deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-26473
Published: 2022-10-07
Description: In vdec fmt, there is a possible use after free due to improper locking. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07342197; Issue ID: ALPS07342197.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-667
References: https://corp.mediatek.com/product-security-bulletin/October-2022; https://corp.mediatek.com/product-security-bulletin/October-2022
CVE: CVE-2022-26474
Published: 2022-10-07
Description: In sensorhub, there is a possible out of bounds write due to an incorrect calculation of buffer size. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07129717; Issue ID: ALPS07129717.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-131
References: https://corp.mediatek.com/product-security-bulletin/October-2022; https://corp.mediatek.com/product-security-bulletin/October-2022
CVE: CVE-2022-26475
Published: 2022-10-07
Description: In wlan, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07310743; Issue ID: ALPS07310743.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://corp.mediatek.com/product-security-bulletin/October-2022; https://corp.mediatek.com/product-security-bulletin/October-2022
CVE: CVE-2022-32589
Published: 2022-10-07
Description: In Wi-Fi driver, there is a possible way to disconnect Wi-Fi due to an improper resource release. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07030600; Issue ID: ALPS07030600.
CVSS Score: 7.5 (HIGH)
CWE: CWE-404
References: https://corp.mediatek.com/product-security-bulletin/October-2022; https://corp.mediatek.com/product-security-bulletin/October-2022
CVE: CVE-2022-32590
Published: 2022-10-07
Description: In wlan, there is a possible use after free due to an incorrect status check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07299425; Issue ID: ALPS07299425.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-754
References: https://corp.mediatek.com/product-security-bulletin/October-2022; https://corp.mediatek.com/product-security-bulletin/October-2022
CVE: CVE-2022-32591
Published: 2022-10-07
Description: In ril, there is a possible system crash due to an incorrect bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07257259; Issue ID: ALPS07257259.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://corp.mediatek.com/product-security-bulletin/October-2022; https://corp.mediatek.com/product-security-bulletin/October-2022
CVE: CVE-2022-32592
Published: 2022-10-07
Description: In cpu dvfs, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07139405; Issue ID: ALPS07139405.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://corp.mediatek.com/product-security-bulletin/October-2022; https://corp.mediatek.com/product-security-bulletin/October-2022
CVE: CVE-2022-32593
Published: 2022-10-07
Description: In vowe, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07138493; Issue ID: ALPS07138493.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://corp.mediatek.com/product-security-bulletin/October-2022; https://corp.mediatek.com/product-security-bulletin/October-2022
CVE: CVE-2022-36634
Published: 2022-10-07
Description: An access control issue in ZKTeco ZKBioSecurity V5000 3.0.5_r allows attackers to arbitrarily create admin users via a crafted HTTP request.
CVSS Score: 8.8 (HIGH)
CWE: CWE-863
References: http://zkbiosecurity.com; http://zkteco.com; https://seclists.org/fulldisclosure/2022/Sep/29
CVE: CVE-2022-39287
Published: 2022-10-07
Description: tiny-csrf is a Node.js cross site request forgery (CSRF) protection middleware. In versions prior to 1.1.0 cookies were not encrypted and thus CSRF tokens were transmitted in the clear. This issue has been addressed in commit `8eead6d` and the patch with be included in version 1.1.0. Users are advised to upgrade. There are no known workarounds for this issue.
