deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-4559
Published: 2022-12-16
Description: A vulnerability was found in INEX IPX-Manager up to 6.2.0. It has been declared as problematic. This vulnerability affects unknown code of the file resources/views/customer/list.foil.php. The manipulation leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 6.3.0 is able to address this issue. The name of the patch is bc9b14c6f70cccdb89b559e8bc3a7318bfe9c243. It is recommended to upgrade the affected component. VDB-215962 is the identifier assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-707
References: https://github.com/inex/IXP-Manager/commit/bc9b14c6f70cccdb89b559e8bc3a7318bfe9c243; https://github.com/inex/IXP-Manager/releases/tag/v6.3.0; https://vuldb.com/?id.215962
CVE: CVE-2022-4560
Published: 2022-12-16
Description: A vulnerability was found in Joget up to 7.0.31. It has been rated as problematic. This issue affects the function getInternalJsCssLib of the file wflow-core/src/main/java/org/joget/plugin/enterprise/UniversalTheme.java of the component wflow-core. The manipulation of the argument key leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 7.0.32 is able to address this issue. The name of the patch is ecf8be8f6f0cb725c18536ddc726d42a11bdaa1b. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-215963.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-79
References: https://github.com/jogetworkflow/jw-community/commit/ecf8be8f6f0cb725c18536ddc726d42a11bdaa1b; https://github.com/jogetworkflow/jw-community/releases/tag/7.0.32; https://vuldb.com/?id.215963
CVE: CVE-2022-4561
Published: 2022-12-16
Description: A vulnerability classified as problematic has been found in SemanticDrilldown Extension. Affected is the function printFilterLine of the file includes/specials/SDBrowseDataPage.php of the component GET Parameter Handler. The manipulation of the argument value leads to cross site scripting. It is possible to launch the attack remotely. The name of the patch is 6e18cf740a4548166c1d95f6d3a28541d298a3aa. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-215964.
CVSS Score: 3.5 (LOW)
CWE: CWE-707
References: https://github.com/wikimedia/mediawiki-extensions-SemanticDrilldown/commit/6e18cf740a4548166c1d95f6d3a28541d298a3aa; https://vuldb.com/?id.215964; https://github.com/wikimedia/mediawiki-extensions-SemanticDrilldown/commit/6e18cf740a4548166c1d95f6d3a28541d298a3aa
CVE: CVE-2022-4563
Published: 2022-12-16
Description: A vulnerability was found in Freedom of the Press SecureDrop. It has been rated as critical. Affected by this issue is some unknown functionality of the file gpg-agent.conf. The manipulation leads to symlink following. Local access is required to approach this attack. The name of the patch is b0526a06f8ca713cce74b63e00d3730618d89691. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-215972.
CVSS Score: 7.8 (HIGH)
CWE: CWE-59
References: https://github.com/freedomofpress/securedrop/commit/b0526a06f8ca713cce74b63e00d3730618d89691; https://github.com/freedomofpress/securedrop/compare/2.5.0...2.5.1; https://github.com/freedomofpress/securedrop/pull/6704
CVE: CVE-2022-4564
Published: 2022-12-16
Description: A vulnerability classified as problematic has been found in University of Central Florida Materia up to 9.0.0. This affects the function before of the file fuel/app/classes/controller/api.php of the component API Controller. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. Upgrading to version 9.0.1-alpha1 is able to address this issue. The name of the patch is af259115d2e8f17068e61902151ee8a9dbac397b. It is recommended to upgrade the affected component. The identifier VDB-215973 was assigned to this vulnerability.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://github.com/ucfopen/Materia/commit/af259115d2e8f17068e61902151ee8a9dbac397b; https://github.com/ucfopen/Materia/pull/1371; https://github.com/ucfopen/Materia/releases/tag/v9.0.1-alpha1
CVE: CVE-2022-41964
Published: 2022-12-16
Description: BigBlueButton is an open source web conferencing system. This vulnerability only affects release candidates of BigBlueButton 2.4. The attacker can start a subscription for poll results before starting an anonymous poll, and use this subscription to see individual responses in the anonymous poll. The attacker had to be a meeting presenter. This issue is patched in version 2.4.0. There are no workarounds.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-200
References: https://github.com/bigbluebutton/bigbluebutton/releases/tag/v2.4.0; https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-fgmj-rx7j-fqr4; https://github.com/bigbluebutton/bigbluebutton/releases/tag/v2.4.0
CVE: CVE-2022-41972
Published: 2022-12-16
Description: Contiki-NG is an open-source, cross-platform operating system for Next-Generation IoT devices. Versions prior to 4.9 contain a NULL Pointer Dereference in BLE L2CAP module. The Contiki-NG operating system for IoT devices contains a Bluetooth Low Energy stack. An attacker can inject a packet in this stack, which causes the implementation to dereference a NULL pointer and triggers undefined behavior. More specifically, while processing the L2CAP protocol, the implementation maps an incoming channel ID to its metadata structure. In this structure, state information regarding credits is managed through calls to the function input_l2cap_credit in the module os/net/mac/ble/ble-l2cap.c. Unfortunately, the input_l2cap_credit function does not check that the metadata corresponding to the user-supplied channel ID actually exists, which can lead to the channel variable being set to NULL before a pointer dereferencing operation is performed. The vulnerability has been patched in the "develop" branch of Contiki-NG, and will be included in release 4.9. Users can apply the patch in Contiki-NG pull request #2253 as a workaround until the new package is released.
