deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-17383
Published: 2022-01-24
Description: A directory traversal vulnerability on Telos Z/IP One devices through 4.0.0r grants an unauthenticated individual root level access to the device's file system. This can be used to identify configuration settings, password hashes for built-in accounts, and the cleartext password for remote configuration of the device through the WebUI.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://sra.io/blog-post/; https://sra.io/blog/this-traversal-had-a-face-for-radio-cve-2020-17383/; https://www.telosalliance.com/downloads?search=software-updates#downloadListing
CVE: CVE-2021-36342
Published: 2022-01-24
Description: Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution in SMRAM.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119, CWE-20
References: https://www.dell.com/support/kbdoc/en-us/000193321/dsa-2021-240; https://www.dell.com/support/kbdoc/en-us/000193321/dsa-2021-240
CVE: CVE-2021-36343
Published: 2022-01-24
Description: Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution in SMRAM.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119, CWE-20
References: https://www.dell.com/support/kbdoc/en-us/000193321/dsa-2021-240; https://www.dell.com/support/kbdoc/en-us/000193321/dsa-2021-240
CVE: CVE-2021-36349
Published: 2022-01-24
Description: Dell EMC Data Protection Central versions 19.5 and prior contain a Server Side Request Forgery vulnerability in the DPC DNS client processing. A remote malicious user could potentially exploit this vulnerability, allowing port scanning of external hosts.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-918, CWE-918
References: https://www.dell.com/support/kbdoc/000195103; https://www.dell.com/support/kbdoc/000195103
CVE: CVE-2021-43588
Published: 2022-01-24
Description: Dell EMC Data Protection Central version 19.5 contains an Improper Input Validation Vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to denial of service.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20, CWE-20
References: https://www.dell.com/support/kbdoc/000195103; https://www.dell.com/support/kbdoc/000195103
CVE: CVE-2021-43589
Published: 2022-01-24
Description: Dell EMC Unity, Dell EMC UnityVSA and Dell EMC Unity XT versions prior to 5.1.2.0.5.007 contain an operating system (OS) command injection Vulnerability. A locally authenticated user with high privileges may potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the Unity underlying OS, with the privileges of the vulnerable application. Exploitation may lead to an elevation of privilege.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-77, CWE-78
References: https://www.dell.com/support/kbdoc/en-us/000194836/dsa-2021-271-dell-emc-unity-dell-emc-unity-vsa-and-dell-emc-unity-xt-security-update-for-multiple-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000194836/dsa-2021-271-dell-emc-unity-dell-emc-unity-vsa-and-dell-emc-unity-xt-security-update-for-multiple-vulnerabilities
CVE: CVE-2021-45222
Published: 2022-01-24
Description: An issue was discovered in COINS Construction Cloud 11.12. Due to logical flaws in the human ressources interface, it is vulnerable to privilege escalation by HR personnel.