CVSS Score: 8.1 (HIGH)
CWE: CWE-319
References: https://github.com/valexandersaulys/tiny-csrf/commit/8eead6da3b56e290512bbe8d20c2c5df3be317ba; https://github.com/valexandersaulys/tiny-csrf/security/advisories/GHSA-pj2c-h76w-vv6f; https://github.com/valexandersaulys/tiny-csrf/commit/8eead6da3b56e290512bbe8d20c2c5df3be317ba
CVE: CVE-2022-31680
Published: 2022-10-07
Description: The vCenter Server contains an unsafe deserialisation vulnerability in the PSC (Platform services controller). A malicious actor with admin access on vCenter server may exploit this issue to execute arbitrary code on the underlying operating system that hosts the vCenter Server.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-502
References: https://www.talosintelligence.com/vulnerability_reports/TALOS-2022-1587; https://www.vmware.com/security/advisories/VMSA-2022-0025.html; https://www.talosintelligence.com/vulnerability_reports/TALOS-2022-1587
CVE: CVE-2022-31681
Published: 2022-10-07
Description: VMware ESXi contains a null-pointer deference vulnerability. A malicious actor with privileges within the VMX process only, may create a denial of service condition on the host.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: https://www.vmware.com/security/advisories/VMSA-2022-0025.html; https://www.vmware.com/security/advisories/VMSA-2022-0025.html
CVE: CVE-2022-39285
Published: 2022-10-07
Description: ZoneMinder is a free, open source Closed-circuit television software application The file parameter is vulnerable to a cross site scripting vulnerability (XSS) by backing out of the current "tr" "td" brackets. This then allows a malicious user to provide code that will execute when a user views the specific log on the "view=log" page. This vulnerability allows an attacker to store code within the logs that will be executed when loaded by a legitimate user. These actions will be performed with the permission of the victim. This could lead to data loss and/or further exploitation including account takeover. This issue has been addressed in versions `1.36.27` and `1.37.24`. Users are advised to upgrade. Users unable to upgrade should disable database logging.
CVSS Score: 7.6 (HIGH)
CWE: CWE-79
References: http://packetstormsecurity.com/files/171498/Zoneminder-Log-Injection-XSS-Cross-Site-Request-Forgery.html; https://github.com/ZoneMinder/zoneminder/commit/c0a4c05e84eea0f6ccf7169c014efe5422c9ba0d; https://github.com/ZoneMinder/zoneminder/commit/d289eb48601a76e34feea3c[PII_REDACTED]b1fae59
CVE: CVE-2022-39289
Published: 2022-10-07
Description: ZoneMinder is a free, open source Closed-circuit television software application. In affected versions the ZoneMinder API Exposes Database Log contents to user without privileges, allows insertion, modification, deletion of logs without System Privileges. Users are advised yo upgrade as soon as possible. Users unable to upgrade should disable database logging.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-200, CWE-287, CWE-862
References: https://github.com/ZoneMinder/zoneminder/commit/34ffd92bf123070cab6c83ad4cfe6297dd0ed0b4; https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-mpcx-3gvh-9488; https://github.com/ZoneMinder/zoneminder/commit/34ffd92bf123070cab6c83ad4cfe6297dd0ed0b4
CVE: CVE-2022-39290
Published: 2022-10-07
Description: ZoneMinder is a free, open source Closed-circuit television software application. In affected versions authenticated users can bypass CSRF keys by modifying the request supplied to the Zoneminder web application. These modifications include replacing HTTP POST with an HTTP GET and removing the CSRF key from the request. An attacker can take advantage of this by using an HTTP GET request to perform actions with no CSRF protection. This could allow an attacker to cause an authenticated user to perform unexpected actions on the web application. Users are advised to upgrade as soon as possible. There are no known workarounds for this issue.
CVSS Score: 8.0 (HIGH)
CWE: CWE-287, CWE-287
References: http://packetstormsecurity.com/files/171498/Zoneminder-Log-Injection-XSS-Cross-Site-Request-Forgery.html; https://github.com/ZoneMinder/zoneminder/commit/c0a4c05e84eea0f6ccf7169c014efe5422c9ba0d; https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-xgv6-qv6c-399q
CVE: CVE-2022-39291
Published: 2022-10-07
Description: ZoneMinder is a free, open source Closed-circuit television software application. Affected versions of zoneminder are subject to a vulnerability which allows users with "View" system permissions to inject new data into the logs stored by Zoneminder. This was observed through an HTTP POST request containing log information to the "/zm/index.php" endpoint. Submission is not rate controlled and could affect database performance and/or consume all storage resources. Users are advised to upgrade. There are no known workarounds for this issue.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-20
References: http://packetstormsecurity.com/files/171498/Zoneminder-Log-Injection-XSS-Cross-Site-Request-Forgery.html; https://github.com/ZoneMinder/zoneminder/commit/34ffd92bf123070cab6c83ad4cfe6297dd0ed0b4; https://github.com/ZoneMinder/zoneminder/commit/73d9f2482cdcb[PII_REDACTED]98d3cf92546f9e40c
CVE: CVE-2022-3275
Published: 2022-10-07
Description: Command injection is possible in the puppetlabs-apt module prior to version 9.0.0. A malicious actor is able to exploit this vulnerability only if they are able to provide unsanitized input to the module. This condition is rare in most deployments of Puppet and Puppet Enterprise.
