deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-44749
Published: 2022-11-24
Description: A directory traversal vulnerability in the ZIP archive extraction routines of KNIME Analytics Platform 3.2.0 and above can result in arbitrary files being overwritten on the user's system. This vulnerability is also known as 'Zip-Slip'.





An attacker can create a KNIME workflow that, when being opened by a user, can overwrite arbitrary files that the user has write access to. It's not necessary to execute the workflow, opening the workflow is sufficient. The user will notice that something is wrong because an error is being reported but only after the files have already been written.

This can impact data integrity (file contents are changed) or cause errors in other software (vital files being corrupted). It can even lead to remote code execution if executable files are being replaced and subsequently executed by the user. In all cases the attacker has to know the location of files on the user's system, though.



CVSS Score: 5.5 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://www.knime.com/security/advisories; https://www.knime.com/security/advisories
CVE: CVE-2022-4136
Published: 2022-11-24
Description: Dangerous method exposed which can lead to RCE in qmpass/leadshop v1.4.15 allows an attacker to control the target host by calling any function in leadshop.php via the GET method.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-749
References: https://github.com/qmpaas/leadshop/commit/f27e9ca5c93eaadda1097396b65c234b16186d67; https://huntr.dev/bounties/fe418ae1-7c80-4d91-8a5a-923d60ba78c3; https://github.com/qmpaas/leadshop/commit/f27e9ca5c93eaadda1097396b65c234b16186d67
CVE: CVE-2022-40266
Published: 2022-11-24
Description: Improper Input Validation vulnerability in Mitsubishi Electric GOT2000 Series GT27 model FTP server versions 01.39.000 and prior, Mitsubishi Electric GOT2000 Series GT25 model FTP server versions 01.39.000 and prior and Mitsubishi Electric GOT2000 Series GT23 model FTP server versions 01.39.000 and prior allows a remote authenticated attacker to cause a Denial of Service condition by sending specially crafted command.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20, CWE-20
References: https://jvn.jp/vu/JVNVU95633416; https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-016_en.pdf; https://jvn.jp/vu/JVNVU95633416
CVE: CVE-2022-40976
Published: 2022-11-24
Description: A path traversal vulnerability was discovered in multiple Pilz products. An unauthenticated local attacker could use a zipped, malicious configuration file to trigger arbitrary file writes ('zip-slip'). File writes do not affect confidentiality or availability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://cert.vde.com/en/advisories/VDE-2022-044/; https://cert.vde.com/en/advisories/VDE-2022-045/; https://cert.vde.com/en/advisories/VDE-2022-044/
CVE: CVE-2022-40977
Published: 2022-11-24
Description: A path traversal vulnerability was discovered in Pilz PASvisu Server before 1.12.0. An unauthenticated remote attacker could use a zipped, malicious configuration file to trigger arbitrary file writes ('zip-slip'). File writes do not affect confidentiality or availability.

CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://cert.vde.com/en/advisories/VDE-2022-033/; https://cert.vde.com/en/advisories/VDE-2022-033/
CVE: CVE-2022-4088
Published: 2022-11-24
Description: A vulnerability was found in rickxy Stock Management System and classified as critical. Affected by this issue is some unknown functionality of the file /pages/processlogin.php. The manipulation of the argument user/password leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-214322 is the identifier assigned to this vulnerability.
