deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-3520
Published: 2022-12-02
Description: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0765.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-122, CWE-787
References: https://github.com/vim/vim/commit/36343ae0fb7247e060abfd35fb8e4337b33abb4b; https://huntr.dev/bounties/c1db3b70-f4fe-481f-8a24-0b1449c94246; https://security.gentoo.org/glsa/202305-16
CVE: CVE-2022-46167
Published: 2022-12-02
Description: Capsule is a multi-tenancy and policy-based framework for Kubernetes. Prior to version 0.1.3, a ServiceAccount deployed in a Tenant Namespace, when granted with `PATCH` capabilities on its own Namespace, is able to edit it and remove the Owner Reference, breaking the reconciliation of the Capsule Operator and removing all the enforcement like Pod Security annotations, Network Policies, Limit Range and Resource Quota items. An attacker could detach the Namespace from a Tenant that is forbidding starting privileged Pods using the Pod Security labels by removing the OwnerReference, removing the enforcement labels, and being able to start privileged containers that would be able to start a generic Kubernetes privilege escalation. Patches have been released for version 0.1.3. No known workarounds are available.

CVSS Score: 8.8 (HIGH)
CWE: CWE-863
References: https://github.com/clastix/capsule/commit/1df430e71be8c4778c82eca3459978ad7d0b4b7b; https://github.com/clastix/capsule/commit/75525ac19254b0c5111e34d7985e2be7bc8b1ac1; https://github.com/clastix/capsule/releases/tag/v0.1.3
CVE: CVE-2022-2640
Published: 2022-12-02
Description: The Config-files of Horner Automation’s RCC 972 with firmware version 15.40 are encrypted with weak XOR encryption vulnerable to reverse engineering. This could allow an attacker to obtain credentials to run services such as File Transfer Protocol (FTP) and Hypertext Transfer Protocol (HTTP).
CVSS Score: 7.5 (HIGH)
CWE: CWE-326
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-335-02; https://www.cisa.gov/uscert/ics/advisories/icsa-22-335-02
CVE: CVE-2022-2641
Published: 2022-12-02
Description: Horner Automation’s RCC 972 with firmware version 15.40 has a static encryption key on the device. This could allow an attacker to perform unauthorized changes to the device, remotely execute arbitrary code, or cause a denial-of-service condition.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-321
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-335-02; https://www.cisa.gov/uscert/ics/advisories/icsa-22-335-02
CVE: CVE-2022-2642
Published: 2022-12-02
Description: Horner Automation’s RCC 972 firmware version 15.40 contains global variables. This could allow an attacker to read out sensitive values and variable keys from the device.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1108
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-335-02; https://www.cisa.gov/uscert/ics/advisories/icsa-22-335-02
CVE: CVE-2022-3086
Published: 2022-12-02
Description: Cradlepoint IBR600 NCOS versions 6.5.0.160bc2e and prior are vulnerable 
to shell escape, which enables local attackers with non-superuser 
credentials to gain full, unrestrictive shell access which may allow an 
attacker to execute arbitrary code.


CVSS Score: 7.1 (HIGH)
CWE: CWE-77
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-321-02; https://www.cisa.gov/uscert/ics/advisories/icsa-22-321-02
CVE: CVE-2022-44290
Published: 2022-12-02
Description: webTareas 2.4p5 was discovered to contain a SQL injection vulnerability via the id parameter in deleteapprovalstages.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: http://webtareas.com; https://github.com/anhdq201/webtareas/issues/2; http://webtareas.com
CVE: CVE-2022-44291
Published: 2022-12-02
Description: webTareas 2.4p5 was discovered to contain a SQL injection vulnerability via the id parameter in phasesets.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: http://webtareas.com; https://github.com/anhdq201/webtareas/issues/1; http://webtareas.com
CVE: CVE-2022-44944
Published: 2022-12-02
Description: Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add Announcement function at /index.php?module=help_pages/pages&entities_id=24. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://rukovoditel.com; https://github.com/anhdq201/rukovoditel/issues/14; http://rukovoditel.com
CVE: CVE-2022-44945
Published: 2022-12-02
Description: Rukovoditel v3.2.1 was discovered to contain a SQL injection vulnerability via the heading_field_id parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: http://rukovoditel.com; https://github.com/anhdq201/rukovoditel/issues/16; http://rukovoditel.com
CVE: CVE-2022-44946
Published: 2022-12-02
Description: Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add Page function at /index.php?module=help_pages/pages&entities_id=24. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://rukovoditel.com; https://github.com/anhdq201/rukovoditel/issues/15; http://rukovoditel.com
CVE: CVE-2022-44947
Published: 2022-12-02
Description: Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Highlight Row feature at /index.php?module=entities/listing_types&entities_id=24. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Note field after clicking "Add".
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://rukovoditel.com; https://github.com/anhdq201/rukovoditel/issues/13; http://rukovoditel.com
CVE: CVE-2022-44948
Published: 2022-12-02
Description: Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Entities Group feature at/index.php?module=entities/entities_groups. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field after clicking "Add".
