deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-27079
Published: 2022-03-24
Description: Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /goform/setPicListItem.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://github.com/GD008/vuln/blob/main/tenda_M3_setPicListItem/M3_setPicListItem.md; https://github.com/GD008/vuln/blob/main/tenda_M3_setPicListItem/M3_setPicListItem.md
CVE: CVE-2022-27080
Published: 2022-03-24
Description: Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /goform/setWorkmode.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://github.com/GD008/vuln/blob/main/tenda_M3_setWorkmode/M3_setWorkmode.md; https://github.com/GD008/vuln/blob/main/tenda_M3_setWorkmode/M3_setWorkmode.md
CVE: CVE-2022-27081
Published: 2022-03-24
Description: Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /goform/SetLanInfo.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://github.com/GD008/vuln/blob/main/tenda_M3_SetLanInfo/M3_SetLanInfo.md; https://github.com/GD008/vuln/blob/main/tenda_M3_SetLanInfo/M3_SetLanInfo.md
CVE: CVE-2022-27082
Published: 2022-03-24
Description: Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /goform/SetInternetLanInfo.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://github.com/GD008/vuln/blob/main/tenda_M3_SetInternetLanInfo/M3_SetInternetLanInfo.md; https://github.com/GD008/vuln/blob/main/tenda_M3_SetInternetLanInfo/M3_SetInternetLanInfo.md
CVE: CVE-2022-27083
Published: 2022-03-24
Description: Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /cgi-bin/uploadAccessCodePic.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://github.com/GD008/vuln/blob/main/tenda_M3_uploadAccessCodePic/M3_uploadAccessCodePic.md; https://github.com/GD008/vuln/blob/main/tenda_M3_uploadAccessCodePic/M3_uploadAccessCodePic.md
CVE: CVE-2022-27811
Published: 2022-03-24
Description: GNOME OCRFeeder before 0.8.4 allows OS command injection via shell metacharacters in a PDF or image filename.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://gitlab.gnome.org/GNOME/ocrfeeder/-/commit/5286120c8bc8b7ba74e0f9b19b5262b509f38cee; https://gitlab.gnome.org/GNOME/ocrfeeder/-/issues/20; https://gitlab.gnome.org/GNOME/ocrfeeder/-/merge_requests/13
CVE: CVE-2022-27820
Published: 2022-03-24
Description: OWASP Zed Attack Proxy (ZAP) through w2022-03-21 does not verify the TLS certificate chain of an HTTPS server.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-295
References: http://www.openwall.com/lists/oss-security/2022/03/24/3; https://github.com/zaproxy/zaproxy/releases; https://www.openwall.com/lists/oss-security/2022/03/23/1
CVE: CVE-2022-0315
Published: 2022-03-24
Description: Insecure Temporary File in GitHub repository horovod/horovod prior to 0.24.0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-377, CWE-668
References: https://github.com/horovod/horovod/commit/b96ecae4dc69fc0a83c7c2d3f1dde600c20a1b41; https://huntr.dev/bounties/7e50397b-dd63-4bb5-b56d-704094a7da45; https://github.com/horovod/horovod/commit/b96ecae4dc69fc0a83c7c2d3f1dde600c20a1b41
CVE: CVE-2022-1061
Published: 2022-03-24
Description: Heap Buffer Overflow in parseDragons in GitHub repository radareorg/radare2 prior to 5.6.8.
CVSS Score: 7.5 (HIGH)
CWE: CWE-122, CWE-787
References: https://github.com/radareorg/radare2/commit/d4ce40b516ffd70cf2e9e36832d8de139117d522; https://huntr.dev/bounties/a7546dae-01c5-4fb0-8a8e-c04ea4e9bac7; https://github.com/radareorg/radare2/commit/d4ce40b516ffd70cf2e9e36832d8de139117d522
CVE: CVE-2022-0145
Published: 2022-03-24
Description: Cross-site Scripting (XSS) - Stored in GitHub repository forkcms/forkcms prior to 5.11.1.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/forkcms/forkcms/commit/981730f1a3d59b423ca903b1f4bf79b848a1766e; https://huntr.dev/bounties/b5b8c680-3cd9-4477-bcd9-3a29657ba7ba; https://github.com/forkcms/forkcms/commit/981730f1a3d59b423ca903b1f4bf79b848a1766e
CVE: CVE-2021-43700
Published: 2022-03-24
Description: An issue was discovered in ApiManager 1.1. there is sql injection vulnerability that can use in /index.php?act=api&tag=8.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/gongwalker/ApiManager/issues/26; https://github.com/gongwalker/ApiManager/issues/26
CVE: CVE-2022-1052
Published: 2022-03-24
Description: Heap Buffer Overflow in iterate_chained_fixups in GitHub repository radareorg/radare2 prior to 5.6.6.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-122, CWE-787
References: https://github.com/radareorg/radare2/commit/0052500c1ed5bf8263b26b9fd7773dbdc6f170c4; https://huntr.dev/bounties/3b3b7f77-ab8d-4de3-999b-eeec0a3eebe7; https://github.com/radareorg/radare2/commit/0052500c1ed5bf8263b26b9fd7773dbdc6f170c4
CVE: CVE-2021-43659
Published: 2022-03-24
Description: In halo 1.4.14, the function point of uploading the avatar, any file can be uploaded, such as uploading an HTML file, which will cause a stored XSS vulnerability.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/halo-dev/halo/issues/1522; https://github.com/halo-dev/halo/issues/1522
CVE: CVE-2021-39491
Published: 2022-03-24
Description: A Cross Site Scripting (XSS) vulnerability exists in Yogesh Ojha reNgine v1.0 via the Scan Engine name file in the Scan Engine deletion confirmation modal box . .