CVSS Score: 7.3 (HIGH)
CWE: CWE-707, CWE-89
References: https://github.com/rickxy/Stock-Management-System/issues/2; https://vuldb.com/?id.214322; https://github.com/rickxy/Stock-Management-System/issues/2
CVE: CVE-2022-4089
Published: 2022-11-24
Description: A vulnerability was found in rickxy Stock Management System. It has been declared as problematic. This vulnerability affects unknown code of the file /pages/processlogin.php. The manipulation of the argument user leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-214324.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-707, CWE-79
References: https://github.com/rickxy/Stock-Management-System/issues/3; https://vuldb.com/?id.214324; https://github.com/rickxy/Stock-Management-System/issues/3
CVE: CVE-2022-4090
Published: 2022-11-24
Description: A vulnerability was found in rickxy Stock Management System and classified as problematic. This issue affects some unknown processing of the file us_transac.php?action=add. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-214331.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863, CWE-352
References: https://github.com/rickxy/Stock-Management-System/issues/4; https://vuldb.com/?id.214331; https://github.com/rickxy/Stock-Management-System/issues/4
CVE: CVE-2022-26885
Published: 2022-11-24
Description: When using tasks to read config files, there is a risk of database password disclosure. We recommend you upgrade to version 2.0.6 or higher.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://lists.apache.org/thread/z7084r9cs2r26cszkkgjqpb5bhnxqssp; https://lists.apache.org/thread/z7084r9cs2r26cszkkgjqpb5bhnxqssp
CVE: CVE-2022-2650
Published: 2022-11-24
Description: Improper Restriction of Excessive Authentication Attempts in GitHub repository wger-project/wger prior to 2.2.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-307, CWE-307
References: https://github.com/wger-project/wger/commit/5e3167e3a2dc95836fa2607fe201524c031a2c4c; https://huntr.dev/bounties/f0d85efa-4e78-4b1d-848f-edea115af64b; https://github.com/wger-project/wger/commit/5e3167e3a2dc95836fa2607fe201524c031a2c4c
CVE: CVE-2022-25164
Published: 2022-11-25
Description: Cleartext Storage of Sensitive Information vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A to 1.095Z and Mitsubishi Electric MX OPC UA Module Configurator-R versions 1.08J and prior allows a remote unauthenticated attacker to disclose sensitive information. As a result, unauthenticated attackers can gain unauthorized access to the MELSEC CPU module and the MELSEC OPC UA server module.
CVSS Score: 8.6 (HIGH)
CWE: CWE-312, CWE-312
References: https://jvn.jp/vu/JVNVU97244961/index.html; https://www.cisa.gov/uscert/ics/advisories/icsa-22-333-05; https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-015_en.pdf
CVE: CVE-2022-29825
Published: 2022-11-25
Description: Use of Hard-coded Password vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A to 1.090U, GT Designer3 Version1 (GOT2000) versions from 1.122C to 1.290C, and MT Works2 versions from 1.100E to 1.200J allows an unauthenticated attacker to disclose sensitive information. As a result, unauthenticated users may view programs and project files or execute programs illegally.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-259, CWE-798
References: https://jvn.jp/vu/JVNVU97244961/index.html; https://www.cisa.gov/uscert/ics/advisories/icsa-22-333-05; https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-015_en.pdf
CVE: CVE-2022-29826
Published: 2022-11-25
Description: Cleartext Storage of Sensitive Information vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A to 1.087R and Motion Control Setting(GX Works3 related software) versions from 1.000A to 1.042U allows a remote unauthenticated attacker to disclose sensitive information. As a result, unauthenticated users may view programs and project files or execute programs illegally.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-312, CWE-312
References: https://jvn.jp/vu/JVNVU97244961/index.html; https://www.cisa.gov/uscert/ics/advisories/icsa-22-333-05; https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-015_en.pdf
CVE: CVE-2022-29827
Published: 2022-11-25
Description: Use of Hard-coded Cryptographic Key vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A and later allows a remote unauthenticated attacker to disclose sensitive information. As a result, unauthenticated attackers may view programs and project files or execute programs illegally.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-321, CWE-798
References: https://jvn.jp/vu/JVNVU97244961/index.html; https://www.cisa.gov/uscert/ics/advisories/icsa-22-333-05; https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-015_en.pdf
CVE: CVE-2022-29828
Published: 2022-11-25
Description: Use of Hard-coded Cryptographic Key vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A and later allows a remote unauthenticated attacker to disclose sensitive information. As a result, unauthenticated attackers may view programs and project file or execute programs illegally.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-321, CWE-798
References: https://jvn.jp/vu/JVNVU97244961/index.html; https://www.cisa.gov/uscert/ics/advisories/icsa-22-333-05; https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-015_en.pdf
CVE: CVE-2022-29829
Published: 2022-11-25
Description: Use of Hard-coded Cryptographic Key vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A to 1.090U, GT Designer3 Version1 (GOT2000) versions from 1.122C to 1.290C, Motion Control Setting(GX Works3 related software) versions from 1.035M to 1.042U, and MT Works2 versions from 1.100E to 1.200J allows a remote unauthenticated attacker to disclose sensitive information. As a result, unauthenticated users may view programs and project files or execute programs illegally.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-321, CWE-798
References: https://jvn.jp/vu/JVNVU97244961/index.html; https://www.cisa.gov/uscert/ics/advisories/icsa-22-333-05; https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-015_en.pdf
CVE: CVE-2022-29830
Published: 2022-11-25
Description: Use of Hard-coded Cryptographic Key vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A to 1.095Z, and Motion Control Setting(GX Works3 related software) versions from 1.000A to 1.065T allows a remote unauthenticated attacker to disclose or tamper with sensitive information. As a result, unauthenticated attackers may obtain information about project files illegally.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-321, CWE-798
References: https://jvn.jp/vu/JVNVU97244961/index.html; https://www.cisa.gov/uscert/ics/advisories/icsa-22-333-05; https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-015_en.pdf
CVE: CVE-2022-29831
Published: 2022-11-25
Description: Use of Hard-coded Password vulnerability in Mitsubishi Electric Corporation GX Works3 versions from 1.015R to 1.095Z allows a remote unauthenticated attacker to obtain information about the project file for MELSEC safety CPU modules.
