deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-42775
Published: 2022-12-06
Description: In camera driver, there is a possible memory corruption due to improper locking. This could lead to local denial of service in kernel.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119, CWE-667
References: https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]88411006; https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]88411006
CVE: CVE-2022-42776
Published: 2022-12-06
Description: In UscAIEngine service, there is a missing permission check. This could lead to set up UscAIEngine service with no additional execution privileges needed.
CVSS Score: 7.8 (HIGH)
CWE: CWE-862, CWE-862
References: https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]88411006; https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]88411006
CVE: CVE-2022-42777
Published: 2022-12-06
Description: In power management service, there is a missing permission check. This could lead to set up power management service with no additional execution privileges needed.
CVSS Score: 7.8 (HIGH)
CWE: CWE-862, CWE-862
References: https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]91336001; https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]91336001
CVE: CVE-2022-42778
Published: 2022-12-06
Description: In windows manager service, there is a missing permission check. This could lead to set up windows manager service with no additional execution privileges needed.
CVSS Score: 7.8 (HIGH)
CWE: CWE-862, CWE-862
References: https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]88411006; https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]88411006
CVE: CVE-2022-42779
Published: 2022-12-06
Description: In wlan driver, there is a possible missing bounds check, This could lead to local denial of service in wlan services.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-126, CWE-125
References: https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]88411006; https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]88411006
CVE: CVE-2022-42780
Published: 2022-12-06
Description: In wlan driver, there is a possible missing bounds check, This could lead to local denial of service in wlan services.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-126, CWE-125
References: https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]88411006; https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]88411006
CVE: CVE-2022-42781
Published: 2022-12-06
Description: In wlan driver, there is a possible missing bounds check, This could lead to local denial of service in wlan services.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-126, CWE-125
References: https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]88411006; https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]88411006
CVE: CVE-2022-42782
Published: 2022-12-06
Description: In wlan driver, there is a possible missing permission check, This could lead to local information disclosure.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200, CWE-862
References: https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]88411006; https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]88411006
CVE: CVE-2022-4296
Published: 2022-12-06
Description: A vulnerability classified as problematic has been found in TP-Link TL-WR740N. Affected is an unknown function of the component ARP Handler. The manipulation leads to resource consumption. The attack needs to be done within the local network. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-214812.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-404
References: https://vuldb.com/?id.214812; https://www.youtube.com/watch?v=D--fb-cesmA; https://vuldb.com/?id.214812
CVE: CVE-2022-4300
Published: 2022-12-06
Description: A vulnerability was found in FastCMS. It has been rated as critical. This issue affects some unknown processing of the file /template/edit of the component Template Handler. The manipulation leads to injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-214901 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-707, CWE-94
References: https://github.com/Ha0Liu/cveAdd/blob/developer/fastcms%E6%A8%A1%E7%89%88%E6%B3%A8%E5%85%A5/fastcms%20template%20injection%20vulnerability.md; https://vuldb.com/?id.214901; https://github.com/Ha0Liu/cveAdd/blob/developer/fastcms%E6%A8%A1%E7%89%88%E6%B3%A8%E5%85%A5/fastcms%20template%20injection%20vulnerability.md
CVE: CVE-2020-6627
Published: 2022-12-06
Description: The web-management application on Seagate Central NAS STCG2000300, STCG3000300, and STCG4000300 devices allows OS command injection via mv_backend_launch in cirrus/application/helpers/mv_backend_helper.php by leveraging the "start" state and sending a check_device_name request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: http://packetstormsecurity.com/files/172590/Seagate-Central-Storage-2015.0916-User-Creation-Command-Execution.html; https://github.com/rapid7/metasploit-framework/pull/12844; https://pentest.blog/advisory-seagate-central-storage-remote-code-execution/
CVE: CVE-2022-40209
Published: 2022-12-06
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Xylus Themes WP Smart Import plugin <= 1.0.2 on WordPress.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/wp-smart-import/wordpress-importer-plugin-1-0-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-smart-import/wordpress-importer-plugin-1-0-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2022-46383
Published: 2022-12-06
Description: RackN Digital Rebar through 4.6.14, 4.7 through 4.7.22, 4.8 through 4.8.5, 4.9 through 4.9.12, and 4.10 through 4.10.8 has exposed a privileged token via a public API endpoint (Incorrect Access Control). The token can be used to escalate privileges within the Digital Rebar system and grant full administrative access.
