deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-40290
Published: 2022-10-31
Description: 
The application was vulnerable to an unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability in the barcode generation functionality, allowing attackers to generate an unsafe link that could compromise users.


CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.themissinglink.com.au/security-advisories/cve-2022-40290; https://www.themissinglink.com.au/security-advisories/cve-2022-40290
CVE: CVE-2022-40291
Published: 2022-10-31
Description: 
The application was vulnerable to Cross-Site Request Forgery (CSRF) attacks, allowing an attacker to coerce users into sending malicious requests to the site to delete their account, or in rare circumstances, hijack their account and create other admin accounts.


CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://www.themissinglink.com.au/security-advisories/cve-2022-40291; https://www.themissinglink.com.au/security-advisories/cve-2022-40291
CVE: CVE-2022-40292
Published: 2022-10-31
Description: 
The application allowed for Unauthenticated User Enumeration by interacting with an unsecured endpoint to retrieve information on each account within the system.


CVSS Score: 5.3 (MEDIUM)
CWE: CWE-209, CWE-209
References: https://www.themissinglink.com.au/security-advisories/cve-2022-40292; https://www.themissinglink.com.au/security-advisories/cve-2022-40292
CVE: CVE-2022-40293
Published: 2022-10-31
Description: 
The application was vulnerable to a session fixation that could be used hijack accounts.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-384, CWE-384
References: https://www.themissinglink.com.au/security-advisories/cve-2022-40293; https://www.themissinglink.com.au/security-advisories/cve-2022-40293
CVE: CVE-2022-40294
Published: 2022-10-31
Description: 
The application was identified to have an CSV injection in data export functionality, allowing for malicious code to be embedded within export data and then triggered in exported data viewers.


CVSS Score: 8.8 (HIGH)
CWE: CWE-1236, CWE-1236
References: https://www.themissinglink.com.au/security-advisories/cve-2022-40294; https://www.themissinglink.com.au/security-advisories/cve-2022-40294
CVE: CVE-2022-40295
Published: 2022-10-31
Description: The application was vulnerable to an authenticated information disclosure, allowing administrators to view unsalted user passwords, which could lead to the compromise of plaintext passwords via offline attacks.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-916, CWE-311
References: https://www.themissinglink.com.au/security-advisories/cve-2022-40295; https://www.themissinglink.com.au/security-advisories/cve-2022-40295
CVE: CVE-2022-40296
Published: 2022-10-31
Description: 
The application was vulnerable to a Server-Side Request Forgery attacks, allowing the backend server to interact with unexpected endpoints, potentially including internal and local services, leading to attacks in other downstream systems.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-918, CWE-918, CWE-918
References: https://www.themissinglink.com.au/security-advisories/cve-2022-40296; https://www.themissinglink.com.au/security-advisories/cve-2022-40296
CVE: CVE-2022-43752
Published: 2022-10-31
Description: Oracle Solaris version 10 1/13, when using the Common Desktop Environment (CDE), is vulnerable to a privilege escalation vulnerability. A low privileged user can escalate to root by crafting a malicious printer and double clicking on the the crafted printer's icon.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120, CWE-120
References: http://phrack.org/issues/70/13.html#article; https://github.com/0xdea/exploits/blob/master/solaris/raptor_dtprintcheckdir_intel.c; http://phrack.org/issues/70/13.html#article
CVE: CVE-2021-27784
Published: 2022-10-31
Description: The provided HCL Launch Container images contain non-unique HTTPS certificates and a database encryption key. The fix provides directions and tools to replace the non-unique keys and certificates. This does not affect the standard installer packages.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-327, CWE-327
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0101093; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0101093
CVE: CVE-2022-43353
Published: 2022-11-01
Description: Sanitization Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/?page=orders/view_order.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/daytime888/bug_report/blob/main/vendors/oretnom23/sanitization-management-system/SQLi-1.md; https://github.com/daytime888/bug_report/blob/main/vendors/oretnom23/sanitization-management-system/SQLi-1.md
CVE: CVE-2022-43354
Published: 2022-11-01
Description: Sanitization Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/?page=orders/manage_request.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/daytime888/bug_report/blob/main/vendors/oretnom23/sanitization-management-system/SQLi-2.md; https://github.com/daytime888/bug_report/blob/main/vendors/oretnom23/sanitization-management-system/SQLi-2.md
CVE: CVE-2022-43355
Published: 2022-11-01
Description: Sanitization Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /php-sms/classes/Master.php?f=delete_service.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/daytime888/bug_report/blob/main/vendors/oretnom23/sanitization-management-system/SQLi-3.md; https://github.com/daytime888/bug_report/blob/main/vendors/oretnom23/sanitization-management-system/SQLi-3.md
CVE: CVE-2022-44542
Published: 2022-11-01
Description: lesspipe before 2.06 allows attackers to execute code via Perl Storable (pst) files, because of deserialized object destructor execution via a key/value pair in a hash.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502, CWE-502
References: https://bugs.gentoo.org/865631; https://github.com/wofr06/lesspipe/releases/tag/v2.06; https://security.gentoo.org/glsa/202211-02
CVE: CVE-2022-2572
Published: 2022-11-01
Description: In affected versions of Octopus Server where access is managed by an external authentication provider, it was possible that the API key/keys of a disabled/deleted user were still valid after the access was revoked.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287, CWE-287
References: https://advisories.octopus.com/post/2022/sa2022-23/; https://advisories.octopus.com/post/2022/sa2022-23/
CVE: CVE-2020-36605
Published: 2022-11-01
Description: Incorrect Default Permissions vulnerability in Hitachi Infrastructure Analytics Advisor on Linux (Analytics probe component), Hitachi Ops Center Analyzer on Linux (Analyzer probe component), Hitachi Ops Center Viewpoint on Linux (Viewpoint RAID Agent component) allows local users to read and write specific files.



