deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-10650
Published: 2022-12-26
Description: A deserialization flaw was discovered in jackson-databind through 2.9.10.4. It could allow an unauthenticated user to perform code execution via ignite-jta or quartz-core: org.apache.ignite.cache.jta.jndi.CacheJndiTmLookup, org.apache.ignite.cache.jta.jndi.CacheJndiTmFactory, and org.quartz.utils.JNDIConnectionProvider.
CVSS Score: 8.1 (HIGH)
CWE: CWE-502, CWE-502
References: https://github.com/FasterXML/jackson-databind/commit/a424c038ba0c0d65e579e22001dec925902ac0ef; https://github.com/FasterXML/jackson-databind/issues/2658; https://github.com/advisories/GHSA-rpr3-cw39-3pxh
CVE: CVE-2020-11101
Published: 2022-12-26
Description: Sierra Wireless AirLink Mobility Manager (AMM) before 2.17 mishandles sessions and thus an unauthenticated attacker can obtain a login session with administrator privileges.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://source.sierrawireless.com/-/media/support_downloads/security-bulletins/pdf/swi-psa-2020-007---amm-unauthenticated-login.ashx; https://www.sierrawireless.com/company/security/; https://source.sierrawireless.com/-/media/support_downloads/security-bulletins/pdf/swi-psa-2020-007---amm-unauthenticated-login.ashx
CVE: CVE-2021-4281
Published: 2022-12-26
Description: A vulnerability was found in Brave UX for-the-badge and classified as critical. Affected by this issue is some unknown functionality of the file .github/workflows/combine-prs.yml. The manipulation leads to os command injection. The name of the patch is 55b5a234c0fab935df5fb08365bc8fe9c37cf46b. It is recommended to apply a patch to fix this issue. VDB-216842 is the identifier assigned to this vulnerability.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-78
References: https://github.com/BraveUX/for-the-badge/commit/55b5a234c0fab935df5fb08365bc8fe9c37cf46b; https://github.com/BraveUX/for-the-badge/pull/165; https://vuldb.com/?ctiid.216842
CVE: CVE-2019-13988
Published: 2022-12-26
Description: Sierra Wireless MGOS before 3.15.2 and 4.x before 4.3 allows attackers to read log files via a Direct Request (aka Forced Browsing).
CVSS Score: 6.5 (MEDIUM)
References: https://source.sierrawireless.com/-/media/support_downloads/security-bulletins/pdf/swi-psa-2020-006---mgos-security-update.ashx; https://www.sierrawireless.com/company/security/; https://source.sierrawireless.com/-/media/support_downloads/security-bulletins/pdf/swi-psa-2020-006---mgos-security-update.ashx
CVE: CVE-2019-14802
Published: 2022-12-26
Description: HashiCorp Nomad 0.5.0 through 0.9.4 (fixed in 0.9.5) reveals unintended environment variables to the rendering task during template rendering, aka GHSA-6hv3-7c34-4hx8. This applies to nomad/client/allocrunner/taskrunner/template.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://advisories.gitlab.com/advisory/advgo_github_com_hashicorp_nomad_client_allocrunner_taskrunner_template_GMS_2022_818.html; https://www.hashicorp.com/blog/category/nomad; https://advisories.gitlab.com/advisory/advgo_github_com_hashicorp_nomad_client_allocrunner_taskrunner_template_GMS_2022_818.html
CVE: CVE-2019-18177
Published: 2022-12-26
Description: In certain Citrix products, information disclosure can be achieved by an authenticated VPN user when there is a configured SSL VPN endpoint. This affects Citrix ADC and Citrix Gateway 13.0-58.30 and later releases before the CTX276688 update.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://support.citrix.com/article/CTX276688/citrix-application-delivery-controller-citrix-gateway-and-citrix-sdwan-wanop-appliance-security-update; https://support.citrix.com/article/CTX276688/citrix-application-delivery-controller-citrix-gateway-and-citrix-sdwan-wanop-appliance-security-update
CVE: CVE-2019-19705
Published: 2022-12-26
Description: Realtek Audio Drivers for Windows, as used on the Lenovo ThinkPad X1 Carbon 20A7, 20A8, 20BS, and 20BT before 6.0.8882.1 and 20KH and 20KG before 6.0.8907.1 (and on many other Lenovo and non-Lenovo products), mishandles DLL preloading.
