392
Published: 2022-12-15
Description: An issue was discovered in Mbed TLS before 2.28.2 and 3.x before 3.3.0. An adversary with access to precise enough information about memory accesses (typically, an untrusted operating system attacking a secure enclave) can recover an RSA private key after observing the victim performing a single private-key operation, if the window size (MBEDTLS_MPI_WINDOW_SIZE) used for the exponentiation is 3 or smaller.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-203, CWE-203
References: https://github.com/Mbed-TLS/mbedtls/releases/tag/v2.28.2; https://github.com/Mbed-TLS/mbedtls/releases/tag/v3.3.0; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4BR7ZCVKLPGCOEEALUHZMFHXQHR6S4QL/
CVE: CVE-2022-46393
Published: 2022-12-15
Description: An issue was discovered in Mbed TLS before 2.28.2 and 3.x before 3.3.0. There is a potential heap-based buffer overflow and heap-based buffer over-read in DTLS if MBEDTLS_SSL_DTLS_CONNECTION_ID is enabled and MBEDTLS_SSL_CID_IN_LEN_MAX > 2 * MBEDTLS_SSL_CID_OUT_LEN_MAX.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125, CWE-787, CWE-125, CWE-787
References: https://github.com/Mbed-TLS/mbedtls/releases/tag/v2.28.2; https://github.com/Mbed-TLS/mbedtls/releases/tag/v3.3.0; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4BR7ZCVKLPGCOEEALUHZMFHXQHR6S4QL/
CVE: CVE-2022-41960
Published: 2022-12-16
Description: BigBlueButton is an open source web conferencing system. Versions prior to 2.4.3, are subject to Insufficient Verification of Data Authenticity, resulting in Denial of Service. An attacker can make a Meteor call to `validateAuthToken` using a victim's userId, meetingId, and an invalid authToken. This forces the victim to leave the conference, because the resulting verification failure is also observed and handled by the victim's client. The attacker must be a participant in any meeting on the server. This issue is patched in version 2.4.3. There are no workarounds.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-345
References: https://github.com/bigbluebutton/bigbluebutton/releases/tag/v2.4.3; https://github.com/bigbluebutton/bigbluebutton/releases/tag/v2.5-alpha-1; https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-rgjp-3r74-g4cm
CVE: CVE-2021-28655
Published: 2022-12-16
Description: The improper Input Validation vulnerability in "”Move folder to Trash” feature of Apache Zeppelin allows an attacker to delete the arbitrary files.  This issue affects Apache Zeppelin Apache Zeppelin version 0.9.0 and prior versions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://lists.apache.org/thread/bxs056g3xlsofz0jb3wny9dw4llwptd2; https://lists.apache.org/thread/bxs056g3xlsofz0jb3wny9dw4llwptd2
CVE: CVE-2022-41961
Published: 2022-12-16
Description: BigBlueButton is an open source web conferencing system. Versions prior to 2.4-rc-6 are subject to Ineffective user bans. The attacker could register multiple users, and join the meeting with one of them. When that user is banned, they could still join the meeting with the remaining registered users from the same extId. This issue has been fixed by improving permissions such that banning a user removes all users related to their extId, including registered users that have not joined the meeting. This issue is patched in versions 2.4-rc-6 and 2.5-alpha-1. There are no workarounds. 
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-345, CWE-346
References: https://github.com/bigbluebutton/bigbluebutton/releases/tag/v2.4-rc-6; https://github.com/bigbluebutton/bigbluebutton/releases/tag/v2.5-alpha-1; https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-wxjp-h88g-7fqg
CVE: CVE-2022-41962
Published: 2022-12-16
Description: BigBlueButton is an open source web conferencing system. Versions prior to 2.4-rc-6, and 2.5-alpha-1 contain Incorrect Authorization for setting emoji status. A user with moderator rights can use the clear status feature to set any emoji status for other users. Moderators should only be able to set none as the status of other users. This issue is patched in 2.4-rc-6 and 2.5-alpha-1There are no workarounds. 
CVSS Score: 2.7 (LOW)
CWE: CWE-863
References: https://github.com/bigbluebutton/bigbluebutton/releases/tag/v2.4-rc-6; https://github.com/bigbluebutton/bigbluebutton/releases/tag/v2.5-alpha-1; https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-88qf-33qm-9mm7
CVE: CVE-2022-46870
Published: 2022-12-16
Description: An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Zeppelin allows logged-in users to execute arbitrary javascript in other users' browsers.
This issue affects Apache Zeppelin before 0.8.2. Users are recommended to upgrade to a supported version of Zeppelin.



CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://lists.apache.org/thread/gb1wdnrm1095xw6qznpsycfrht4lwbwc; https://lists.apache.org/thread/gb1wdnrm1095xw6qznpsycfrht4lwbwc
CVE: CVE-2022-36223
Published: 2022-12-16
Description: In Emby Server 4.6.7.0, the playlist name field is vulnerable to XSS stored where it is possible to steal the administrator access token and flip or steal the media server administrator account.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://medium.com/%40cupc4k3/administrator-account-takeover-in-emby-media-server-616fc2a6704f; https://medium.com/%40cupc4k3/administrator-account-takeover-in-emby-media-server-616fc2a6704f; https://medium.com/stolabs/cve-2022-36223-administrator-account-takeover-in-emby-media-server-616fc2a6704f
CVE: CVE-2022-41963
Published: 2022-12-16
Description: BigBlueButton is an open source web conferencing system. Versions prior to 2.4.3 contain a whiteboard grace period that exists to handle delayed messages, but this grace period could be used by attackers to take actions in the few seconds after their access is revoked. The attacker must be a meeting participant. This issue is patched in version 2.4.3 an version 2.5-alpha-1
CVSS Score: 2.7 (LOW)
CWE: CWE-281
References: https://github.com/bigbluebutton/bigbluebutton/releases/tag/v2.4.3; https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-v6p9-926c-6qfp; https://github.com/bigbluebutton/bigbluebutton/releases/tag/v2.4.3