CVSS Score: 9.8 (CRITICAL)
References: https://docs.rackn.io/en/latest/doc/security/cve_2022_46383.html; https://rackn.com/products/rebar/; https://docs.rackn.io/en/latest/doc/security/cve_2022_46383.html
CVE: CVE-2022-38123
Published: 2022-12-06
Description: Improper Input Validation of plugin files in Administrator Interface of Secomea GateManager allows a server administrator to inject code into the GateManager interface.

This issue affects:

Secomea GateManager

versions prior to 10.0.




CVSS Score: 8.7 (HIGH)
CWE: CWE-20, CWE-20
References: https://www.secomea.com/support/cybersecurity-advisory/; https://www.secomea.com/support/cybersecurity-advisory/
CVE: CVE-2022-41325
Published: 2022-12-06
Description: An integer overflow in the VNC module in VideoLAN VLC Media Player through 3.0.17.4 allows attackers, by tricking a user into opening a crafted playlist or connecting to a rogue VNC server, to crash VLC or execute code under some conditions.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190, CWE-190
References: https://twitter.com/0xMitsurugi; https://www.debian.org/security/2022/dsa-5297; https://www.synacktiv.com/sites/default/files/2022-11/vlc_vnc_int_overflow-CVE-2022-41325.pdf
CVE: CVE-2022-43363
Published: 2022-12-06
Description: Telegram Web 15.3.1 allows XSS via a certain payload derived from a Target Corporation website. NOTE: some third parties have been unable to discern any relationship between the Pastebin information and a possible XSS finding.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://bugs.telegram.org/c/17831; https://pastebin.com/72MRwNXW; https://bugs.telegram.org/c/17831
CVE: CVE-2022-44289
Published: 2022-12-06
Description: Thinkphp 5.1.41 and 5.0.24 has a code logic error which causes file upload getshell.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434, CWE-434
References: https://github.com/top-think/framework/issues/2772; https://github.com/top-think/framework/issues/2772
CVE: CVE-2022-46382
Published: 2022-12-06
Description: RackN Digital Rebar through 4.6.14, 4.7 through 4.7.22, 4.8 through 4.8.5, 4.9 through 4.9.12, and 4.10 through 4.10.8 has Insecure Permissions. After signing into Digital Rebar, users are issued authentication tokens tied to their account to perform actions within Digital Rebar. During the validation process of these tokens, Digital Rebar did not check if the user account still exists. Deleted Digital Rebar users could still use their tokens to perform actions within Digital Rebar.
CVSS Score: 8.8 (HIGH)
CWE: CWE-276, CWE-276
References: https://rackn.com/products/rebar/; https://rackn.com/products/rebar/
CVE: CVE-2022-30305
Published: 2022-12-06
Description: An insufficient logging [CWE-778] vulnerability in FortiSandbox versions 4.0.0 to 4.0.2, 3.2.0 to 3.2.3 and 3.1.0 to 3.1.5 and FortiDeceptor versions 4.2.0, 4.1.0 through 4.1.1, 4.0.0 through 4.0.2, 3.3.0 through 3.3.3, 3.2.0 through 3.2.2,3.1.0 through 3.1.1 and 3.0.0 through 3.0.2  may allow a remote attacker to repeatedly enter incorrect credentials without causing a log entry, and with no limit on the number of failed authentication attempts.
CVSS Score: 3.7 (LOW)
CWE: CWE-778, CWE-307
References: https://fortiguard.com/psirt/FG-IR-21-170; https://fortiguard.com/psirt/FG-IR-21-170
CVE: CVE-2022-33875
Published: 2022-12-06
Description: An improper neutralization of special elements used in an SQL Command ('SQL Injection') vulnerability in Fortinet FortiADC version 7.1.0, version 7.0.0 through 7.0.2 and version 6.2.4 and below allows an authenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://fortiguard.com/psirt/FG-IR-22-252; https://fortiguard.com/psirt/FG-IR-22-252
CVE: CVE-2022-33876
Published: 2022-12-06
Description: Multiple instances of improper input validation vulnerability in Fortinet FortiADC version 7.1.0, version 7.0.0 through 7.0.2 and version 6.2.4 and below allows an authenticated attacker to retrieve files with specific extension from the underlying Linux system via crafted HTTP requests.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-20, CWE-20
References: https://fortiguard.com/psirt/FG-IR-22-253; https://fortiguard.com/psirt/FG-IR-22-253
CVE: CVE-2022-35843
Published: 2022-12-06
Description: An authentication bypass by assumed-immutable data vulnerability [CWE-302] in the FortiOS SSH login component 7.2.0,  7.0.0 through 7.0.7,  6.4.0 through 6.4.9, 6.2 all versions, 6.0 all versions and FortiProxy SSH login component 7.0.0 through 7.0.5, 2.0.0 through 2.0.10, 1.2.0 all versions may allow a remote and unauthenticated attacker to login into the device via sending specially crafted Access-Challenge response from the Radius server.
