deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-33912
Published: 2022-01-19
Description: libspf2 before 1.2.11 has a four-byte heap-based buffer overflow that might allow remote attackers to execute arbitrary code (via an unauthenticated e-mail message from anywhere on the Internet) with a crafted SPF DNS record, because of incorrect sprintf usage in SPF_record_expand_data in spf_expand.c. The vulnerable code may be part of the supply chain of a site's e-mail infrastructure (e.g., with additional configuration, Exim can use libspf2; the Postfix web site links to unofficial patches for use of libspf2 with Postfix; older versions of spfquery relied on libspf2) but most often is not.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/shevek/libspf2/tree/8131fe140704eaae695e76b5cd09e39bd1dd220b; https://lists.debian.org/debian-lts-announce/2022/01/msg00015.html; https://nathanielbennett.com/blog/libspf2-cve-jan-2022-disclosure
CVE: CVE-2021-33913
Published: 2022-01-19
Description: libspf2 before 1.2.11 has a heap-based buffer overflow that might allow remote attackers to execute arbitrary code (via an unauthenticated e-mail message from anywhere on the Internet) with a crafted SPF DNS record, because of SPF_record_expand_data in spf_expand.c. The amount of overflowed data depends on the relationship between the length of an entire domain name and the length of its leftmost label. The vulnerable code may be part of the supply chain of a site's e-mail infrastructure (e.g., with additional configuration, Exim can use libspf2; the Postfix web site links to unofficial patches for use of libspf2 with Postfix; older versions of spfquery relied on libspf2) but most often is not.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/shevek/libspf2/tree/8131fe140704eaae695e76b5cd09e39bd1dd220b; https://lists.debian.org/debian-lts-announce/2022/01/msg00015.html; https://nathanielbennett.com/blog/libspf2-cve-jan-2022-disclosure
CVE: CVE-2021-42810
Published: 2022-01-19
Description: A flaw in the previous versions of the product may allow an authenticated attacker the ability to execute code as a privileged user on a system where the agent is installed.
CVSS Score: 7.8 (HIGH)
CWE: CWE-336, CWE-335
References: https://cpl.thalesgroup.com/support/security-updates; https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2022/MNDT-2022-0002/MNDT-2022-0002.md; https://cpl.thalesgroup.com/support/security-updates
CVE: CVE-2021-44299
Published: 2022-01-19
Description: A reflected cross-site scripting (XSS) vulnerability in \lib\packages\themes\themes.php of Navigate CMS v2.9.4 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/NavigateCMS/Navigate-CMS/issues/29; https://github.com/NavigateCMS/Navigate-CMS/issues/29
CVE: CVE-2021-46203
Published: 2022-01-19
Description: Taocms v3.0.2 was discovered to contain an arbitrary file read vulnerability via the path parameter.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://github.com/taogogo/taocms/issues/13; https://github.com/taogogo/taocms/issues/13
CVE: CVE-2021-46204
Published: 2022-01-19
Description: Taocms v3.0.2 was discovered to contain an arbitrary file read vulnerability via the path parameter. SQL injection vulnerability via taocms\include\Model\Article.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/taogogo/taocms/issues/14; https://github.com/taogogo/taocms/issues/14
CVE: CVE-2022-0274
Published: 2022-01-19
Description: Cross-site Scripting (XSS) - Stored in NuGet OrchardCore.Application.Cms.Targets prior to 1.2.2.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/orchardcms/orchardcore/commit/218f25ddfadb66a54de7a82dffe3ab2e4ab7c4b4; https://huntr.dev/bounties/a82a714a-9b71-475e-bfc3-43326fcaf764; https://github.com/orchardcms/orchardcore/commit/218f25ddfadb66a54de7a82dffe3ab2e4ab7c4b4
CVE: CVE-2021-38789
Published: 2022-01-19
Description: Allwinner R818 SoC Android Q SDK V1.0 is affected by an incorrect access control vulnerability that does not check the caller's permission, in which a third-party app could change system settings.
