deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-21440
Published: 2023-02-09
Description: Improper access control vulnerability in WindowManagerService prior to SMR Feb-2023 Release 1 allows attackers to take a screen capture.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-285, CWE-829
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=02; https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=02
CVE: CVE-2023-21441
Published: 2023-02-09
Description: Insufficient Verification of Data Authenticity vulnerability in Routine prior to versions 2.6.30.6 in Android Q(10), 3.1.21.10 in Android R(11) and 3.5.2.23 in Android S(12) allows local attacker to access protected files via unused code.
CVSS Score: 7.4 (HIGH)
CWE: CWE-345, CWE-345
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=02; https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=02
CVE: CVE-2023-21442
Published: 2023-02-09
Description: Improper access control vulnerability in Runestone application prior to version 2.9.09.003 in Android R(11) and 3.2.01.007 in Android S(12) allows local attackers to get device location information.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-284
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=02; https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=02
CVE: CVE-2023-21443
Published: 2023-02-09
Description: Improper cryptographic implementation in Samsung Flow for Android prior to version 4.9.04 allows adjacent attackers to decrypt encrypted messages or inject commands.
CVSS Score: 7.5 (HIGH)
CWE: CWE-326, CWE-326
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=02; https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=02
CVE: CVE-2023-21444
Published: 2023-02-09
Description: Improper cryptographic implementation in Samsung Flow for PC 4.9.14.0 allows adjacent attackers to decrypt encrypted messages or inject commands.
CVSS Score: 7.5 (HIGH)
CWE: CWE-326, CWE-326
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=02; https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=02
CVE: CVE-2023-21445
Published: 2023-02-09
Description: Improper access control vulnerability in MyFiles prior to versions 12.2.09 in Android R(11), 13.1.03.501 in Android S(12) and 14.1.00.422 in Android T(13) allows local attacker to write file with MyFiles privilege via implicit intent.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-284, CWE-668
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=02; https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=02
CVE: CVE-2023-21446
Published: 2023-02-09
Description: Improper input validation in MyFiles prior to version 12.2.09 in Android R(11), 13.1.03.501 in Android S( 12) and 14.1.00.422 in Android T(13) allows local attacker to access data of MyFiles.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-20
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=02; https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=02
CVE: CVE-2023-21447
Published: 2023-02-09
Description: Improper access control vulnerabilities in Samsung Cloud prior to version 5.3.0.32 allows local attackers to access information with Samsung Cloud&#39;s privilege via implicit intent.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-284, CWE-668
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=02; https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=02
CVE: CVE-2023-21448
Published: 2023-02-09
Description: Path traversal vulnerability in Samsung Cloud prior to version 5.3.0.32 allows attacker to access specific png file.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=02; https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=02
CVE: CVE-2023-21450
Published: 2023-02-09
Description: Missing Authorization vulnerability in One Hand Operation + prior to version 6.1.21 allows multi-users to access owner&#39;s widget without authorization via gesture setting.
