deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-36626
Published: 2022-12-27
Description: A vulnerability classified as critical has been found in Modern Tribe Panel Builder Plugin. Affected is the function add_post_content_filtered_to_search_sql of the file ModularContent/SearchFilter.php. The manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 4528d4f855dbbf24e9fc12a162fda84ce3bedc2f. It is recommended to apply a patch to fix this issue. VDB-216738 is the identifier assigned to this vulnerability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-707, CWE-79
References: https://github.com/moderntribe/panel-builder/commit/4528d4f855dbbf24e9fc12a162fda84ce3bedc2f; https://github.com/moderntribe/panel-builder/pull/173; https://vuldb.com/?id.216738
CVE: CVE-2022-4691
Published: 2022-12-27
Description: Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.0.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/usememos/memos/commit/c07b4a57caa89905e54b800f4d8fb720bbf5bf82; https://huntr.dev/bounties/459b55c1-22f5-4556-9cda-9b86aa91582f; https://github.com/usememos/memos/commit/c07b4a57caa89905e54b800f4d8fb720bbf5bf82
CVE: CVE-2022-4694
Published: 2022-12-27
Description: Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.0.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/usememos/memos/commit/65cc19c12efa392f792f6bb154b4838547e0af5e; https://huntr.dev/bounties/a4d865c2-1a2b-4e3a-aaae-915b0dfc3f22; https://github.com/usememos/memos/commit/65cc19c12efa392f792f6bb154b4838547e0af5e
CVE: CVE-2022-4695
Published: 2022-12-27
Description: Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.0.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/usememos/memos/commit/65cc19c12efa392f792f6bb154b4838547e0af5e; https://huntr.dev/bounties/2559d548-b847-40fb-94d6-18c1ad58b789; https://github.com/usememos/memos/commit/65cc19c12efa392f792f6bb154b4838547e0af5e
CVE: CVE-2022-4719
Published: 2022-12-27
Description: Business Logic Errors in GitHub repository ikus060/rdiffweb prior to 2.5.5.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-840
References: https://github.com/ikus060/rdiffweb/commit/bc4bed89affcba71251fe54ed10639da9d392c1d; https://huntr.dev/bounties/9f746881-ad42-446b-9b1d-153391eacc09; https://github.com/ikus060/rdiffweb/commit/bc4bed89affcba71251fe54ed10639da9d392c1d
CVE: CVE-2022-4720
Published: 2022-12-27
Description: Open Redirect in GitHub repository ikus060/rdiffweb prior to 2.5.5.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601, CWE-601
References: https://github.com/ikus060/rdiffweb/commit/6afaae56a29536f0118b3380d296c416aa6d078d; https://huntr.dev/bounties/339687af-6e25-4ad8-823d-c097f607ea70; https://github.com/ikus060/rdiffweb/commit/6afaae56a29536f0118b3380d296c416aa6d078d
CVE: CVE-2022-4721
Published: 2022-12-27
Description: Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in GitHub repository ikus060/rdiffweb prior to 2.5.5.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-75
References: https://github.com/ikus060/rdiffweb/commit/6afaae56a29536f0118b3380d296c416aa6d078d; https://huntr.dev/bounties/3c48ef5d-da4d-4ee4-aaca-af65e7273720; https://github.com/ikus060/rdiffweb/commit/6afaae56a29536f0118b3380d296c416aa6d078d
CVE: CVE-2022-4722
Published: 2022-12-27
Description: Authentication Bypass by Primary Weakness in GitHub repository ikus060/rdiffweb prior to 2.5.5.
