deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-29046
Published: 2022-04-12
Description: Jenkins Subversion Plugin 2.15.3 and earlier does not escape the name and description of List Subversion tags (and more) parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://seclists.org/fulldisclosure/2022/Jul/18; https://support.apple.com/kb/HT213345; https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-2617
CVE: CVE-2022-29047
Published: 2022-04-12
Description: Jenkins Pipeline: Shared Groovy Libraries Plugin 564.ve62a_4eb_b_e039 and earlier, except 2.21.3, allows attackers able to submit pull requests (or equivalent), but not able to commit directly to the configured SCM, to effectively change the Pipeline behavior by changing the definition of a dynamically retrieved library in their pull request, even if the Pipeline is configured to not trust them.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-863
References: https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-1951; https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-1951
CVE: CVE-2022-29048
Published: 2022-04-12
Description: A cross-site request forgery (CSRF) vulnerability in Jenkins Subversion Plugin 2.15.3 and earlier allows attackers to connect to an attacker-specified URL.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: http://seclists.org/fulldisclosure/2022/Jul/18; https://support.apple.com/kb/HT213345; https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-2075
CVE: CVE-2022-29049
Published: 2022-04-12
Description: Jenkins promoted builds Plugin 873.v6149db_d64130 and earlier, except 3.10.1, does not validate the names of promotions defined in Job DSL, allowing attackers with Job/Configure permission to create a promotion with an unsafe name.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-2655; https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-2655
CVE: CVE-2022-29050
Published: 2022-04-12
Description: A cross-site request forgery (CSRF) vulnerability in Jenkins Publish Over FTP Plugin 1.16 and earlier allows attackers to connect to an FTP server using attacker-specified credentials.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-2321; https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-2321
CVE: CVE-2022-29051
Published: 2022-04-12
Description: Missing permission checks in Jenkins Publish Over FTP Plugin 1.16 and earlier allow attackers with Overall/Read permission to connect to an FTP server using attacker-specified credentials.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-2321; https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-2321
CVE: CVE-2022-29052
Published: 2022-04-12
Description: Jenkins Google Compute Engine Plugin 4.3.8 and earlier stores private keys unencrypted in cloud agent config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission, or access to the Jenkins controller file system.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-522
References: https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-2045; https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-2045
CVE: CVE-2022-0436
Published: 2022-04-12
Description: Path Traversal in GitHub repository gruntjs/grunt prior to 1.5.2.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-22
References: https://github.com/gruntjs/grunt/commit/aad3d4521c3098fb255fb2db8f2e1d691a033665; https://huntr.dev/bounties/f55315e9-9f6d-4dbb-8c40-bae50c1ae92b; https://lists.debian.org/debian-lts-announce/2023/04/msg00008.html
CVE: CVE-2022-1330
Published: 2022-04-12
Description: stored xss due to unsantized anchor url in GitHub repository alvarotrigo/fullpage.js prior to 4.0.4. stored xss .
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/alvarotrigo/fullpage.js/commit/e7a5db42711700c8a584e61b5e532a64039fe92b; https://huntr.dev/bounties/08d2a6d0-772f-4b05-834e-86343f263c35; https://github.com/alvarotrigo/fullpage.js/commit/e7a5db42711700c8a584e61b5e532a64039fe92b
CVE: CVE-2021-44520
Published: 2022-04-13
Description: In Citrix XenMobile Server through 10.12 RP9, there is an Authenticated Command Injection vulnerability, leading to remote code execution with root privileges.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: https://docs.citrix.com/en-us/xenmobile/server/document-history.html; https://gist.github.com/tree-chtsec/766f81e22ae383987d75eedb3b23b709; https://support.citrix.com/article/CTX370551
CVE: CVE-2022-26151
Published: 2022-04-13
Description: Citrix XenMobile Server 10.12 through RP11, 10.13 through RP7, and 10.14 through RP4 allows Command Injection.