CVSS Score: 7.8 (HIGH)
CWE: CWE-428, CWE-428
References: https://support.lenovo.com/us/en/product_security/ps500315-realtek-audio-driver-vulnerability; https://support.lenovo.com/us/en/product_security/ps500315-realtek-audio-driver-vulnerability
CVE: CVE-2018-16135
Published: 2022-12-26
Description: The Opera Mini application 47.1.2249.129326 for Android allows remote attackers to spoof the Location Permission dialog via a crafted web site.
CVSS Score: 6.5 (MEDIUM)
References: https://payatu.com/advisory/opera-mini-location-permission-spoof-; https://payatu.com/advisory/opera-mini-location-permission-spoof-
CVE: CVE-2019-11851
Published: 2022-12-26
Description: The ACENet service in Sierra Wireless ALEOS before 4.4.9, 4.5.x through 4.9.x before 4.9.5, and 4.10.x through 4.13.x before 4.14.0 allows remote attackers to execute arbitrary code via a buffer overflow.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120, CWE-120
References: http://source.sierrawireless.com/-/media/support_downloads/security-bulletins/pdf/swi-psa-2021-001.ashx; https://www.sierrawireless.com/company/security/; http://source.sierrawireless.com/-/media/support_downloads/security-bulletins/pdf/swi-psa-2021-001.ashx
CVE: CVE-2019-19030
Published: 2022-12-26
Description: Cloud Native Computing Foundation Harbor before 1.10.3 and 2.x before 2.0.1 allows resource enumeration because unauthenticated API calls reveal (via the HTTP status code) whether a resource exists.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-204
References: https://github.com/goharbor/harbor/security/advisories/GHSA-q9x4-q76f-5h5j; https://github.com/goharbor/harbor/security/advisories/GHSA-q9x4-q76f-5h5j
CVE: CVE-2020-24600
Published: 2022-12-26
Description: Shilpi CAPExWeb 1.1 allows SQL injection via a servlet/capexweb.cap_sendMail GET request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://cybersecurityworks.com/zerodays/cve-2020-24600-sql-injection-in-capexweb.html; https://cybersecurityworks.com/zerodays/cve-2020-24600-sql-injection-in-capexweb.html
CVE: CVE-2020-28191
Published: 2022-12-26
Description: The console in Togglz before 2.9.4 allows CSRF.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://github.com/advisories/GHSA-697v-pxg3-j262; https://github.com/togglz/togglz/commit/ed66e3f584de954297ebaf98ea4a[PII_REDACTED]07; https://github.com/togglz/togglz/pull/495
CVE: CVE-2022-36664
Published: 2022-12-26
Description: Password Manager for IIS 2.0 has a cross-site scripting (XSS) vulnerability via the /isapi/PasswordManager.dll ResultURL parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://passwordmanager.adiscon.com/en/manual/; https://packetstormsecurity.com/files/168599/Password-Manager-For-IIS-2.0-Cross-Site-Scripting.html; http://passwordmanager.adiscon.com/en/manual/
CVE: CVE-2022-46763
Published: 2022-12-27
Description: A SQL injection issue in a database stored function in TrueConf Server 5.2.0.10225 (fixed in 5.2.6.10025) allows a low-privileged database user to execute arbitrary SQL commands as the database administrator, resulting in execution of arbitrary code.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89, CWE-89
References: https://github.com/sldlb/public_cve_submissions/blob/main/CVE-2022-46763.txt; https://solidlab.ru/our-news/145-trueconf.html; https://vuldb.com/?diff.216851
CVE: CVE-2022-46764
Published: 2022-12-27
Description: A SQL injection issue in the web API in TrueConf Server 5.2.0.10225 (fixed in 5.2.6.10025) allows remote unauthenticated attackers to execute arbitrary SQL commands, ultimately leading to remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89, CWE-89
References: https://github.com/sldlb/public_cve_submissions/blob/main/CVE-2022-46764.txt; https://solidlab.ru/our-news/145-trueconf.html; https://vuldb.com/?diff.216845
CVE: CVE-2015-10005
Published: 2022-12-27
Description: A vulnerability was found in markdown-it up to 2.x. It has been classified as problematic. Affected is an unknown function of the file lib/common/html_re.js. The manipulation leads to inefficient regular expression complexity. Upgrading to version 3.0.0 is able to address this issue. The name of the patch is 89c8620157d6e38f[PII_REDACTED]d25138fc9d1b0d. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-216852.