CVSS Score: 8.4 (HIGH)
CWE: CWE-78
References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CH4NUKZKPY4MFQHFBTONJK2AWES4DFDA/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YR5LIOF5VKS4DC2NQWXTMPPXOYJC46XC/; https://puppet.com/security/cve/CVE-2022-3275
CVE: CVE-2022-3276
Published: 2022-10-07
Description: Command injection is possible in the puppetlabs-mysql module prior to version 13.0.0. A malicious actor is able to exploit this vulnerability only if they are able to provide unsanitized input to the module. This condition is rare in most deployments of Puppet and Puppet Enterprise.
CVSS Score: 8.4 (HIGH)
CWE: CWE-78
References: https://puppet.com/security/cve/CVE-2022-3276; https://puppet.com/security/cve/CVE-2022-3276
CVE: CVE-2022-41574
Published: 2022-10-07
Description: An access-control vulnerability in Gradle Enterprise 2022.4 through 2022.3.1 allows remote attackers to prevent backups from occurring, and send emails with arbitrary text content to the configured installation-administrator contact address, via HTTP access to an accidentally exposed internal endpoint. This is fixed in 2022.3.2.
CVSS Score: 7.5 (HIGH)
CWE: CWE-863
References: https://security.gradle.com; https://security.gradle.com/advisory/2022-12; https://security.gradle.com
CVE: CVE-2022-39959
Published: 2022-10-07
Description: Panini Everest Engine 2.0.4 allows unprivileged users to create a file named Everest.exe in the %PROGRAMDATA%\Panini folder. This leads to privilege escalation because a service, running as SYSTEM, uses the unquoted path of %PROGRAMDATA%\Panini\Everest Engine\EverestEngine.exe and therefore a Trojan horse %PROGRAMDATA%\Panini\Everest.exe may be executed instead of the intended vendor-supplied EverestEngine.exe file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-428
References: https://github.com/usmarine2141/CVE-2022-39959; https://www.panini.com/en/news-events/panini-patents-revolutionary-new-%E2%80%9Ceverest%E2%80%9D-architecture; https://github.com/usmarine2141/CVE-2022-39959
CVE: CVE-2022-41442
Published: 2022-10-07
Description: PicUploader v2.6.3 was discovered to contain cross-site scripting (XSS) vulnerability via the setStorageParams function in SettingController.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/xiebruce/PicUploader/commit/2b0411bddb7942e0ace136a82d4ccde0fe66f263; https://github.com/xiebruce/PicUploader/issues/80; https://github.com/xiebruce/PicUploader/commit/2b0411bddb7942e0ace136a82d4ccde0fe66f263
CVE: CVE-2022-36635
Published: 2022-10-07
Description: ZKteco ZKBioSecurity V5000 4.1.3 was discovered to contain a SQL injection vulnerability via the component /baseOpLog.do.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: http://zkbiosecurity.com; http://zkteco.com; https://medium.com/stolabs/cve-2022-36635-a-sql-injection-in-zksecuritybio-to-rce-c5bde2962d47
CVE: CVE-2022-39281
Published: 2022-10-08
Description: fat_free_crm is a an open source, Ruby on Rails customer relationship management platform (CRM). In versions prior to 0.20.1 an authenticated user can perform a remote Denial of Service attack against Fat Free CRM via bucket access. The vulnerability has been patched in commit `c85a254` and will be available in release `0.20.1`. Users are advised to upgrade or to manually apply patch `c85a254`. There are no known workarounds for this issue.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://github.com/fatfreecrm/fat_free_crm/commit/c85a2546348c2692d32f952c753f7f0b43d1ca71; https://github.com/fatfreecrm/fat_free_crm/releases/tag/v0.20.1; https://github.com/fatfreecrm/fat_free_crm/security/advisories/GHSA-p75c-5x3h-cxcg
CVE: CVE-2022-3434
Published: 2022-10-08
Description: A vulnerability was found in SourceCodester Web-Based Student Clearance System. It has been rated as problematic. Affected by this issue is the function prepare of the file /Admin/add-student.php. The manipulation leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-210356.