CVSS Score: 7.2 (HIGH)
CWE: CWE-77
References: https://support.citrix.com/article/CTX370551; https://support.citrix.com/search; https://www.chtsecurity.com/news/09be10ae-b50e-46c9-8ce7-2e995fd988fe
CVE: CVE-2022-26589
Published: 2022-04-13
Description: A Cross-Site Request Forgery (CSRF) in Pluck CMS v4.7.15 allows attackers to delete arbitrary pages.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://medium.com/%40devansh3008/pluck-cms-v4-7-15-csrf-vulnerability-at-delete-page-9fff0309f9c; https://owasp.org/www-community/attacks/csrf; https://medium.com/%40devansh3008/pluck-cms-v4-7-15-csrf-vulnerability-at-delete-page-9fff0309f9c
CVE: CVE-2022-22279
Published: 2022-04-13
Description: A post-authentication arbitrary file read vulnerability impacting end-of-life Secure Remote Access (SRA) products and older firmware versions of Secure Mobile Access (SMA) 100 series products, specifically the SRA appliances running all 8.x, 9.0.0.5-19sv and earlier versions and Secure Mobile Access (SMA) 100 series products running older firmware 9.0.0.9-26sv and earlier versions
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-23, CWE-22
References: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0006; https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0006
CVE: CVE-2022-29156
Published: 2022-04-13
Description: drivers/infiniband/ulp/rtrs/rtrs-clt.c in the Linux kernel before 5.16.12 has a double free related to rtrs_clt_dev_release.
CVSS Score: 7.8 (HIGH)
CWE: CWE-415
References: https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.16.12; https://github.com/torvalds/linux/commit/8700af2cc18c919b2a83e74e0479038fd113c15d; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2022-1339
Published: 2022-04-13
Description: SQL injection in ElementController.php in GitHub repository pimcore/pimcore prior to 10.3.5. This vulnerability is capable of steal the data
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://github.com/pimcore/pimcore/commit/adae3be64427466bf0df15ceaea2ac30da93752c; https://huntr.dev/bounties/ae8dc737-844e-40da-a9f7-e72d8e50f6f9; https://github.com/pimcore/pimcore/commit/adae3be64427466bf0df15ceaea2ac30da93752c
CVE: CVE-2022-27475
Published: 2022-04-13
Description: Cross site scripting (XSS) vulnerability in tramyardg hotel-mgmt-system, allows attackers to execute arbitrary code when when /admin.php is loaded.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/tramyardg/hotel-mgmt-system; https://github.com/tramyardg/hotel-mgmt-system/commit/3aa5fdd736927f4ba8d4b7efbba850a258ab42ce; https://github.com/tramyardg/hotel-mgmt-system
CVE: CVE-2020-29653
Published: 2022-04-13
Description: Froxlor through 0.10.22 does not perform validation on user input passed in the customermail GET parameter. The value of this parameter is reflected in the login webpage, allowing the injection of arbitrary HTML tags.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/Froxlor/Froxlor/commits/master; https://github.com/Froxlor/Froxlor/security/advisories; https://nozero.io/en/cve-2020-29653-froxlor-html-injection-dangling-markup/
CVE: CVE-2021-43742
Published: 2022-04-13
Description: CMSimple 5.4 is vulnerable to Cross Site Scripting (XSS) via the file upload feature.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/iiSiLvEr/CMSimple5.4-Vulnerabilities; https://github.com/iiSiLvEr/CVEs/tree/main/CVE-2021-43742; https://github.com/iiSiLvEr/CMSimple5.4-Vulnerabilities
CVE: CVE-2022-24308
Published: 2022-04-13
Description: Automox Agent prior to version 37 on Windows and Linux and Version 36 on OSX could allow for a non privileged user to obtain sensitive information during the install process.
CVSS Score: 5.5 (MEDIUM)
References: https://automox.com; https://www.automox.com/security/security-bulletin; https://automox.com
CVE: CVE-2021-43741
Published: 2022-04-13
Description: CMSimple 5.4 is vulnerable to Directory Traversal. The vulnerability exists when a user changes the file name to malicious file on config.php leading to remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://github.com/iiSiLvEr/CMSimple5.4-Vulnerabilities; https://github.com/iiSiLvEr/CVEs/tree/main/CVE-2021-43741; https://github.com/iiSiLvEr/CMSimple5.4-Vulnerabilities
CVE: CVE-2022-26144
Published: 2022-04-13
Description: An XSS issue was discovered in MantisBT before 2.25.3. Improper escaping of a Plugin name allows execution of arbitrary code (if CSP allows it) in manage_plugin_page.php and manage_plugin_uninstall.php when a crafted plugin is installed.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://mantisbt.org/bugs/view.php?id=29688; https://mantisbt.org/bugs/view.php?id=29688
CVE: CVE-2022-26643
Published: 2022-04-13
Description: An issue in EasyIO CPT Graphics v0.8 allows attackers to discover valid users in the application.
