deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-20316
Published: 2022-08-23
Description: A flaw was found in the way Samba handled file/directory metadata. This flaw allows an authenticated attacker with permissions to read or modify share metadata, to perform this operation outside of the share.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-362, CWE-362
References: https://access.redhat.com/security/cve/CVE-2021-20316; https://bugzilla.redhat.com/show_bug.cgi?id=2009673; https://bugzilla.samba.org/show_bug.cgi?id=14842
CVE: CVE-2021-23156
Published: 2022-08-23
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2021-23161
Published: 2022-08-23
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2021-23177
Published: 2022-08-23
Description: An improper link resolution flaw while extracting an archive can lead to changing the access control list (ACL) of the target of the link. An attacker may provide a malicious archive to a victim user, who would trigger this flaw when trying to extract the archive. A local attacker may use this flaw to change the ACL of a file on the system and gain more privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-59, CWE-59
References: https://access.redhat.com/security/cve/CVE-2021-23177; https://bugzilla.redhat.com/show_bug.cgi?id=2024245; https://github.com/libarchive/libarchive/commit/fba4f123cc456d2b2538f811bb831483bf336bad
CVE: CVE-2021-31566
Published: 2022-08-23
Description: An improper link resolution flaw can occur while extracting an archive leading to changing modes, times, access control lists, and flags of a file outside of the archive. An attacker may provide a malicious archive to a victim user, who would trigger this flaw when trying to extract the archive. A local attacker may use this flaw to gain more privileges in a system.
CVSS Score: 7.8 (HIGH)
CWE: CWE-59, CWE-59
References: https://access.redhat.com/security/cve/CVE-2021-31566; https://bugzilla.redhat.com/show_bug.cgi?id=2024237; https://github.com/libarchive/libarchive/commit/b41daecb5ccb4c8e3b2c53fd6147109fc12c3043
CVE: CVE-2021-3670
Published: 2022-08-23
Description: MaxQueryDuration not honoured in Samba AD DC LDAP
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400
References: https://bugzilla.redhat.com/show_bug.cgi?id=2077533; https://bugzilla.samba.org/show_bug.cgi?id=14694; https://gitlab.com/samba-team/samba/-/commit/1d5b155619bc532c46932965b215bd73a920e56f
CVE: CVE-2021-3690
Published: 2022-08-23
Description: A flaw was found in Undertow. A buffer leak on the incoming WebSocket PONG message may lead to memory exhaustion. This flaw allows an attacker to cause a denial of service. The highest threat from this vulnerability is availability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-401
References: https://access.redhat.com/security/cve/CVE-2021-3690; https://bugzilla.redhat.com/show_bug.cgi?id=1991299; https://github.com/undertow-io/undertow/commit/c7e84a0b7efced38506d7d1dfea[PII_REDACTED]877
CVE: CVE-2021-3701
Published: 2022-08-23
Description: A flaw was found in ansible-runner where the default temporary files configuration in ansible-2.0.0 are written to world R/W locations. This flaw allows an attacker to pre-create the directory, resulting in reading private information or forcing ansible-runner to write files as the legitimate user in a place they did not expect. The highest threat from this vulnerability is to confidentiality and integrity.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-276, CWE-276
References: https://access.redhat.com/security/cve/CVE-2021-3701; https://bugzilla.redhat.com/show_bug.cgi?id=1977959; https://github.com/ansible/ansible-runner/issues/738
CVE: CVE-2021-3702
Published: 2022-08-23
Description: A race condition flaw was found in ansible-runner, where an attacker could watch for rapid creation and deletion of a temporary directory, substitute their directory at that name, and then have access to ansible-runner's private_data_dir the next time ansible-runner made use of the private_data_dir. The highest Threat out of this flaw is to integrity and confidentiality.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-362, CWE-362
References: https://access.redhat.com/security/cve/CVE-2021-3702; https://bugzilla.redhat.com/show_bug.cgi?id=1977965; https://github.com/ansible/ansible-runner/pull/742/commits