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://rukovoditel.com; https://github.com/anhdq201/rukovoditel/issues/8; http://rukovoditel.com
CVE: CVE-2022-44949
Published: 2022-12-02
Description: Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add New Field function at /index.php?module=entities/fields&entities_id=24. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Short Name field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://rukovoditel.com; https://github.com/anhdq201/rukovoditel/issues/12; http://rukovoditel.com
CVE: CVE-2022-44950
Published: 2022-12-02
Description: Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add New Field function at /index.php?module=entities/fields&entities_id=24. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://rukovoditel.com; https://github.com/anhdq201/rukovoditel/issues/10; http://rukovoditel.com
CVE: CVE-2022-44951
Published: 2022-12-02
Description: Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add New Form tab function at /index.php?module=entities/forms&entities_id=24. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://rukovoditel.com; https://github.com/anhdq201/rukovoditel/issues/11; http://rukovoditel.com
CVE: CVE-2022-44952
Published: 2022-12-02
Description: Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in /index.php?module=configuration/application. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Copyright Text field after clicking "Add".
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://rukovoditel.com; https://github.com/anhdq201/rukovoditel/issues/9; http://rukovoditel.com
CVE: CVE-2022-44953
Published: 2022-12-02
Description: webtareas 2.4p5 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /linkedcontent/listfiles.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field after clicking "Add".
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://webtareas.com; https://github.com/anhdq201/webtareas/issues/8; http://webtareas.com
CVE: CVE-2022-44954
Published: 2022-12-02
Description: webtareas 2.4p5 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /contacts/listcontacts.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Last Name field after clicking "Add".
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://webtareas.com; https://github.com/anhdq201/webtareas/issues/10; http://webtareas.com
CVE: CVE-2022-44955
Published: 2022-12-02
Description: webtareas 2.4p5 was discovered to contain a cross-site scripting (XSS) vulnerability in the Chat function. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Messages field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://webtareas.com; https://github.com/anhdq201/webtareas/issues/5; http://webtareas.com
CVE: CVE-2022-44956
Published: 2022-12-02
Description: webtareas 2.4p5 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /projects/listprojects.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://webtareas.com; https://github.com/anhdq201/webtareas/issues/3; http://webtareas.com
CVE: CVE-2022-44957
Published: 2022-12-02
Description: webtareas 2.4p5 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /clients/listclients.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://webtareas.com; https://github.com/anhdq201/webtareas/issues/11; http://webtareas.com
CVE: CVE-2022-44959
Published: 2022-12-02
Description: webtareas 2.4p5 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /meetings/listmeetings.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://webtareas.com; https://github.com/anhdq201/webtareas/issues/6; http://webtareas.com
CVE: CVE-2022-44960
Published: 2022-12-02
Description: webtareas 2.4p5 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /general/search.php?searchtype=simple. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Search field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://webtareas.com; https://github.com/anhdq201/webtareas/issues/4; http://webtareas.com
CVE: CVE-2022-44961
Published: 2022-12-02
Description: webtareas 2.4p5 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /forums/editforum.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://webtareas.com; https://github.com/anhdq201/webtareas/issues/7; http://webtareas.com
CVE: CVE-2022-44962
Published: 2022-12-02
Description: webtareas 2.4p5 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /calendar/viewcalendar.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Subject field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://webtareas.com; https://github.com/anhdq201/webtareas/issues/12; http://webtareas.com
CVE: CVE-2022-4208
Published: 2022-12-02
Description: The Chained Quiz plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'datef' parameter on the 'chainedquiz_list' page in versions up to, and including, 1.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/Xib3rR4dAr/417a11bcb9b8da28cfe5ba1c17c44d0e; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2824193%40chained-quiz&new=2824193%40chained-quiz&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/5a316c0a-452a-4205-b79b-8bd911016ab2?source=cve
CVE: CVE-2022-4209
Published: 2022-12-02
Description: The Chained Quiz plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'pointsf' parameter on the 'chainedquiz_list' page in versions up to, and including, 1.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/Xib3rR4dAr/417a11bcb9b8da28cfe5ba1c17c44d0e; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2824193%40chained-quiz&new=2824193%40chained-quiz&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/b708b72f-d906-47c9-9bf7-a9397956db3d?source=cve
CVE: CVE-2022-4210
Published: 2022-12-02
Description: The Chained Quiz plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'dnf' parameter on the 'chainedquiz_list' page in versions up to, and including, 1.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/Xib3rR4dAr/417a11bcb9b8da28cfe5ba1c17c44d0e; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2824193%40chained-quiz&new=2824193%40chained-quiz&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/c8a49064-ad48-410e-9b32-f94109830ccf?source=cve