CVSS Score: 2.9 (LOW)
CWE: CWE-476
References: https://github.com/contiki-ng/contiki-ng/pull/2253; https://github.com/contiki-ng/contiki-ng/security/advisories/GHSA-24xp-g5gf-6vvm; https://github.com/contiki-ng/contiki-ng/pull/2253
CVE: CVE-2022-4565
Published: 2022-12-16
Description: A vulnerability classified as problematic was found in Dromara HuTool up to 5.8.10. This vulnerability affects unknown code of the file cn.hutool.core.util.ZipUtil.java. The manipulation leads to resource consumption. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 5.8.11 is able to address this issue. It is recommended to upgrade the affected component. VDB-215974 is the identifier assigned to this vulnerability.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-404, CWE-404
References: https://github.com/dromara/hutool/issues/2797; https://vuldb.com/?id.215974; https://github.com/dromara/hutool/issues/2797
CVE: CVE-2022-4566
Published: 2022-12-16
Description: A vulnerability, which was classified as critical, has been found in y_project RuoYi 4.7.5. This issue affects some unknown processing of the file com/ruoyi/generator/controller/GenController. The manipulation leads to sql injection. The name of the patch is 167970e5c4da7bb46217f576dc50622b83f32b40. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-215975.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-707, CWE-89
References: https://gitee.com/y_project/RuoYi/commit/167970e5c4da7bb46217f576dc50622b83f32b40; https://gitee.com/y_project/RuoYi/issues/I65V2B; https://github.com/luelueking/ruoyi-4.7.5-vuln-poc
CVE: CVE-2022-2966
Published: 2022-12-16
Description: Out-of-bounds Read vulnerability in Delta Electronics DOPSoft.This issue affects DOPSoft: All Versions.


CVSS Score: 3.3 (LOW)
CWE: CWE-125
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-244-01; https://www.cisa.gov/uscert/ics/advisories/icsa-22-244-01
CVE: CVE-2022-3166
Published: 2022-12-16
Description: 
Rockwell Automation was made aware that the webservers of the Micrologix 1100 and 1400 controllers contain a vulnerability that may lead to a denial-of-service condition. The security vulnerability could be exploited by an attacker with network access to the affected systems by sending TCP packets to webserver and closing it abruptly which would cause a denial-of-service condition for the web server application on the device


CVSS Score: 7.5 (HIGH)
CWE: CWE-924, CWE-924
References: https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1137678; https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1137678
CVE: CVE-2022-47208
Published: 2022-12-16
Description: The “puhttpsniff” service, which runs by default, is susceptible to command injection due to improperly sanitized user input. An unauthenticated attacker on the same network segment as the router can execute arbitrary commands on the device without authentication.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://www.tenable.com/security/research/tra-2022-37; https://www.tenable.com/security/research/tra-2022-37
CVE: CVE-2022-47209
Published: 2022-12-16
Description: A support user exists on the device and appears to be a backdoor for Technical Support staff. The default password for this account is “support” and cannot be changed by a user via any normally accessible means.
CVSS Score: 8.8 (HIGH)
CWE: CWE-287, CWE-287
References: https://www.tenable.com/security/research/tra-2022-37; https://www.tenable.com/security/research/tra-2022-37
CVE: CVE-2022-47210
Published: 2022-12-16
Description: The default console presented to users over telnet (when enabled) is restricted to a subset of commands. Commands issued at this console, however, appear to be fed directly into a system call or other similar function. This allows any authenticated user to execute arbitrary commands on the device.