CVSS Score: 8.8 (HIGH)
CWE: CWE-269
References: https://appsource.microsoft.com/en-us/product/web-apps/constructionindustrysolutionslimited-5057232.coinsconstructioncloud?tab=overview; https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2021-029.txt; https://www.syss.de/pentest-blog/multiple-schwachstellen-im-coins-construction-cloud-erp-syss-2021-028/-029/-030/-031/-051/-052/-053
CVE: CVE-2021-45223
Published: 2022-01-24
Description: An issue was discovered in COINS Construction Cloud 11.12. Due to insufficient input neutralization, it is vulnerable to denial of service attacks via forced server crashes.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://appsource.microsoft.com/en-us/product/web-apps/constructionindustrysolutionslimited-5057232.coinsconstructioncloud?tab=overview; https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2021-028.txt; https://www.syss.de/pentest-blog/multiple-schwachstellen-im-coins-construction-cloud-erp-syss-2021-028/-029/-030/-031/-051/-052/-053
CVE: CVE-2021-45224
Published: 2022-01-24
Description: An issue was discovered in COINS Construction Cloud 11.12. In several locations throughout the application, JavaScript code is passed as a URL parameter. Attackers can trivially alter this code to cause malicious behaviour. The application is therefore vulnerable to reflected XSS via malicious URLs.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://appsource.microsoft.com/en-us/product/web-apps/constructionindustrysolutionslimited-5057232.coinsconstructioncloud?tab=overview; https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2021-053.txt; https://www.syss.de/pentest-blog/multiple-schwachstellen-im-coins-construction-cloud-erp-syss-2021-028/-029/-030/-031/-051/-052/-053
CVE: CVE-2021-45225
Published: 2022-01-24
Description: An issue was discovered in COINS Construction Cloud 11.12. Due to improper input neutralization, it is vulnerable to reflected cross-site scripting (XSS) via malicious links (affecting the search window and activity view window).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://appsource.microsoft.com/en-us/product/web-apps/constructionindustrysolutionslimited-5057232.coinsconstructioncloud?tab=overview; https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2021-052.txt; https://www.syss.de/pentest-blog/multiple-schwachstellen-im-coins-construction-cloud-erp-syss-2021-028/-029/-030/-031/-051/-052/-053
CVE: CVE-2021-45226
Published: 2022-01-24
Description: An issue was discovered in COINS Construction Cloud 11.12. Due to improper validation of user-controlled HTTP headers, attackers can cause it to send password-reset e-mails pointing to arbitrary websites.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-116
References: https://appsource.microsoft.com/en-us/product/web-apps/constructionindustrysolutionslimited-5057232.coinsconstructioncloud?tab=overview; https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2021-051.txt; https://www.syss.de/pentest-blog/multiple-schwachstellen-im-coins-construction-cloud-erp-syss-2021-028/-029/-030/-031/-051/-052/-053
CVE: CVE-2021-46451
Published: 2022-01-24
Description: An SQL Injection vulnerabilty exists in Sourcecodester Online Project Time Management System 1.0 via the pid parameter in the load_file function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/2022/Online-Project-Time-Management; https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/2022/Online-Project-Time-Management
CVE: CVE-2022-21710
Published: 2022-01-24
Description: ShortDescription is a MediaWiki extension that provides local short description support. A cross-site scripting (XSS) vulnerability exists in versions prior to 2.3.4. On a wiki that has the ShortDescription enabled, XSS can be triggered on any page or the page with the action=info parameter, which displays the shortdesc property. This is achieved using the wikitext `{{SHORTDESC:&lt;img src=x onerror=alert()&gt;}}`. This issue has a patch in version 2.3.4.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/StarCitizenTools/mediawiki-extensions-ShortDescription/commit/7c[PII_REDACTED]8620c6c858258cc4e1a8de6e48ea; https://github.com/StarCitizenTools/mediawiki-extensions-ShortDescription/commit/bf568edd892adb8528dcb64f75dddf3eeaccc12c; https://github.com/StarCitizenTools/mediawiki-extensions-ShortDescription/security/advisories/GHSA-mgcp-qw2r-6832
CVE: CVE-2022-21711
Published: 2022-01-24
Description: elfspirit is an ELF static analysis and injection framework that parses, manipulates, and camouflages ELF files. When analyzing the ELF file format in versions prior to 1.1, there is an out-of-bounds read bug, which can lead to application crashes or information leakage. By constructing a special format ELF file, the information of any address can be leaked. elfspirit version 1.1 contains a patch for this issue.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125, CWE-125
References: https://github.com/liyansong2018/elfspirit/commit/c5b0f5a9a24f2451bbeda4751d67633bc375e608; https://github.com/liyansong2018/elfspirit/issues/1; https://github.com/liyansong2018/elfspirit/security/advisories/GHSA-jr8h-2657-m68r
CVE: CVE-2022-21715
Published: 2022-01-24
Description: CodeIgniter4 is the 4.x branch of CodeIgniter, a PHP full-stack web framework. A cross-site scripting (XSS) vulnerability was found in `API\ResponseTrait` in Codeigniter4 prior to version 4.1.8. Attackers can do XSS attacks if a potential victim is using `API\ResponseTrait`. Version 4.1.8 contains a patch for this vulnerability. There are two potential workarounds available. Users may avoid using `API\ResponseTrait` or `ResourceController` Users may also disable Auto Route and use defined routes only.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://codeigniter4.github.io/userguide/incoming/routing.html#use-defined-routes-only; https://github.com/codeigniter4/CodeIgniter4/commit/70d881cf5322b7c32e69516aebd2273ac6a1e8dd; https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-7528-7jg5-6g62
CVE: CVE-2022-22554
Published: 2022-01-24
Description: Dell EMC System Update, version 1.9.2 and prior, contain an Unprotected Storage of Credentials vulnerability. A local attacker with user privleges could potentially exploit this vulnerability leading to the disclosure of user passwords.