CVSS Score: 7.5 (HIGH)
CWE: CWE-862
References: https://github.com/pokerfacett/MY_CVE_CREDIT/blob/master/Allwinner%20R818%20SoC%EF%BC%9Aaw_display%20service%20has%20EoP%20Vulnerability.md; https://vul.wangan.com/a/CNVD-2021-46927; https://www.allwinnertech.com/index.php?c=product&a=index&id=92
CVE: CVE-2022-0243
Published: 2022-01-19
Description: Cross-site Scripting (XSS) - Stored in NuGet OrchardCore.Application.Cms.Targets prior to 1.2.2.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/orchardcms/orchardcore/commit/218f25ddfadb66a54de7a82dffe3ab2e4ab7c4b4; https://huntr.dev/bounties/fa538421-ae55-4288-928f-4e96aaed5803; https://github.com/orchardcms/orchardcore/commit/218f25ddfadb66a54de7a82dffe3ab2e4ab7c4b4
CVE: CVE-2022-22769
Published: 2022-01-19
Description: The Web server component of TIBCO Software Inc.'s TIBCO EBX, TIBCO EBX, TIBCO EBX, TIBCO EBX Add-ons, TIBCO EBX Add-ons, TIBCO EBX Add-ons, and TIBCO Product and Service Catalog powered by TIBCO EBX contains an easily exploitable vulnerability that allows a low privileged attacker with network access to execute Stored Cross Site Scripting (XSS) on the affected system. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.'s TIBCO EBX: versions 5.8.124 and below, TIBCO EBX: versions 5.9.3, 5.9.4, 5.9.5, 5.9.6, 5.9.7, 5.9.8, 5.9.9, 5.9.10, 5.9.11, 5.9.12, 5.9.13, 5.9.14, and 5.9.15, TIBCO EBX: versions 6.0.0, 6.0.1, 6.0.2, and 6.0.3, TIBCO EBX Add-ons: versions 3.20.18 and below, TIBCO EBX Add-ons: versions 4.1.0, 4.2.0, 4.2.1, 4.2.2, 4.3.0, 4.3.1, 4.3.2, 4.3.3, 4.3.4, 4.4.0, 4.4.1, 4.4.2, 4.4.3, 4.5.0, 4.5.1, 4.5.2, 4.5.3, 4.5.4, 4.5.5, and 4.5.6, TIBCO EBX Add-ons: versions 5.0.0, 5.0.1, 5.1.0, 5.1.1, and 5.2.0, and TIBCO Product and Service Catalog powered by TIBCO EBX: versions 1.1.0 and below.
CVSS Score: 8.0 (HIGH)
CWE: CWE-79
References: https://www.tibco.com/services/support/advisories; https://www.tibco.com/support/advisories/2022/01/tibco-security-advisory-january-19-2022-tibco-ebx-2022-22769; https://www.tibco.com/services/support/advisories
CVE: CVE-2021-23225
Published: 2022-01-19
Description: Cacti 1.1.38 allows authenticated users with User Management permissions to inject arbitrary web script or HTML in the "new_username" field during creation of a new user via "Copy" method at user_admin.php.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://lists.debian.org/debian-lts-announce/2022/03/msg00038.html; https://www.cacti.net/info/changelog; https://lists.debian.org/debian-lts-announce/2022/03/msg00038.html
CVE: CVE-2021-23842
Published: 2022-01-19
Description: Communication to the AMC2 uses a state-of-the-art cryptographic algorithm for symmetric encryption called Blowfish. An attacker could retrieve the key from the firmware to decrypt network traffic between the AMC2 and the host system. Thus, an attacker can exploit this vulnerability to decrypt and modify network traffic, decrypt and further investigate the device\'s firmware file, and change the device configuration. The attacker needs to have access to the local network, typically even the same subnet.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-321, CWE-798
References: https://psirt.bosch.com/security-advisories/BOSCH-SA-940448-BT.html; https://psirt.bosch.com/security-advisories/BOSCH-SA-940448-BT.html
CVE: CVE-2021-23843
Published: 2022-01-19
Description: The Bosch software tools AccessIPConfig.exe and AmcIpConfig.exe are used to configure certains settings in AMC2 devices. The tool allows putting a password protection on configured devices to restrict access to the configuration of an AMC2. An attacker can circumvent this protection and make unauthorized changes to configuration data on the device. An attacker can exploit this vulnerability to manipulate the device\'s configuration or make it unresponsive in the local network. The attacker needs to have access to the local network, typically even the same subnet.