CVE: CVE-2021-3714
Published: 2022-08-23
Description: A flaw was found in the Linux kernels memory deduplication mechanism. Previous work has shown that memory deduplication can be attacked via a local exploitation mechanism. The same technique can be used if an attacker can upload page sized files and detect the change in access time from a networked service to determine if the page has been merged.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-200
References: https://access.redhat.com/security/cve/CVE-2021-3714; https://arxiv.org/abs/2111.08553; https://arxiv.org/pdf/2111.08553.pdf
CVE: CVE-2021-3724
Published: 2022-08-23
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2021-3736
Published: 2022-08-23
Description: A flaw was found in the Linux kernel. A memory leak problem was found in mbochs_ioctl in samples/vfio-mdev/mbochs.c in Virtual Function I/O (VFIO) Mediated devices. This flaw could allow a local attacker to leak internal kernel information.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200, CWE-401
References: https://access.redhat.com/security/cve/CVE-2021-3736; https://bugzilla.redhat.com/show_bug.cgi?id=1995570; https://github.com/torvalds/linux/commit/de5494af4815a4c9328536c72741229b7de88e7f
CVE: CVE-2021-3759
Published: 2022-08-23
Description: A memory overflow vulnerability was found in the Linux kernel’s ipc functionality of the memcg subsystem, in the way a user calls the semget function multiple times, creating semaphores. This flaw allows a local user to starve the resources, causing a denial of service. The highest threat from this vulnerability is to system availability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-400, CWE-770
References: https://access.redhat.com/security/cve/CVE-2021-3759; https://bugzilla.redhat.com/show_bug.cgi?id=1999675; https://lists.debian.org/debian-lts-announce/2022/12/msg00031.html
CVE: CVE-2021-3763
Published: 2022-08-23
Description: A flaw was found in the Red Hat AMQ Broker management console in version 7.8 where an existing user is able to access some limited information even when the role the user is assigned to should not be allow access to the management console. The main impact is to confidentiality as this flaw means some role bindings are incorrectly checked, some privileged meta information such as queue names and configuration details are disclosed but the impact is limited as not all information is accessible and there is no affect to integrity.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863, CWE-863
References: https://access.redhat.com/security/cve/CVE-2021-3763; https://bugzilla.redhat.com/show_bug.cgi?id=2000654; https://issues.redhat.com/browse/ENTMQBR-5372
CVE: CVE-2021-3764
Published: 2022-08-23
Description: A memory leak flaw was found in the Linux kernel's ccp_run_aes_gcm_cmd() function that allows an attacker to cause a denial of service. The vulnerability is similar to the older CVE-2019-18808. The highest threat from this vulnerability is to system availability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-400, CWE-401
References: https://access.redhat.com/security/cve/CVE-2021-3764; https://bugzilla.redhat.com/show_bug.cgi?id=1997467; https://github.com/torvalds/linux/commit/505d9dcb0f7ddf9d075e729523a33d38642ae680
CVE: CVE-2021-3771
Published: 2022-08-23
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2021-3798
Published: 2022-08-23
Description: A flaw was found in openCryptoki. The openCryptoki Soft token does not check if an EC key is valid when an EC key is created via C_CreateObject, nor when C_DeriveKey is used with ECDH public data. This may allow a malicious user to extract the private key by performing an invalid curve attack.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://access.redhat.com/security/cve/CVE-2021-3798; https://bugzilla.redhat.com/show_bug.cgi?id=1990591; https://github.com/opencryptoki/opencryptoki/commit/4e3b43c3d8844402c04a66b55c6c940f965109f0
CVE: CVE-2021-3800
Published: 2022-08-23
Description: A flaw was found in glib before version 2.63.6. Due to random charset alias, pkexec can leak content from files owned by privileged users to unprivileged ones under the right condition.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200, CWE-552