CVSS Score: 2.3 (LOW)
CWE: CWE-862, CWE-862
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=02; https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=02
CVE: CVE-2023-21451
Published: 2023-02-09
Description: A Stack-based overflow vulnerability in IpcRxEmbmsSessionList in SECRIL prior to Android S(12) allows attacker to cause memory corruptions.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-20, CWE-787
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=04; https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=04
CVE: CVE-2022-43550
Published: 2023-02-09
Description: A command injection vulnerability exists in Jitsi before commit 8aa7be58522f4264078d54752aae5483bfd854b2 when launching browsers on Windows which could allow an attacker to insert an arbitrary URL which opens up the opportunity to remote execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-77
References: https://github.com/jitsi/jitsi/commit/8aa7be58522f4264078d54752aae5483bfd854b2; https://github.com/jitsi/jitsi/commit/8aa7be58522f4264078d54752aae5483bfd854b2
CVE: CVE-2022-43552
Published: 2023-02-09
Description: A use after free vulnerability exists in curl <7.87.0. Curl can be asked to *tunnel* virtually all protocols it supports through an HTTP proxy. HTTP proxies can (and often do) deny such tunnel operations. When getting denied to tunnel the specific protocols SMB or TELNET, curl would use a heap-allocated struct after it had been freed, in its transfer shutdown code path.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-416, CWE-416, CWE-416
References: http://seclists.org/fulldisclosure/2023/Mar/17; https://hackerone.com/reports/1764858; https://security.gentoo.org/glsa/202310-12
CVE: CVE-2022-44566
Published: 2023-02-09
Description: A denial of service vulnerability present in ActiveRecord's PostgreSQL adapter <7.0.4.1 and <6.1.7.1. When a value outside the range for a 64bit signed integer is provided to the PostgreSQL connection adapter, it will treat the target column type as numeric. Comparing integer values against numeric values can result in a slow sequential scan resulting in potential Denial of Service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://code.jeremyevans.net/2022-11-01-forcing-sequential-scans-on-postgresql.html; https://discuss.rubyonrails.org/t/cve-2022-44566-possible-denial-of-service-vulnerability-in-activerecords-postgresql-adapter/82119; https://code.jeremyevans.net/2022-11-01-forcing-sequential-scans-on-postgresql.html
CVE: CVE-2022-44570
Published: 2023-02-09
Description: A denial of service vulnerability in the Range header parsing component of Rack >= 1.5.0. A Carefully crafted input can cause the Range header parsing component in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. Any applications that deal with Range requests (such as streaming applications, or applications that serve files) may be impacted.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-1333
References: https://discuss.rubyonrails.org/t/cve-2022-44570-possible-denial-of-service-vulnerability-in-racks-range-header-parsing/82125; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.debian.org/security/2023/dsa-5530
CVE: CVE-2022-44571
Published: 2023-02-09
Description: There is a denial of service vulnerability in the Content-Disposition parsingcomponent of Rack fixed in 2.0.9.2, 2.1.4.2, 2.2.4.1, 3.0.0.1. This could allow an attacker to craft an input that can cause Content-Disposition header parsing in Rackto take an unexpected amount of time, possibly resulting in a denial ofservice attack vector. This header is used typically used in multipartparsing. Any applications that parse multipart posts using Rack (virtuallyall Rails applications) are impacted.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-1333
References: https://discuss.rubyonrails.org/t/cve-2022-44571-possible-denial-of-service-vulnerability-in-rack-content-disposition-parsing/82126; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.debian.org/security/2023/dsa-5530
CVE: CVE-2022-44572
Published: 2023-02-09
Description: A denial of service vulnerability in the multipart parsing component of Rack fixed in 2.0.9.2, 2.1.4.2, 2.2.4.1 and 3.0.0.1 could allow an attacker tocraft input that can cause RFC2183 multipart boundary parsing in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. Any applications that parse multipart posts using Rack (virtually all Rails applications) are impacted.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-1333
References: https://hackerone.com/reports/1639882; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.debian.org/security/2023/dsa-5530
CVE: CVE-2023-22792
Published: 2023-02-09
Description: A regular expression based DoS vulnerability in Action Dispatch <6.0.6.1,< 6.1.7.1, and <7.0.4.1. Specially crafted cookies, in combination with a specially crafted X_FORWARDED_HOST header can cause the regular expression engine to enter a state of catastrophic backtracking. This can cause the process to use large amounts of CPU and memory, leading to a possible DoS vulnerability All users running an affected release should either upgrade or use one of the workarounds immediately.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-1333