This issue affects Hitachi Infrastructure Analytics Advisor: from 2.0.0-00 through 4.4.0-00; Hitachi Ops Center Analyzer: from 10.0.0-00 before 10.9.0-00; Hitachi Ops Center Viewpoint: from 10.8.0-00 before 10.9.0-00.

CVSS Score: 6.6 (MEDIUM)
CWE: CWE-276, CWE-276
References: https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2022-134/index.html; https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2022-134/index.html
CVE: CVE-2022-3191
Published: 2022-11-01
Description: Insertion of Sensitive Information into Log File vulnerability in Hitachi Ops Center Analyzer on Linux (Virtual Strage Software Agent component) allows local users to gain sensitive information.
This issue affects Hitachi Ops Center Analyzer: from 10.8.1-00 before 10.9.0-00

CVSS Score: 6.6 (MEDIUM)
CWE: CWE-532, CWE-532
References: https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2022-134/index.html; https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2022-134/index.html
CVE: CVE-2022-3370
Published: 2022-11-01
Description: Use after free in Custom Elements in Google Chrome prior to 106.0.5249.91 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2022/09/stable-channel-update-for-desktop_30.html; https://crbug.com/1366813; https://chromereleases.googleblog.com/2022/09/stable-channel-update-for-desktop_30.html
CVE: CVE-2022-3373
Published: 2022-11-01
Description: Out of bounds write in V8 in Google Chrome prior to 106.0.5249.91 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://chromereleases.googleblog.com/2022/09/stable-channel-update-for-desktop_30.html; https://crbug.com/1366399; https://chromereleases.googleblog.com/2022/09/stable-channel-update-for-desktop_30.html
CVE: CVE-2022-41552
Published: 2022-11-01
Description: Server-Side Request Forgery (SSRF) vulnerability in Hitachi Infrastructure Analytics Advisor on Linux (Data Center Analytics, Analytics probe components), Hitachi Ops Center Analyzer on Linux (Hitachi Ops Center Analyzer detail view, Hitachi Ops Center Analyzer probe components) allows Server Side Request Forgery.
This issue affects Hitachi Infrastructure Analytics Advisor: from 2.0.0-00 through 4.4.0-00; Hitachi Ops Center Analyzer: from 10.0.0-00 before 10.9.0-00.