CVSS Score: 8.8 (HIGH)
CWE: CWE-306, CWE-306
References: https://psirt.bosch.com/security-advisories/BOSCH-SA-940448-BT.html; https://psirt.bosch.com/security-advisories/BOSCH-SA-940448-BT.html
CVE: CVE-2021-26247
Published: 2022-01-19
Description: As an unauthenticated remote user, visit "http://<CACTI_SERVER>/auth_changepassword.php?ref=<script>alert(1)</script>" to successfully execute the JavaScript payload present in the "ref" URL parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.cacti.net/info/changelog; https://www.cacti.net/info/changelog
CVE: CVE-2021-3816
Published: 2022-01-19
Description: Cacti 1.1.38 allows authenticated users with User Management permissions to inject arbitrary HTML in the group_prefix field during the creation of a new group via "Copy" method at user_group_admin.php.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.cacti.net/info/changelog; https://www.cacti.net/info/changelog
CVE: CVE-2021-44777
Published: 2022-01-19
Description: Cross-Site Request Forgery (CSRF) vulnerabilities leading to single or bulk e-mail entries deletion discovered in Email Tracker WordPress plugin (versions <= 5.2.6).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://patchstack.com/database/vulnerability/email-tracker/wordpress-email-tracker-plugin-5-2-6-cross-site-request-forgery-csrf-vulnerabilities-leading-to-single-or-bulk-e-mail-entries-deletion; https://wordpress.org/plugins/email-tracker/#developers; https://patchstack.com/database/vulnerability/email-tracker/wordpress-email-tracker-plugin-5-2-6-cross-site-request-forgery-csrf-vulnerabilities-leading-to-single-or-bulk-e-mail-entries-deletion
CVE: CVE-2022-23045
Published: 2022-01-19
Description: PhpIPAM v1.4.4 allows an authenticated admin user to inject persistent JavaScript code inside the "Site title" parameter while updating the site settings. The "Site title" setting is injected in several locations which triggers the XSS.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://fluidattacks.com/advisories/osbourne/; https://github.com/phpipam/phpipam/releases/tag/v1.4.5; https://fluidattacks.com/advisories/osbourne/
CVE: CVE-2022-23046
Published: 2022-01-19
Description: PhpIPAM v1.4.4 allows an authenticated admin user to inject SQL sentences in the "subnet" parameter while searching a subnet via app/admin/routing/edit-bgp-mapping-search.php
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.com/files/165683/PHPIPAM-1.4.4-SQL-Injection.html; https://fluidattacks.com/advisories/mercury/; https://github.com/phpipam/phpipam/releases/tag/v1.4.5
CVE: CVE-2022-21679
Published: 2022-01-19
Description: Istio is an open platform to connect, manage, and secure microservices. In Istio 1.12.0 and 1.12.1 The authorization policy with hosts and notHosts might be accidentally bypassed for ALLOW action or rejected unexpectedly for DENY action during the upgrade from 1.11 to 1.12.0/1.12.1. Istio 1.12 supports the hosts and notHosts fields in authorization policy with a new Envoy API shipped with the 1.12 data plane. A bug in the 1.12.0 and 1.12.1 incorrectly uses the new Envoy API with the 1.11 data plane. This will cause the hosts and notHosts fields to be always matched regardless of the actual value of the host header when mixing 1.12.0/1.12.1 control plane and 1.11 data plane. Users are advised to upgrade or to not mix the 1.12.0/1.12.1 control plane with 1.11 data plane if using hosts or notHosts field in authorization policy.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-670, CWE-670
References: https://github.com/istio/istio/security/advisories/GHSA-rwfr-xrvw-2rvv; https://istio.io/latest/news/releases/1.12.x/announcing-1.12.2/; https://github.com/istio/istio/security/advisories/GHSA-rwfr-xrvw-2rvv
CVE: CVE-2022-21699
Published: 2022-01-19
Description: IPython (Interactive Python) is a command shell for interactive computing in multiple programming languages, originally developed for the Python programming language. Affected versions are subject to an arbitrary code execution vulnerability achieved by not properly managing cross user temporary files. This vulnerability allows one user to run code as another on the same machine. All users are advised to upgrade.