CVSS Score: 5.3 (MEDIUM)
References: http://cpt.com; http://easyio.com; https://gist.github.com/rvismit/3fd33b47a753e1b7065421f42b2dd496
CVE: CVE-2022-27256
Published: 2022-04-13
Description: A PHP Local File inclusion vulnerability in the Redbasic theme for Hubzilla before version 7.2 allows remote attackers to include arbitrary php files via the schema parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://framagit.org/hubzilla/core/-/commit/0784cd593a39a4fc297e8a82f7e79bc8019a0868#1c497fbb3a46b78edf04cc2a2fa33f67e3ffbe2a; https://hubzilla.org/channel/hubzilla/; https://volse.net/~haraldei/infosec/disclosures/hubzilla-before-7-2-multiple-vulnerabilities/
CVE: CVE-2021-46167
Published: 2022-04-13
Description: An access control issue in the authentication module of wizplat PD065 v1.19 allows attackers to access sensitive data and cause a Denial of Service (DoS).
CVSS Score: 7.8 (HIGH)
References: http://wizplat.com/PRODUCT1_3/?idx=217; https://github.com/bosslabdcu/Vulnerability-Reporting/security/advisories/GHSA-w8x7-9p5m-2vx4; https://www.amazon.in/High-Speed-Recognition-Fingerprint-Encrypted-Security/dp/B07BRH1GF5/ref=cm_cr_arp_d_product_top?ie=UTF8
CVE: CVE-2022-28052
Published: 2022-04-13
Description: Directory Traversal vulnerability in file cn/roothub/store/FileSystemStorageService in function store in Roothub 2.6.0 allows remote attackers with low privlege to arbitrarily upload files via /common/upload API, which could lead to remote arbitrary code execution.
CVSS Score: 8.0 (HIGH)
CWE: CWE-22
References: https://github.com/Hyperkopite/Roothub_vulns/blob/main/arbitrary%20file%20upload.md; https://github.com/miansen/Roothub/tree/v2.6; https://github.com/Hyperkopite/Roothub_vulns/blob/main/arbitrary%20file%20upload.md
CVE: CVE-2015-20107
Published: 2022-04-13
Description: In Python (aka CPython) up to 3.10.8, the mailcap module does not add escape characters into commands discovered in the system mailcap file. This may allow attackers to inject shell commands into applications that call mailcap.findmatch with untrusted input (if they lack validation of user-provided filenames or arguments). The fix is also back-ported to 3.7, 3.8, 3.9
CVSS Score: 7.6 (HIGH)
CWE: CWE-77
References: https://bugs.python.org/issue24778; https://github.com/python/cpython/issues/68966; https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html
CVE: CVE-2019-6834
Published: 2022-04-13
Description: A CWE-502: Deserialization of Untrusted Data vulnerability exists which could allow an attacker to execute arbitrary code on the targeted system with SYSTEM privileges when placing a malicious user to be authenticated for this vulnerability to be successfully exploited. Affected Product: Schneider Electric Software Update (SESU) SUT Service component (V2.1.1 to V2.3.0)
CVSS Score: 7.3 (HIGH)
CWE: CWE-502
References: https://www.se.com/ww/en/download/document/SEVD-2019-225-06/; https://www.se.com/ww/en/download/document/SEVD-2019-225-06/
CVE: CVE-2021-22794
Published: 2022-04-13
Description: A CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause remote code execution. Affected Product: StruxureWare Data Center Expert (V7.8.1 and prior)
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-22
References: https://www.se.com/ww/en/download/document/SEVD-2021-257-03/; https://www.se.com/ww/en/download/document/SEVD-2021-257-03/
CVE: CVE-2021-22795
Published: 2022-04-13
Description: A CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause remote code execution when performed over the network. Affected Product: StruxureWare Data Center Expert (V7.8.1 and prior)
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-78
References: https://www.se.com/ww/en/download/document/SEVD-2021-257-03/; https://www.se.com/ww/en/download/document/SEVD-2021-257-03/
CVE: CVE-2021-22797
Published: 2022-04-13
Description: A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal) vulnerability exists that could cause malicious script to be deployed in an unauthorized location and may result in code execution on the engineering workstation when a malicious project file is loaded in the engineering software. Affected Product: EcoStruxure Control Expert (V15.0 SP1 and prior, including former Unity Pro), EcoStruxure Process Expert (2020 and prior, including former HDCS), SCADAPack RemoteConnect for x70 (All versions)
CVSS Score: 7.8 (HIGH)
CWE: CWE-22
References: https://www.se.com/ww/en/download/document/SEVD-2021-257-01/; https://www.se.com/ww/en/download/document/SEVD-2021-257-01/
CVE: CVE-2021-42136
Published: 2022-04-13