CVSS Score: 8.1 (HIGH)
CWE: CWE-284, CWE-287
References: https://fortiguard.com/psirt/FG-IR-22-255; https://fortiguard.com/psirt/FG-IR-22-255
CVE: CVE-2022-38379
Published: 2022-12-06
Description: Improper neutralization of input during web page generation [CWE-79] in FortiSOAR 7.0.0 through 7.0.3 and 7.2.0 may allow an authenticated attacker to inject HTML tags via input fields of various components within FortiSOAR.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-79
References: https://fortiguard.com/psirt/FG-IR-22-220; https://fortiguard.com/psirt/FG-IR-22-220
CVE: CVE-2022-40680
Published: 2022-12-06
Description: A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiOS 6.0.7 - 6.0.15, 6.2.2 - 6.2.12, 6.4.0 - 6.4.9 and 7.0.0 - 7.0.3 allows a privileged attacker to execute unauthorized code or commands via storing malicious payloads in replacement messages.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://fortiguard.com/psirt/FG-IR-21-248; https://fortiguard.com/psirt/FG-IR-21-248
CVE: CVE-2022-45326
Published: 2022-12-06
Description: An XML external entity (XXE) injection vulnerability in Kwoksys Kwok Information Server before v2.9.5.SP31 allows remote authenticated users to conduct server-side request forgery (SSRF) attacks.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-611, CWE-611
References: http://www.kwoksys.com/wiki/index.php?title=Release_Notes; https://www.navsec.net/2022/11/12/kwoksys-xxe.html; http://www.kwoksys.com/wiki/index.php?title=Release_Notes
CVE: CVE-2022-23466
Published: 2022-12-06
Description: teler is an real-time intrusion detection and threat alert dashboard. teler prior to version 2.0.0-rc.4 is vulnerable to DOM-based cross-site scripting (XSS) in the teler dashboard. When teler requests messages from the event stream on the `/events` endpoint, the log data displayed on the dashboard are not sanitized. This only affects authenticated users and can only be exploited based on detected threats if the log contains a DOM scripting payload. This vulnerability has been fixed on version `v2.0.0-rc.4`. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/kitabisa/teler/commit/20f59eda2420ac64e29f199a61230a0abc875e8e; https://github.com/kitabisa/teler/security/advisories/GHSA-xr7p-8q82-878q; https://github.com/kitabisa/teler/commit/20f59eda2420ac64e29f199a61230a0abc875e8e
CVE: CVE-2022-23470
Published: 2022-12-06
Description: Galaxy is an open-source platform for data analysis. An arbitrary file read exists in Galaxy 22.01 and Galaxy 22.05 due to the switch to Gunicorn, which can be used to read any file accessible to the operating system user under which Galaxy is running. This vulnerability affects Galaxy 22.01 and higher, after the switch to gunicorn, which serve static contents directly.  Additionally, the vulnerability is mitigated when using Nginx or Apache to serve /static/* contents, instead of Galaxy's internal middleware. This issue has been patched in commit `e5e6bda4f` and will be included in future releases. Users are advised to manually patch their installations. There are no known workarounds for this vulnerability.
