deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-24867
Published: 2022-02-21
Description: Numerous Plugins and Themes from the AccessPress Themes (aka Access Keys) vendor are backdoored due to their website being compromised. Only plugins and themes downloaded via the vendor website are affected, and those hosted on wordpress.org are not. However, all of them were updated or removed to avoid any confusion
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-912
References: https://jetpack.com/2022/01/18/backdoor-found-in-themes-and-plugins-from-accesspress-themes/; https://wpscan.com/vulnerability/9c76bada-fa32-4c2f-9855-d0efd1e63eff; https://jetpack.com/2022/01/18/backdoor-found-in-themes-and-plugins-from-accesspress-themes/
CVE: CVE-2021-24921
Published: 2022-02-21
Description: The Advanced Database Cleaner WordPress plugin before 3.0.4 does not sanitise and escape $_GET keys and values before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/43ab0997-4d15-4ff7-af41-7b528b0ba3c7; https://wpscan.com/vulnerability/43ab0997-4d15-4ff7-af41-7b528b0ba3c7
CVE: CVE-2021-25055
Published: 2022-02-21
Description: The FeedWordPress plugin before 2022.0123 is affected by a Reflected Cross-Site Scripting (XSS) within the "visibility" parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset/2662665; https://wpscan.com/vulnerability/7ed050a4-27eb-4ecb-9182-1d8fa1e71571; https://plugins.trac.wordpress.org/changeset/2662665
CVE: CVE-2021-25057
Published: 2022-02-21
Description: The Translation Exchange WordPress plugin through 1.0.14 was vulnerable to Authenticated Stored Cross-Site Scripting (XSS) within the Project Key text field found in the plugin's settings.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/c0dd3ef1-579d-43a4-801a-660c41495d58; https://wpscan.com/vulnerability/c0dd3ef1-579d-43a4-801a-660c41495d58
CVE: CVE-2021-25058
Published: 2022-02-21
Description: The Buffer Button WordPress plugin through 1.0 was vulnerable to Authenticated Stored Cross Site Scripting (XSS) within the Twitter username to mention text field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/fd5271ef-1da5-4d09-888e-f1fd71820cde; https://wpscan.com/vulnerability/fd5271ef-1da5-4d09-888e-f1fd71820cde
CVE: CVE-2021-25060
Published: 2022-02-21
Description: The Five Star Business Profile and Schema WordPress plugin before 2.1.7 does not have any authorisation and CSRF in its bpfwp_welcome_add_contact_page and bpfwp_welcome_set_contact_information AJAX action, allowing any authenticated users, such as subscribers, to call them. Furthermore, due to the lack of sanitisation, it also lead to Stored Cross-Site Scripting issues
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/9e1ac711-1f65-49fa-b007-66170a77b265; https://wpscan.com/vulnerability/9e1ac711-1f65-49fa-b007-66170a77b265
CVE: CVE-2021-25069
Published: 2022-02-21
Description: The Download Manager WordPress plugin before 3.2.34 does not sanitise and escape the package_ids parameter before using it in a SQL statement, leading to a SQL injection, which can also be exploited to cause a Reflected Cross-Site Scripting issue
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://plugins.trac.wordpress.org/changeset/2656086; https://wpscan.com/vulnerability/4ff5e638-1b89-41df-b65a-f821de8934e8; https://plugins.trac.wordpress.org/changeset/2656086
CVE: CVE-2021-25075
Published: 2022-02-21
Description: The Duplicate Page or Post WordPress plugin before 1.5.1 does not have any authorisation and has a flawed CSRF check in the wpdevart_duplicate_post_parametrs_save_in_db AJAX action, allowing any authenticated users, such as subscriber to call it and change the plugin's settings, or perform such attack via CSRF. Furthermore, due to the lack of escaping, this could lead to Stored Cross-Site Scripting issues
CVSS Score: 3.5 (LOW)
CWE: CWE-862
References: https://wpscan.com/vulnerability/db5a0431-af4d-45b7-be4e-36b6c90a601b; https://wpscan.com/vulnerability/db5a0431-af4d-45b7-be4e-36b6c90a601b
CVE: CVE-2021-25082
Published: 2022-02-21
Description: The Popup Builder WordPress plugin before 4.0.7 does not validate and sanitise the sgpb_type parameter before using it in a require statement, leading to a Local File Inclusion issue. Furthermore, since the beginning of the string can be controlled, the issue can lead to RCE vulnerability via wrappers such as PHAR
CVSS Score: 8.8 (HIGH)
CWE: CWE-22
References: https://plugins.trac.wordpress.org/changeset/2659117; https://wpscan.com/vulnerability/0f90f10c-4b0a-46da-ac1f-aa6a03312132; https://plugins.trac.wordpress.org/changeset/2659117
CVE: CVE-2021-25099
Published: 2022-02-21