CVSS Score: 7.5 (HIGH)
CWE: CWE-259, CWE-798
References: https://jvn.jp/vu/JVNVU97244961; https://www.cisa.gov/uscert/ics/advisories/icsa-22-333-05; https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-015_en.pdf
CVE: CVE-2022-29832
Published: 2022-11-25
Description: Cleartext Storage of Sensitive Information in Memory vulnerability in Mitsubishi Electric Corporation GX Works3 versions 1.015R and later, GX Works2 all versions and GX Developer versions 8.40S and later allows a remote unauthenticated attacker to disclose sensitive information. As a result, unauthenticated users could obtain information about the project file for MELSEC safety CPU modules or project file for MELSEC Q/FX/L series with security setting.
CVSS Score: 3.7 (LOW)
CWE: CWE-316, CWE-312
References: https://jvn.jp/vu/JVNVU97244961; https://www.cisa.gov/uscert/ics/advisories/icsa-22-333-05; https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-015_en.pdf
CVE: CVE-2022-29833
Published: 2022-11-25
Description: Insufficiently Protected Credentials vulnerability in Mitsubishi Electric Corporation GX Works3 versions 1.015R and later allows a remote unauthenticated attacker to disclose sensitive information. As a result, unauthenticated users could access to MELSEC safety CPU modules illgally.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-522, CWE-522
References: https://jvn.jp/vu/JVNVU97244961; https://www.cisa.gov/uscert/ics/advisories/icsa-22-333-05; https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-015_en.pdf
CVE: CVE-2022-4135
Published: 2022-11-25
Description: Heap buffer overflow in GPU in Google Chrome prior to 107.0.5304.121 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://chromereleases.googleblog.com/2022/11/stable-channel-update-for-desktop_24.html; https://crbug.com/1392715; https://security.gentoo.org/glsa/202305-10
CVE: CVE-2022-45884
Published: 2022-11-25
Description: An issue was discovered in the Linux kernel through 6.0.9. drivers/media/dvb-core/dvbdev.c has a use-after-free, related to dvb_register_device dynamically allocating fops.
CVSS Score: 7.0 (HIGH)
CWE: CWE-362, CWE-416
References: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=627bb528b086b4136315c25d6a447a98ea9448d3; https://lore.kernel.org/linux-media/[PII_REDACTED]1822.6640-1-imv4bel%40gmail.com/; https://lore.kernel.org/linux-media/[PII_REDACTED]1822.6640-4-imv4bel%40gmail.com/
CVE: CVE-2022-45885
Published: 2022-11-25
Description: An issue was discovered in the Linux kernel through 6.0.9. drivers/media/dvb-core/dvb_frontend.c has a race condition that can cause a use-after-free when a device is disconnected.
CVSS Score: 7.0 (HIGH)
CWE: CWE-362, CWE-416, CWE-362, CWE-416
References: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=6769a0b7ee0c3b31e1b22c3fadff2bfb642de23f; https://lore.kernel.org/linux-media/[PII_REDACTED]1822.6640-1-imv4bel%40gmail.com/; https://lore.kernel.org/linux-media/[PII_REDACTED]1822.6640-2-imv4bel%40gmail.com/
CVE: CVE-2022-45886
Published: 2022-11-25
Description: An issue was discovered in the Linux kernel through 6.0.9. drivers/media/dvb-core/dvb_net.c has a .disconnect versus dvb_device_open race condition that leads to a use-after-free.