CVSS Score: 8.2 (HIGH)
CWE: CWE-250, CWE-279, CWE-269
References: https://github.com/ipython/ipython/commit/46a51ed69cdf41b4333943d9ceeb945c4ede5668; https://github.com/ipython/ipython/security/advisories/GHSA-pq7m-3gw7-gq5x; https://ipython.readthedocs.io/en/stable/whatsnew/version8.html#ipython-8-0-1-cve-2022-21699
CVE: CVE-2022-21701
Published: 2022-01-19
Description: Istio is an open platform to connect, manage, and secure microservices. In versions 1.12.0 and 1.12.1 Istio is vulnerable to a privilege escalation attack. Users who have `CREATE` permission for `gateways.gateway.networking.k8s.io` objects can escalate this privilege to create other resources that they may not have access to, such as `Pod`. This vulnerability impacts only an Alpha level feature, the Kubernetes Gateway API. This is not the same as the Istio Gateway type (gateways.networking.istio.io), which is not vulnerable. Users are advised to upgrade to resolve this issue. Users unable to upgrade should implement any of the following which will prevent this vulnerability: Remove the gateways.gateway.networking.k8s.io CustomResourceDefinition, set PILOT_ENABLE_GATEWAY_API_DEPLOYMENT_CONTROLLER=true environment variable in Istiod, or remove CREATE permissions for gateways.gateway.networking.k8s.io objects from untrusted users.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-863, CWE-863
References: https://github.com/istio/istio/security/advisories/GHSA-mq8f-9446-c28r; https://istio.io/latest/news/releases/1.12.x/announcing-1.12.2/; https://github.com/istio/istio/security/advisories/GHSA-mq8f-9446-c28r
CVE: CVE-2021-46025
Published: 2022-01-19
Description: A Cross SIte Scripting (XSS) vulnerability exists in OneBlog <= 2.2.8. via the add function in the operation tab list in the background.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/zhangyd-c/OneBlog/issues/27; https://github.com/zhangyd-c/OneBlog/issues/27
CVE: CVE-2021-46027
Published: 2022-01-19
Description: mysiteforme, as of 19-12-2022, has a CSRF vulnerability in the background blog management. The attacker constructs a CSRF load. Once the administrator clicks a malicious link, a blog tag will be added
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://github.com/wangl1989/mysiteforme/issues/40; https://github.com/wangl1989/mysiteforme/issues/40
CVE: CVE-2021-4143
Published: 2022-01-19
Description: Cross-site Scripting (XSS) - Generic in GitHub repository bigbluebutton/bigbluebutton prior to 2.4.0.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/bigbluebutton/bigbluebutton/commit/62040bdcb3c2f993ba72ab89f4db2015e18d1706; https://huntr.dev/bounties/e67603e6-8497-4ab6-b93a-02c26407d443; https://github.com/bigbluebutton/bigbluebutton/commit/62040bdcb3c2f993ba72ab89f4db2015e18d1706
CVE: CVE-2022-21704
Published: 2022-01-19
Description: log4js-node is a port of log4js to node.js. In affected versions default file permissions for log files created by the file, fileSync and dateFile appenders are world-readable (in unix). This could cause problems if log files contain sensitive information. This would affect any users that have not supplied their own permissions for the files via the mode parameter in the config. Users are advised to update.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-276, CWE-276
References: https://github.com/log4js-node/log4js-node/blob/v6.4.0/CHANGELOG.md#640; https://github.com/log4js-node/log4js-node/pull/1141/commits/[PII_REDACTED]a1b65adb66931fdf702ead34fa9b76; https://github.com/log4js-node/log4js-node/security/advisories/GHSA-82v2-mx6x-wq7q
CVE: CVE-2021-46026
Published: 2022-01-20
Description: mysiteforme, as of 19-12-2022, is vulnerable to Cross Site Scripting (XSS) via the add blog tag function in the blog tag in the background blog management.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/wangl1989/mysiteforme/issues/39; https://github.com/wangl1989/mysiteforme/issues/39
CVE: CVE-2021-46028
Published: 2022-01-20
Description: In mblog <= 3.5.0 there is a CSRF vulnerability in the background article management. The attacker constructs a CSRF load. Once the administrator clicks a malicious link, the article will be deleted.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://github.com/langhsu/mblog/issues/50; https://github.com/langhsu/mblog/issues/50
CVE: CVE-2021-43269
Published: 2022-01-20
Description: In Code42 app before 8.8.0, eval injection allows an attacker to change a device’s proxy configuration to use a malicious proxy auto-config (PAC) file, leading to arbitrary code execution. This affects Incydr Basic, Advanced, and Gov F1; CrashPlan Cloud; and CrashPlan for Small Business. (Incydr Professional and Enterprise are unaffected.)
