deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-42345
Published: 2022-12-19
Description: Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb22-59.html; https://helpx.adobe.com/security/products/experience-manager/apsb22-59.html
CVE: CVE-2022-42346
Published: 2022-12-19
Description: Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb22-59.html; https://helpx.adobe.com/security/products/experience-manager/apsb22-59.html
CVE: CVE-2022-42348
Published: 2022-12-19
Description: Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb22-59.html; https://helpx.adobe.com/security/products/experience-manager/apsb22-59.html
CVE: CVE-2022-42349
Published: 2022-12-19
Description: Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb22-59.html; https://helpx.adobe.com/security/products/experience-manager/apsb22-59.html
CVE: CVE-2022-42350
Published: 2022-12-19
Description: Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb22-59.html; https://helpx.adobe.com/security/products/experience-manager/apsb22-59.html
CVE: CVE-2022-42352
Published: 2022-12-19
Description: Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb22-59.html; https://helpx.adobe.com/security/products/experience-manager/apsb22-59.html
CVE: CVE-2022-42354
Published: 2022-12-19
Description: Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb22-59.html; https://helpx.adobe.com/security/products/experience-manager/apsb22-59.html
CVE: CVE-2022-42356
Published: 2022-12-19
Description: Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb22-59.html; https://helpx.adobe.com/security/products/experience-manager/apsb22-59.html
CVE: CVE-2022-42357
Published: 2022-12-19
Description: Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb22-59.html; https://helpx.adobe.com/security/products/experience-manager/apsb22-59.html
CVE: CVE-2022-42362
Published: 2022-12-19
Description: Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb22-59.html; https://helpx.adobe.com/security/products/experience-manager/apsb22-59.html
CVE: CVE-2022-42364
Published: 2022-12-19
Description: Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb22-59.html; https://helpx.adobe.com/security/products/experience-manager/apsb22-59.html
CVE: CVE-2022-42365
Published: 2022-12-19
Description: Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb22-59.html; https://helpx.adobe.com/security/products/experience-manager/apsb22-59.html
CVE: CVE-2022-44463
Published: 2022-12-19
Description: Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb22-59.html; https://helpx.adobe.com/security/products/experience-manager/apsb22-59.html
CVE: CVE-2022-44465
Published: 2022-12-19
Description: Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb22-59.html; https://helpx.adobe.com/security/products/experience-manager/apsb22-59.html
CVE: CVE-2022-44466
Published: 2022-12-19
Description: Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb22-59.html; https://helpx.adobe.com/security/products/experience-manager/apsb22-59.html
CVE: CVE-2022-44467
Published: 2022-12-19
Description: Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb22-59.html; https://helpx.adobe.com/security/products/experience-manager/apsb22-59.html
CVE: CVE-2022-44470
Published: 2022-12-19
Description: Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb22-59.html; https://helpx.adobe.com/security/products/experience-manager/apsb22-59.html
CVE: CVE-2022-44471
Published: 2022-12-19
Description: Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb22-59.html; https://helpx.adobe.com/security/products/experience-manager/apsb22-59.html
CVE: CVE-2022-44474
Published: 2022-12-19
Description: Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb22-59.html; https://helpx.adobe.com/security/products/experience-manager/apsb22-59.html
CVE: CVE-2022-44488
Published: 2022-12-19
Description: Adobe Experience Manager version 6.5.14 (and earlier) is affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability. A low-privilege authenticated attacker could leverage this vulnerability to redirect users to malicious websites. Exploitation of this issue requires user interaction.