CVSS Score: 9.8 (CRITICAL)
CWE: CWE-918, CWE-918
References: https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2022-134/index.html; https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2022-134/index.html
CVE: CVE-2022-41553
Published: 2022-11-01
Description: Insertion of Sensitive Information into Temporary File vulnerability in Hitachi Infrastructure Analytics Advisor on Linux (Analytics probe component), Hitachi Ops Center Analyzer on Linux (Hitachi Ops Center Analyzer probe component) allows local users to gain sensitive information.
This issue affects Hitachi Infrastructure Analytics Advisor: from 2.0.0-00 through 4.4.0-00; Hitachi Ops Center Analyzer: from 10.0.0-00 before 10.9.0-00.

CVSS Score: 6.5 (MEDIUM)
CWE: CWE-532, CWE-532
References: https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2022-134/index.html; https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2022-134/index.html
CVE: CVE-2022-25885
Published: 2022-11-01
Description: The package muhammara before 2.6.0; all versions of package hummus are vulnerable to Denial of Service (DoS) when PDFStreamForResponse() is used with invalid data.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://github.com/galkahana/HummusJS/issues/439; https://github.com/julianhille/MuhammaraJS/commit/0a6427eec82ef2978995e453de2dc0d6224dd46c; https://github.com/julianhille/MuhammaraJS/issues/188
CVE: CVE-2022-25892
Published: 2022-11-01
Description: The package muhammara before 2.6.1, from 3.0.0 and before 3.1.1; all versions of package hummus are vulnerable to Denial of Service (DoS) when supplied with a maliciously crafted PDF file to be parsed.
CVSS Score: 7.5 (HIGH)
References: https://github.com/galkahana/HummusJS/issues/463; https://github.com/julianhille/MuhammaraJS/commit/1890fb555eaf171db79b73fdc3ea543bbd63c002; https://github.com/julianhille/MuhammaraJS/commit/90b278d09f16062d93a4160ef0a54d449d739c51
CVE: CVE-2022-3369
Published: 2022-11-01
Description: An Improper Access Control vulnerability in the bdservicehost.exe component, as used in Bitdefender Engines for Windows, allows an attacker to delete privileged registry keys by pointing a Registry symlink to a privileged key. This issue affects: Bitdefender Engines versions prior to 7.92659. It also affects Bitdefender Antivirus Free, Bitdefender Antivirus Plus, Bitdefender Internet Security, Bitdefender Total Security, as well as Bitdefender Endpoint Security Tools for Windows with engine versions prior to 7.92659.
CVSS Score: 8.6 (HIGH)
CWE: CWE-269, CWE-269
References: https://www.bitdefender.com/support/security-advisories/improper-handling-of-registry-symbolic-links-in-bitdefender-engines-va-10562; https://www.bitdefender.com/support/security-advisories/improper-handling-of-registry-symbolic-links-in-bitdefender-engines-va-10562
CVE: CVE-2022-42252
Published: 2022-11-01
Description: If Apache Tomcat 8.5.0 to 8.5.82, 9.0.0-M1 to 9.0.67, 10.0.0-M1 to 10.0.26 or 10.1.0-M1 to 10.1.0 was configured to ignore invalid HTTP headers via setting rejectIllegalHeader to false (the default for 8.5.x only), Tomcat did not reject a request containing an invalid Content-Length header making a request smuggling attack possible if Tomcat was located behind a reverse proxy that also failed to reject the request with the invalid header.
CVSS Score: 7.5 (HIGH)
CWE: CWE-444, CWE-444, CWE-444
References: https://lists.apache.org/thread/zzcxzvqfdqn515zfs3dxb7n8gty589sq; https://security.gentoo.org/glsa/202305-37; https://lists.apache.org/thread/zzcxzvqfdqn515zfs3dxb7n8gty589sq
CVE: CVE-2022-42309
Published: 2022-11-01
Description: Xenstore: Guests can crash xenstored Due to a bug in the fix of XSA-115 a malicious guest can cause xenstored to use a wrong pointer during node creation in an error path, resulting in a crash of xenstored or a memory corruption in xenstored causing further damage. Entering the error path can be controlled by the guest e.g. by exceeding the quota value of maximum nodes per domain.
CVSS Score: 8.8 (HIGH)
CWE: CWE-763
References: http://www.openwall.com/lists/oss-security/2022/11/01/4; http://xenbits.xen.org/xsa/advisory-414.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YTMITQBGC23MSDHUCAPCVGLMVXIBXQTQ/
CVE: CVE-2022-42310
Published: 2022-11-01