Description: A stored Cross-Site Scripting (XSS) vulnerability in the Missing Data Codes functionality of REDCap before 11.4.0 allows remote attackers to execute JavaScript code in the client's browser by storing said code as a Missing Data Code value. This can then be leveraged to execute a Cross-Site Request Forgery attack to escalate privileges to administrator.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-79
References: http://packetstormsecurity.com/files/166723/REDCap-Cross-Site-Scripting.html; https://redcap.med.usc.edu/_shib/assets/ChangeLog_Standard.pdf; https://www.project-redcap.org/
CVE: CVE-2022-0221
Published: 2022-04-13
Description: A CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could result in information disclosure when opening a malicious solution file provided by an attacker with SCADAPack Workbench. This could be exploited to pass data from local files to a remote system controlled by an attacker. Affected Product: SCADAPack Workbench (6.6.8a and prior)
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-611, CWE-611
References: https://www.se.com/ww/en/download/document/SEVD-2022-087-01/; https://www.se.com/ww/en/download/document/SEVD-2022-087-01/
CVE: CVE-2022-1246
Published: 2022-04-13
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2022-1280. Reason: This candidate is a reservation duplicate of CVE-2022-1280. Notes: All CVE users should reference CVE-2022-1280 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2022-1280
Published: 2022-04-13
Description: A use-after-free vulnerability was found in drm_lease_held in drivers/gpu/drm/drm_lease.c in the Linux kernel due to a race problem. This flaw allows a local user privilege attacker to cause a denial of service (DoS) or a kernel information leak.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-416, CWE-416
References: https://bugzilla.redhat.com/show_bug.cgi?id=2071022; https://www.openwall.com/lists/oss-security/2022/04/12/3; https://bugzilla.redhat.com/show_bug.cgi?id=2071022
CVE: CVE-2022-1332
Published: 2022-04-13
Description: One of the API in Mattermost version 6.4.1 and earlier fails to properly protect the permissions, which allows the authenticated members with restricted custom admin role to bypass the restrictions and view the server logs and server config.json file contents.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200, CWE-269
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2022-1333
Published: 2022-04-13
Description: Mattermost Playbooks plugin v1.24.0 and earlier fails to properly check the limit on the number of webhooks, which allows authenticated and authorized users to create a specifically drafted Playbook which could trigger a large amount of webhook requests leading to Denial of Service.
CVSS Score: 3.5 (LOW)
CWE: CWE-770, CWE-770
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2022-1337
Published: 2022-04-13
Description: The image proxy component in Mattermost version 6.4.1 and earlier allocates memory for multiple copies of a proxied image, which allows an authenticated attacker to crash the server via links to very large image files.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-400, CWE-770
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2022-1344
Published: 2022-04-13
Description: Stored XSS due to no sanitization in the filename in GitHub repository causefx/organizr prior to 2.1.1810. This allows attackers to execute malicious scripts in the user's browser and it can lead to session hijacking, sensitive data exposure, and worse.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-79
References: https://github.com/causefx/organizr/commit/a09d834d995599756b62016af7026d2408ecf43a; https://huntr.dev/bounties/35f66966-af13-4f07-9734-0c50fdfc3a8c; https://github.com/causefx/organizr/commit/a09d834d995599756b62016af7026d2408ecf43a
CVE: CVE-2022-1346
Published: 2022-04-13
Description: Multiple Stored XSS in GitHub repository causefx/organizr prior to 2.1.1810. This allows attackers to execute malicious scripts in the user's browser and it can lead to session hijacking, sensitive data exposure, and worse.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-79
References: https://github.com/causefx/organizr/commit/a09d834d995599756b62016af7026d2408ecf43a; https://huntr.dev/bounties/8fe435b0-192f-41ca-b41e-580fcd34892f; https://github.com/causefx/organizr/commit/a09d834d995599756b62016af7026d2408ecf43a
CVE: CVE-2022-22955
Published: 2022-04-13
Description: VMware Workspace ONE Access has two authentication bypass vulnerabilities (CVE-2022-22955 & CVE-2022-22956) in the OAuth2 ACS framework. A malicious actor may bypass the authentication mechanism and execute any operation due to exposed endpoints in the authentication framework.