CVSS Score: 3.5 (LOW)
CWE: CWE-601
References: https://helpx.adobe.com/security/products/experience-manager/apsb22-59.html; https://helpx.adobe.com/security/products/experience-manager/apsb22-59.html
CVE: CVE-2022-4614
Published: 2022-12-19
Description: Cross-site Scripting (XSS) - Stored in GitHub repository alagrede/znote-app prior to 1.7.11.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/alagrede/znote-app/commit/d889337b9c3ed16ca1aa43837af0960321dd77f2; https://huntr.dev/bounties/8b[PII_REDACTED]-4fe4-85e0-1a9143e4dca5; https://github.com/alagrede/znote-app/commit/d889337b9c3ed16ca1aa43837af0960321dd77f2
CVE: CVE-2022-4615
Published: 2022-12-19
Description: Cross-site Scripting (XSS) - Reflected in GitHub repository openemr/openemr prior to 7.0.0.2.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/openemr/openemr/commit/d5eb41697f7f1bc2c7ee5bc9bbf58684e1c8cc14; https://huntr.dev/bounties/9c66ece4-bcaa-417d-8b98-e8daff8a728b; https://github.com/openemr/openemr/commit/d5eb41697f7f1bc2c7ee5bc9bbf58684e1c8cc14
CVE: CVE-2022-38708
Published: 2022-12-19
Description: 
IBM Cognos Analytics 11.1.7 11.2.0, and 11.2.1 could be vulnerable to a Server-Side Request Forgery Attack (SSRF) attack by constructing URLs from user-controlled data. This could enable attackers to make arbitrary requests to the internal network or to the local file system. IBM X-Force ID: 234180.


CVSS Score: 6.5 (MEDIUM)
CWE: CWE-918, CWE-918
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/234180; https://www.ibm.com/support/pages/node/6841801; https://exchange.xforce.ibmcloud.com/vulnerabilities/234180
CVE: CVE-2022-39160
Published: 2022-12-19
Description: 
IBM Cognos Analytics 11.2.1, 11.2.0, and 11.1.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 235064.


CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/235064; https://www.ibm.com/support/pages/node/6841801; https://exchange.xforce.ibmcloud.com/vulnerabilities/235064
CVE: CVE-2022-43883
Published: 2022-12-19
Description: 
IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 could be vulnerable to a Log Injection attack by constructing URLs from user-controlled data. This could enable attackers to make arbitrary requests to the internal network or to the local file system. IBM X-Force ID: 240266.


CVSS Score: 6.5 (MEDIUM)
CWE: CWE-116
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/240266; https://www.ibm.com/support/pages/node/6841801; https://exchange.xforce.ibmcloud.com/vulnerabilities/240266
CVE: CVE-2022-43887
Published: 2022-12-19
Description: 
IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 could be vulnerable to sensitive information exposure by passing API keys to log files. If these keys contain sensitive information, it could lead to further attacks. IBM X-Force ID: 240450.


CVSS Score: 5.3 (MEDIUM)
CWE: CWE-532, CWE-532
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/240450; https://www.ibm.com/support/pages/node/6841801; https://exchange.xforce.ibmcloud.com/vulnerabilities/240450
CVE: CVE-2022-45041
Published: 2022-12-19
Description: SQL Injection exits in xinhu < 2.5.0
CVSS Score: 7.5 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/N1k0la-T/somefiles/blob/main/sqli.py; https://github.com/N1k0la-T/vulnerability/issues/1; https://github.com/N1k0la-T/somefiles/blob/main/sqli.py
CVE: CVE-2022-23536
Published: 2022-12-19
Description: Cortex provides multi-tenant, long term storage for Prometheus. A local file inclusion vulnerability exists in Cortex versions 1.13.0, 1.13.1 and 1.14.0, where a malicious actor could remotely read local files as a result of parsing maliciously crafted Alertmanager configurations when submitted to the Alertmanager Set Configuration API. Only users of the Alertmanager service where `-experimental.alertmanager.enable-api` or `enable_api: true` is configured are affected. Affected Cortex users are advised to upgrade to patched versions 1.13.2 or 1.14.1. However as a workaround, Cortex administrators may reject Alertmanager configurations containing the `api_key_file` setting in the `opsgenie_configs` section before sending to the Set Alertmanager Configuration API.