CVSS Score: 7.2 (HIGH)
CWE: CWE-305, CWE-287
References: https://github.com/ikus060/rdiffweb/commit/d1aaa96b665a39fba9e98d6054a9de511ba0a837; https://huntr.dev/bounties/c62126dc-d9a6-4d3e-988d-967031876c58; https://github.com/ikus060/rdiffweb/commit/d1aaa96b665a39fba9e98d6054a9de511ba0a837
CVE: CVE-2022-4723
Published: 2022-12-27
Description: Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.5.5.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-770
References: https://github.com/ikus060/rdiffweb/commit/6e9ee210548f6d3210704cac302cfc7cdb239765; https://huntr.dev/bounties/9369681b-8bfc-4146-a54c-c5108442d92c; https://github.com/ikus060/rdiffweb/commit/6e9ee210548f6d3210704cac302cfc7cdb239765
CVE: CVE-2022-4724
Published: 2022-12-27
Description: Improper Access Control in GitHub repository ikus060/rdiffweb prior to 2.5.5.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: https://github.com/ikus060/rdiffweb/commit/c4a19cf67d575c4886171b8efcbf4675d51f3929; https://huntr.dev/bounties/e6fb1931-8d9c-4895-be4a-59839b4b6445; https://github.com/ikus060/rdiffweb/commit/c4a19cf67d575c4886171b8efcbf4675d51f3929
CVE: CVE-2022-4725
Published: 2022-12-27
Description: A vulnerability was found in AWS SDK 2.59.0. It has been rated as critical. This issue affects the function XpathUtils of the file aws-android-sdk-core/src/main/java/com/amazonaws/util/XpathUtils.java of the component XML Parser. The manipulation leads to server-side request forgery. Upgrading to version 2.59.1 is able to address this issue. The name of the patch is c3e6d69422e1f0c80fe53f2d757b8df97619af2b. It is recommended to upgrade the affected component. The identifier VDB-216737 was assigned to this vulnerability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-918
References: https://github.com/aws-amplify/aws-sdk-android/commit/c3e6d69422e1f0c80fe53f2d757b8df97619af2b; https://github.com/aws-amplify/aws-sdk-android/pull/3100; https://github.com/aws-amplify/aws-sdk-android/releases/tag/release_v2.59.1
CVE: CVE-2022-4726
Published: 2022-12-27
Description: A vulnerability classified as critical was found in SourceCodester Sanitization Management System 1.0. Affected by this vulnerability is an unknown functionality of the component Admin Login. The manipulation of the argument username/password leads to sql injection. The attack can be launched remotely. The associated identifier of this vulnerability is VDB-216739.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-707, CWE-89
References: https://vuldb.com/?id.216739; https://vuldb.com/?id.216739
CVE: CVE-2022-4727
Published: 2022-12-27
Description: A vulnerability, which was classified as problematic, was found in OpenMRS Appointment Scheduling Module up to 1.16.x. This affects the function getNotes of the file api/src/main/java/org/openmrs/module/appointmentscheduling/AppointmentRequest.java of the component Notes Handler. The manipulation of the argument notes leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 1.17.0 is able to address this issue. The name of the patch is 2ccbe39c020809765de41eeb8ee4c70b5ec49cc8. It is recommended to upgrade the affected component. The identifier VDB-216741 was assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-707, CWE-79
References: https://github.com/openmrs/openmrs-module-appointmentscheduling/commit/2ccbe39c020809765de41eeb8ee4c70b5ec49cc8; https://github.com/openmrs/openmrs-module-appointmentscheduling/pull/39; https://github.com/openmrs/openmrs-module-appointmentscheduling/releases/tag/1.17.0
CVE: CVE-2022-4728
Published: 2022-12-27
Description: A vulnerability has been found in Graphite Web and classified as problematic. This vulnerability affects unknown code of the component Cookie Handler. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 2f178f490e10efc03cd1d27c72f64ecab224eb23. It is recommended to apply a patch to fix this issue. VDB-216742 is the identifier assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-707, CWE-79
References: https://github.com/graphite-project/graphite-web/commit/2f178f490e10efc03cd1d27c72f64ecab224eb23; https://github.com/graphite-project/graphite-web/issues/2744; https://github.com/graphite-project/graphite-web/pull/2785
CVE: CVE-2022-4729
Published: 2022-12-27
Description: A vulnerability was found in Graphite Web and classified as problematic. This issue affects some unknown processing of the component Template Name Handler. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 2f178f490e10efc03cd1d27c72f64ecab224eb23. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-216743.