CVSS Score: 8.2 (HIGH)
CWE: CWE-256, CWE-522
References: https://www.dell.com/support/kbdoc/000195007; https://www.dell.com/support/kbdoc/000195007
CVE: CVE-2022-0177
Published: 2022-01-24
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. Reason: This CVE has been rejected as it was incorrectly assigned. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2021-43394
Published: 2022-01-24
Description: Unisys OS 2200 Messaging Integration Services (NTSI) 7R3B IC3 and IC4, 7R3C, and 7R3D has an Incorrect Implementation of an Authentication Algorithm. An LDAP password is not properly validated.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://public.support.unisys.com/common/public/vulnerability/NVD_Detail_Rpt.aspx?ID=66; https://public.support.unisys.com/common/public/vulnerability/NVD_Detail_Rpt.aspx?ID=66
CVE: CVE-2021-44988
Published: 2022-01-25
Description: Jerryscript v3.0.0 and below was discovered to contain a stack overflow via ecma_find_named_property in ecma-helpers.c.
CVSS Score: 7.8 (HIGH)
CWE: CWE-770
References: https://github.com/jerryscript-project/jerryscript/issues/4890; https://github.com/jerryscript-project/jerryscript/issues/4891; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2021-44992
Published: 2022-01-25
Description: There is an Assertion ''ecma_object_is_typedarray (obj_p)'' failed at /jerry-core/ecma/operations/ecma-typedarray-object.c in Jerryscript 3.0.0.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119
References: https://github.com/jerryscript-project/jerryscript/issues/4875; https://security.samsungmobile.com/securityUpdate.smsb; https://github.com/jerryscript-project/jerryscript/issues/4875
CVE: CVE-2021-44993
Published: 2022-01-25
Description: There is an Assertion ''ecma_is_value_boolean (base_value)'' failed at /jerry-core/ecma/operations/ecma-get-put-value.c in Jerryscript 3.0.0.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-617
References: https://github.com/jerryscript-project/jerryscript/issues/4876; https://security.samsungmobile.com/securityUpdate.smsb; https://github.com/jerryscript-project/jerryscript/issues/4876
CVE: CVE-2021-44994
Published: 2022-01-25
Description: There is an Assertion ''JERRY_CONTEXT (jmem_heap_allocated_size) == 0'' failed at /jerry-core/jmem/jmem-heap.c in Jerryscript 3.0.0.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-617
References: https://github.com/jerryscript-project/jerryscript/issues/4894; https://github.com/jerryscript-project/jerryscript/issues/4895; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2021-46474
Published: 2022-01-25
Description: Jsish v3.5.0 was discovered to contain a heap buffer overflow via jsiEvalCodeSub in src/jsiEval.c. This vulnerability can lead to a Denial of Service (DoS).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://github.com/pcmacdon/jsish/issues/57; https://github.com/pcmacdon/jsish/issues/57
CVE: CVE-2021-46475
Published: 2022-01-25
Description: Jsish v3.5.0 was discovered to contain a heap buffer overflow via jsi_ArraySliceCmd in src/jsiArray.c. This vulnerability can lead to a Denial of Service (DoS).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://github.com/pcmacdon/jsish/issues/64; https://github.com/pcmacdon/jsish/issues/64
CVE: CVE-2021-46477
Published: 2022-01-25