References: https://discuss.rubyonrails.org/t/cve-2023-22792-possible-redos-based-dos-vulnerability-in-action-dispatch/82115; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.debian.org/security/2023/dsa-5372
CVE: CVE-2023-22794
Published: 2023-02-09
Description: A vulnerability in ActiveRecord <6.0.6.1, v6.1.7.1 and v7.0.4.1 related to the sanitization of comments. If malicious user input is passed to either the `annotate` query method, the `optimizer_hints` query method, or through the QueryLogs interface which automatically adds annotations, it may be sent to the database withinsufficient sanitization and be able to inject SQL outside of the comment.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://discuss.rubyonrails.org/t/cve-2023-22794-sql-injection-vulnerability-via-activerecord-comments/82117; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.debian.org/security/2023/dsa-5372
CVE: CVE-2023-22795
Published: 2023-02-09
Description: A regular expression based DoS vulnerability in Action Dispatch <6.1.7.1 and <7.0.4.1 related to the If-None-Match header. A specially crafted HTTP If-None-Match header can cause the regular expression engine to enter a state of catastrophic backtracking, when on a version of Ruby below 3.2.0. This can cause the process to use large amounts of CPU and memory, leading to a possible DoS vulnerability All users running an affected release should either upgrade or use one of the workarounds immediately.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-1333
References: https://discuss.rubyonrails.org/t/cve-2023-22795-possible-redos-based-dos-vulnerability-in-action-dispatch/82118; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.debian.org/security/2023/dsa-5372
CVE: CVE-2023-22796
Published: 2023-02-09
Description: A regular expression based DoS vulnerability in Active Support <6.1.7.1 and <7.0.4.1. A specially crafted string passed to the underscore method can cause the regular expression engine to enter a state of catastrophic backtracking. This can cause the process to use large amounts of CPU and memory, leading to a possible DoS vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-1333
References: https://discuss.rubyonrails.org/t/cve-2023-22796-possible-redos-based-dos-vulnerability-in-active-supports-underscore/82116; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.debian.org/security/2023/dsa-5372
CVE: CVE-2023-22797
Published: 2023-02-09
Description: An open redirect vulnerability is fixed in Rails 7.0.4.1 with the new protection against open redirects from calling redirect_to with untrusted user input. In prior versions the developer was fully responsible for only providing trusted input. However the check introduced could allow an attacker to bypass with a carefully crafted URL resulting in an open redirect vulnerability.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601, CWE-601
References: https://discuss.rubyonrails.org/t/cve-2023-22799-possible-redos-based-dos-vulnerability-in-globalid/82127; https://discuss.rubyonrails.org/t/cve-2023-22799-possible-redos-based-dos-vulnerability-in-globalid/82127
CVE: CVE-2023-22798
Published: 2023-02-09
Description: Prior to commit 51867e0d15a6d7f80d5b714fd0e9976b9c160bb0, https://github.com/brave/adblock-lists removed redirect interceptors on some websites like Facebook in which the redirect interceptor may have been there for security purposes. This could potentially cause open redirects on these websites. Brave's redirect interceptor removal feature is known as "debouncing" and is intended to remove unnecessary redirects that track users across the web.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601, CWE-601
References: https://hackerone.com/reports/1579374; https://hackerone.com/reports/1579374
CVE: CVE-2023-22799
Published: 2023-02-09
Description: A ReDoS based DoS vulnerability in the GlobalID <1.0.1 which could allow an attacker supplying a carefully crafted input can cause the regular expression engine to take an unexpected amount of time. All users running an affected release should either upgrade or use one of the workarounds immediately.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-1333
References: https://discuss.rubyonrails.org/t/cve-2023-22799-possible-redos-based-dos-vulnerability-in-globalid/82127; https://discuss.rubyonrails.org/t/cve-2023-22799-possible-redos-based-dos-vulnerability-in-globalid/82127
CVE: CVE-2023-23912
Published: 2023-02-09
Description: A vulnerability, found in EdgeRouters Version 2.0.9-hotfix.5 and earlier and UniFi Security Gateways (USG) Version 4.4.56 and earlier with their DHCPv6 prefix delegation set to dhcpv6-stateless or dhcpv6-stateful, allows a malicious actor directly connected to the WAN interface of an affected device to create a remote code execution vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-75, CWE-94, CWE-94