CVSS Score: 9.8 (CRITICAL)
References: https://www.vmware.com/security/advisories/VMSA-2022-0011.html; https://www.vmware.com/security/advisories/VMSA-2022-0011.html
CVE: CVE-2022-22956
Published: 2022-04-13
Description: VMware Workspace ONE Access has two authentication bypass vulnerabilities (CVE-2022-22955 & CVE-2022-22956) in the OAuth2 ACS framework. A malicious actor may bypass the authentication mechanism and execute any operation due to exposed endpoints in the authentication framework.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: http://packetstormsecurity.com/files/171918/Mware-Workspace-ONE-Remote-Code-Execution.html; http://packetstormsecurity.com/files/171918/VMware-Workspace-ONE-Remote-Code-Execution.html; https://www.vmware.com/security/advisories/VMSA-2022-0011.html
CVE: CVE-2022-22957
Published: 2022-04-13
Description: VMware Workspace ONE Access, Identity Manager and vRealize Automation contain two remote code execution vulnerabilities (CVE-2022-22957 & CVE-2022-22958). A malicious actor with administrative access can trigger deserialization of untrusted data through malicious JDBC URI which may result in remote code execution.
CVSS Score: 7.2 (HIGH)
CWE: CWE-502
References: http://packetstormsecurity.com/files/171918/Mware-Workspace-ONE-Remote-Code-Execution.html; http://packetstormsecurity.com/files/171918/VMware-Workspace-ONE-Remote-Code-Execution.html; https://www.vmware.com/security/advisories/VMSA-2022-0011.html
CVE: CVE-2022-22958
Published: 2022-04-13
Description: VMware Workspace ONE Access, Identity Manager and vRealize Automation contain two remote code execution vulnerabilities (CVE-2022-22957 & CVE-2022-22958). A malicious actor with administrative access can trigger deserialization of untrusted data through malicious JDBC URI which may result in remote code execution.
CVSS Score: 7.2 (HIGH)
CWE: CWE-502
References: https://www.vmware.com/security/advisories/VMSA-2022-0011.html; https://www.vmware.com/security/advisories/VMSA-2022-0011.html
CVE: CVE-2022-22959
Published: 2022-04-13
Description: VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a cross site request forgery vulnerability. A malicious actor can trick a user through a cross site request forgery to unintentionally validate a malicious JDBC URI.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://www.vmware.com/security/advisories/VMSA-2022-0011.html; https://www.vmware.com/security/advisories/VMSA-2022-0011.html
CVE: CVE-2022-22960
Published: 2022-04-13
Description: VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a privilege escalation vulnerability due to improper permissions in support scripts. A malicious actor with local access can escalate privileges to 'root'.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732, CWE-732
References: http://packetstormsecurity.com/files/171918/Mware-Workspace-ONE-Remote-Code-Execution.html; http://packetstormsecurity.com/files/171918/VMware-Workspace-ONE-Remote-Code-Execution.html; http://packetstormsecurity.com/files/171935/VMware-Workspace-ONE-Access-Privilege-Escalation.html
CVE: CVE-2022-22961
Published: 2022-04-13
Description: VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an information disclosure vulnerability due to returning excess information. A malicious actor with remote access may leak the hostname of the target system. Successful exploitation of this issue can lead to targeting victims.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://www.vmware.com/security/advisories/VMSA-2022-0011.html; https://www.vmware.com/security/advisories/VMSA-2022-0011.html
CVE: CVE-2022-25795
Published: 2022-04-13
Description: A Memory Corruption Vulnerability in Autodesk TrueView 2022 and 2021 may lead to remote code execution through maliciously crafted DWG files.
CVSS Score: 7.8 (HIGH)
CWE: CWE-755
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2021-0010%3B; https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0007; https://www.autodesk.com/trust/security-advisories/adsk-sa-2021-0010%3B
CVE: CVE-2022-25797
Published: 2022-04-13
Description: A maliciously crafted PDF file in Autodesk AutoCAD 2022, 2021, 2020, 2019 can be used to dereference for a write beyond the allocated buffer while parsing PDF files. The vulnerability exists because the application fails to handle a crafted PDF file, which causes an unhandled exception.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0007; https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0007
CVE: CVE-2022-27503
Published: 2022-04-13
Description: Cross-site Scripting (XSS) vulnerability in Citrix StoreFront affects version 1912 before CU5 and version 3.12 before CU9
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://support.citrix.com/article/CTX377814; https://support.citrix.com/article/CTX377814