Description: Jsish v3.5.0 was discovered to contain a heap buffer overflow via RegExp_constructor in src/jsiRegexp.c. This vulnerability can lead to a Denial of Service (DoS).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://github.com/pcmacdon/jsish/issues/63; https://github.com/pcmacdon/jsish/issues/63
CVE: CVE-2021-46478
Published: 2022-01-25
Description: Jsish v3.5.0 was discovered to contain a heap buffer overflow via jsiClearStack in src/jsiEval.c. This vulnerability can lead to a Denial of Service (DoS).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://github.com/pcmacdon/jsish/issues/60; https://github.com/pcmacdon/jsish/issues/60
CVE: CVE-2021-46480
Published: 2022-01-25
Description: Jsish v3.5.0 was discovered to contain a heap buffer overflow via jsiValueObjDelete in src/jsiEval.c. This vulnerability can lead to a Denial of Service (DoS).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://github.com/pcmacdon/jsish/issues/61; https://github.com/pcmacdon/jsish/issues/61
CVE: CVE-2021-46481
Published: 2022-01-25
Description: Jsish v3.5.0 was discovered to contain a memory leak via linenoise at src/linenoise.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://github.com/pcmacdon/jsish/issues/55; https://github.com/pcmacdon/jsish/issues/55
CVE: CVE-2021-46482
Published: 2022-01-25
Description: Jsish v3.5.0 was discovered to contain a heap buffer overflow via NumberConstructor at src/jsiNumber.c.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/pcmacdon/jsish/issues/66; https://github.com/pcmacdon/jsish/issues/66
CVE: CVE-2021-46483
Published: 2022-01-25
Description: Jsish v3.5.0 was discovered to contain a heap buffer overflow via BooleanConstructor at src/jsiBool.c.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/pcmacdon/jsish/issues/62; https://github.com/pcmacdon/jsish/issues/62
CVE: CVE-2022-23935
Published: 2022-01-25
Description: lib/Image/ExifTool.pm in ExifTool before 12.38 mishandles a $file =~ /\|$/ check, leading to command injection.
CVSS Score: 7.8 (HIGH)
CWE: CWE-78
References: https://gist.github.com/ert-plus/1414276e4cb5d56dd431c2f0429e4429; https://github.com/exiftool/exiftool/commit/74dbab1d2766d6422bb05b033ac6634bf8d1f582; https://gist.github.com/ert-plus/1414276e4cb5d56dd431c2f0429e4429
CVE: CVE-2022-0338
Published: 2022-01-25
Description: Insertion of Sensitive Information into Log File in Conda loguru prior to 0.5.3.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-532, CWE-532, CWE-732
References: https://github.com/delgan/loguru/commit/ea39375e62f9b8f18e2ca798a5c0fb8c972b7eaa; https://huntr.dev/bounties/359bea50-2bc6-426a-b2f9-175d401b1ed0; https://github.com/delgan/loguru/commit/ea39375e62f9b8f18e2ca798a5c0fb8c972b7eaa
CVE: CVE-2022-0268
Published: 2022-01-25
Description: Cross-site Scripting (XSS) - Stored in Packagist getgrav/grav prior to 1.7.28.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/getgrav/grav/commit/6f2fa9311afb9ecd34030dec2aff7b39e9e7e735; https://huntr.dev/bounties/67085545-331e-4469-90f3-a1a46a078d39; https://github.com/getgrav/grav/commit/6f2fa9311afb9ecd34030dec2aff7b39e9e7e735
CVE: CVE-2021-45340
Published: 2022-01-25
Description: In Libsixel prior to and including v1.10.3, a NULL pointer dereference in the stb_image.h component of libsixel allows attackers to cause a denial of service (DOS) via a crafted PICT file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/libsixel/libsixel/issues/51; https://github.com/libsixel/libsixel/issues/51
CVE: CVE-2021-45341
Published: 2022-01-25
