deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-38395
Published: 2022-12-12
Description: HP Support Assistant uses HP Performance Tune-up as a diagnostic tool. HP Support Assistant uses Fusion to launch HP Performance Tune-up. It is possible for an attacker to exploit the DLL hijacking vulnerability and elevate privileges when Fusion launches the HP Performance Tune-up.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427, CWE-427
References: https://support.hp.com/us-en/document/ish_6[PII_REDACTED]147-16/hpsbhf03809; https://support.hp.com/us-en/document/ish_6[PII_REDACTED]147-16/hpsbhf03809
CVE: CVE-2022-38656
Published: 2022-12-12
Description: HCL Commerce, when using Elasticsearch, can allow a remote attacker to cause a denial of service attack on the site and make administrative changes.

CVSS Score: 8.6 (HIGH)
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0101265; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0101265
CVE: CVE-2022-38661
Published: 2022-12-12
Description: HCL Workload Automation could allow a local user to overwrite key system files which would cause the system to crash.

CVSS Score: 6.2 (MEDIUM)
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0100939; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0100939
CVE: CVE-2022-3509
Published: 2022-12-12
Description: A parsing issue similar to CVE-2022-3171, but with textformat in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses. We recommend updating to the versions mentioned above.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://github.com/protocolbuffers/protobuf/commit/a3888f53317a8018e7a439bac4abeb8f3425d5e9; https://github.com/protocolbuffers/protobuf/commit/a3888f53317a8018e7a439bac4abeb8f3425d5e9
CVE: CVE-2022-3510
Published: 2022-12-12
Description: A parsing issue similar to CVE-2022-3171, but with Message-Type Extensions in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses. We recommend updating to the versions mentioned above.


CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://github.com/protocolbuffers/protobuf/commit/db7c[PII_REDACTED]722f45c1d26fc08bc41d1bf48; https://github.com/protocolbuffers/protobuf/commit/db7c[PII_REDACTED]722f45c1d26fc08bc41d1bf48
CVE: CVE-2022-42445
Published: 2022-12-12
Description: HCL Launch could allow a user with administrative privileges, including "Manage Security" permissions, the ability to recover a credential previously saved for performing authenticated LDAP searches.

CVSS Score: 4.9 (MEDIUM)
CWE: CWE-522
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0101208; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0101208
CVE: CVE-2022-42446
Published: 2022-12-12
Description: Starting with Sametime 12, anonymous users are enabled by default. After logging in as an anonymous user, one has the ability to browse the User Directory and potentially create chats with internal users.

CVSS Score: 6.5 (MEDIUM)
CWE: CWE-276, CWE-276
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0101768; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0101768
CVE: CVE-2022-43518
Published: 2022-12-12
Description: An authenticated path traversal vulnerability exists in the Aruba EdgeConnect Enterprise web interface. Successful exploitation of this vulnerability results in the ability to read arbitrary files on the underlying operating system, including sensitive system files in Aruba EdgeConnect Enterprise Software version(s): ECOS 9.2.1.0 and below; ECOS 9.1.3.0 and below; ECOS 9.0.7.0 and below; ECOS 8.3.7.1 and below.


CVSS Score: 4.9 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-018.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-018.txt
CVE: CVE-2022-43541
Published: 2022-12-12
Description: Vulnerabilities in the Aruba EdgeConnect Enterprise command line interface allow remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to complete system compromise in Aruba EdgeConnect Enterprise Software version(s): ECOS 9.2.1.0 and below; ECOS 9.1.3.0 and below; ECOS 9.0.7.0 and below; ECOS 8.3.7.1 and below.


CVSS Score: 7.2 (HIGH)
CWE: CWE-94
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-018.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-018.txt
CVE: CVE-2022-43542
Published: 2022-12-12
Description: Vulnerabilities in the Aruba EdgeConnect Enterprise command line interface allow remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to complete system compromise in Aruba EdgeConnect Enterprise Software version(s): ECOS 9.2.1.0 and below; ECOS 9.1.3.0 and below; ECOS 9.0.7.0 and below; ECOS 8.3.7.1 and below.