CVSS Score: 7.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://www.tenable.com/security/research/tra-2022-37; https://www.tenable.com/security/research/tra-2022-37
CVE: CVE-2022-3157
Published: 2022-12-16
Description: 
A vulnerability exists in the Rockwell Automation controllers that allows a malformed CIP request to cause a major non-recoverable fault (MNRF) and a denial-of-service condition (DOS). 


CVSS Score: 8.6 (HIGH)
CWE: CWE-20
References: https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1137757; https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1137757
CVE: CVE-2022-46670
Published: 2022-12-16
Description: 
Rockwell Automation was made aware of a vulnerability by a security researcher from Georgia Institute of Technology that the MicroLogix 1100 and 1400 controllers contain a vulnerability that may give an attacker the ability to accomplish remote code execution.  The vulnerability is an unauthenticated stored cross-site scripting vulnerability in the embedded webserver. The payload is transferred to the controller over SNMP and is rendered on the homepage of the embedded website. 


CVSS Score: 7.1 (HIGH)
CWE: CWE-79, CWE-79
References: https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1137679; https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1137679
CVE: CVE-2021-31650
Published: 2022-12-16
Description: A SQL injection vulnerability in Sourcecodester Online Grading System 1.0 allows remote attackers to execute arbitrary SQL commands via the uname parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://www.exploit-db.com/exploits/49493; https://www.exploit-db.com/exploits/49493
CVE: CVE-2021-38241
Published: 2022-12-16
Description: Deserialization issue discovered in Ruoyi before 4.6.1 allows remote attackers to run arbitrary code via weak cipher in Shiro framework.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502, CWE-502
References: https://www.du1ge.com/archives/CVE-2021-38241; https://www.du1ge.com/archives/CVE-2021-38241
CVE: CVE-2022-23490
Published: 2022-12-16
Description: BigBlueButton is an open source web conferencing system. Versions prior to 2.4.0 expose sensitive information to Unauthorized Actors. This issue affects meetings with polls, where the attacker is a meeting participant. Subscribing to the current-poll collection does not update the client UI, but does give the attacker access to the contents of the collection, which include the individual poll responses. This issue is patched in version 2.4.0. There are no workarounds.

CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200, CWE-863, CWE-863
References: https://github.com/bigbluebutton/bigbluebutton/releases/tag/v2.4.0; https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-4qgc-xhw5-6qfg; https://github.com/bigbluebutton/bigbluebutton/releases/tag/v2.4.0
CVE: CVE-2022-26579
Published: 2022-12-16
Description: PAX A930 device with PayDroid_7.1.1_Virgo_V04.3.26T1_20210419 can allow a root privileged attacker to install unsigned packages. The attacker must have shell access to the device and gain root privileges in order to exploit this vulnerability.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-345, CWE-345
References: https://cyshield.com/e077d6c3-adff-49a1-afc3-71e10140f95c; https://github.com/wr3nchsr/PAX-Paydroid-Advisories/blob/master/advisories/2022/CVEs/CVE-2022-26579.md; https://wr3nchsr.github.io/pax-paydroid-vulnerabilities-advisory-2022/
CVE: CVE-2022-26580
Published: 2022-12-16
Description: PAX A930 device with PayDroid_7.1.1_Virgo_V04.3.26T1_20210419 can allow the execution of specific command injections on selected binaries in the ADB daemon shell service. The attacker must have physical USB access to the device in order to exploit this vulnerability.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-78
References: https://cyshield.com/e077d6c3-adff-49a1-afc3-71e10140f95c; https://github.com/wr3nchsr/PAX-Paydroid-Advisories/blob/master/advisories/2022/CVEs/CVE-2022-26580.md; https://wr3nchsr.github.io/pax-paydroid-vulnerabilities-advisory-2022/
CVE: CVE-2022-26581
Published: 2022-12-16
Description: PAX A930 device with PayDroid_7.1.1_Virgo_V04.3.26T1_20210419 can allow an unauthorized attacker to perform privileged actions through the execution of specific binaries listed in ADB daemon. The attacker must have physical USB access to the device in order to exploit this vulnerability.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-862
References: https://cyshield.com/e077d6c3-adff-49a1-afc3-71e10140f95c; https://github.com/wr3nchsr/PAX-Paydroid-Advisories/blob/master/advisories/2022/CVEs/CVE-2022-26581.md; https://wr3nchsr.github.io/pax-paydroid-vulnerabilities-advisory-2022/
CVE: CVE-2022-26582
Published: 2022-12-16
Description: PAX A930 device with PayDroid_7.1.1_Virgo_V04.3.26T1_20210419 can allow an attacker to gain root access through command injection in systool client. The attacker must have shell access to the device in order to exploit this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20, CWE-78, CWE-20, CWE-78