CVSS Score: 3.5 (LOW)
CWE: CWE-707, CWE-79
References: https://vuldb.com/?id.210356; https://www.jianshu.com/p/489bca847079; https://vuldb.com/?id.210356
CVE: CVE-2022-3435
Published: 2022-10-08
Description: A vulnerability classified as problematic has been found in Linux Kernel. This affects the function fib_nh_match of the file net/ipv4/fib_semantics.c of the component IPv4 Handler. The manipulation leads to out-of-bounds read. It is possible to initiate the attack remotely. It is recommended to apply a patch to fix this issue. The identifier VDB-210357 was assigned to this vulnerability.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119
References: https://lists.debian.org/debian-lts-announce/2022/12/msg00031.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GGHENNMLCWIQV2LLA56BJNFIUZ7WB4IY/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/S2KTU5LFZNQS7YNGE56MT46VHMXL3DD2/
CVE: CVE-2022-3436
Published: 2022-10-09
Description: A vulnerability classified as critical was found in SourceCodester Web-Based Student Clearance System 1.0. Affected by this vulnerability is an unknown functionality of the file edit-photo.php of the component Photo Handler. The manipulation leads to unrestricted upload. The attack can be launched remotely. The associated identifier of this vulnerability is VDB-210367.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-266, CWE-434
References: http://packetstormsecurity.com/files/176007/Online-Student-Clearance-System-1.0-Shell-Upload.html; https://vuldb.com/?id.210367; http://packetstormsecurity.com/files/176007/Online-Student-Clearance-System-1.0-Shell-Upload.html
CVE: CVE-2022-42703
Published: 2022-10-09
Description: mm/rmap.c in the Linux kernel before 5.19.7 has a use-after-free related to leaf anon_vma double reuse.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416
References: https://bugs.chromium.org/p/project-zero/issues/detail?id=2351; https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.19.7; https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=2555283eb40df[PII_REDACTED]3121e9393ef9b542b
CVE: CVE-2022-42010
Published: 2022-10-10
Description: An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash when receiving a message with certain invalid type signatures.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-347, CWE-347
References: https://gitlab.freedesktop.org/dbus/dbus/-/issues/418; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E4CO7N226I3X5FNBR2MACCH6TS764VJP/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ND74SKN56BCYL3QLEAAB6E64UUBRA5UG/
CVE: CVE-2022-42011
Published: 2022-10-10
Description: An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash when receiving a message where an array length is inconsistent with the size of the element type.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-129, CWE-129
References: https://gitlab.freedesktop.org/dbus/dbus/-/issues/413; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E4CO7N226I3X5FNBR2MACCH6TS764VJP/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ND74SKN56BCYL3QLEAAB6E64UUBRA5UG/
CVE: CVE-2022-42012
Published: 2022-10-10
Description: An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash by sending a message with attached file descriptors in an unexpected format.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://gitlab.freedesktop.org/dbus/dbus/-/issues/417; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E4CO7N226I3X5FNBR2MACCH6TS764VJP/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ND74SKN56BCYL3QLEAAB6E64UUBRA5UG/
CVE: CVE-2022-42724
Published: 2022-10-10
Description: app/Controller/UsersController.php in MISP before 2.4.164 allows attackers to discover role names (this is information that only the site admin should have).
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863
References: https://github.com/MISP/MISP/commit/934b9cd4fc6d6378ad349ea630ad9f1319ac82f5; https://github.com/MISP/MISP/commit/934b9cd4fc6d6378ad349ea630ad9f1319ac82f5
CVE: CVE-2022-42725
Published: 2022-10-10
Description: Warpinator through 1.2.14 allows access outside of an intended directory, as demonstrated by symbolic directory links.