CVSS Score: 3.5 (LOW)
CWE: CWE-1333
References: https://github.com/markdown-it/markdown-it/commit/89c8620157d6e38f[PII_REDACTED]d25138fc9d1b0d; https://github.com/markdown-it/markdown-it/releases/tag/3.0.0; https://vuldb.com/?ctiid.216852
CVE: CVE-2018-25049
Published: 2022-12-27
Description: A vulnerability was found in email-existence. It has been rated as problematic. Affected by this issue is some unknown functionality of the file index.js. The manipulation leads to inefficient regular expression complexity. The name of the patch is 0029ba71b6ad0d8ec0baa2ecc6256d038bdd9b56. It is recommended to apply a patch to fix this issue. VDB-216854 is the identifier assigned to this vulnerability.
CVSS Score: 3.0 (LOW)
CWE: CWE-1333
References: https://github.com/nmanousos/email-existence/commit/0029ba71b6ad0d8ec0baa2ecc6256d038bdd9b56; https://github.com/nmanousos/email-existence/pull/37; https://vuldb.com/?ctiid.216854
CVE: CVE-2019-25086
Published: 2022-12-27
Description: A vulnerability was found in IET-OU Open Media Player up to 1.5.0. It has been declared as problematic. This vulnerability affects the function webvtt of the file application/controllers/timedtext.php. The manipulation of the argument ttml_url leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 1.5.1 is able to address this issue. The name of the patch is 3f39f2d68d11895929c04f7b49b97a734ae7cd1f. It is recommended to upgrade the affected component. VDB-216862 is the identifier assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-79
References: https://github.com/IET-OU/open-media-player/commit/3f39f2d68d11895929c04f7b49b97a734ae7cd1f; https://github.com/IET-OU/open-media-player/issues/93; https://github.com/IET-OU/open-media-player/releases/tag/1.5.1
CVE: CVE-2019-25087
Published: 2022-12-27
Description: A vulnerability was found in RamseyK httpserver. It has been rated as critical. This issue affects the function ResourceHost::getResource of the file src/ResourceHost.cpp of the component URI Handler. The manipulation of the argument uri leads to path traversal: '../filedir'. The attack may be initiated remotely. The name of the patch is 1a0de56e4dafff9c2f9c8f6b130a764f7a50df52. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-216863.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-24, CWE-22
References: https://github.com/RamseyK/httpserver/commit/1a0de56e4dafff9c2f9c8f6b130a764f7a50df52; https://vuldb.com/?ctiid.216863; https://vuldb.com/?id.216863
CVE: CVE-2022-4748
Published: 2022-12-27
Description: A vulnerability was found in FlatPress. It has been classified as critical. This affects the function doItemActions of the file fp-plugins/mediamanager/panels/panel.mediamanager.file.php of the component File Delete Handler. The manipulation of the argument deletefile leads to path traversal. The name of the patch is 5d5c7f6d8f072d14926fc2c3a97cdd763802f170. It is recommended to apply a patch to fix this issue. The identifier VDB-216861 was assigned to this vulnerability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://github.com/flatpressblog/flatpress/commit/5d5c7f6d8f072d14926fc2c3a97cdd763802f170; https://github.com/flatpressblog/flatpress/issues/179; https://vuldb.com/?ctiid.216861
CVE: CVE-2019-25088
Published: 2022-12-27
Description: A vulnerability was found in ytti Oxidized Web. It has been classified as problematic. Affected is an unknown function of the file lib/oxidized/web/views/conf_search.haml. The manipulation of the argument to_research leads to cross site scripting. It is possible to launch the attack remotely. The name of the patch is 55ab9bdc68b03ebce9280b8746ef31d7fdedcc45. It is recommended to apply a patch to fix this issue. VDB-216870 is the identifier assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/ytti/oxidized-web/commit/55ab9bdc68b03ebce9280b8746ef31d7fdedcc45; https://github.com/ytti/oxidized-web/pull/195; https://vuldb.com/?ctiid.216870
CVE: CVE-2021-4282
Published: 2022-12-27