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/yogeshojha/rengine/issues/460; https://github.com/yogeshojha/rengine/issues/460
CVE: CVE-2022-0550
Published: 2022-03-24
Description: Improper Input Validation vulnerability in custom report logo upload in Nozomi Networks Guardian, and CMC allows an authenticated attacker with admin or report manager roles to execute unattended commands on the appliance using web server user privileges. This issue affects: Nozomi Networks Guardian versions prior to 22.0.0. Nozomi Networks CMC versions prior to 22.0.0.
CVSS Score: 7.2 (HIGH)
CWE: CWE-20, CWE-20
References: https://security.nozominetworks.com/NN-2022:2-01; https://security.nozominetworks.com/NN-2022:2-01
CVE: CVE-2022-0551
Published: 2022-03-24
Description: Improper Input Validation vulnerability in project file upload in Nozomi Networks Guardian and CMC allows an authenticated attacker with admin or import manager roles to execute unattended commands on the appliance using web server user privileges. This issue affects: Nozomi Networks Guardian versions prior to 22.0.0. Nozomi Networks CMC versions prior to 22.0.0.
CVSS Score: 7.2 (HIGH)
CWE: CWE-20, CWE-20
References: https://security.nozominetworks.com/NN-2022:2-02; https://security.nozominetworks.com/NN-2022:2-02
CVE: CVE-2022-0955
Published: 2022-03-24
Description: Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/data-hub prior to 1.2.4.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/pimcore/data-hub/commit/15d5b57af2466eebd3bbc531ead5dafa35d0a36e; https://huntr.dev/bounties/708971a6-1e6c-4c51-a411-255caeba51df; https://github.com/pimcore/data-hub/commit/15d5b57af2466eebd3bbc531ead5dafa35d0a36e
CVE: CVE-2022-1058
Published: 2022-03-24
Description: Open Redirect on login in GitHub repository go-gitea/gitea prior to 1.16.5.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601, CWE-601
References: https://github.com/go-gitea/gitea/commit/e3d8e92bdc67562783de9a76b5b7842b68daeb48; https://huntr.dev/bounties/4fb42144-ac70-4f76-a5e1-ef6b5e55dc0d; https://github.com/go-gitea/gitea/commit/e3d8e92bdc67562783de9a76b5b7842b68daeb48
CVE: CVE-2022-26629
Published: 2022-03-24
Description: An Access Control vulnerability exists in SoroushPlus+ Messenger 1.0.30 in the Lock Screen Security Feature function due to insufficient permissions and privileges, which allows a malicious attacker bypass the lock screen function.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-863
References: https://github.com/sysenter-eip/CVE-2022-26629; https://github.com/sysenter-eip/CVE-2022-26629
CVE: CVE-2022-0153
Published: 2022-03-24
Description: SQL Injection in GitHub repository forkcms/forkcms prior to 5.11.1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/forkcms/forkcms/commit/7a12046a67ae5d8cf04face3ee75e55f03a1a608; https://huntr.dev/bounties/841503dd-311c-470a-a8ec-d4579b3274eb; https://github.com/forkcms/forkcms/commit/7a12046a67ae5d8cf04face3ee75e55f03a1a608
CVE: CVE-2022-21820
Published: 2022-03-24
Description: NVIDIA DCGM contains a vulnerability in nvhostengine, where a network user can cause detection of error conditions without action, which may lead to limited code execution, some denial of service, escalation of privileges, and limited impacts to both data confidentiality and integrity.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-20, CWE-755, CWE-787
References: http://packetstormsecurity.com/files/167396/NVIDIA-Data-Center-GPU-Manager-Remote-Memory-Corruption.html; https://nvidia.custhelp.com/app/answers/detail/a_id/5328; http://packetstormsecurity.com/files/167396/NVIDIA-Data-Center-GPU-Manager-Remote-Memory-Corruption.html
CVE: CVE-2022-25568
Published: 2022-03-24
Description: MotionEye v0.42.1 and below allows attackers to access sensitive information via a GET request to /config/list. To exploit this vulnerability, a regular user password must be unconfigured.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1188
References: https://github.com/ccrisan/motioneye/issues/2292; https://www.pizzapower.me/2022/02/17/motioneye-config-info-disclosure/; https://github.com/ccrisan/motioneye/issues/2292