References: https://community.ui.com/releases/Security-Advisory-Bulletin-028-028/696e4e3b-718c-4da4-9a21-965a85633b5f; https://community.ui.com/releases/Security-Advisory-Bulletin-028-028/696e4e3b-718c-4da4-9a21-965a85633b5f
CVE: CVE-2023-24322
Published: 2023-02-09
Description: A reflected cross-site scripting (XSS) vulnerability in the FileDialog.aspx component of mojoPortal v2.7.0.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the ed and tbi parameters.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/blakduk/Advisories/blob/main/Mojoportal/README.md; https://github.com/i7MEDIA/mojoportal/; https://www.mojoportal.com/
CVE: CVE-2023-24323
Published: 2023-02-09
Description: Mojoportal v2.7 was discovered to contain an authenticated XML external entity (XXE) injection vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-611, CWE-611
References: https://github.com/blakduk/Advisories/blob/main/Mojoportal/README.md; https://github.com/i7MEDIA/mojoportal; https://www.mojoportal.com/
CVE: CVE-2023-24687
Published: 2023-02-09
Description: Mojoportal v2.7.0.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Company Info Settings component. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the txtCompanyName parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/blakduk/Advisories/blob/main/Mojoportal/README.md; https://github.com/i7MEDIA/mojoportal/; https://www.mojoportal.com/
CVE: CVE-2023-24688
Published: 2023-02-09
Description: An issue in Mojoportal v2.7.0.0 allows an unauthenticated attacker to register a new user even if the Allow User Registrations feature is disabled.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-284
References: https://github.com/blakduk/Advisories/blob/main/Mojoportal/README.md; https://www.mojoportal.com/; https://github.com/blakduk/Advisories/blob/main/Mojoportal/README.md
CVE: CVE-2023-24689
Published: 2023-02-09
Description: An issue in Mojoportal v2.7.0.0 and below allows an authenticated attacker to list all css files inside the root path of the webserver via manipulation of the "s" parameter in /DesignTools/ManageSkin.aspx
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://github.com/blakduk/Advisories/blob/main/Mojoportal/README.md; https://www.mojoportal.com/; https://github.com/blakduk/Advisories/blob/main/Mojoportal/README.md
CVE: CVE-2022-21939
Published: 2023-02-09
Description: Sensitive Cookie Without 'HttpOnly' Flag vulnerability in Johnson Controls System Configuration Tool (SCT) version 14 prior to 14.2.3 and version 15 prior to 15.0.3 could allow access to the cookie.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1004, CWE-732
References: https://www.cisa.gov/uscert/ics/advisories/icsa-23-040-03; https://www.johnsoncontrols.com/cyber-solutions/security-advisories; https://www.cisa.gov/uscert/ics/advisories/icsa-23-040-03
CVE: CVE-2022-21940
Published: 2023-02-09
Description: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute vulnerability in Johnson Controls System Configuration Tool (SCT) version 14 prior to 14.2.3 and version 15 prior to 15.0.3 could allow access to the cookie.
CVSS Score: 7.5 (HIGH)
CWE: CWE-614, CWE-311
References: https://www.cisa.gov/uscert/ics/advisories/icsa-23-040-03; https://www.johnsoncontrols.com/cyber-solutions/security-advisories; https://www.cisa.gov/uscert/ics/advisories/icsa-23-040-03
CVE: CVE-2023-23625
Published: 2023-02-09
Description: go-unixfs is an implementation of a unix-like filesystem on top of an ipld merkledag. Trying to read malformed HAMT sharded directories can cause panics and virtual memory leaks. If you are reading untrusted user input, an attacker can then trigger a panic. This is caused by bogus `fanout` parameter in the HAMT directory nodes. Users are advised to upgrade to version 0.4.3 to resolve this issue. Users unable to upgrade should not feed untrusted user data to the decoding functions.

CVSS Score: 5.9 (MEDIUM)
CWE: CWE-400
References: https://github.com/ipfs/go-unixfs/commit/467d139a640ecee4f2e74643dafcc58bb3b54175; https://github.com/ipfs/go-unixfs/security/advisories/GHSA-q264-w97q-q778; https://github.com/ipfs/go-unixfs/commit/467d139a640ecee4f2e74643dafcc58bb3b54175
CVE: CVE-2023-23626
Published: 2023-02-09
Description: go-bitfield is a simple bitfield package for the go language aiming to be more performant that the standard library. When feeding untrusted user input into the size parameter of `NewBitfield` and `FromBytes` functions, an attacker can trigger `panic`s. This happen when the `size` is a not a multiple of `8` or is negative. There were already a note in the `NewBitfield` documentation, however known users of this package are subject to this issue. Users are advised to upgrade. Users unable to upgrade should ensure that `size` is a multiple of 8 before calling `NewBitfield` or `FromBytes`.