References: https://access.redhat.com/security/cve/CVE-2021-3800; https://bugzilla.redhat.com/show_bug.cgi?id=1938284; https://gitlab.gnome.org/GNOME/glib/-/commit/3529bb4450a51995
CVE: CVE-2021-3827
Published: 2022-08-23
Description: A flaw was found in keycloak, where the default ECP binding flow allows other authentication flows to be bypassed. By exploiting this behavior, an attacker can bypass the MFA authentication by sending a SOAP request with an AuthnRequest and Authorization header with the user's credentials. The highest threat from this vulnerability is to confidentiality and integrity.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-287, CWE-287
References: https://access.redhat.com/security/cve/CVE-2021-3827; https://bugzilla.redhat.com/show_bug.cgi?id=2007512; https://github.com/keycloak/keycloak/commit/44000caaf5051d7f218d1ad79573bd3d175cad0d
CVE: CVE-2021-3839
Published: 2022-08-23
Description: A flaw was found in the vhost library in DPDK. Function vhost_user_set_inflight_fd() does not validate `msg->payload.inflight.num_queues`, possibly causing out-of-bounds memory read/write. Any software using DPDK vhost library may crash as a result of this vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125, CWE-125, CWE-787
References: https://access.redhat.com/security/cve/CVE-2021-3839; https://bugzilla.redhat.com/show_bug.cgi?id=2025882; https://github.com/DPDK/dpdk/commit/6442c329b9d2ded0f44b27d2016aaba8ba5844c5
CVE: CVE-2021-3894
Published: 2022-08-23
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2021-3905
Published: 2022-08-23
Description: A memory leak was found in Open vSwitch (OVS) during userspace IP fragmentation processing. An attacker could use this flaw to potentially exhaust available memory by keeping sending packet fragments.
CVSS Score: 7.5 (HIGH)
CWE: CWE-401, CWE-401
References: https://access.redhat.com/security/cve/CVE-2021-3905; https://bugzilla.redhat.com/show_bug.cgi?id=2019692; https://github.com/openvswitch/ovs-issues/issues/226
CVE: CVE-2022-28882
Published: 2022-08-23
Description: A Denial-of-Service (DoS) vulnerability was discovered in F-Secure & WithSecure products whereby the aegen.dll will go into an infinite loop when unpacking PE files. This eventually leads to scanning engine crash. The exploit can be triggered remotely by an attacker.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-835
References: https://www.withsecure.com/en/support/security-advisories; https://www.withsecure.com/en/support/security-advisories
CVE: CVE-2022-28883
Published: 2022-08-23
Description: A Denial-of-Service (DoS) vulnerability was discovered in F-Secure & WithSecure products whereby the aerdl unpack function crashes. This can lead to a possible scanning engine crash. The exploit can be triggered remotely by an attacker.
CVSS Score: 3.5 (LOW)
References: https://www.withsecure.com/en/support/security-advisories; https://www.withsecure.com/en/support/security-advisories
CVE: CVE-2022-29476
Published: 2022-08-23
Description: Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability in 8 Degree Themes otification Bar for WordPress plugin <= 1.1.8 at WordPress.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/8-degree-notification-bar/wordpress-notification-bar-for-wordpress-plugin-1-1-8-unauthenticated-stored-cross-site-scripting-xss-vulnerability; https://wordpress.org/plugins/8-degree-notification-bar/; https://patchstack.com/database/vulnerability/8-degree-notification-bar/wordpress-notification-bar-for-wordpress-plugin-1-1-8-unauthenticated-stored-cross-site-scripting-xss-vulnerability
CVE: CVE-2022-2965
Published: 2022-08-23
Description: Improper Restriction of Rendered UI Layers or Frames in GitHub repository notrinos/notrinoserp prior to 0.7.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-1021
References: https://github.com/notrinos/notrinoserp/commit/c2ff3d8e85a811003b796ca38f5b3290deeaa3aa; https://huntr.dev/bounties/61e3bdf7-3548-45ea-b105-967abc0977f4; https://github.com/notrinos/notrinoserp/commit/c2ff3d8e85a811003b796ca38f5b3290deeaa3aa
CVE: CVE-2022-33142
Published: 2022-08-23
Description: Authenticated (subscriber+) Denial Of Service (DoS) vulnerability in WordPlus WordPress Better Messages plugin <= 1.9.10.57 at WordPress.