Description: The GiveWP WordPress plugin before 2.17.3 does not sanitise and escape the form_id parameter before outputting it back in the response of an unauthenticated request via the give_checkout_login AJAX action, leading to a Reflected Cross-Site Scripting
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/2659032; https://wpscan.com/vulnerability/87a64b27-23a3-40f5-a3d8-0650975fee6f; https://plugins.trac.wordpress.org/changeset/2659032
CVE: CVE-2021-25100
Published: 2022-02-21
Description: The GiveWP WordPress plugin before 2.17.3 does not escape the s parameter before outputting it back in an attribute in the Donation Forms dashboard, leading to a Reflected Cross-Site Scripting
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/2659032; https://wpscan.com/vulnerability/fe2c02bf-207c-43da-98bd-4c85d235de8b; https://plugins.trac.wordpress.org/changeset/2659032
CVE: CVE-2021-25101
Published: 2022-02-21
Description: The Anti-Malware Security and Brute-Force Firewall WordPress plugin before 4.20.94 does not sanitise and escape the POST data before outputting it back in attributes of an admin page, leading to a Reflected Cross-Site scripting. Due to the presence of specific parameter value, available to admin users, this can only be exploited by an admin against another admin user.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/5fd0380c-0d1d-4380-96f0-a07be5a61eba; https://wpscan.com/vulnerability/5fd0380c-0d1d-4380-96f0-a07be5a61eba
CVE: CVE-2021-4208
Published: 2022-02-21
Description: The ExportFeed WordPress plugin through 2.0.1.0 does not sanitise and escape the product_id POST parameter before using it in a SQL statement, leading to a SQL injection vulnerability exploitable by high privilege users
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://wpscan.com/vulnerability/0cf63b44-f709-4ba4-be14-1eea934c2007; https://wpscan.com/vulnerability/0cf63b44-f709-4ba4-be14-1eea934c2007
CVE: CVE-2022-0134
Published: 2022-02-21
Description: The AnyComment WordPress plugin before 0.2.18 does not have CSRF checks in the Import and Revert HyperComments features, allowing attackers to make logged in admin perform such actions via a CSRF attack
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://wpscan.com/vulnerability/fa09ea9b-d5a0-4773-a692-9ff0200bcd85; https://wpscan.com/vulnerability/fa09ea9b-d5a0-4773-a692-9ff0200bcd85
CVE: CVE-2022-0164
Published: 2022-02-21
Description: The Coming soon and Maintenance mode WordPress plugin before 3.5.3 does not have authorisation and CSRF checks in its coming_soon_send_mail AJAX action, allowing any authenticated users, with a role as low as subscriber to send arbitrary emails to all subscribed users
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-862
References: https://plugins.trac.wordpress.org/changeset/2655973; https://wpscan.com/vulnerability/942535f9-73bf-4467-872a-20075f03bc51; https://plugins.trac.wordpress.org/changeset/2655973
CVE: CVE-2022-0186
Published: 2022-02-21
Description: The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.5.3 does not sanitise and escape the Description field when editing a gallery, allowing users with a role as low as contributor to perform Cross-Site Scripting attacks against other users having access to the gallery dashboard
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/3a9c44c0-866e-4fdf-b53d-666db2e11720; https://wpscan.com/vulnerability/3a9c44c0-866e-4fdf-b53d-666db2e11720
CVE: CVE-2022-0199
Published: 2022-02-21
Description: The Coming soon and Maintenance mode WordPress plugin before 3.6.8 does not have CSRF check in its coming_soon_send_mail AJAX action, allowing attackers to make logged in admin to send arbitrary emails to all subscribed users via a CSRF attack
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/changeset/2659455; https://wpscan.com/vulnerability/1ab1748f-c939-4953-83fc-9df878da7714; https://plugins.trac.wordpress.org/changeset/2659455
CVE: CVE-2022-0211
Published: 2022-02-21
Description: The Shield Security WordPress plugin before 13.0.6 does not sanitise and escape admin notes, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/0d276cca-d6eb-4f4c-83dd-fbc03254c679; https://wpscan.com/vulnerability/0d276cca-d6eb-4f4c-83dd-fbc03254c679
CVE: CVE-2022-0228
Published: 2022-02-21
Description: The Popup Builder WordPress plugin before 4.0.7 does not validate and properly escape the orderby and order parameters before using them in a SQL statement in the admin dashboard, which could allow high privilege users to perform SQL injection