CVSS Score: 7.2 (HIGH)
CWE: CWE-94
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-018.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-018.txt
CVE: CVE-2022-43780
Published: 2022-12-12
Description: Certain HP ENVY, OfficeJet, and DeskJet printers may be vulnerable to a Denial of Service attack.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://support.hp.com/us-en/document/ish_7[PII_REDACTED]489-16/hpsbpi03813; https://support.hp.com/us-en/document/ish_7[PII_REDACTED]489-16/hpsbpi03813
CVE: CVE-2022-44532
Published: 2022-12-12
Description: An authenticated path traversal vulnerability exists in the Aruba EdgeConnect Enterprise command line interface. Successful exploitation of this vulnerability results in the ability to read arbitrary files on the underlying operating system, including sensitive system files in Aruba EdgeConnect Enterprise Software version(s): ECOS 9.2.1.0 and below; ECOS 9.1.3.0 and below; ECOS 9.0.7.0 and below; ECOS 8.3.7.1 and below.


CVSS Score: 4.9 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-018.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-018.txt
CVE: CVE-2022-44533
Published: 2022-12-12
Description: A vulnerability in the Aruba EdgeConnect Enterprise web management interface allows remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to complete system compromise in Aruba EdgeConnect Enterprise Software version(s): ECOS 9.2.1.0 and below; ECOS 9.1.3.0 and below; ECOS 9.0.7.0 and below; ECOS 8.3.7.1 and below.


CVSS Score: 7.2 (HIGH)
CWE: CWE-94
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-018.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-018.txt
CVE: CVE-2022-44647
Published: 2022-12-12
Description: An Out-of-bounds read vulnerability in Trend Micro Apex One and Apex One as a Service could allow a local attacker to disclose sensitive information on affected installations.

Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

This is similar to, but not the same as CVE-2022-44648.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://success.trendmicro.com/solution/000291770; https://www.zerodayinitiative.com/advisories/ZDI-22-1617/; https://success.trendmicro.com/solution/000291770
CVE: CVE-2022-44648
Published: 2022-12-12
Description: An Out-of-bounds read vulnerability in Trend Micro Apex One and Apex One as a Service could allow a local attacker to disclose sensitive information on affected installations.

Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

This is similar to, but not the same as CVE-2022-44647.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://success.trendmicro.com/solution/000291770; https://www.zerodayinitiative.com/advisories/ZDI-22-1618/; https://success.trendmicro.com/solution/000291770
CVE: CVE-2022-44649
Published: 2022-12-12
Description: An out-of-bounds access vulnerability in the Unauthorized Change Prevention service of Trend Micro Apex One and Apex One as a Service could allow a local attacker to elevate privileges on affected installations.

Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://success.trendmicro.com/solution/000291770; https://www.zerodayinitiative.com/advisories/ZDI-22-1619/; https://success.trendmicro.com/solution/000291770
CVE: CVE-2022-44650
Published: 2022-12-12
Description: A memory corruption vulnerability in the Unauthorized Change Prevention service of Trend Micro Apex One and Apex One as a Service could allow a local attacker to elevate privileges on affected installations.

Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://success.trendmicro.com/solution/000291770; https://www.zerodayinitiative.com/advisories/ZDI-22-1616/; https://success.trendmicro.com/solution/000291770
CVE: CVE-2022-44651
Published: 2022-12-12
Description: A Time-of-Check Time-Of-Use vulnerability in the Trend Micro Apex One and Apex One as a Service agent could allow a local attacker to escalate privileges on affected installations.

Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
CVSS Score: 7.0 (HIGH)
CWE: CWE-367, CWE-367
References: https://success.trendmicro.com/solution/000291770; https://www.zerodayinitiative.com/advisories/ZDI-22-1620/; https://success.trendmicro.com/solution/000291770
CVE: CVE-2022-44652
Published: 2022-12-12
Description: An improper handling of exceptional conditions vulnerability in Trend Micro Apex One and Apex One as a Service could allow a local attacker to escalate privileges on affected installations.

Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-755, CWE-755
References: https://success.trendmicro.com/solution/000291770; https://www.zerodayinitiative.com/advisories/ZDI-22-1621/; https://success.trendmicro.com/solution/000291770
CVE: CVE-2022-44653
Published: 2022-12-12
Description: A security agent directory traversal vulnerability in Trend Micro Apex One and Apex One as a Service could allow a local attacker to escalate privileges on affected installations.

Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-22, CWE-22
References: https://success.trendmicro.com/solution/000291770; https://www.zerodayinitiative.com/advisories/ZDI-22-1622/; https://success.trendmicro.com/solution/000291770
CVE: CVE-2022-44654
Published: 2022-12-12
Description: Affected builds of Trend Micro Apex One and Apex One as a Service contain a monitor engine component that is complied without the /SAFESEH memory protection mechanism which helps to monitor for malicious payloads. The affected component's memory protection mechanism has been updated to enhance product security.
CVSS Score: 7.5 (HIGH)
CWE: CWE-122
References: https://success.trendmicro.com/solution/000291770; https://success.trendmicro.com/solution/000291770
CVE: CVE-2021-4243
Published: 2022-12-12
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2021-32850. Reason: This candidate is a duplicate of CVE-2021-32850. Notes: All CVE users should reference CVE-2021-32850 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2021-4244
Published: 2022-12-12
Description: A vulnerability classified as problematic has been found in yikes-inc-easy-mailchimp-extender Plugin up to 6.8.5. This affects an unknown part of the file admin/partials/ajax/add_field_to_form.php. The manipulation of the argument field_name/merge_tag/field_type/list_id leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 6.8.6 is able to address this issue. The name of the patch is 3662c6593aa1bb[PII_REDACTED]891d26de2e947695. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-215307.
CVSS Score: 2.6 (LOW)
CWE: CWE-707, CWE-79
References: https://github.com/EvanHerman/yikes-inc-easy-mailchimp-extender/commit/3662c6593aa1bb[PII_REDACTED]891d26de2e947695; https://github.com/EvanHerman/yikes-inc-easy-mailchimp-extender/pull/889; https://github.com/EvanHerman/yikes-inc-easy-mailchimp-extender/releases/tag/6.8.6
CVE: CVE-2022-45968
Published: 2022-12-12
Description: Alist v3.4.0 is vulnerable to File Upload. A user with only file upload permission can upload any file to any folder (even a password protected one).
CVSS Score: 8.8 (HIGH)
CWE: CWE-434, CWE-434
References: https://github.com/alist-org/alist/issues/2444; https://github.com/alist-org/alist/issues/2444
CVE: CVE-2022-45970
Published: 2022-12-12
Description: Alist v3.5.1 is vulnerable to Cross Site Scripting (XSS) via the bulletin board.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/alist-org/alist/issues/2457; https://github.com/alist-org/alist/issues/2457
CVE: CVE-2022-4421
Published: 2022-12-12
Description: A vulnerability was found in rAthena FluxCP. It has been classified as problematic. Affected is an unknown function of the file themes/default/servicedesk/view.php of the component Service Desk Image URL Handler. The manipulation of the argument sslink leads to cross site scripting. It is possible to launch the attack remotely. The name of the patch is 8a39b2b2bf28353b3503ff[PII_REDACTED]db15aa7e. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-215304.
CVSS Score: 3.5 (LOW)
CWE: CWE-707, CWE-79
References: https://github.com/rathena/FluxCP/commit/8a39b2b2bf28353b3503ff[PII_REDACTED]db15aa7e; https://vuldb.com/?id.215304; https://github.com/rathena/FluxCP/commit/8a39b2b2bf28353b3503ff[PII_REDACTED]db15aa7e
CVE: CVE-2022-45043
Published: 2022-12-12
Description: Tenda AX12 V22.03.01.16_cn is vulnerable to command injection via goform/fast_setting_internet_set.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://github.com/The-Itach1/IOT-CVE/tree/master/Tenda/AX12/2; https://github.com/The-Itach1/IOT-CVE/tree/master/Tenda/AX12/2; https://github.com/The-Itach1/IOT-CVE/tree/master/Tenda/AX12/2
CVE: CVE-2022-45956
Published: 2022-12-12
Description: Boa Web Server versions 0.94.13 through 0.94.14 fail to validate the correct security constraint on the HEAD HTTP method allowing everyone to bypass the Basic Authorization mechanism.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-863, CWE-863