Description: Xenstore: Guests can create orphaned Xenstore nodes By creating multiple nodes inside a transaction resulting in an error, a malicious guest can create orphaned nodes in the Xenstore data base, as the cleanup after the error will not remove all nodes already created. When the transaction is committed after this situation, nodes without a valid parent can be made permanent in the data base.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-459
References: http://www.openwall.com/lists/oss-security/2022/11/01/5; http://xenbits.xen.org/xsa/advisory-415.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YTMITQBGC23MSDHUCAPCVGLMVXIBXQTQ/
CVE: CVE-2022-42311
Published: 2022-11-01
Description: Xenstore: guests can let run xenstored out of memory T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Malicious guests can cause xenstored to allocate vast amounts of memory, eventually resulting in a Denial of Service (DoS) of xenstored. There are multiple ways how guests can cause large memory allocations in xenstored: - - by issuing new requests to xenstored without reading the responses, causing the responses to be buffered in memory - - by causing large number of watch events to be generated via setting up multiple xenstore watches and then e.g. deleting many xenstore nodes below the watched path - - by creating as many nodes as allowed with the maximum allowed size and path length in as many transactions as possible - - by accessing many nodes inside a transaction
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-770, CWE-770
References: http://xenbits.xen.org/xsa/advisory-326.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YTMITQBGC23MSDHUCAPCVGLMVXIBXQTQ/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YZVXG7OOOXCX6VIPEMLFDPIPUTFAYWPE/
CVE: CVE-2022-42312
Published: 2022-11-01
Description: Xenstore: guests can let run xenstored out of memory T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Malicious guests can cause xenstored to allocate vast amounts of memory, eventually resulting in a Denial of Service (DoS) of xenstored. There are multiple ways how guests can cause large memory allocations in xenstored: - - by issuing new requests to xenstored without reading the responses, causing the responses to be buffered in memory - - by causing large number of watch events to be generated via setting up multiple xenstore watches and then e.g. deleting many xenstore nodes below the watched path - - by creating as many nodes as allowed with the maximum allowed size and path length in as many transactions as possible - - by accessing many nodes inside a transaction
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-770, CWE-770
References: http://xenbits.xen.org/xsa/advisory-326.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YTMITQBGC23MSDHUCAPCVGLMVXIBXQTQ/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YZVXG7OOOXCX6VIPEMLFDPIPUTFAYWPE/
CVE: CVE-2022-42313
Published: 2022-11-01
Description: Xenstore: guests can let run xenstored out of memory T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Malicious guests can cause xenstored to allocate vast amounts of memory, eventually resulting in a Denial of Service (DoS) of xenstored. There are multiple ways how guests can cause large memory allocations in xenstored: - - by issuing new requests to xenstored without reading the responses, causing the responses to be buffered in memory - - by causing large number of watch events to be generated via setting up multiple xenstore watches and then e.g. deleting many xenstore nodes below the watched path - - by creating as many nodes as allowed with the maximum allowed size and path length in as many transactions as possible - - by accessing many nodes inside a transaction
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-770, CWE-770
References: http://xenbits.xen.org/xsa/advisory-326.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YTMITQBGC23MSDHUCAPCVGLMVXIBXQTQ/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YZVXG7OOOXCX6VIPEMLFDPIPUTFAYWPE/
CVE: CVE-2022-42314
Published: 2022-11-01