CVSS Score: 3.5 (LOW)
CWE: CWE-707, CWE-79
References: https://github.com/graphite-project/graphite-web/commit/2f178f490e10efc03cd1d27c72f64ecab224eb23; https://github.com/graphite-project/graphite-web/issues/2745; https://github.com/graphite-project/graphite-web/pull/2785
CVE: CVE-2022-4730
Published: 2022-12-27
Description: A vulnerability was found in Graphite Web. It has been classified as problematic. Affected is an unknown function of the component Absolute Time Range Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 2f178f490e10efc03cd1d27c72f64ecab224eb23. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-216744.
CVSS Score: 3.5 (LOW)
CWE: CWE-707, CWE-79
References: https://github.com/graphite-project/graphite-web/commit/2f178f490e10efc03cd1d27c72f64ecab224eb23; https://github.com/graphite-project/graphite-web/issues/2746; https://github.com/graphite-project/graphite-web/pull/2785
CVE: CVE-2022-4732
Published: 2022-12-27
Description: Unrestricted Upload of File with Dangerous Type in GitHub repository microweber/microweber prior to 1.3.2.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: https://github.com/microweber/microweber/commit/0d279ac81052ce7ee97c18c811a9b8e912189da0; https://huntr.dev/bounties/d5be2e96-1f2f-4357-a385-e184cf0119aa; https://github.com/microweber/microweber/commit/0d279ac81052ce7ee97c18c811a9b8e912189da0
CVE: CVE-2022-4733
Published: 2022-12-27
Description: Cross-site Scripting (XSS) - Stored in GitHub repository openemr/openemr prior to 7.0.0.2.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/openemr/openemr/commit/4565d8d1eb80c6aa42cf6b1810ba0a64e0f6abde; https://huntr.dev/bounties/f353adfb-e5b8-43e7-957a-894670fd4ccd; https://github.com/openemr/openemr/commit/4565d8d1eb80c6aa42cf6b1810ba0a64e0f6abde
CVE: CVE-2022-4734
Published: 2022-12-27
Description: Improper Removal of Sensitive Information Before Storage or Transfer in GitHub repository usememos/memos prior to 0.9.1.


CVSS Score: 8.1 (HIGH)
CWE: CWE-212, CWE-212
References: https://github.com/usememos/memos/commit/05b41804e33a34102f1f75bb2d69195dda6a1210; https://huntr.dev/bounties/4b4421dc-73af-4dec-884c-836f9732cb5b; https://github.com/usememos/memos/commit/05b41804e33a34102f1f75bb2d69195dda6a1210
CVE: CVE-2022-4767
Published: 2022-12-27
Description: Denial of Service in GitHub repository usememos/memos prior to 0.9.1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-400
References: https://github.com/usememos/memos/commit/f888c628408501daf639de07b90a72ab443b0f4c; https://huntr.dev/bounties/75b4a085-923c-4ecc-bbf6-e049290db502; https://github.com/usememos/memos/commit/f888c628408501daf639de07b90a72ab443b0f4c
CVE: CVE-2022-45423
Published: 2022-12-27
Description: Some Dahua software products have a vulnerability of unauthenticated request of MQTT credentials. An attacker can obtain encrypted MQTT credentials by sending a specific crafted packet to the vulnerable interface (the credentials cannot be directly exploited).