References: https://packetstormsecurity.com/files/169962/Boa-Web-Server-0.94.13-0.94.14-Authentication-Bypass.html; https://packetstormsecurity.com/files/169962/Boa-Web-Server-0.94.13-0.94.14-Authentication-Bypass.html
CVE: CVE-2022-45957
Published: 2022-12-12
Description: ZTE ZXHN-H108NS router with firmware version H108NSV1.0.7u_ZRD_GR2_A68 is vulnerable to remote stack buffer overflow.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-787
References: https://packetstormsecurity.com/files/169949/ZTE-ZXHN-H108NS-Stack-Buffer-Overflow-Denial-Of-Service.html; https://packetstormsecurity.com/files/169949/ZTE-ZXHN-H108NS-Stack-Buffer-Overflow-Denial-Of-Service.html
CVE: CVE-2022-45977
Published: 2022-12-12
Description: Tenda AX12 V22.03.01.21_CN was found to have a command injection vulnerability via /goform/setMacFilterCfg function.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://github.com/The-Itach1/IOT-CVE/tree/master/Tenda/AX12/3; https://github.com/The-Itach1/IOT-CVE/tree/master/Tenda/AX12/3
CVE: CVE-2022-45979
Published: 2022-12-12
Description: Tenda AX12 v22.03.01.21_CN was discovered to contain a stack overflow via the ssid parameter at /goform/fast_setting_wifi_set .
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-787
References: https://github.com/The-Itach1/IOT-CVE/tree/master/Tenda/AX12/4; https://github.com/The-Itach1/IOT-CVE/tree/master/Tenda/AX12/4
CVE: CVE-2022-45980
Published: 2022-12-12
Description: Tenda AX12 V22.03.01.21_CN was discovered to contain a Cross-Site Request Forgery (CSRF) via /goform/SysToolRestoreSet .
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://github.com/The-Itach1/IOT-CVE/tree/master/Tenda/AX12/6; https://github.com/The-Itach1/IOT-CVE/tree/master/Tenda/AX12/6
CVE: CVE-2022-43503
Published: 2022-12-12
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2022-44147
Published: 2022-12-12
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2019-16891. Reason: This candidate is a reservation duplicate of CVE-2019-16891. Notes: All CVE users should reference CVE-2019-16891 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2022-45119
Published: 2022-12-12
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2022-45996
Published: 2022-12-12
Description: Tenda W20E V16.01.0.6(3392) is vulnerable to Command injection via cmd_get_ping_output.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78, CWE-78
References: https://github.com/bugfinder0/public_bug/tree/main/tenda/w20e/2; https://github.com/bugfinder0/public_bug/tree/main/tenda/w20e/2
CVE: CVE-2022-45997
Published: 2022-12-12
Description: Tenda W20E V16.01.0.6(3392) is vulnerable to Buffer Overflow.
CVSS Score: 7.2 (HIGH)
CWE: CWE-120, CWE-120
References: https://github.com/bugfinder0/public_bug/tree/main/tenda/w20e/1; https://github.com/bugfinder0/public_bug/tree/main/tenda/w20e/1
CVE: CVE-2022-3359
Published: 2022-12-12
Description: The Shortcodes and extra features for Phlox theme WordPress plugin before 2.10.7 unserializes the content of an imported file, which could lead to PHP object injection when a user imports (intentionally or not) a malicious file and a suitable gadget chain is present on the blog.
CVSS Score: 8.8 (HIGH)
References: https://wpscan.com/vulnerability/08f3ce22-94a0-496a-aaf9-d35b6b0f5bb6; https://wpscan.com/vulnerability/08f3ce22-94a0-496a-aaf9-d35b6b0f5bb6
CVE: CVE-2022-3605
Published: 2022-12-12
Description: The WP CSV Exporter WordPress plugin before 1.3.7 does not properly escape the fields when exporting data as CSV, leading to a CSV injection vulnerability.
CVSS Score: 7.8 (HIGH)
References: https://wpscan.com/vulnerability/28ecdf61-e478-42c3-87c0-80a9912eadb2; https://wpscan.com/vulnerability/28ecdf61-e478-42c3-87c0-80a9912eadb2
CVE: CVE-2022-3609
Published: 2022-12-12