CVSS Score: 7.0 (HIGH)
CWE: CWE-362, CWE-416
References: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=4172385b0c9ac366dcab78eda48c26814b87ed1a; https://lore.kernel.org/linux-media/[PII_REDACTED]1822.6640-1-imv4bel%40gmail.com/; https://lore.kernel.org/linux-media/[PII_REDACTED]1822.6640-3-imv4bel%40gmail.com/
CVE: CVE-2022-45887
Published: 2022-11-25
Description: An issue was discovered in the Linux kernel through 6.0.9. drivers/media/usb/ttusb-dec/ttusb_dec.c has a memory leak because of the lack of a dvb_frontend_detach call.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-362, CWE-772, CWE-362, CWE-772
References: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=517a281338322ff8293f988771c98aaa7205e457; https://lore.kernel.org/linux-media/[PII_REDACTED]1822.6640-1-imv4bel%40gmail.com/; https://lore.kernel.org/linux-media/[PII_REDACTED]1822.6640-5-imv4bel%40gmail.com/
CVE: CVE-2022-45888
Published: 2022-11-25
Description: An issue was discovered in the Linux kernel through 6.0.9. drivers/char/xillybus/xillyusb.c has a race condition and use-after-free during physical removal of a USB device.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-362, CWE-416
References: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=282a4b71816b[PII_REDACTED]a7bab3a9dcee12a920; https://lore.kernel.org/all/[PII_REDACTED]5404.GA375335%40ubuntu/; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2022-2721
Published: 2022-11-25
Description: In affected versions of Octopus Server it is possible for target discovery to print certain values marked as sensitive to log files in plaint-text in when verbose logging is enabled.
CVSS Score: 7.5 (HIGH)
CWE: CWE-532, CWE-532
References: https://advisories.octopus.com/post/2022/sa2022-24/; https://advisories.octopus.com/post/2022/sa2022-24/
CVE: CVE-2022-40282
Published: 2022-11-25
Description: The web server of Hirschmann BAT-C2 before 09.13.01.00R04 allows authenticated command injection. This allows an authenticated attacker to pass commands to the shell of the system because the dir parameter of the FsCreateDir Ajax function is not sufficiently sanitized. The vendor's ID is BSECV-2022-21.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: http://packetstormsecurity.com/files/170063/Hirschmann-Belden-BAT-C2-8.8.1.0R8-Command-Injection.html; http://seclists.org/fulldisclosure/2022/Nov/19; https://www.belden.com/support/security-assurance
CVE: CVE-2022-36133
Published: 2022-11-25
Description: The WebConfig functionality of Epson TM-C3500 and TM-C7500 devices with firmware version WAM31500 allows authentication bypass.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-287
References: https://download.epson-biz.com/epson/epson_public_document.php?name=Infomation_history.pdf; https://download.epson-biz.com/modules/colorworks/; https://download.epson-biz.com/epson/epson_public_document.php?name=Infomation_history.pdf
CVE: CVE-2022-4091
Published: 2022-11-25
Description: A vulnerability was found in SourceCodester Canteen Management System. It has been classified as problematic. This affects the function query of the file food.php. The manipulation of the argument product_name leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-214359.
CVSS Score: 3.5 (LOW)
CWE: CWE-707
References: https://vuldb.com/?id.214359; https://www.jianshu.com/p/e977cda45d3c?v=[PII_REDACTED]28; https://vuldb.com/?id.214359
CVE: CVE-2022-4141
Published: 2022-11-25
Description: Heap based buffer overflow in vim/vim 9.0.0946 and below by allowing an attacker to CTRL-W gf in the expression used in the RHS of the substitute command.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: https://github.com/vim/vim/commit/cc762a48d42b579fb7bdec2c614636b830342dd5; https://huntr.dev/bounties/20ece512-c600-45ac-8a84-d0931e05541f; https://lists.debian.org/debian-lts-announce/2023/06/msg00015.html
CVE: CVE-2022-38166
Published: 2022-11-25
Description: In F-Secure Endpoint Protection for Windows and macOS before channel with Capricorn database 2022-11-22_07, the aerdl.dll unpacker handler crashes. This can lead to a scanning engine crash, triggerable remotely by an attacker for denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-248
References: https://www.f-secure.com/en/home/support/security-advisories/cve-2022-38166; https://www.f-secure.com/en/home/support/security-advisories/cve-2022-38166
CVE: CVE-2022-38767
Published: 2022-11-25
Description: An issue was discovered in Wind River VxWorks 6.9 and 7, that allows a specifically crafted packet sent by a Radius server, may cause Denial of Service during the IP Radius access procedure.