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://plugins.trac.wordpress.org/changeset/2659117; https://wpscan.com/vulnerability/22facac2-52f4-4e5f-be59-1d2934b260d9; https://plugins.trac.wordpress.org/changeset/2659117
CVE: CVE-2022-0234
Published: 2022-02-21
Description: The WOOCS WordPress plugin before 1.3.7.5 does not sanitise and escape the woocs_in_order_currency parameter of the woocs_get_products_price_html AJAX action (available to both unauthenticated and authenticated users) before outputting it back in the response, leading to a Reflected Cross-Site Scripting
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/2659191; https://wpscan.com/vulnerability/fd568a1f-bd51-41bb-960d-f8573b84527b; https://plugins.trac.wordpress.org/changeset/2659191
CVE: CVE-2022-0252
Published: 2022-02-21
Description: The GiveWP WordPress plugin before 2.17.3 does not escape the json parameter before outputting it back in an attribute in the Import admin dashboard, leading to a Reflected Cross-Site Scripting
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/2659032; https://wpscan.com/vulnerability/b0e551af-087b-43e7-bdb7-11d7f639028a; https://plugins.trac.wordpress.org/changeset/2659032
CVE: CVE-2022-0255
Published: 2022-02-21
Description: The Database Backup for WordPress plugin before 2.5.1 does not properly sanitise and escape the fragment parameter before using it in a SQL statement in the admin dashboard, leading to a SQL injection issue
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://wpscan.com/vulnerability/684bb06d-864f-4cba-ab0d-f83974d026fa; https://wpscan.com/vulnerability/684bb06d-864f-4cba-ab0d-f83974d026fa
CVE: CVE-2022-0279
Published: 2022-02-21
Description: The AnyComment WordPress plugin before 0.2.18 is affected by a race condition when liking/disliking a comment/reply, which could allow any authenticated user to quickly raise their rating or lower the rating of other users
CVSS Score: 3.1 (LOW)
CWE: CWE-362
References: https://wpscan.com/vulnerability/43a4b2d3-1bd5-490c-982c-bb[PII_REDACTED]; https://wpscan.com/vulnerability/43a4b2d3-1bd5-490c-982c-bb[PII_REDACTED]
CVE: CVE-2022-0288
Published: 2022-02-21
Description: The Ad Inserter WordPress plugin before 2.7.10, Ad Inserter Pro WordPress plugin before 2.7.10 do not sanitise and escape the html_element_selection parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/27b64412-33a4-462c-bc45-f81697e4fe42; https://wpscan.com/vulnerability/27b64412-33a4-462c-bc45-f81697e4fe42
CVE: CVE-2022-0313
Published: 2022-02-21
Description: The Float menu WordPress plugin before 4.3.1 does not have CSRF check in place when deleting menu, which could allow attackers to make a logged in admin delete them via a CSRF attack
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/changeset/2661431; https://wpscan.com/vulnerability/1ce6c8f4-6f4b-4d56-8d11-43355ef32e8c; https://plugins.trac.wordpress.org/changeset/2661431
CVE: CVE-2021-45008
Published: 2022-02-21
Description: Plesk CMS 18.0.37 is affected by an insecure permissions vulnerability that allows privilege Escalation from user to admin rights. OTE: the vendor states that this is only a site-specific problem on websites of one or more Plesk users
CVSS Score: 8.8 (HIGH)
CWE: CWE-281, CWE-281
References: https://github.com/AS4mir/CVE-2021-45008/blob/main/README.md; https://github.com/AS4mir/CVE-2021-45008/blob/main/README.md
CVE: CVE-2022-24553
Published: 2022-02-21
Description: An issue was found in Zfaka <= 1.4.5. The verification of the background file upload function check is not strict, resulting in remote command execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://github.com/zfaka-plus/zfaka/issues/260; https://www.cnblogs.com/J0o1ey/p/15858138.html; https://github.com/zfaka-plus/zfaka/issues/260
CVE: CVE-2022-0692
Published: 2022-02-21
Description: Open Redirect on Rudloff/alltube in Packagist rudloff/alltube prior to 3.0.1.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://github.com/rudloff/alltube/commit/bc14b6e45c766c05757fb607ef8d444cbbfba71a; https://huntr.dev/bounties/4fb39400-e08b-47af-8c1f-5093c9a51203; https://github.com/rudloff/alltube/commit/bc14b6e45c766c05757fb607ef8d444cbbfba71a
CVE: CVE-2021-44142
Published: 2022-02-21
Description: The Samba vfs_fruit module uses extended file attributes (EA, xattr) to provide "...enhanced compatibility with Apple SMB clients and interoperability with a Netatalk 3 AFP fileserver." Samba versions prior to 4.13.17, 4.14.12 and 4.15.5 with vfs_fruit configured allow out-of-bounds heap read and write via specially crafted extended file attributes. A remote attacker with write access to extended file attributes can execute arbitrary code with the privileges of smbd, typically root.