Description: A vulnerability was found in FreePBX voicemail. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file page.voicemail.php. The manipulation leads to cross site scripting. The attack can be launched remotely. Upgrading to version 14.0.6.25 is able to address this issue. The name of the patch is 12e1469ef9208eda9d8955206e[PII_REDACTED]6ee6. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-216871.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/FreePBX/voicemail/commit/12e1469ef9208eda9d8955206e[PII_REDACTED]6ee6; https://github.com/FreePBX/voicemail/releases/tag/release%2F14.0.6.25; https://vuldb.com/?ctiid.216871
CVE: CVE-2021-4283
Published: 2022-12-27
Description: A vulnerability was found in FreeBPX voicemail. It has been rated as problematic. Affected by this issue is some unknown functionality of the file views/ssettings.php of the component Settings Handler. The manipulation of the argument key leads to cross site scripting. The attack may be launched remotely. Upgrading to version 14.0.6.25 is able to address this issue. The name of the patch is ffce[PII_REDACTED]acd16fe0f676246905aa3cb2f3. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-216872.
CVSS Score: 2.4 (LOW)
CWE: CWE-79
References: https://github.com/FreePBX/voicemail/commit/ffce[PII_REDACTED]acd16fe0f676246905aa3cb2f3; https://github.com/FreePBX/voicemail/releases/tag/release%2F14.0.6.25; https://vuldb.com/?ctiid.216872
CVE: CVE-2021-4284
Published: 2022-12-27
Description: A vulnerability classified as problematic has been found in OpenMRS HTML Form Entry UI Framework Integration Module up to 1.x. This affects an unknown part. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 2.0.0 is able to address this issue. The name of the patch is 811990972ea07649ae33c4b56c61c3b520895f07. It is recommended to upgrade the affected component. The identifier VDB-216873 was assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/openmrs/openmrs-module-htmlformentryui/commit/811990972ea07649ae33c4b56c61c3b520895f07; https://github.com/openmrs/openmrs-module-htmlformentryui/pull/51; https://github.com/openmrs/openmrs-module-htmlformentryui/releases/tag/2.0.0
CVE: CVE-2022-4755
Published: 2022-12-27
Description: A vulnerability was found in FlatPress and classified as problematic. This issue affects the function main of the file fp-plugins/mediamanager/panels/panel.mediamanager.file.php of the component Media Manager Plugin. The manipulation of the argument mm-newgallery-name leads to cross site scripting. The attack may be initiated remotely. The name of the patch is d3f329496536dc99f9707f2f295d571d65a496f5. It is recommended to apply a patch to fix this issue. The identifier VDB-216869 was assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/flatpressblog/flatpress/commit/d3f329496536dc99f9707f2f295d571d65a496f5; https://github.com/flatpressblog/flatpress/issues/177; https://vuldb.com/?ctiid.216869
CVE: CVE-2021-4285
Published: 2022-12-27
Description: A vulnerability classified as problematic was found in Nagios NCPA. This vulnerability affects unknown code of the file agent/listener/templates/tail.html. The manipulation of the argument name leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 2.4.0 is able to address this issue. The name of the patch is 5abbcd7aa26e0fc815e6b2b0ffe1c15ef3e8fab5. It is recommended to upgrade the affected component. VDB-216874 is the identifier assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/NagiosEnterprises/ncpa/commit/5abbcd7aa26e0fc815e6b2b0ffe1c15ef3e8fab5; https://github.com/NagiosEnterprises/ncpa/pull/834; https://github.com/NagiosEnterprises/ncpa/releases/tag/v2.4.0
CVE: CVE-2021-4286
Published: 2022-12-27
Description: A vulnerability, which was classified as problematic, has been found in cocagne pysrp up to 1.0.16. This issue affects the function calculate_x of the file srp/_ctsrp.py. The manipulation leads to information exposure through discrepancy. Upgrading to version 1.0.17 is able to address this issue. The name of the patch is dba52642f5e95d3da7af[PII_REDACTED]ee6053195f. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-216875.