Description: Xenstore: guests can let run xenstored out of memory T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Malicious guests can cause xenstored to allocate vast amounts of memory, eventually resulting in a Denial of Service (DoS) of xenstored. There are multiple ways how guests can cause large memory allocations in xenstored: - - by issuing new requests to xenstored without reading the responses, causing the responses to be buffered in memory - - by causing large number of watch events to be generated via setting up multiple xenstore watches and then e.g. deleting many xenstore nodes below the watched path - - by creating as many nodes as allowed with the maximum allowed size and path length in as many transactions as possible - - by accessing many nodes inside a transaction
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-770, CWE-770
References: http://xenbits.xen.org/xsa/advisory-326.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YTMITQBGC23MSDHUCAPCVGLMVXIBXQTQ/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YZVXG7OOOXCX6VIPEMLFDPIPUTFAYWPE/
CVE: CVE-2022-42315
Published: 2022-11-01
Description: Xenstore: guests can let run xenstored out of memory T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Malicious guests can cause xenstored to allocate vast amounts of memory, eventually resulting in a Denial of Service (DoS) of xenstored. There are multiple ways how guests can cause large memory allocations in xenstored: - - by issuing new requests to xenstored without reading the responses, causing the responses to be buffered in memory - - by causing large number of watch events to be generated via setting up multiple xenstore watches and then e.g. deleting many xenstore nodes below the watched path - - by creating as many nodes as allowed with the maximum allowed size and path length in as many transactions as possible - - by accessing many nodes inside a transaction
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-770, CWE-770
References: http://xenbits.xen.org/xsa/advisory-326.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YTMITQBGC23MSDHUCAPCVGLMVXIBXQTQ/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YZVXG7OOOXCX6VIPEMLFDPIPUTFAYWPE/
CVE: CVE-2022-42316
Published: 2022-11-01
Description: Xenstore: guests can let run xenstored out of memory T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Malicious guests can cause xenstored to allocate vast amounts of memory, eventually resulting in a Denial of Service (DoS) of xenstored. There are multiple ways how guests can cause large memory allocations in xenstored: - - by issuing new requests to xenstored without reading the responses, causing the responses to be buffered in memory - - by causing large number of watch events to be generated via setting up multiple xenstore watches and then e.g. deleting many xenstore nodes below the watched path - - by creating as many nodes as allowed with the maximum allowed size and path length in as many transactions as possible - - by accessing many nodes inside a transaction
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-770, CWE-770
References: http://xenbits.xen.org/xsa/advisory-326.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YTMITQBGC23MSDHUCAPCVGLMVXIBXQTQ/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YZVXG7OOOXCX6VIPEMLFDPIPUTFAYWPE/
CVE: CVE-2022-42317
Published: 2022-11-01
Description: Xenstore: guests can let run xenstored out of memory T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Malicious guests can cause xenstored to allocate vast amounts of memory, eventually resulting in a Denial of Service (DoS) of xenstored. There are multiple ways how guests can cause large memory allocations in xenstored: - - by issuing new requests to xenstored without reading the responses, causing the responses to be buffered in memory - - by causing large number of watch events to be generated via setting up multiple xenstore watches and then e.g. deleting many xenstore nodes below the watched path - - by creating as many nodes as allowed with the maximum allowed size and path length in as many transactions as possible - - by accessing many nodes inside a transaction
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-770, CWE-770
References: http://xenbits.xen.org/xsa/advisory-326.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YTMITQBGC23MSDHUCAPCVGLMVXIBXQTQ/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YZVXG7OOOXCX6VIPEMLFDPIPUTFAYWPE/