CVE: CVE-2021-43084
Published: 2022-03-24
Description: An SQL Injection vulnerability exists in Dreamer CMS 4.0.0 via the tableName parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://gitee.com/isoftforce/dreamer_cms/issues/I4F93V; https://gitee.com/isoftforce/dreamer_cms/issues/I4F93V
CVE: CVE-2021-43085
Published: 2022-03-24
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2021-43666
Published: 2022-03-24
Description: A Denial of Service vulnerability exists in mbed TLS 3.0.0 and earlier in the mbedtls_pkcs12_derivation function when an input password's length is 0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-130
References: https://github.com/ARMmbed/mbedtls/issues/5136; https://lists.debian.org/debian-lts-announce/2022/12/msg00036.html; https://github.com/ARMmbed/mbedtls/issues/5136
CVE: CVE-2022-22374
Published: 2022-03-24
Description: The BMC (IBM Power 9 AC922 OP910, OP920, OP930, and OP940) may be subject to a firmware downgrade attack which may affect its ability to operate its host. IBM X-Force ID: 221442.
CVSS Score: 9.1 (CRITICAL)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/221442; https://www.ibm.com/support/pages/node/6565075; https://exchange.xforce.ibmcloud.com/vulnerabilities/221442
CVE: CVE-2022-24769
Published: 2022-03-24
Description: Moby is an open-source project created by Docker to enable and accelerate software containerization. A bug was found in Moby (Docker Engine) prior to version 20.10.14 where containers were incorrectly started with non-empty inheritable Linux process capabilities, creating an atypical Linux environment and enabling programs with inheritable file capabilities to elevate those capabilities to the permitted set during `execve(2)`. Normally, when executable programs have specified permitted file capabilities, otherwise unprivileged users and processes can execute those programs and gain the specified file capabilities up to the bounding set. Due to this bug, containers which included executable programs with inheritable file capabilities allowed otherwise unprivileged users and processes to additionally gain these inheritable file capabilities up to the container's bounding set. Containers which use Linux users and groups to perform privilege separation inside the container are most directly impacted. This bug did not affect the container security sandbox as the inheritable set never contained more capabilities than were included in the container's bounding set. This bug has been fixed in Moby (Docker Engine) 20.10.14. Running containers should be stopped, deleted, and recreated for the inheritable capabilities to be reset. This fix changes Moby (Docker Engine) behavior such that containers are started with a more typical Linux environment. As a workaround, the entry point of a container can be modified to use a utility like `capsh(1)` to drop inheritable capabilities prior to the primary process starting.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-732, CWE-732
References: http://www.openwall.com/lists/oss-security/2022/05/12/1; https://github.com/moby/moby/commit/2bbc786e4c59761d722d2d1518cd0a32829bc07f; https://github.com/moby/moby/releases/tag/v20.10.14
CVE: CVE-2022-24776
Published: 2022-03-24
Description: Flask-AppBuilder is an application development framework, built on top of the Flask web framework. Flask-AppBuilder contains an open redirect vulnerability when using database authentication login page on versions below 3.4.5. This issue is fixed in version 3.4.5. There are currently no known workarounds.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://github.com/dpgaspar/Flask-AppBuilder/pull/1804; https://github.com/dpgaspar/Flask-AppBuilder/releases/tag/v3.4.5; https://github.com/dpgaspar/Flask-AppBuilder/security/advisories/GHSA-2ccw-7px8-vmpf
CVE: CVE-2022-24781
Published: 2022-03-24
Description: Geon is a board game based on solving questions about the Pythagorean Theorem. Malicious users can obtain the uuid from other users, spoof that uuid through the browser console and become co-owners of the target session. This issue is patched in version 1.1.0. No known workaround exists.