CVSS Score: 2.6 (LOW)
CWE: CWE-203
References: https://github.com/cocagne/pysrp/commit/dba52642f5e95d3da7af[PII_REDACTED]ee6053195f; https://github.com/cocagne/pysrp/pull/43; https://github.com/cocagne/pysrp/releases/tag/1.0.17
CVE: CVE-2021-4287
Published: 2022-12-27
Description: A vulnerability, which was classified as problematic, was found in ReFirm Labs binwalk up to 2.3.2. Affected is an unknown function of the file src/binwalk/modules/extractor.py of the component Archive Extraction Handler. The manipulation leads to symlink following. It is possible to launch the attack remotely. Upgrading to version 2.3.3 is able to address this issue. The name of the patch is fa0c0bd59b[PII_REDACTED]942fe4cb5452e76c1dcd. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-216876.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-61, CWE-59
References: https://github.com/ReFirmLabs/binwalk/commit/fa0c0bd59b[PII_REDACTED]942fe4cb5452e76c1dcd; https://github.com/ReFirmLabs/binwalk/pull/556; https://github.com/ReFirmLabs/binwalk/releases/tag/v2.3.3
CVE: CVE-2019-25089
Published: 2022-12-27
Description: A vulnerability has been found in Morgawr Muon 0.1.1 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file src/muon/handler.clj. The manipulation leads to insufficiently random values. The attack can be launched remotely. Upgrading to version 0.2.0-indev is able to address this issue. The name of the patch is c09ed972c020f759110c707b06ca2644f0bacd7f. It is recommended to upgrade the affected component. The identifier VDB-216877 was assigned to this vulnerability.