CVSS Score: 7.5 (HIGH)
CWE: CWE-306, CWE-306
References: https://www.dahuasecurity.com/support/cybersecurity/details/1137; https://www.dahuasecurity.com/support/cybersecurity/details/1137
CVE: CVE-2022-45424
Published: 2022-12-27
Description: Some Dahua software products have a vulnerability of unauthenticated request of AES crypto key. An attacker can obtain the AES crypto key by sending a specific crafted packet to the vulnerable interface.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-306, CWE-306
References: https://www.dahuasecurity.com/support/cybersecurity/details/1137; https://www.dahuasecurity.com/support/cybersecurity/details/1137
CVE: CVE-2022-45425
Published: 2022-12-27
Description: Some Dahua software products have a vulnerability of using of hard-coded cryptographic key. An attacker can obtain the AES crypto key by exploiting this vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-798, CWE-798
References: https://www.dahuasecurity.com/support/cybersecurity/details/1137; https://www.dahuasecurity.com/support/cybersecurity/details/1137
CVE: CVE-2022-45426
Published: 2022-12-27
Description: Some Dahua software products have a vulnerability of unrestricted download of file. After obtaining the permissions of ordinary users, by sending a specific crafted packet to the vulnerable interface, an attacker can download arbitrary files.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-552, CWE-552
References: https://www.dahuasecurity.com/support/cybersecurity/details/1137; https://www.dahuasecurity.com/support/cybersecurity/details/1137
CVE: CVE-2022-45427
Published: 2022-12-27
Description: Some Dahua software products have a vulnerability of unrestricted upload of file. After obtaining the permissions of administrators, by sending a specific crafted packet to the vulnerable interface, an attacker can upload arbitrary files.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434, CWE-434
References: https://www.dahuasecurity.com/support/cybersecurity/details/1137; https://www.dahuasecurity.com/support/cybersecurity/details/1137
CVE: CVE-2022-45428
Published: 2022-12-27
Description: Some Dahua software products have a vulnerability of sensitive information leakage. After obtaining the permissions of administrators, by sending a specific crafted packet to the vulnerable interface, an attacker can obtain the debugging information.
CVSS Score: 2.7 (LOW)
CWE: CWE-201
References: https://www.dahuasecurity.com/support/cybersecurity/details/1137; https://www.dahuasecurity.com/support/cybersecurity/details/1137
CVE: CVE-2022-45429
Published: 2022-12-27
Description: Some Dahua software products have a vulnerability of server-side request forgery (SSRF). An Attacker can access internal resources by concatenating links (URL) that conform to specific rules.
CVSS Score: 7.5 (HIGH)
CWE: CWE-918, CWE-918
References: https://www.dahuasecurity.com/support/cybersecurity/details/1137; https://www.dahuasecurity.com/support/cybersecurity/details/1137
CVE: CVE-2022-45430
Published: 2022-12-27
Description: Some Dahua software products have a vulnerability of unauthenticated enable or disable SSHD service. After bypassing the firewall access control policy, by sending a specific crafted packet to the vulnerable interface, an attacker could enable or disable the SSHD service.
CVSS Score: 3.7 (LOW)
CWE: CWE-284
References: https://www.dahuasecurity.com/support/cybersecurity/details/1137; https://www.dahuasecurity.com/support/cybersecurity/details/1137
CVE: CVE-2022-45431
Published: 2022-12-27
Description: Some Dahua software products have a vulnerability of unauthenticated restart of remote DSS Server. After bypassing the firewall access control policy, by sending a specific crafted packet to the vulnerable interface, an attacker could unauthenticated restart of remote DSS Server.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://www.dahuasecurity.com/support/cybersecurity/details/1137; https://www.dahuasecurity.com/support/cybersecurity/details/1137
CVE: CVE-2022-45432
Published: 2022-12-27
Description: Some Dahua software products have a vulnerability of unauthenticated search for devices. After bypassing the firewall access control policy, by sending a specific crafted packet to the vulnerable interface, an attacker could unauthenticated search for devices in range of IPs from remote DSS Server.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-306
References: https://www.dahuasecurity.com/support/cybersecurity/details/1137; https://www.dahuasecurity.com/support/cybersecurity/details/1137
CVE: CVE-2022-45433
Published: 2022-12-27
Description: Some Dahua software products have a vulnerability of unauthenticated traceroute host from remote DSS Server. After bypassing the firewall access control policy, by sending a specific crafted packet to the vulnerable interface, an attacker could get the traceroute results.