References: https://cyshield.com/e077d6c3-adff-49a1-afc3-71e10140f95c; https://github.com/wr3nchsr/PAX-Paydroid-Advisories/blob/master/advisories/2022/CVEs/CVE-2022-26582.md; https://wr3nchsr.github.io/pax-paydroid-vulnerabilities-advisory-2022/
CVE: CVE-2022-37832
Published: 2022-12-16
Description: Mutiny 7.2.0-10788 suffers from Hardcoded root password.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798, CWE-798
References: https://labs.jumpsec.com/advisory-cve-2022-37832-mutiny-network-monitoring-appliance-hardcoded-credentials/; https://labs.jumpsec.com/advisory-cve-2022-37832-mutiny-network-monitoring-appliance-hardcoded-credentials/
CVE: CVE-2022-23530
Published: 2022-12-16
Description: GuardDog is a CLI tool to identify malicious PyPI packages. Versions prior to v0.1.8 are vulnerable to arbitrary file write when scanning a specially-crafted remote PyPI package. Extracting files using shutil.unpack_archive() from a potentially malicious tarball without validating that the destination file path is within the intended destination directory can cause files outside the destination directory to be overwritten.  This issue is patched in version 0.1.8. Potential workarounds include using a safer module, like zipfile, and validating the location of the extracted files and discarding those with malicious paths.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-22
References: https://github.com/DataDog/guarddog/blob/a1d064ceb09d39bb28deb6972bc0a278756ea91f/guarddog/scanners/package_scanner.py#L153..158; https://github.com/DataDog/guarddog/commit/37c7d0767ba28f4df46117d478f97652594c491c; https://github.com/DataDog/guarddog/security/advisories/GHSA-78m5-jpmf-ch7v
CVE: CVE-2022-38756
Published: 2022-12-16
Description: A vulnerability has been identified in Micro Focus GroupWise Web in versions prior to 18.4.2. The GW Web component makes a request to the Post Office Agent that contains sensitive information in the query parameters that could be logged by any intervening HTTP proxies.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-532, CWE-532
References: http://packetstormsecurity.com/files/170768/Micro-Focus-GroupWise-Session-ID-Disclosure.html; http://seclists.org/fulldisclosure/2023/Jan/28; https://portal.microfocus.com/s/article/KM000012374?language=en_US
CVE: CVE-2022-23531
Published: 2022-12-17
Description: GuardDog is a CLI tool to identify malicious PyPI packages. Versions prior to 0.1.5 are vulnerable to Relative Path Traversal when scanning a specially-crafted local PyPI package. Running GuardDog against a specially-crafted package can allow an attacker to write an arbitrary file on the machine where GuardDog is executed due to a path traversal vulnerability when extracting the .tar.gz file of the package being scanned, which exists by design in the tarfile.TarFile.extractall function. This issue is patched in version 0.1.5.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-23, CWE-22
References: https://github.com/DataDog/guarddog/pull/89/commits/a56aff58264cb6b7855d71b00dc10c39a5dbd306; https://github.com/DataDog/guarddog/releases/tag/v0.1.5; https://github.com/DataDog/guarddog/security/advisories/GHSA-rp2v-v467-q9vq
CVE: CVE-2022-23488
Published: 2022-12-17
Description: BigBlueButton is an open source web conferencing system. Versions prior to 2.4-rc-6 are vulnerable to Insertion of Sensitive Information Into Sent Data. The moderators-only webcams lock setting is not enforced on the backend, which allows an attacker to subscribe to viewers' webcams, even when the lock setting is applied. (The required streamId was being sent to all users even with lock setting applied). This issue is fixed in version 2.4-rc-6.  There are no workarounds.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200, CWE-201, CWE-863
References: https://github.com/bigbluebutton/bigbluebutton/releases/tag/v2.4-rc-6; https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-j5g3-f74q-rvfq; https://github.com/bigbluebutton/bigbluebutton/releases/tag/v2.4-rc-6
CVE: CVE-2022-4572
Published: 2022-12-17
Description: A vulnerability, which was classified as problematic, has been found in UBI Reader up to 0.8.0. Affected by this issue is the function ubireader_extract_files of the file ubireader/ubifs/output.py of the component UBIFS File Handler. The manipulation leads to path traversal. The attack may be launched remotely. Upgrading to version 0.8.5 is able to address this issue. The name of the patch is d5d68e6b1b9f7070c29df5f67fc060f579ae9139. It is recommended to upgrade the affected component. VDB-216146 is the identifier assigned to this vulnerability.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-22
References: https://github.com/jrspruitt/ubi_reader/commit/d5d68e6b1b9f7070c29df5f67fc060f579ae9139; https://github.com/jrspruitt/ubi_reader/pull/57; https://github.com/jrspruitt/ubi_reader/releases/tag/v0.8.5-master
CVE: CVE-2022-4567
Published: 2022-12-17
Description: Improper Access Control in GitHub repository openemr/openemr prior to 7.0.0.2.