CVSS Score: 6.5 (MEDIUM)
CWE: CWE-73, CWE-184, CWE-641
References: https://cortexmetrics.io/docs/api/#set-alertmanager-configuration; https://github.com/cortexproject/cortex/releases/tag/v1.13.2; https://github.com/cortexproject/cortex/releases/tag/v1.14.1
CVE: CVE-2022-23543
Published: 2022-12-19
Description: Silverware Games is a social network where people can play games online. Users can attach URLs to YouTube videos, the site will generate related `<iframe>` when the post will be published. The handler has some sort of protection so non-YouTube links can't be posted, as well as HTML tags are being stripped. However, it was still possible to add custom HTML attributes (e.g. `onclick=alert("xss")`) to the `<iframe>'. This issue was fixed in the version `1.1.34` and does not require any extra actions from our members. There has been no evidence that this vulnerability was used by anyone at this time.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-80, CWE-79
References: https://github.com/mesosoi/silverwaregames-io-issue-tracker/security/advisories/GHSA-62r9-4v3r-rw89; https://github.com/mesosoi/silverwaregames-io-issue-tracker/security/advisories/GHSA-62r9-4v3r-rw89
CVE: CVE-2022-40434
Published: 2022-12-19
Description: Softr v2.0 was discovered to be vulnerable to HTML injection via the Name field of the Account page.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-79, CWE-79
References: http://softr.com; https://isaghojaria.medium.com/softr-v2-0-was-discovered-to-be-vulnerable-to-html-injection-via-the-name-field-of-the-account-page-c6fbd3162254; https://www.softr.io/
CVE: CVE-2022-44940
Published: 2022-12-19
Description: Patchelf v0.9 was discovered to contain an out-of-bounds read via the function modifyRPath at src/patchelf.cc.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-125, CWE-125
References: https://github.com/NixOS/patchelf/pull/419; https://github.com/NixOS/patchelf/pull/419
CVE: CVE-2022-3752
Published: 2022-12-19
Description: An unauthorized user could use a specially crafted sequence of Ethernet/IP messages, combined with heavy traffic 
loading to cause a denial-of-service condition in Rockwell Automation Logix controllers resulting in a major non-recoverable fault. If the target device becomes unavailable, a user would have to clear the fault and redownload 
the user project file to bring the device back online and continue normal operation.



CVSS Score: 8.6 (HIGH)
CWE: CWE-20
References: https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1137664; https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1137664
CVE: CVE-2022-44108
Published: 2022-12-19
Description: pdftojson commit 94204bb was discovered to contain a stack overflow via the component Object::copy(Object*):Object.cc.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://github.com/ldenoue/pdftojson; https://github.com/ldenoue/pdftojson/issues/3; https://github.com/ldenoue/pdftojson
CVE: CVE-2022-44109
Published: 2022-12-19
Description: pdftojson commit 94204bb was discovered to contain a stack overflow via the component Stream::makeFilter(char*, Stream*, Object*, int).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://github.com/ldenoue/pdftojson; https://github.com/ldenoue/pdftojson/issues/4; https://github.com/ldenoue/pdftojson
CVE: CVE-2022-46399
Published: 2022-12-19
Description: The Microchip RN4870 module firmware 1.43 (and the Microchip PIC LightBlue Explorer Demo 4.2 DT100112) is unresponsive with ConReqTimeoutZero.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://microchip.com; https://www.computer.org/csdl/proceedings-article/sp/2023/933600a521/1He7Yja1AYM; https://www.computer.org/csdl/proceedings/sp/2023/1He7WWuJExG
CVE: CVE-2022-46400
Published: 2022-12-19
Description: The Microchip RN4870 module firmware 1.43 (and the Microchip PIC LightBlue Explorer Demo 4.2 DT100112) allows attackers to bypass passkey entry in legacy pairing.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-287
References: https://microchip.com; https://www.computer.org/csdl/proceedings-article/sp/2023/933600a521/1He7Yja1AYM; https://www.computer.org/csdl/proceedings/sp/2023/1He7WWuJExG
CVE: CVE-2022-46401
Published: 2022-12-19
Description: The Microchip RN4870 module firmware 1.43 (and the Microchip PIC LightBlue Explorer Demo 4.2 DT100112) accepts PauseEncReqPlainText before pairing is complete.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-20
References: https://microchip.com; https://www.computer.org/csdl/proceedings-article/sp/2023/933600a521/1He7Yja1AYM; https://www.computer.org/csdl/proceedings/sp/2023/1He7WWuJExG
CVE: CVE-2022-46402
Published: 2022-12-19
Description: The Microchip RN4870 module firmware 1.43 (and the Microchip PIC LightBlue Explorer Demo 4.2 DT100112) accepts PairCon_rmSend with incorrect values.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-354, CWE-354
References: https://microchip.com; https://www.computer.org/csdl/proceedings-article/sp/2023/933600a521/1He7Yja1AYM; https://www.computer.org/csdl/proceedings/sp/2023/1He7WWuJExG
CVE: CVE-2022-46403
Published: 2022-12-19
Description: The Microchip RN4870 module firmware 1.43 (and the Microchip PIC LightBlue Explorer Demo 4.2 DT100112) mishandles reject messages.