CVSS Score: 7.5 (HIGH)
CWE: CWE-59
References: http://www.openwall.com/lists/oss-security/2022/10/24/1; http://www.openwall.com/lists/oss-security/2023/04/26/1; https://github.com/linuxmint/warpinator/commit/5244c33d4c109ede9607b9d[PII_REDACTED]0e2cddc
CVE: CVE-2022-3438
Published: 2022-10-10
Description: Open Redirect in GitHub repository ikus060/rdiffweb prior to 2.5.0a4.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://github.com/ikus060/rdiffweb/commit/4d464b467f14b8eb9103d7f5f0774e49995527c7; https://huntr.dev/bounties/bc5689e4-221a-4200-a8ab-42c659f89f67; https://github.com/ikus060/rdiffweb/commit/4d464b467f14b8eb9103d7f5f0774e49995527c7
CVE: CVE-2021-44171
Published: 2022-10-10
Description: A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiOS version 6.0.0 through 6.0.14, FortiOS version 6.2.0 through 6.2.10, FortiOS version 6.4.0 through 6.4.8, FortiOS version 7.0.0 through 7.0.3 allows attacker to execute privileged commands on a linked FortiSwitch via diagnostic CLI commands.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-78
References: https://fortiguard.com/psirt/FG-IR-21-242; https://fortiguard.com/psirt/FG-IR-21-242
CVE: CVE-2022-26121
Published: 2022-10-10
Description: An exposure of resource to wrong sphere vulnerability [CWE-668] in FortiAnalyzer and FortiManager GUI 7.0.0 through 7.0.3, 6.4.0 through 6.4.8, 6.2.0 through 6.2.9, 6.0.0 through 6.0.11, 5.6.0 through 5.6.11 may allow an unauthenticated and remote attacker to access report template images via referencing the name in the URL path.
CVSS Score: 3.7 (LOW)
CWE: CWE-668
References: https://fortiguard.com/psirt/FG-IR-22-026; https://fortiguard.com/psirt/FG-IR-22-026
CVE: CVE-2022-3442
Published: 2022-10-10
Description: A vulnerability was found in Crealogix EBICS 7.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /ebics-server/ebics.aspx. The manipulation leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 7.1 is able to address this issue. It is recommended to upgrade the affected component. VDB-210374 is the identifier assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-707, CWE-79
References: https://vuldb.com/?id.210374; https://www.pentagrid.ch/en/blog/reflected-xss-vulnerability-in-crealogix-ebics-implementation/; https://vuldb.com/?id.210374
CVE: CVE-2022-39292
Published: 2022-10-10
Description: Slack Morphism is a modern client library for Slack Web/Events API/Socket Mode and Block Kit. Debug logs expose sensitive URLs for Slack webhooks that contain private information. The problem is fixed in version 1.3.2 which redacts sensitive URLs for webhooks. As a workaround, people who use Slack webhooks may disable or filter debug logs.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1258
References: https://github.com/abdolence/slack-morphism-rust/releases/tag/v1.3.2; https://github.com/abdolence/slack-morphism-rust/security/advisories/GHSA-4mjx-2gh5-ph8h; https://github.com/abdolence/slack-morphism-rust/releases/tag/v1.3.2
CVE: CVE-2022-40248
Published: 2022-10-10
Description: An HTML injection vulnerability exists in CERT/CC VINCE software prior to 1.50.4. An authenticated attacker can inject arbitrary HTML via form using the "Product Affected" field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-74, CWE-79
References: https://github.com/CERTCC/VINCE/issues?q=label%3Asecurity; https://github.com/CERTCC/VINCE/issues?q=label%3Asecurity
CVE: CVE-2022-40257
Published: 2022-10-10
Description: An HTML injection vulnerability exists in CERT/CC VINCE software prior to 1.50.4. An authenticated attacker can inject arbitrary HTML via a crafted email with HTML content in the Subject field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-74, CWE-79
References: https://github.com/CERTCC/VINCE/issues?q=label%3Asecurity; https://github.com/CERTCC/VINCE/issues?q=label%3Asecurity
CVE: CVE-2021-25044
Published: 2022-10-10
Description: The Cryptocurrency Pricing list and Ticker WordPress plugin through 1.5 does not sanitise and escape the ccpw_setpage parameter before outputting it back in pages where its shortcode is embed, leading to a Reflected Cross-Site Scripting issue
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/dc1507c1-8894-4ab6-b25f-c5e26a425b03; https://wpscan.com/vulnerability/dc1507c1-8894-4ab6-b25f-c5e26a425b03