CVSS Score: 7.7 (HIGH)
CWE: CWE-400
References: https://patchstack.com/database/vulnerability/bp-better-messages/wordpress-better-messages-plugin-1-9-10-57-denial-of-service-dos-vulnerability; https://wordpress.org/plugins/bp-better-messages/#developers; https://patchstack.com/database/vulnerability/bp-better-messages/wordpress-better-messages-plugin-1-9-10-57-denial-of-service-dos-vulnerability
CVE: CVE-2022-34648
Published: 2022-08-23
Description: Authenticated (author+) Stored Cross-Site Scripting (XSS) vulnerability in dmitrylitvinov Uploading SVG, WEBP and ICO files plugin <= 1.0.1 at WordPress.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/uploading-svgwebp-and-ico-files/wordpress-uploading-svg-webp-and-ico-files-plugin-1-0-0-authenticated-stored-cross-site-scripting-xss-vulnerability; https://wordpress.org/plugins/uploading-svgwebp-and-ico-files/#developers; https://patchstack.com/database/vulnerability/uploading-svgwebp-and-ico-files/wordpress-uploading-svg-webp-and-ico-files-plugin-1-0-0-authenticated-stored-cross-site-scripting-xss-vulnerability
CVE: CVE-2022-34658
Published: 2022-08-23
Description: Multiple Authenticated (contributor+) Persistent Cross-Site Scripting (XSS) vulnerabilities in W3 Eden Download Manager plugin <= 3.2.48 at WordPress.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/download-manager/wordpress-download-manager-plugin-3-2-48-multiple-authenticated-persistent-cross-site-scripting-xss-vulnerabilities; https://wordpress.org/plugins/download-manager/#developers; https://patchstack.com/database/vulnerability/download-manager/wordpress-download-manager-plugin-3-2-48-multiple-authenticated-persistent-cross-site-scripting-xss-vulnerabilities
CVE: CVE-2022-34868
Published: 2022-08-23
Description: Authenticated Arbitrary Settings Update vulnerability in YooMoney ЮKassa для WooCommerce plugin <= 2.3.0 at WordPress.
CVSS Score: 8.8 (HIGH)
CWE: CWE-264
References: https://patchstack.com/database/vulnerability/yookassa/wordpress-yukassa-dlya-woocommerce-plugin-2-3-0-authenticated-arbitrary-settings-update-vulnerability; https://wordpress.org/plugins/yookassa/#developers; https://patchstack.com/database/vulnerability/yookassa/wordpress-yukassa-dlya-woocommerce-plugin-2-3-0-authenticated-arbitrary-settings-update-vulnerability
CVE: CVE-2022-35235
Published: 2022-08-23
Description: Authenticated (admin+) Arbitrary File Read vulnerability in XplodedThemes WPide plugin <= 2.6 at WordPress.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-22, CWE-22, CWE-552
References: https://patchstack.com/database/vulnerability/wpide/wordpress-wpide-plugin-2-6-authenticated-arbitrary-file-read-vulnerability; https://wordpress.org/plugins/wpide/#developers; https://patchstack.com/database/vulnerability/wpide/wordpress-wpide-plugin-2-6-authenticated-arbitrary-file-read-vulnerability
CVE: CVE-2022-35242
Published: 2022-08-23
Description: Unauthenticated plugin settings change vulnerability in 59sec THE Leads Management System: 59sec LITE plugin <= 3.4.1 at WordPress.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264
References: https://patchstack.com/database/vulnerability/59sec-lite-contact-form-7-push-notifications-on-ios-and-android/wordpress-the-leads-management-system-59sec-lite-plugin-3-4-1-unauthenticated-plugin-settings-change-vulnerability; https://wordpress.org/plugins/59sec-lite-contact-form-7-push-notifications-on-ios-and-android/; https://patchstack.com/database/vulnerability/59sec-lite-contact-form-7-push-notifications-on-ios-and-android/wordpress-the-leads-management-system-59sec-lite-plugin-3-4-1-unauthenticated-plugin-settings-change-vulnerability