CVSS Score: 7.5 (HIGH)
References: https://support2.windriver.com/index.php?page=cve&on=view&id=CVE-2022-38767; https://windriver.com; https://support2.windriver.com/index.php?page=cve&on=view&id=CVE-2022-38767
CVE: CVE-2022-37720
Published: 2022-11-25
Description: Orchardproject Orchard CMS 1.10.3 is vulnerable to Cross Site Scripting (XSS). When a low privileged user such as an author or publisher, injects a crafted html and javascript payload in a blog post, leading to full admin account takeover or privilege escalation when the malicious blog post is loaded in the victim's browser.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-79, CWE-79
References: http://orchard.com; http://orchardproject.com; https://labs.integrity.pt/advisories/cve-2022-37720/
CVE: CVE-2022-38377
Published: 2022-11-25
Description: An improper access control vulnerability [CWE-284] in FortiManager 7.2.0, 7.0.0 through 7.0.3, 6.4.0 through 6.4.7, 6.2.0 through 6.2.9, 6.0.0 through 6.0.11 and FortiAnalyzer 7.2.0, 7.0.0 through 7.0.3, 6.4.0 through 6.4.8, 6.2.0 through 6.2.10, 6.0.0 through 6.0.12 may allow a remote and authenticated admin user assigned to a specific ADOM to access other ADOMs information such as device information and dashboard information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284
References: https://fortiguard.com/psirt/FG-IR-20-143; https://fortiguard.com/psirt/FG-IR-20-143
CVE: CVE-2022-44411
Published: 2022-11-25
Description: Web Based Quiz System v1.0 transmits user passwords in plaintext during the authentication process, allowing attackers to obtain users' passwords via a bruteforce attack.
CVSS Score: 7.5 (HIGH)
CWE: CWE-319, CWE-319
References: https://shimo.im/docs/5xkGMZx0ZeUmpx3X; https://shimo.im/docs/5xkGMZx0ZeUmpx3X
CVE: CVE-2022-45036
Published: 2022-11-25
Description: A cross-site scripting (XSS) vulnerability in the Search Settings module of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the No Results field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://shimo.im/docs/2wAlXR1j6BsJlDAP; https://shimo.im/docs/2wAlXR1j6BsJlDAP
CVE: CVE-2022-45037
Published: 2022-11-25
Description: A cross-site scripting (XSS) vulnerability in /admin/users/index.php of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Display Name field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://shimo.im/docs/dPkpKPQEjXfvYoqO; https://shimo.im/docs/dPkpKPQEjXfvYoqO
CVE: CVE-2022-45038
Published: 2022-11-25
Description: A cross-site scripting (XSS) vulnerability in /admin/settings/save.php of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Website Footer field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://shimo.im/docs/Ee32MrJd80iEwyA2; https://shimo.im/docs/Ee32MrJd80iEwyA2
CVE: CVE-2022-45039
Published: 2022-11-25
Description: An arbitrary file upload vulnerability in the Server Settings module of WBCE CMS v1.5.4 allows attackers to execute arbitrary code via a crafted PHP file.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434, CWE-434
References: https://shimo.im/docs/XKq4MKmDYDC8B1kN; https://shimo.im/docs/XKq4MKmDYDC8B1kN
CVE: CVE-2022-45040
Published: 2022-11-25
Description: A cross-site scripting (XSS) vulnerability in /admin/pages/sections_save.php of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name Section field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://shimo.im/docs/XKq4MKmDGnsgjZkN; https://shimo.im/docs/XKq4MKmDGnsgjZkN
CVE: CVE-2022-23044
Published: 2022-11-25
Description: Tiny File Manager version 2.4.8 allows an unauthenticated remote attacker to persuade users to perform unintended actions within the application. This is possible because the application is vulnerable to CSRF.



CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://fluidattacks.com/advisories/mosey/; https://github.com/prasathmani/tinyfilemanager/; https://fluidattacks.com/advisories/mosey/
CVE: CVE-2022-37721
Published: 2022-11-25
Description: PyroCMS 3.9 is vulnerable to a stored Cross Site Scripting (XSS_ when a low privileged user such as an author, injects a crafted html and javascript payload in a blog post, leading to full admin account takeover or privilege escalation.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-79, CWE-79
References: http://pyrocms.com; https://labs.integrity.pt/advisories/cve-2022-37721/; http://pyrocms.com