CVSS Score: 8.1 (HIGH)
CWE: CWE-284
References: https://github.com/openemr/openemr/commit/953cb84dfd55fee9d5296668ec7fdb8bf25bcea4; https://huntr.dev/bounties/1ac677c4-ec0a-4788-9465-51d9b6bd8fd2; https://github.com/openemr/openemr/commit/953cb84dfd55fee9d5296668ec7fdb8bf25bcea4
CVE: CVE-2022-4581
Published: 2022-12-17
Description: A vulnerability was found in 1j01 mind-map and classified as problematic. This issue affects some unknown processing of the file app.coffee. The manipulation of the argument html leads to cross site scripting. The attack may be initiated remotely. The name of the patch is 9617e6084dfeccd92079ab4d7f439300a4b24394. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-216167.
CVSS Score: 3.5 (LOW)
CWE: CWE-707
References: https://github.com/1j01/mind-map/commit/9617e6084dfeccd92079ab4d7f439300a4b24394; https://vuldb.com/?id.216167; https://github.com/1j01/mind-map/commit/9617e6084dfeccd92079ab4d7f439300a4b24394
CVE: CVE-2022-4582
Published: 2022-12-17
Description: A vulnerability was found in starter-public-edition-4 up to 4.6.10. It has been classified as problematic. Affected is an unknown function. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 4.6.11 is able to address this issue. The name of the patch is 2606983c20f6ea3430ac4b36b3d2e88aafef45da. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-216168.
CVSS Score: 3.5 (LOW)
CWE: CWE-707
References: https://github.com/ivantcholakov/starter-public-edition-4/commit/2606983c20f6ea3430ac4b36b3d2e88aafef45da; https://github.com/ivantcholakov/starter-public-edition-4/releases/tag/v4.6.11; https://vuldb.com/?id.216168
CVE: CVE-2022-4583
Published: 2022-12-17
Description: A vulnerability was found in jLEMS. It has been declared as critical. Affected by this vulnerability is the function unpackJar of the file src/main/java/org/lemsml/jlems/io/util/JUtil.java. The manipulation leads to path traversal. The attack can be launched remotely. The name of the patch is 8c224637d7d561076364a9e3c2c375daeaf463dc. It is recommended to apply a patch to fix this issue. The identifier VDB-216169 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-22
References: https://github.com/LEMS/jLEMS/commit/8c224637d7d561076364a9e3c2c375daeaf463dc; https://github.com/LEMS/jLEMS/pull/103; https://vuldb.com/?id.216169
CVE: CVE-2022-4584
Published: 2022-12-17
Description: A vulnerability was found in Axiomatic Bento4 up to 1.6.0-639. It has been rated as critical. Affected by this issue is some unknown functionality of the component mp42aac. The manipulation leads to heap-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-216170 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-122
References: https://github.com/axiomatic-systems/Bento4/files/10095915/POC2.tar.gz; https://github.com/axiomatic-systems/Bento4/issues/818; https://vuldb.com/?ctiid.216170
CVE: CVE-2022-4585
Published: 2022-12-17
Description: A vulnerability classified as problematic has been found in Opencaching Deutschland oc-server3. This affects an unknown part of the file htdocs/templates2/ocstyle/start.tpl of the component Cookie Handler. The manipulation of the argument usercountryCode leads to cross site scripting. It is possible to initiate the attack remotely. The name of the patch is c720f2777a452186c67ef30db3679dd409556544. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-216171.
CVSS Score: 3.5 (LOW)
CWE: CWE-707, CWE-79
References: https://github.com/OpencachingDeutschland/oc-server3/commit/c720f2777a452186c67ef30db3679dd409556544; https://github.com/OpencachingDeutschland/oc-server3/pull/894; https://vuldb.com/?id.216171