CVSS Score: 3.1 (LOW)
CWE: CWE-330
References: https://github.com/Morgawr/Muon/commit/c09ed972c020f759110c707b06ca2644f0bacd7f; https://github.com/Morgawr/Muon/issues/4; https://vuldb.com/?ctiid.216877
CVE: CVE-2019-25090
Published: 2022-12-27
Description: A vulnerability was found in FreePBX arimanager up to 13.0.5.3 and classified as problematic. Affected by this issue is some unknown functionality of the component Views Handler. The manipulation of the argument dataurl leads to cross site scripting. The attack may be launched remotely. Upgrading to version 13.0.5.4 is able to address this issue. The name of the patch is 199dea7cc7020d3c469a86a39fbd80f5edd3c5ab. It is recommended to upgrade the affected component. VDB-216878 is the identifier assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/FreePBX/arimanager/commit/199dea7cc7020d3c469a86a39fbd80f5edd3c5ab; https://github.com/FreePBX/arimanager/releases/tag/release%2F13.0.5.4; https://vuldb.com/?ctiid.216878
CVE: CVE-2020-36633
Published: 2022-12-27
Description: A vulnerability was found in moodle-block_sitenews 1.0. It has been classified as problematic. This affects the function get_content of the file block_sitenews.php. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. Upgrading to version 1.1 is able to address this issue. The name of the patch is cd18d8b1afe464ae[PII_REDACTED]f4e070bac4c58f. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-216879.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://github.com/eberhardt/moodle-block_sitenews/commit/cd18d8b1afe464ae[PII_REDACTED]f4e070bac4c58f; https://github.com/eberhardt/moodle-block_sitenews/pull/5; https://github.com/eberhardt/moodle-block_sitenews/releases/tag/v1.1
CVE: CVE-2020-36634
Published: 2022-12-27
Description: A vulnerability classified as problematic has been found in Indeed Engineering util up to 1.0.33. Affected is the function visit/appendTo of the file varexport/src/main/java/com/indeed/util/varexport/servlet/ViewExportedVariablesServlet.java. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 1.0.34 is able to address this issue. The name of the patch is c0952a9db51a880e9544d9fac2a2218a6bfc9c63. It is recommended to upgrade the affected component. VDB-216882 is the identifier assigned to this vulnerability.
CVSS Score: 2.6 (LOW)
CWE: CWE-79
References: https://github.com/indeedeng/util/commit/c0952a9db51a880e9544d9fac2a2218a6bfc9c63; https://github.com/indeedeng/util/releases/tag/published%2F1.0.34; https://vuldb.com/?ctiid.216882
CVE: CVE-2021-4288
Published: 2022-12-27
Description: A vulnerability was found in OpenMRS openmrs-module-referenceapplication up to 2.11.x. It has been rated as problematic. This issue affects some unknown processing of the file omod/src/main/webapp/pages/userApp.gsp. The manipulation leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 2.12.0 is able to address this issue. The name of the patch is 35f81901a4cb925747a9615b8706f5079d2196a1. It is recommended to upgrade the affected component. The identifier VDB-216881 was assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/openmrs/openmrs-module-referenceapplication/commit/35f81901a4cb925747a9615b8706f5079d2196a1; https://github.com/openmrs/openmrs-module-referenceapplication/pull/92; https://github.com/openmrs/openmrs-module-referenceapplication/releases/tag/referenceapplication-2.12.0
CVE: CVE-2021-4289
Published: 2022-12-27
Description: A vulnerability classified as problematic was found in OpenMRS openmrs-module-referenceapplication up to 2.11.x. Affected by this vulnerability is the function post of the file omod/src/main/java/org/openmrs/module/referenceapplication/page/controller/UserAppPageController.java of the component User App Page. The manipulation of the argument AppId leads to cross site scripting. The attack can be launched remotely. Upgrading to version 2.12.0 is able to address this issue. The name of the patch is 0410c091d46eed3c132fe0fcafe[PII_REDACTED]f74. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-216883.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/openmrs/openmrs-module-referenceapplication/commit/0410c091d46eed3c132fe0fcafe[PII_REDACTED]f74; https://github.com/openmrs/openmrs-module-referenceapplication/pull/89; https://github.com/openmrs/openmrs-module-referenceapplication/releases/tag/referenceapplication-2.12.0
CVE: CVE-2022-4766
Published: 2022-12-27
Description: A vulnerability was found in dolibarr_project_timesheet up to 4.5.5. It has been declared as problematic. This vulnerability affects unknown code of the component Form Handler. The manipulation leads to cross-site request forgery. The attack can be initiated remotely. Upgrading to version 4.5.6.a is able to address this issue. The name of the patch is 082282e9dab43963e6c8f03cfaddd7921de377f4. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-216880.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://github.com/delcroip/dolibarr_project_timesheet/commit/082282e9dab43963e6c8f03cfaddd7921de377f4; https://github.com/delcroip/dolibarr_project_timesheet/pull/200; https://github.com/delcroip/dolibarr_project_timesheet/releases/tag/4.5.6.a