CVE: CVE-2022-4211
Published: 2022-12-02
Description: The Chained Quiz plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'emailf' parameter on the 'chainedquiz_list' page in versions up to, and including, 1.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/Xib3rR4dAr/417a11bcb9b8da28cfe5ba1c17c44d0e; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2824193%40chained-quiz&new=2824193%40chained-quiz&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/6781b7b7-c11a-4328-8d14-ffafc2ccb127?source=cve
CVE: CVE-2022-4212
Published: 2022-12-02
Description: The Chained Quiz plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'ipf' parameter on the 'chainedquiz_list' page in versions up to, and including, 1.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/Xib3rR4dAr/417a11bcb9b8da28cfe5ba1c17c44d0e; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2824193%40chained-quiz&new=2824193%40chained-quiz&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/99555021-68f4-4395-978d-ff1bbae9ebd4?source=cve
CVE: CVE-2022-4213
Published: 2022-12-02
Description: The Chained Quiz plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'dn' parameter on the 'chainedquiz_list' page in versions up to, and including, 1.3.2.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2825368%40chained-quiz&new=2825368%40chained-quiz&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/d46edcfe-ab6b-4966-9d85-40a2e2ee3d44?source=cve; https://www.wordfence.com/vulnerability-advisories-continued/#CVE-2022-4213
CVE: CVE-2022-4214
Published: 2022-12-02
Description: The Chained Quiz plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'ip' parameter on the 'chainedquiz_list' page in versions up to, and including, 1.3.2.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://gist.github.com/Xib3rR4dAr/417a11bcb9b8da28cfe5ba1c17c44d0e; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2826500%40chained-quiz&new=2826500%40chained-quiz&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/9145ce0d-311c-4be1-be15-7e1791c17860?source=cve
CVE: CVE-2022-4215
Published: 2022-12-02
Description: The Chained Quiz plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'date' parameter on the 'chainedquiz_list' page in versions up to, and including, 1.3.2.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/Xib3rR4dAr/417a11bcb9b8da28cfe5ba1c17c44d0e; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2826500%40chained-quiz&new=2826500%40chained-quiz&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/b6bb8fea-8b2c-42da-a224-0719a584d92b?source=cve
CVE: CVE-2022-4216
Published: 2022-12-02
Description: The Chained Quiz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'facebook_appid' parameter in versions up to, and including, 1.3.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with administrative privileges to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/Xib3rR4dAr/417a11bcb9b8da28cfe5ba1c17c44d0e; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2825114%40chained-quiz&new=2825114%40chained-quiz&sfp_email=&sfph_mail=; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2825368%40chained-quiz&new=2825368%40chained-quiz&sfp_email=&sfph_mail=
CVE: CVE-2022-4217
Published: 2022-12-02
Description: The Chained Quiz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'api_key' parameter in versions up to, and including, 1.3.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with administrative privileges to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/Xib3rR4dAr/417a11bcb9b8da28cfe5ba1c17c44d0e; https://plugins.trac.wordpress.org/changeset/2824193; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2825368%40chained-quiz&new=2825368%40chained-quiz&sfp_email=&sfph_mail=
CVE: CVE-2022-4218
Published: 2022-12-02
Description: The Chained Quiz plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.2.4. This is due to missing nonce validation on the list_quizzes() function. This makes it possible for unauthenticated attackers to delete quizzes and copy quizzes via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://gist.github.com/Xib3rR4dAr/417a11bcb9b8da28cfe5ba1c17c44d0e; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2826623%40chained-quiz&new=2826623%40chained-quiz&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/49333c6b-58f6-4d5a-a[PII_REDACTED]0175a?source=cve
CVE: CVE-2022-4219
Published: 2022-12-02
Description: The Chained Quiz plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.2.4. This is due to missing nonce validation on the manage() function. This makes it possible for unauthenticated attackers to delete submitted quiz responses via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://gist.github.com/Xib3rR4dAr/417a11bcb9b8da28cfe5ba1c17c44d0e; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2826623%40chained-quiz&new=2826623%40chained-quiz&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/cf96887c-6e0d-43d9-a3f2-88981adb4c98?source=cve
CVE: CVE-2022-4220
Published: 2022-12-02
Description: The Chained Quiz plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.2.4. This is due to missing nonce validation on the list_questions() function. This makes it possible for unauthenticated attackers to delete questions from quizzes via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://gist.github.com/Xib3rR4dAr/417a11bcb9b8da28cfe5ba1c17c44d0e; https://plugins.trac.wordpress.org/browser/chained-quiz/trunk/controllers/questions.php#L73; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2826623%40chained-quiz&new=2826623%40chained-quiz&sfp_email=&sfph_mail=
CVE: CVE-2022-4262
Published: 2022-12-02
Description: Type confusion in V8 in Google Chrome prior to 108.0.5359.94 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-843, CWE-843
References: https://chromereleases.googleblog.com/2022/12/stable-channel-update-for-desktop.html; https://crbug.com/1394403; https://chromereleases.googleblog.com/2022/12/stable-channel-update-for-desktop.html