Description: The GetYourGuide Ticketing WordPress plugin before 1.0.4 does not sanitise and escape some parameters, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 4.8 (MEDIUM)
References: https://wpscan.com/vulnerability/b893cac2-6511-4e2a-9eff-baf0f3cc9d7e; https://wpscan.com/vulnerability/b893cac2-6511-4e2a-9eff-baf0f3cc9d7e
CVE: CVE-2022-3853
Published: 2022-12-12
Description: Cross-site Scripting (XSS) is a client-side code injection attack. The attacker aims to execute malicious scripts in a web browser of the victim by including malicious code in a legitimate web page or web application.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/c2bc7d23-5bfd-481c-b42b-da7ee80d9514; https://wpscan.com/vulnerability/c2bc7d23-5bfd-481c-b42b-da7ee80d9514
CVE: CVE-2022-3862
Published: 2022-12-12
Description: The Livemesh Addons for Elementor WordPress plugin before 7.2.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.8 (MEDIUM)
References: https://wpscan.com/vulnerability/3db9a8f5-3335-4b8d-a067-091cbfed1efc; https://wpscan.com/vulnerability/3db9a8f5-3335-4b8d-a067-091cbfed1efc
CVE: CVE-2022-3879
Published: 2022-12-12
Description: The Car Dealer (Dealership) and Vehicle sales WordPress Plugin WordPress plugin before 3.05 does not have proper authorisation and CSRF in an AJAX action, allowing any authenticated users, such as subscriber to call it and install and activate arbitrary plugins from wordpress.org
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352, CWE-863
References: https://wpscan.com/vulnerability/0db1762e-1401-4006-88ed-d09a4bc6585b; https://wpscan.com/vulnerability/0db1762e-1401-4006-88ed-d09a4bc6585b
CVE: CVE-2022-3880
Published: 2022-12-12
Description: The Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan WordPress plugin before 4.20 does not have proper authorisation and CSRF in an AJAX action, allowing any authenticated users, such as subscriber to call it and install and activate arbitrary plugins from wordpress.org
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352, CWE-863
References: https://wpscan.com/vulnerability/24743c72-310f-41e9-aac9-e05b2bb1a14e; https://wpscan.com/vulnerability/24743c72-310f-41e9-aac9-e05b2bb1a14e
CVE: CVE-2022-3881
Published: 2022-12-12
Description: The WP Tools Increase Maximum Limits, Repair, Server PHP Info, Javascript errors, File Permissions, Transients, Error Log WordPress plugin before 3.43 does not have proper authorisation and CSRF in an AJAX action, allowing any authenticated users, such as subscriber to call it and install and activate arbitrary plugins from wordpress.org
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-352, CWE-863
References: https://wpscan.com/vulnerability/c2a9cf01-051a-429a-82ca-280885114b5a; https://wpscan.com/vulnerability/c2a9cf01-051a-429a-82ca-280885114b5a
CVE: CVE-2022-3882
Published: 2022-12-12
Description: The Memory Usage, Memory Limit, PHP and Server Memory Health Check and Fix Plugin WordPress plugin before 2.46 does not have proper authorisation and CSRF in an AJAX action, allowing any authenticated users, such as subscriber to call it and install and activate arbitrary plugins from wordpress.org
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352, CWE-863
References: https://wpscan.com/vulnerability/a39c643f-eaa4-4c71-b75d-2c4fe34ac875; https://wpscan.com/vulnerability/a39c643f-eaa4-4c71-b75d-2c4fe34ac875
CVE: CVE-2022-3883
Published: 2022-12-12
Description: The Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection WordPress plugin before 7.24 does not have proper authorisation and CSRF in an AJAX action, allowing any authenticated users, such as subscriber to call it and install and activate arbitrary plugins from wordpress.org
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352, CWE-863
References: https://wpscan.com/vulnerability/8695b157-abac-4aa6-a022-e3ae41c03544; https://wpscan.com/vulnerability/8695b157-abac-4aa6-a022-e3ae41c03544