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: https://support.code42.com/Terms_and_conditions/Code42_customer_support_resources/Code42_security_advisories/Arbitrary_code_execution_via_malicious_Code42_app_proxy_configuration; https://www.code42.com/r/support/CVE-2021-43269; https://support.code42.com/Terms_and_conditions/Code42_customer_support_resources/Code42_security_advisories/Arbitrary_code_execution_via_malicious_Code42_app_proxy_configuration
CVE: CVE-2022-0277
Published: 2022-01-20
Description: Incorrect Permission Assignment for Critical Resource in Packagist microweber/microweber prior to 1.2.11.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-732, CWE-732
References: https://github.com/microweber/microweber/commit/e680e134a4215c979bfd2eaf58336be34c8fc6e6; https://huntr.dev/bounties/0e776f3d-35b1-4a9e-8fe8-91e46c0d6316; https://github.com/microweber/microweber/commit/e680e134a4215c979bfd2eaf58336be34c8fc6e6
CVE: CVE-2022-0278
Published: 2022-01-20
Description: Cross-site Scripting (XSS) - Stored in Packagist microweber/microweber prior to 1.2.11.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/microweber/microweber/commit/b64ef574b82dbf89a908e1569d790c7012d1ccd7; https://huntr.dev/bounties/64495d0f-d5ec-4542-9693-32372c18d030; https://github.com/microweber/microweber/commit/b64ef574b82dbf89a908e1569d790c7012d1ccd7
CVE: CVE-2021-3866
Published: 2022-01-20
Description: Cross-site Scripting (XSS) - Stored in GitHub repository zulip/zulip more than and including 44f935695d452cc3fb16845a0c6af710438b153d and prior to 3eb2791c3e9695f7d37ffe84e0c2184fae665cb6.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://blog.zulip.com/2022/01/19/cve-2021-3866/; https://github.com/zulip/zulip/commit/3eb2791c3e9695f7d37ffe84e0c2184fae665cb6; https://huntr.dev/bounties/5f48dac5-e112-4b23-bbbf-cc00ba83bcf2
CVE: CVE-2021-45230
Published: 2022-01-20
Description: In Apache Airflow prior to 2.2.0. This CVE applies to a specific case where a User who has "can_create" permissions on DAG Runs can create Dag Runs for dags that they don't have "edit" permissions for.