CVSS Score: 3.7 (LOW)
CWE: CWE-306
References: https://www.dahuasecurity.com/support/cybersecurity/details/1137; https://www.dahuasecurity.com/support/cybersecurity/details/1137
CVE: CVE-2022-45434
Published: 2022-12-27
Description: Some Dahua software products have a vulnerability of unauthenticated un-throttled ICMP requests on remote DSS Server. After bypassing the firewall access control policy, by sending a specific crafted packet to the vulnerable interface, an attacker could exploit the victim server to launch ICMP request attack to the designated target host.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-770
References: https://www.dahuasecurity.com/support/cybersecurity/details/1137; https://www.dahuasecurity.com/support/cybersecurity/details/1137
CVE: CVE-2022-47968
Published: 2022-12-27
Description: Heimdall Application Dashboard through 2.5.4 allows reflected and stored XSS via "Application name" to the "Add application" page. The stored XSS will be triggered in the "Application list" page.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/linuxserver/Heimdall/issues/1086; https://samy.link/blog; https://github.com/linuxserver/Heimdall/issues/1086
CVE: CVE-2022-3156
Published: 2022-12-27
Description: A remote code execution vulnerability exists in Rockwell Automation Studio 5000 Logix Emulate software.  Users are granted elevated permissions on certain product services when the software is installed. Due to 
this misconfiguration, a malicious user could potentially achieve remote code execution on the targeted software.

 



CVSS Score: 7.8 (HIGH)
CWE: CWE-287, CWE-287
References: https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1137846; https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1137846
CVE: CVE-2020-36567
Published: 2022-12-27
Description: Unsanitized input in the default logger in github.com/gin-gonic/gin before v1.6.0 allows remote attackers to inject arbitrary log lines.
CVSS Score: 7.5 (HIGH)
CWE: CWE-116
References: https://github.com/gin-gonic/gin/commit/a71af9c144f9579f6dbe945341c1df37aaf09c0d; https://github.com/gin-gonic/gin/pull/2237; https://pkg.go.dev/vuln/GO-2020-0001
CVE: CVE-2013-10005
Published: 2022-12-27
Description: The RemoteAddr and LocalAddr methods on the returned net.Conn may call themselves, leading to an infinite loop which will crash the program due to a stack overflow.
CVSS Score: 7.5 (HIGH)
CWE: CWE-835
References: https://github.com/btcsuite/go-socks/commit/233bccbb1abe02f05750f7ace66f5bffdb13defc; https://pkg.go.dev/vuln/GO-2020-0024; https://github.com/btcsuite/go-socks/commit/233bccbb1abe02f05750f7ace66f5bffdb13defc
CVE: CVE-2014-125026
Published: 2022-12-27
Description: LZ4 bindings use a deprecated C API that is vulnerable to memory corruption, which could lead to arbitrary code execution if called with untrusted user input.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://github.com/cloudflare/golz4/commit/199f5f7878062ca17a98e079f2dbe1205e2ed898; https://github.com/cloudflare/golz4/issues/5; https://pkg.go.dev/vuln/GO-2020-0022
CVE: CVE-2015-10004
Published: 2022-12-27
Description: Token validation methods are susceptible to a timing side-channel during HMAC comparison. With a large enough number of requests over a low latency connection, an attacker may use this to determine the expected HMAC.