CVE: CVE-2022-35726
Published: 2022-08-23
Description: Broken Authentication vulnerability in yotuwp Video Gallery plugin <= 1.3.4.5 at WordPress.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-287, CWE-287
References: https://patchstack.com/database/vulnerability/yotuwp-easy-youtube-embed/wordpress-video-gallery-plugin-1-3-4-5-broken-authentication; https://wordpress.org/plugins/yotuwp-easy-youtube-embed/#developers; https://patchstack.com/database/vulnerability/yotuwp-easy-youtube-embed/wordpress-video-gallery-plugin-1-3-4-5-broken-authentication
CVE: CVE-2022-36282
Published: 2022-08-23
Description: Authenticated (editor+) Stored Cross-Site Scripting (XSS) vulnerability in Roman Pronskiy's Search Exclude plugin <= 1.2.6 at WordPress.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/search-exclude/wordpress-search-exclude-plugin-1-2-6-authenticated-stored-cross-site-scripting-xss-vulnerability; https://wordpress.org/plugins/search-exclude/#developers; https://patchstack.com/database/vulnerability/search-exclude/wordpress-search-exclude-plugin-1-2-6-authenticated-stored-cross-site-scripting-xss-vulnerability
CVE: CVE-2022-36285
Published: 2022-08-23
Description: Authenticated Arbitrary File Upload vulnerability in dmitrylitvinov Uploading SVG, WEBP and ICO files plugin <= 1.0.1 at WordPress.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: https://patchstack.com/database/vulnerability/uploading-svgwebp-and-ico-files/wordpress-uploading-svg-webp-and-ico-files-plugin-1-0-0-authenticated-arbitrary-file-upload-vulnerability; https://wordpress.org/plugins/uploading-svgwebp-and-ico-files/#developers; https://patchstack.com/database/vulnerability/uploading-svgwebp-and-ico-files/wordpress-uploading-svg-webp-and-ico-files-plugin-1-0-0-authenticated-arbitrary-file-upload-vulnerability
CVE: CVE-2022-36288
Published: 2022-08-23
Description: Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in W3 Eden Download Manager plugin <= 3.2.48 at WordPress.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/download-manager/wordpress-download-manager-plugin-3-2-48-multiple-cross-site-request-forgery-csrf-vulnerabilities; https://wordpress.org/plugins/download-manager/#developers; https://patchstack.com/database/vulnerability/download-manager/wordpress-download-manager-plugin-3-2-48-multiple-cross-site-request-forgery-csrf-vulnerabilities
CVE: CVE-2022-36292
Published: 2022-08-23
Description: Cross-Site Request Forgery (CSRF) vulnerabilities in WPChill Gallery PhotoBlocks plugin <= 1.2.6 at WordPress.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/photoblocks-grid-gallery/wordpress-gallery-photoblocks-plugin-1-2-6-cross-site-request-forgery-csrf-vulnerabilities; https://wordpress.org/plugins/photoblocks-grid-gallery/; https://patchstack.com/database/vulnerability/photoblocks-grid-gallery/wordpress-gallery-photoblocks-plugin-1-2-6-cross-site-request-forgery-csrf-vulnerabilities
CVE: CVE-2022-36341
Published: 2022-08-23
Description: Authenticated (subscriber+) plugin settings change leading to Stored Cross-Site Scripting (XSS) vulnerability in Akash soni's AS – Create Pinterest Pinboard Pages plugin <= 1.0 at WordPress.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/as-create-pinterest-pinboard-pages/wordpress-as-create-pinterest-pinboard-pages-plugin-1-0-authenticated-plugin-settings-change-leading-to-stored-cross-site-scripting-xss-vulnerability; https://wordpress.org/plugins/as-create-pinterest-pinboard-pages/; https://patchstack.com/database/vulnerability/as-create-pinterest-pinboard-pages/wordpress-as-create-pinterest-pinboard-pages-plugin-1-0-authenticated-plugin-settings-change-leading-to-stored-cross-site-scripting-xss-vulnerability