CVSS Score: 8.8 (HIGH)
CWE: CWE-125, CWE-787, CWE-125, CWE-787
References: https://bugzilla.samba.org/show_bug.cgi?id=14914; https://kb.cert.org/vuls/id/119678; https://security.gentoo.org/glsa/202309-06
CVE: CVE-2021-26256
Published: 2022-02-21
Description: Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability discovered in Survey Maker WordPress plugin (versions <= 2.0.6).
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/survey-maker/wordpress-survey-maker-plugin-2-0-6-unauthenticated-stored-cross-site-scripting-xss-vulnerability; https://wordpress.org/plugins/survey-maker/#developers; https://patchstack.com/database/vulnerability/survey-maker/wordpress-survey-maker-plugin-2-0-6-unauthenticated-stored-cross-site-scripting-xss-vulnerability
CVE: CVE-2021-27753
Published: 2022-02-21
Description: "Sametime Android PathTraversal Vulnerability"
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-22
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0096575; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0096575
CVE: CVE-2021-27755
Published: 2022-02-21
Description: "Sametime Android potential path traversal vulnerability when using File class"
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-22
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0096575; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0096575
CVE: CVE-2021-27796
Published: 2022-02-21
Description: A vulnerability in Brocade Fabric OS versions before Brocade Fabric OS v8.0.1b, v7.4.1d could allow an authenticated attacker within the restricted shell environment (rbash) as either the “user” or “factory” account, to read the contents of any file on the filesystem utilizing one of a few available binaries.
CVSS Score: 6.5 (MEDIUM)
References: https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2021-1721; https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2021-1721
CVE: CVE-2021-27797
Published: 2022-02-21
Description: Brocade Fabric OS before Brocade Fabric OS v8.2.1c, v8.1.2h, and all versions of Brocade Fabric OS v8.0.x and v7.x contain documented hard-coded credentials, which could allow attackers to gain access to the system.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2021-1722; https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2021-1722
CVE: CVE-2021-44141
Published: 2022-02-21
Description: All versions of Samba prior to 4.15.5 are vulnerable to a malicious client using a server symlink to determine if a file or directory exists in an area of the server file system not exported under the share definition. SMB1 with unix extensions has to be enabled in order for this attack to succeed.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200, CWE-59
References: https://security.gentoo.org/glsa/202309-06; https://www.samba.org/samba/security/CVE-2021-44141.html; https://security.gentoo.org/glsa/202309-06
CVE: CVE-2021-44568
Published: 2022-02-21
Description: Two heap-overflow vulnerabilities exist in openSUSE/libsolv libsolv through 13 Dec 2020 in the decisionmap variable via the resolve_dependencies function at src/solver.c (line 1940 & line 1995), which could cause a remote Denial of Service.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787
References: https://github.com/openSUSE/libsolv/issues/425; https://github.com/yangjiageng/PoC/blob/master/libsolv-PoCs/resolve_dependencies-1940; https://github.com/yangjiageng/PoC/blob/master/libsolv-PoCs/resolve_dependencies-1995
CVE: CVE-2022-0564
Published: 2022-02-21
Description: A vulnerability in Qlik Sense Enterprise on Windows could allow an remote attacker to enumerate domain user accounts. An attacker could exploit this vulnerability by sending authentication requests to an affected system. A successful exploit could allow the attacker to compare the response time that are returned by the affected system to determine which accounts are valid user accounts. Affected systems are only vulnerable if they have LDAP configured.