CVSS Score: 8.6 (HIGH)
CWE: CWE-755
References: https://microchip.com; https://www.computer.org/csdl/proceedings-article/sp/2023/933600a521/1He7Yja1AYM; https://www.computer.org/csdl/proceedings/sp/2023/1He7WWuJExG
CVE: CVE-2022-47551
Published: 2022-12-20
Description: Apiman 1.5.7 through 2.2.3.Final has insufficient checks for read permissions within the Apiman Manager REST API. The root cause of the issue is the Apiman project's accidental acceptance of a large contribution that was not fully compatible with the security model of Apiman versions before 3.0.0.Final. Because of this, 3.0.0.Final is not affected by the vulnerability.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-276, CWE-276
References: https://www.apiman.io/blog/permissions-bypass-disclosure/; https://www.github.com/apiman/apiman; https://www.apiman.io/blog/permissions-bypass-disclosure/
CVE: CVE-2022-47577
Published: 2022-12-20
Description: An issue was discovered in the endpoint protection agent in Zoho ManageEngine Device Control Plus 10.1.2228.15. Despite configuring complete restrictions on USB pendrives, USB HDD devices, memory cards, USB connections to mobile devices, etc., it is still possible to bypass the USB restrictions by making use of a virtual machine (VM). This allows a file to be exchanged outside the laptop/system. VMs can be created by any user (even without admin rights). The data exfiltration can occur without any record in the audit trail of Windows events on the host machine. NOTE: the vendor's position is "it's not a vulnerability in our product."
CVSS Score: 7.1 (HIGH)
References: https://medium.com/nestedif/vulnerability-disclosure-business-logic-unauthorized-data-exfiltration-bypassing-dlp-zoho-cc51465ba84a; https://www.manageengine.com/device-control/how-to/device-control.html; https://medium.com/nestedif/vulnerability-disclosure-business-logic-unauthorized-data-exfiltration-bypassing-dlp-zoho-cc51465ba84a
CVE: CVE-2022-47578
Published: 2022-12-20
Description: An issue was discovered in the endpoint protection agent in Zoho ManageEngine Device Control Plus 10.1.2228.15. Despite configuring complete restrictions on USB pendrives, USB HDD devices, memory cards, USB connections to mobile devices, etc., it is still possible to bypass the USB restrictions by booting into Safe Mode. This allows a file to be exchanged outside the laptop/system. Safe Mode can be launched by any user (even without admin rights). Data exfiltration can occur, and also malware might be introduced onto the system. NOTE: the vendor's position is "it's not a vulnerability in our product."
CVSS Score: 7.1 (HIGH)
CWE: CWE-288
References: https://medium.com/nestedif/vulnerability-disclosure-business-logic-unauthorized-data-exfiltration-bypassing-dlp-zoho-cc51465ba84a; https://www.manageengine.com/device-control/how-to/device-control.html; https://medium.com/nestedif/vulnerability-disclosure-business-logic-unauthorized-data-exfiltration-bypassing-dlp-zoho-cc51465ba84a
CVE: CVE-2022-25171
Published: 2022-12-20
Description: The package p4 before 0.0.7 are vulnerable to Command Injection via the run() function due to improper input sanitization
CVSS Score: 7.4 (HIGH)
CWE: CWE-78, CWE-78
References: https://github.com/natelong/p4/blob/master/p4.js%23L12; https://github.com/natelong/p4/commit/ae42e251beabf67c00539ec0e1d7aa149ca445fb; https://security.snyk.io/vuln/SNYK-JS-P4-3167330