CVE: CVE-2022-36347
Published: 2022-08-23
Description: Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Alpine Press Alpine PhotoTile for Pinterest plugin <= 1.3.1 at WordPress.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/alpine-photo-tile-for-pinterest/wordpress-alpine-phototile-for-pinterest-plugin-1-3-1-authenticated-stored-cross-site-scripting-xss-vulnerability; https://wordpress.org/plugins/alpine-photo-tile-for-pinterest/; https://patchstack.com/database/vulnerability/alpine-photo-tile-for-pinterest/wordpress-alpine-phototile-for-pinterest-plugin-1-3-1-authenticated-stored-cross-site-scripting-xss-vulnerability
CVE: CVE-2022-36379
Published: 2022-08-23
Description: Cross-Site Request Forgery (CSRF) leading to plugin settings update in YooMoney ЮKassa для WooCommerce plugin <= 2.3.0 at WordPress.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://patchstack.com/database/vulnerability/yookassa/wordpress-yukassa-dlya-woocommerce-plugin-2-3-0-cross-site-request-forgery-csrf-leading-to-plugin-settings-update; https://wordpress.org/plugins/yookassa/#developers; https://patchstack.com/database/vulnerability/yookassa/wordpress-yukassa-dlya-woocommerce-plugin-2-3-0-cross-site-request-forgery-csrf-leading-to-plugin-settings-update
CVE: CVE-2022-36389
Published: 2022-08-23
Description: Cross-Site Request Forgery (CSRF) vulnerability in WordPlus Better Messages plugin <= 1.9.9.148 at WordPress.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/bp-better-messages/wordpress-better-messages-plugin-1-9-9-148-cross-site-request-forgery-csrf-vulnerability-2; https://wordpress.org/plugins/bp-better-messages/#developers; https://patchstack.com/database/vulnerability/bp-better-messages/wordpress-better-messages-plugin-1-9-9-148-cross-site-request-forgery-csrf-vulnerability-2
CVE: CVE-2022-36394
Published: 2022-08-23
Description: Authenticated (author+) SQL Injection (SQLi) vulnerability in Contest Gallery plugin <= 17.0.4 at WordPress.
CVSS Score: 7.6 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/vulnerability/contest-gallery/wordpress-contest-gallery-plugin-17-0-4-authenticated-sql-injection-sqli-vulnerability; https://wordpress.org/plugins/contest-gallery/#developers; https://patchstack.com/database/vulnerability/contest-gallery/wordpress-contest-gallery-plugin-17-0-4-authenticated-sql-injection-sqli-vulnerability
CVE: CVE-2022-36405
Published: 2022-08-23
Description: Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in amCharts: Charts and Maps plugin <= 1.4 at WordPress.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/amcharts-charts-and-maps/wordpress-amcharts-charts-and-maps-plugin-1-4-authenticated-stored-cross-site-scripting-xss-vulnerability; https://wordpress.org/plugins/amcharts-charts-and-maps/#developers; https://patchstack.com/database/vulnerability/amcharts-charts-and-maps/wordpress-amcharts-charts-and-maps-plugin-1-4-authenticated-stored-cross-site-scripting-xss-vulnerability
CVE: CVE-2022-37111
Published: 2022-08-23
Description: BlueCMS 1.6 has SQL injection in line 132 of admin/article.php
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/seizer-zyx/Vulnerability/issues/1; https://github.com/seizer-zyx/Vulnerability/issues/1