The affected URI is /internal_forms_authentication/ the response time of the form is longer if the supplied user does not exists and shorter if the user exists.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-204, CWE-203
References: https://community.qlik.com/t5/Release-Notes/Qlik-Sense-Enterprise-on-Windows-November-2021-Initial-Release/ta-p/1856531; https://csirt.divd.nl/CVE-2022-0564/; https://csirt.divd.nl/DIVD-2021-00021/
CVE: CVE-2022-0708
Published: 2022-02-21
Description: Mattermost 6.3.0 and earlier fails to protect email addresses of the creator of the team via one of the APIs, which allows authenticated team members to access this information resulting in sensitive & private information disclosure.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200, CWE-200
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2022-22308
Published: 2022-02-21
Description: IBM Planning Analytics 2.0 is vulnerable to a Remote File Include (RFI) attack. User input could be passed into file include commands and the web application could be tricked into including remote files with malicious code. IBM X-Force ID: 216891.
CVSS Score: 7.8 (HIGH)
CWE: CWE-829
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/216891; https://www.ibm.com/support/pages/node/6557106; https://exchange.xforce.ibmcloud.com/vulnerabilities/216891
CVE: CVE-2022-23983
Published: 2022-02-21
Description: Cross-Site Request Forgery (CSRF) vulnerability leading to plugin Settings Update discovered in WP Content Copy Protection & No Right Click WordPress plugin (versions <= 3.4.4).
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://patchstack.com/database/vulnerability/wp-content-copy-protector/wordpress-wp-content-copy-protection-no-right-click-plugin-3-4-4-cross-site-request-forgery-csrf-leads-to-settings-update-vulnerability; https://wordpress.org/plugins/wp-content-copy-protector/#developers; https://patchstack.com/database/vulnerability/wp-content-copy-protector/wordpress-wp-content-copy-protection-no-right-click-plugin-3-4-4-cross-site-request-forgery-csrf-leads-to-settings-update-vulnerability
CVE: CVE-2022-23984
Published: 2022-02-21
Description: Sensitive information disclosure discovered in wpDiscuz WordPress plugin (versions <= 7.3.11).
CVSS Score: 3.7 (LOW)
CWE: CWE-200, CWE-200
References: https://patchstack.com/database/vulnerability/wpdiscuz/wordpress-wpdiscuz-plugin-7-3-11-sensitive-information-disclosure; https://wordpress.org/plugins/wpdiscuz/#developers; https://patchstack.com/database/vulnerability/wpdiscuz/wordpress-wpdiscuz-plugin-7-3-11-sensitive-information-disclosure
CVE: CVE-2022-24295
Published: 2022-02-21
Description: Okta Advanced Server Access Client for Windows prior to version 1.57.0 was found to be vulnerable to command injection via a specially crafted URL.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: https://trust.okta.com/security-advisories/okta-advanced-server-access-client-cve-2022-24295; https://trust.okta.com/security-advisories/okta-advanced-server-access-client-cve-2022-24295
CVE: CVE-2022-25599
Published: 2022-02-21
Description: Cross-Site Request Forgery (CSRF) vulnerability leading to event deletion was discovered in Spiffy Calendar WordPress plugin (versions <= 4.9.0).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://patchstack.com/database/vulnerability/spiffy-calendar/wordpress-spiffy-calendar-plugin-4-9-0-event-deletion-via-cross-site-request-forgery-csrf-vulnerability; https://wordpress.org/plugins/spiffy-calendar/#developers; https://patchstack.com/database/vulnerability/spiffy-calendar/wordpress-spiffy-calendar-plugin-4-9-0-event-deletion-via-cross-site-request-forgery-csrf-vulnerability
CVE: CVE-2021-44569
Published: 2022-02-21
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2021-3200 Reason: This candidate is a duplicate of CVE-2021-3200. Notes: All CVE users should reference CVE-2021-3200 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2021-44570
Published: 2022-02-21
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2021-3200 Reason: This candidate is a duplicate of CVE-2021-3200. Notes: All CVE users should reference CVE-2021-3200 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2022-0563
Published: 2022-02-21
Description: A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an "INPUTRC" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-209, CWE-209
References: https://lore.kernel.org/util-linux/[PII_REDACTED]0609.msiwlm457ngoic6w%40ws.net.home/T/#u; https://security.gentoo.org/glsa/202401-08; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/