Description: A buffer overflow vulnerability in CDataMoji of the jwwlib component of LibreCAD 2.2.0-rc3 and older allows an attacker to achieve Remote Code Execution using a crafted JWW document.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: https://github.com/LibreCAD/LibreCAD/issues/1462; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FCC2FZ6HZOIK3775K4MTCOUHX6PLGPEL/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VUMH3CWGVSMR2UIZEA35Q5UB7PDVVVYS/
CVE: CVE-2021-45029
Published: 2022-01-25
Description: Groovy Code Injection & SpEL Injection which lead to Remote Code Execution. This issue affected Apache ShenYu 2.4.0 and 2.4.1.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94, CWE-94
References: http://www.openwall.com/lists/oss-security/2022/01/25/8; http://www.openwall.com/lists/oss-security/2022/01/26/1; https://lists.apache.org/thread/3zzmwvg3012tg306x8o893fvdcssx639
CVE: CVE-2021-45342
Published: 2022-01-25
Description: A buffer overflow vulnerability in CDataList of the jwwlib component of LibreCAD 2.2.0-rc3 and older allows an attacker to achieve Remote Code Execution using a crafted JWW document.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://github.com/LibreCAD/LibreCAD/issues/1464; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FCC2FZ6HZOIK3775K4MTCOUHX6PLGPEL/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VUMH3CWGVSMR2UIZEA35Q5UB7PDVVVYS/
CVE: CVE-2021-45343
Published: 2022-01-25
Description: In LibreCAD 2.2.0, a NULL pointer dereference in the HATCH handling of libdxfrw allows an attacker to crash the application using a crafted DXF document.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/LibreCAD/LibreCAD/issues/1468; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FCC2FZ6HZOIK3775K4MTCOUHX6PLGPEL/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VUMH3CWGVSMR2UIZEA35Q5UB7PDVVVYS/
CVE: CVE-2021-45802
Published: 2022-01-25
Description: MartDevelopers iResturant 1.0 is vulnerable to SQL Injection. SQL Injection occurs because the email and phone parameter values are added to the SQL query without any verification at the time of membership registration.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://blog.pocas.kr/posts/sqli-iResturant/; https://gist.github.com/P0cas/5aa55f62781364a750ac4a4d47f319fa#file-cve-2021-45802-md; https://blog.pocas.kr/posts/sqli-iResturant/
CVE: CVE-2021-45803
Published: 2022-01-25
Description: MartDevelopers iResturant 1.0 is vulnerable to SQL Injection. SQL Injection occurs because this view parameter value is added to the SQL query without additional verification when viewing reservation.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://blog.pocas.kr/posts/sqli-iResturant-2/; https://gist.github.com/P0cas/5aa55f62781364a750ac4a4d47f319fa#cve-2021-45803; https://blog.pocas.kr/posts/sqli-iResturant-2/
CVE: CVE-2021-45844
Published: 2022-01-25
Description: Improper sanitization in the invocation of ODA File Converter from FreeCAD 0.19 allows an attacker to inject OS commands via a crafted filename.
CVSS Score: 7.8 (HIGH)
CWE: CWE-78
References: https://forum.freecadweb.org/viewtopic.php?t=64733; https://lists.debian.org/debian-lts-announce/2022/03/msg00004.html; https://lists.debian.org/debian-lts-announce/2022/08/msg00008.html
CVE: CVE-2021-45845
Published: 2022-01-25
Description: The Path Sanity Check script of FreeCAD 0.19 is vulnerable to OS command injection, allowing an attacker to execute arbitrary commands via a crafted FCStd document.