CVSS Score: 5.9 (MEDIUM)
CWE: CWE-754, CWE-1284
References: https://github.com/ipfs/go-bitfield/commit/5e1d256fe043fc4163343ccca83862c69c52e579; https://github.com/ipfs/go-bitfield/security/advisories/GHSA-2h6c-j3gf-xp9r; https://github.com/ipfs/go-bitfield/commit/5e1d256fe043fc4163343ccca83862c69c52e579
CVE: CVE-2023-23631
Published: 2023-02-09
Description: github.com/ipfs/go-unixfsnode is an ADL IPLD prime node that wraps go-codec-dagpb's implementation of protobuf to enable pathing. In versions priot to 1.5.2 trying to read malformed HAMT sharded directories can cause panics and virtual memory leaks.
If you are reading untrusted user input, an attacker can then trigger a panic. This is caused by bogus fanout parameter in the HAMT directory nodes. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-400
References: https://github.com/ipfs/go-unixfsnode/commit/59050ea8bc458ae55246ae09243e6e165923e076; https://github.com/ipfs/go-unixfsnode/commit/91b3d39d33ef0cd2aff2c95d50b[PII_REDACTED]b68; https://github.com/ipfs/go-unixfsnode/commit/a4ed723727e0bdc[PII_REDACTED]c2fc0d82802d122
CVE: CVE-2023-0770
Published: 2023-02-09
Description: Stack-based Buffer Overflow in GitHub repository gpac/gpac prior to 2.2.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://github.com/gpac/gpac/commit/c31941822ee275a35bc148382bafef1c53ec1c26; https://huntr.dev/bounties/e0fdeee5-7909-446e-9bd0-db80fd80e8dd; https://www.debian.org/security/2023/dsa-5411
CVE: CVE-2023-23592
Published: 2023-02-09
Description: WALLIX Access Manager 3.x through 4.0.x allows a remote attacker to access sensitive information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://wallix.com; https://www.wallix.com/support/alerts/; https://wallix.com
CVE: CVE-2023-24684
Published: 2023-02-09
Description: ChurchCRM v4.5.3 and below was discovered to contain a SQL injection vulnerability via the EID parameter at GetText.php.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: http://churchcrm.io/; https://github.com/ChurchCRM/CRM; https://github.com/blakduk/Advisories/blob/main/ChurchCRM/README.md
CVE: CVE-2023-24685
Published: 2023-02-09
Description: ChurchCRM v4.5.3 and below was discovered to contain a SQL injection vulnerability via the Event parameter under the Event Attendance reports module.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: http://churchcrm.io/; http://packetstormsecurity.com/files/172047/ChurchCRM-4.5.3-SQL-Injection.html; https://github.com/ChurchCRM/CRM/
CVE: CVE-2023-24686
Published: 2023-02-09
Description: An issue in the CSV Import function of ChurchCRM v4.5.3 and below allows attackers to execute arbitrary code via importing a crafted CSV file.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://churchcrm.io/; https://github.com/ChurchCRM/CRM; https://github.com/blakduk/Advisories/blob/main/ChurchCRM/README.md
CVE: CVE-2023-24690
Published: 2023-02-09
Description: ChurchCRM 4.5.3 and below was discovered to contain a stored cross-site scripting (XSS) vulnerability at /api/public/register/family.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://churchcrm.io/; https://github.com/blakduk/Advisories/blob/main/ChurchCRM/README.md; http://churchcrm.io/
CVE: CVE-2015-10076
Published: 2023-02-09
Description: A vulnerability was found in dimtion Shaarlier up to 1.2.2. It has been declared as critical. Affected by this vulnerability is the function createTag of the file app/src/main/java/com/dimtion/shaarlier/TagsSource.java of the component Tag Handler. The manipulation leads to sql injection. Upgrading to version 1.2.3 is able to address this issue. The identifier of the patch is 3d1d9b239d9b3cd87e8bed45a0f02da583ad371e. It is recommended to upgrade the affected component. The identifier VDB-220453 was assigned to this vulnerability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/dimtion/Shaarlier/commit/3d1d9b239d9b3cd87e8bed45a0f02da583ad371e; https://github.com/dimtion/Shaarlier/releases/tag/v1.2.3; https://vuldb.com/?ctiid.220453