CVSS Score: 7.1 (HIGH)
CWE: CWE-384
References: https://github.com/math-geon/Geon/commit/005456d752d5434b60026edbc83b2665b8557d19; https://github.com/math-geon/Geon/releases/tag/v1.1.0; https://github.com/math-geon/Geon/security/advisories/GHSA-4fv9-g2jh-j5xm
CVE: CVE-2022-24782
Published: 2022-03-24
Description: Discourse is an open source discussion platform. Versions 2.8.2 and prior in the `stable` branch, 2.9.0.beta3 and prior in the `beta` branch, and 2.9.0.beta3 and prior in the `tests-passed` branch are vulnerable to a data leak. Users can request an export of their own activity. Sometimes, due to category settings, they may have category membership for a secure category. The name of this secure category is shown to the user in the export. The same thing occurs when the user's post has been moved to a secure category. A patch for this issue is available in the `main` branch of Discourse's GitHub repository and is anticipated to be part of future releases.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://github.com/discourse/discourse/commit/9d5737fd28374cc876c070f6c3a931a8071ec356; https://github.com/discourse/discourse/pull/16273; https://github.com/discourse/discourse/security/advisories/GHSA-c3cq-w899-f343
CVE: CVE-2022-25571
Published: 2022-03-24
Description: Bluedon Information Security Technologies Co.,Ltd Internet Access Detector v1.0 was discovered to contain an information leak which allows attackers to access the contents of the password file via unspecified vectors.
CVSS Score: 7.5 (HIGH)
References: https://www.yuque.com/docs/share/a3a6f248-364b-459a-b572-52e7584192ba; https://www.yuque.com/docs/share/a3a6f248-364b-459a-b572-52e7584192ba
CVE: CVE-2022-25575
Published: 2022-03-24
Description: Multiple cross-site scripting (XSS) vulnerabilities in Parking Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via crafted payloads injected into the user name, password, and verification code text boxes.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/gou-web/Parking-management-systemXSS-/blob/main/README.md; https://github.com/gou-web/Parking-management-systemXSS-/blob/main/README.md
CVE: CVE-2022-26249
Published: 2022-03-24
Description: Survey King v0.3.0 does not filter data properly when exporting excel files, allowing attackers to execute arbitrary code or access sensitive information via a CSV injection attack.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1236
References: https://gitee.com/surveyking/surveyking/issues/I4V05A; https://gitee.com/surveyking/surveyking/issues/I4V05A
CVE: CVE-2022-26272
Published: 2022-03-24
Description: A remote code execution (RCE) vulnerability in Ionize v1.0.8.1 allows attackers to execute arbitrary code via a crafted string written to the file application/config/config.php.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/ionize/ionize/issues/403; https://github.com/ionize/ionize/issues/403
CVE: CVE-2022-26279
Published: 2022-03-24
Description: EyouCMS v1.5.5 was discovered to have no access control in the component /data/sqldata.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-425
References: https://github.com/eyoucms/eyoucms/issues/22; https://www.eyoucms.com/rizhi/; https://github.com/eyoucms/eyoucms/issues/22
CVE: CVE-2022-26301
Published: 2022-03-24
Description: TuziCMS v2.0.6 was discovered to contain a SQL injection vulnerability via the component App\Manage\Controller\ZhuantiController.class.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/yeyinshi/tuzicms/issues/11; https://github.com/yeyinshi/tuzicms/issues/11
CVE: CVE-2022-25576
Published: 2022-03-24
Description: Anchor CMS v0.12.7 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component anchor/routes/posts.php. This vulnerability allows attackers to arbitrarily delete posts.
CVSS Score: 4.5 (MEDIUM)
CWE: CWE-352
References: https://github.com/anchorcms/anchor-cms; https://github.com/butterflyhack/anchorcms-0.12.7-CSRF; https://github.com/anchorcms/anchor-cms
CVE: CVE-2022-22687
Published: 2022-03-25
Description: Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in Authentication functionality in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows remote attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120, CWE-120
References: https://www.synology.com/security/advisory/Synology_SA_20_26; https://www.synology.com/security/advisory/Synology_SA_20_26
CVE: CVE-2022-22688
Published: 2022-03-25
Description: Improper neutralization of special elements used in a command ('Command Injection') vulnerability in File service functionality in Synology DiskStation Manager (DSM) before 6.2.4-25556-2 allows remote authenticated users to execute arbitrary commands via unspecified vectors.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: https://www.synology.com/security/advisory/Synology_SA_21_22; https://www.synology.com/security/advisory/Synology_SA_21_22
CVE: CVE-2018-25032
Published: 2022-03-25
Description: zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-787
References: http://seclists.org/fulldisclosure/2022/May/33; http://seclists.org/fulldisclosure/2022/May/35; http://seclists.org/fulldisclosure/2022/May/38
CVE: CVE-2021-44751
Published: 2022-03-25
Description: A vulnerability affecting F-Secure SAFE browser was discovered. A maliciously crafted website attached with USSD code in JavaScript or iFrame can trigger dialer application from F-Secure browser which can be exploited by an attacker to send unwanted USSD messages or perform unwanted calls. In most modern Android OS, dialer application will require user interaction, however, some older Android OS may not need user interaction.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-276
References: https://www.f-secure.com/en/business/programs/vulnerability-reward-program/hall-of-fame; https://www.f-secure.com/en/business/programs/vulnerability-reward-program/hall-of-fame
CVE: CVE-2022-1040
Published: 2022-03-25
Description: An authentication bypass vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v18.5 MR3 and older.