CVSS Score: 7.5 (HIGH)
CWE: CWE-668
References: https://github.com/robbert229/jwt/commit/ca1404ee6e83fcbafb66b09ed0d543850a15b654; https://github.com/robbert229/jwt/issues/12; https://pkg.go.dev/vuln/GO-2020-0023
CVE: CVE-2016-15005
Published: 2022-12-27
Description: CSRF tokens are generated using math/rand, which is not a cryptographically secure random number generator, allowing an attacker to predict values and bypass CSRF protections with relatively few requests.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/dinever/golf/commit/3776f338be48b5bc5e8cf9faff7851fc52a3f1fe; https://github.com/dinever/golf/issues/20; https://github.com/dinever/golf/pull/24
CVE: CVE-2017-20146
Published: 2022-12-27
Description: Usage of the CORS handler may apply improper CORS headers, allowing the requester to explicitly control the value of the Access-Control-Allow-Origin header, which bypasses the expected behavior of the Same Origin Policy.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-346
References: https://github.com/gorilla/handlers/commit/90663712d74cb411cbef281bc1e08c19d1a76145; https://github.com/gorilla/handlers/pull/116; https://pkg.go.dev/vuln/GO-2020-0020
CVE: CVE-2018-25046
Published: 2022-12-27
Description: Due to improper path sanitization, archives containing relative file paths can cause files to be written (or overwritten) outside of the target directory.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-22
References: https://github.com/cloudfoundry/archiver/commit/09b5706aa9367972c09144a450bb4523049ee840; https://pkg.go.dev/vuln/GO-2020-0025; https://snyk.io/research/zip-slip-vulnerability
CVE: CVE-2019-25072
Published: 2022-12-27
Description: Due to support of Gzip compression in request bodies, as well as a lack of limiting response body sizes, a malicious server can cause a client to consume a significant amount of system resources, which may be used as a denial of service vector.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://github.com/tendermint/tendermint/commit/03085c2da23b179c4a51f59a03cb40aa4e85a613; https://github.com/tendermint/tendermint/pull/3430; https://pkg.go.dev/vuln/GO-2020-0037
CVE: CVE-2019-25073
Published: 2022-12-27
Description: Improper path sanitization in github.com/goadesign/goa before v3.0.9, v2.0.10, or v1.4.3 allow remote attackers to read files outside of the intended directory.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://github.com/goadesign/goa/commit/70b5a199d0f813d[PII_REDACTED]2c424e1fc73fb39; https://github.com/goadesign/goa/pull/2388; https://pkg.go.dev/vuln/GO-2020-0032
CVE: CVE-2020-36559
Published: 2022-12-27
Description: Due to improper sanitization of user input, HTTPEngine.Handle allows for directory traversal, allowing an attacker to read files outside of the target directory that the server has permission to read.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://github.com/go-aah/aah/commit/881dc9f71d1f7a4e8a9a39df9c5c081d3a2da1ec; https://github.com/go-aah/aah/issues/266; https://github.com/go-aah/aah/pull/267
CVE: CVE-2020-36560
Published: 2022-12-27
Description: Due to improper path sanitization, archives containing relative file paths can cause files to be written (or overwritten) outside of the target directory.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-22
References: https://github.com/artdarek/go-unzip/commit/4975cbe0a719dc50b12da8585f1f207c82f7dfe0; https://github.com/artdarek/go-unzip/pull/2; https://pkg.go.dev/vuln/GO-2020-0034
CVE: CVE-2020-36561
Published: 2022-12-27
Description: Due to improper path sanitization, archives containing relative file paths can cause files to be written (or overwritten) outside of the target directory.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-22
References: https://github.com/yi-ge/unzip/commit/2adbaa4891b9690853ef[PII_REDACTED]f5ad7dc73; https://github.com/yi-ge/unzip/pull/1; https://pkg.go.dev/vuln/GO-2020-0035
CVE: CVE-2020-36564
Published: 2022-12-27
Description: Due to improper validation of caller input, validation is silently disabled if the provided expected token is malformed, causing any user supplied token to be considered valid.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://github.com/justinas/nosurf/commit/4d86df7a4affa1fa50ab39fb09aac56c3ce9c314; https://github.com/justinas/nosurf/pull/60; https://pkg.go.dev/vuln/GO-2020-0049