CVSS Score: 6.5 (MEDIUM)
References: https://lists.apache.org/thread/m778ojn0k595rwco4ht9wjql89mjoxnl; https://lists.apache.org/thread/m778ojn0k595rwco4ht9wjql89mjoxnl
CVE: CVE-2022-0281
Published: 2022-01-20
Description: Exposure of Sensitive Information to an Unauthorized Actor in Packagist microweber/microweber prior to 1.2.11.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://github.com/microweber/microweber/commit/e680e134a4215c979bfd2eaf58336be34c8fc6e6; https://huntr.dev/bounties/315f5ac6-1b5e-4444-ad8f-802371da3505; https://github.com/microweber/microweber/commit/e680e134a4215c979bfd2eaf58336be34c8fc6e6
CVE: CVE-2022-22733
Published: 2022-01-20
Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache ShardingSphere ElasticJob-UI allows an attacker who has guest account to do privilege escalation. This issue affects Apache ShardingSphere ElasticJob-UI Apache ShardingSphere ElasticJob-UI 3.x version 3.0.0 and prior versions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200, CWE-200
References: http://www.openwall.com/lists/oss-security/2022/01/20/2; https://lists.apache.org/thread/qpdsm936n9bhksb0rzn6bq1h7ord2nm6; http://www.openwall.com/lists/oss-security/2022/01/20/2
CVE: CVE-2021-34600
Published: 2022-01-20
Description: Telenot CompasX versions prior to 32.0 use a weak seed for random number generation leading to predictable AES keys used in the NFC tags used for local authorization of users. This may lead to total loss of trustworthiness of the installation.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-335, CWE-335
References: https://www.x41-dsec.de/lab/advisories/x41-2021-003-telenot-complex-insecure-keygen/; https://www.x41-dsec.de/lab/advisories/x41-2021-003-telenot-complex-insecure-keygen/
CVE: CVE-2022-0282
Published: 2022-01-20
Description: Cross-site Scripting in Packagist microweber/microweber prior to 1.2.11.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/microweber/microweber/commit/51b5a4e3ef01e587797c0109159a8ad9d2bac77a; https://huntr.dev/bounties/8815b642-bd9b-4737-951b-bde7319faedd; https://github.com/microweber/microweber/commit/51b5a4e3ef01e587797c0109159a8ad9d2bac77a
CVE: CVE-2022-22820
Published: 2022-01-20
Description: Due to the lack of media file checks before rendering, it was possible for an attacker to cause abnormal CPU consumption for message recipient by sending specially crafted gif image in LINE for Windows before 7.4.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: https://hackerone.com/reports/1357400; https://hackerone.com/reports/1357400
CVE: CVE-2021-32039
Published: 2022-01-20
Description: Users with appropriate file access may be able to access unencrypted user credentials saved by MongoDB Extension for VS Code in a binary file. These credentials may be used by malicious attackers to perform unauthorized actions. This vulnerability affects all MongoDB Extension for VS Code including and prior to version 0.7.0
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-522, CWE-522
References: https://github.com/mongodb-js/vscode/releases/tag/v0.8.0; https://jira.mongodb.org/browse/VSCODE-313; https://github.com/mongodb-js/vscode/releases/tag/v0.8.0
CVE: CVE-2022-0285
Published: 2022-01-20
Description: Cross-site Scripting (XSS) - Stored in Packagist pimcore/pimcore prior to 10.2.9.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/pimcore/pimcore/commit/b432225952e2a5ab0268f401b85a14480369b835; https://huntr.dev/bounties/321918b2-aa01-410e-9f7c-dca5f286bc9c; https://github.com/pimcore/pimcore/commit/b432225952e2a5ab0268f401b85a14480369b835
CVE: CVE-2021-44738
Published: 2022-01-20
Description: Buffer overflow vulnerability has been identified in Lexmark devices through 2021-12-07 in postscript interpreter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://support.lexmark.com/alerts/; https://www.zerodayinitiative.com/advisories/ZDI-22-327/; https://www.zerodayinitiative.com/advisories/ZDI-22-328/
CVE: CVE-2021-44734
Published: 2022-01-20
Description: Embedded web server input sanitization vulnerability in Lexmark devices through 2021-12-07, which can which can lead to remote code execution on the device.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://support.lexmark.com/alerts/; https://www.zerodayinitiative.com/advisories/ZDI-22-332/; https://support.lexmark.com/alerts/
CVE: CVE-2021-44735
Published: 2022-01-20
Description: Embedded web server command injection vulnerability in Lexmark devices through 2021-12-07.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://support.lexmark.com/alerts/; https://www.zerodayinitiative.com/advisories/ZDI-22-326/; https://www.zerodayinitiative.com/advisories/ZDI-22-329/
CVE: CVE-2021-44736
Published: 2022-01-20
Description: The initial admin account setup wizard on Lexmark devices allow unauthenticated access to the “out of service erase” feature.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://support.lexmark.com/alerts/; https://www.zerodayinitiative.com/advisories/ZDI-22-331/; https://support.lexmark.com/alerts/