CVSS Score: 9.8 (CRITICAL)
References: http://packetstormsecurity.com/files/168046/Sophos-XG115w-Firewall-17.0.10-MR-10-Authentication-Bypass.html; https://www.exploit-db.com/exploits/51006; https://www.sophos.com/en-us/security-advisories/sophos-sa-20220325-sfos-rce
CVE: CVE-2022-1064
Published: 2022-03-25
Description: SQL injection through marking blog comments on bulk as spam in GitHub repository forkcms/forkcms prior to 5.11.1.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/forkcms/forkcms/commit/6aca30e10b4181534f73f96d6e2ebeb45ec15069; https://huntr.dev/bounties/2f664985-c5fc-485b-b4fc-4c401be2cf40; https://github.com/forkcms/forkcms/commit/6aca30e10b4181534f73f96d6e2ebeb45ec15069
CVE: CVE-2022-27227
Published: 2022-03-25
Description: In PowerDNS Authoritative Server before 4.4.3, 4.5.x before 4.5.4, and 4.6.x before 4.6.1 and PowerDNS Recursor before 4.4.8, 4.5.x before 4.5.8, and 4.6.x before 4.6.1, insufficient validation of an IXFR end condition causes incomplete zone transfers to be handled as successful transfers.
CVSS Score: 7.5 (HIGH)
References: http://www.openwall.com/lists/oss-security/2022/03/25/1; https://doc.powerdns.com/authoritative/security-advisories/index.html; https://doc.powerdns.com/authoritative/security-advisories/powerdns-advisory-2022-01.html
CVE: CVE-2020-21554
Published: 2022-03-25
Description: A File Deletion vulnerability exists in TinyShop 3.1.1 in the back_list parameter in controllers\admin.php, which could let a malicious user delete any file such as install.lock to reinstall cms.
CVSS Score: 8.1 (HIGH)
References: http://tinyrise.com/; http://tinyrise.com/down.html; https://imgur.com/dg1DM5T
CVE: CVE-2021-43090
Published: 2022-03-25
Description: An XML External Entity (XXE) vulnerability exists in soa-model before 1.6.4 in the WSDLParser function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-611
References: https://github.com/membrane/soa-model/commit/19de16902468e7963cc4dc6b544574bc1ea3f251; https://github.com/membrane/soa-model/commit/3aa295f155f621d5ea661cb9a0604013fc8fd8ff; https://github.com/membrane/soa-model/issues/281
CVE: CVE-2021-46426
Published: 2022-03-25
Description: phpIPAM 1.4.4 allows Reflected XSS and CSRF via app/admin/subnets/find_free_section_subnets.php of the subnets functionality.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-352
References: http://packetstormsecurity.com/files/167227/PHPIPAM-1.4.4-Cross-Site-Request-Forgery-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2022/May/43; https://github.com/phpipam
CVE: CVE-2022-25574
Published: 2022-03-25
Description: A stored cross-site scripting (XSS) vulnerability in the upload function of /admin/show.php allows attackers to execute arbitrary web scripts or HTML via a crafted image file.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: http://douphp.com; https://github.com/aqianhei/aqian/issues/1#issue[PII_REDACTED]; http://douphp.com
CVE: CVE-2021-43091
Published: 2022-03-25
Description: An SQL Injection vlnerability exits in Yeswiki doryphore 20211012 via the email parameter in the registration form.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://github.com/yeswiki/yeswiki/commit/c9785f9a92744c3475f9676a0d8f95de24750094; https://huntr.dev/bounties/07f245a7-ee9f-4b55-a0cc-13d5cb1be6e0/; https://github.com/yeswiki/yeswiki/commit/c9785f9a92744c3475f9676a0d8f95de24750094