CVSS Score: 7.8 (HIGH)
CWE: CWE-78
References: https://github.com/FreeCAD/FreeCAD/pull/5306; https://tracker.freecad.org/view.php?id=4810; https://www.debian.org/security/2022/dsa-5229
CVE: CVE-2021-46113
Published: 2022-01-25
Description: In MartDevelopers KEA-Hotel-ERP open source as of 12-31-2021, a remote code execution vulnerability can be exploited by uploading PHP files using the file upload vulnerability in this service.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://blog.pocas.kr/posts/rce-KEA-Hotel-ERP/; https://gist.github.com/P0cas/5aa55f62781364a750ac4a4d47f319fa#cve-2021-46113; https://www.youtube.com/watch?v=gnSMrvV5e9w
CVE: CVE-2022-23223
Published: 2022-01-25
Description: On Apache ShenYu versions 2.4.0 and 2.4.1, and endpoint existed that disclosed the passwords of all users. Users are recommended to upgrade to version 2.4.2 or later.
CVSS Score: 7.5 (HIGH)
CWE: CWE-522, CWE-522
References: http://www.openwall.com/lists/oss-security/2022/01/25/7; http://www.openwall.com/lists/oss-security/2022/01/26/4; https://lists.apache.org/thread/q2gg6ny6lpkph7nkrvjzqdvqpm805v8s
CVE: CVE-2022-23944
Published: 2022-01-25
Description: User can access /plugin api without authentication. This issue affected Apache ShenYu 2.4.0 and 2.4.1.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-862, CWE-306
References: http://www.openwall.com/lists/oss-security/2022/01/25/15; http://www.openwall.com/lists/oss-security/2022/01/25/5; http://www.openwall.com/lists/oss-security/2022/01/26/2
CVE: CVE-2022-23945
Published: 2022-01-25
Description: Missing authentication on ShenYu Admin when register by HTTP. This issue affected Apache ShenYu 2.4.0 and 2.4.1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-862, CWE-306
References: http://www.openwall.com/lists/oss-security/2022/01/25/6; http://www.openwall.com/lists/oss-security/2022/01/26/3; https://lists.apache.org/thread/q2gg6ny6lpkph7nkrvjzqdvqpm805v8s
CVE: CVE-2021-45846
Published: 2022-01-25
Description: A flaw in the AMF parser of Slic3r libslic3r 1.3.0 allows an attacker to cause an application crash using a crafted AMF document, where a metadata tag lacks a "type" attribute.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/slic3r/Slic3r/issues/5117; https://github.com/slic3r/Slic3r/issues/5117
CVE: CVE-2021-45847
Published: 2022-01-25
Description: Several missing input validations in the 3MF parser component of Slic3r libslic3r 1.3.0 can each allow an attacker to cause an application crash using a crafted 3MF input file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/slic3r/Slic3r/issues/5118; https://github.com/slic3r/Slic3r/issues/5119; https://github.com/slic3r/Slic3r/issues/5120
CVE: CVE-2022-21697
Published: 2022-01-25
Description: Jupyter Server Proxy is a Jupyter notebook server extension to proxy web services. Versions of Jupyter Server Proxy prior to 3.2.1 are vulnerable to Server-Side Request Forgery (SSRF). Any user deploying Jupyter Server or Notebook with jupyter-proxy-server extension enabled is affected. A lack of input validation allows authenticated clients to proxy requests to other hosts, bypassing the `allowed_hosts` check. Because authentication is required, which already grants permissions to make the same requests via kernel or terminal execution, this is considered low to moderate severity. Users may upgrade to version 3.2.1 to receive a patch or, as a workaround, install the patch manually.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-918, CWE-918
References: https://github.com/jupyterhub/jupyter-server-proxy/commit/fd31930bacd12188c448c886e[PII_REDACTED]b99eb; https://github.com/jupyterhub/jupyter-server-proxy/compare/v3.2.0...v3.2.1.patch; https://github.com/jupyterhub/jupyter-server-proxy/security/advisories/GHSA-gcv9-6737-pjqw