CVSS Score: 8.6 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/galaxyproject/galaxy/commit/e5e6bda4f014f807ca77ee0cf6af777a55918346; https://github.com/galaxyproject/galaxy/security/advisories/GHSA-grjf-2ghx-q77x; https://github.com/galaxyproject/galaxy/commit/e5e6bda4f014f807ca77ee0cf6af777a55918346
CVE: CVE-2022-23472
Published: 2022-12-06
Description: Passeo is an open source python password generator. Versions prior to 1.0.5 rely on the python `random` library for random value selection. The python `random` library warns that it should not be used for security purposes due to its reliance on a non-cryptographically secure random number generator. As a result a motivated attacker may be able to guess generated passwords. This issue has been addressed in version 1.0.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-338
References: https://github.com/ArjunSharda/Passeo/commit/8caa798b6bc4647dca59b2376204b6dc6176361a; https://github.com/ArjunSharda/Passeo/security/advisories/GHSA-mhhf-vgwh-fw9h; https://peps.python.org/pep-0506/
CVE: CVE-2022-34361
Published: 2022-12-06
Description: 
IBM Sterling Secure Proxy 6.0.3 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 230522.


CVSS Score: 5.9 (MEDIUM)
CWE: CWE-327, CWE-327
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/230522; https://www.ibm.com/support/pages/node/6844763; https://exchange.xforce.ibmcloud.com/vulnerabilities/230522
CVE: CVE-2022-41559
Published: 2022-12-06
Description: The Web Client component of TIBCO Software Inc.'s TIBCO Nimbus contains an easily exploitable vulnerability that allows an unauthenticated attacker with network access to exploit an open redirect on the affected system. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.'s TIBCO Nimbus: version 10.5.0.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-601, CWE-601
References: https://www.tibco.com/services/support/advisories; https://www.tibco.com/services/support/advisories
CVE: CVE-2022-41560
Published: 2022-12-06
Description: The Statement Set Upload via the Web Client component of TIBCO Software Inc.'s TIBCO Nimbus contains an easily exploitable vulnerability that allows a low privileged attacker with network access to execute a Denial of Service Attack on the affected system. Affected releases are TIBCO Software Inc.'s TIBCO Nimbus: version 10.5.0.
CVSS Score: 6.5 (MEDIUM)
References: https://www.tibco.com/services/support/advisories; https://www.tibco.com/services/support/advisories
CVE: CVE-2022-43369
Published: 2022-12-06
Description: AutoTaxi Stand Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component search.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/sudoninja-noob/CVE-2022-43369/blob/main/CVE-2022-43369; https://phpgurukul.com/auto-taxi-stand-management-system-using-php-and-mysql/; https://github.com/sudoninja-noob/CVE-2022-43369/blob/main/CVE-2022-43369
CVE: CVE-2022-43867
Published: 2022-12-06
Description: 
IBM Spectrum Scale 5.1.0.1 through 5.1.4.1 could allow a local attacker to execute arbitrary commands in the container. IBM X-Force ID: 239437.


CVSS Score: 7.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/239437; https://www.ibm.com/support/pages/node/6844771; https://exchange.xforce.ibmcloud.com/vulnerabilities/239437
CVE: CVE-2022-45548
Published: 2022-12-06
Description: AyaCMS v3.1.2 has an Arbitrary File Upload vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434, CWE-434
References: https://github.com/loadream/AyaCMS/issues/4; https://github.com/loadream/AyaCMS/issues/4
CVE: CVE-2022-46154
Published: 2022-12-06
Description: Kodexplorer is a chinese language web based file manager and browser based code editor. Versions prior to 4.50 did not prevent unauthenticated users from requesting arbitrary files from the host OS file system. As a result any files available to the host process may be accessed by arbitrary users. This issue has been addressed in version 4.50. Users are advised to upgrade. There are no known workarounds for this issue.
CVSS Score: 8.6 (HIGH)
CWE: CWE-22
References: https://github.com/kalcaddle/KodExplorer/commit/1f7072c0e12150686f10ee8cda82c004f04be98c; https://github.com/kalcaddle/KodExplorer/security/advisories/GHSA-6f8p-4w5q-j5j2; https://github.com/kalcaddle/KodExplorer/commit/1f7072c0e12150686f10ee8cda82c004f04be98c
CVE: CVE-2022-46161
Published: 2022-12-06
Description: pdfmake is an open source client/server side PDF printing in pure JavaScript. In versions up to and including 0.2.5 pdfmake contains an unsafe evaluation of user controlled input. Users of pdfmake are thus subject to arbitrary code execution in the context of the process running the pdfmake code. There are no known fixes for this issue. Users are advised to restrict access to trusted user input.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-94
References: https://github.com/bpampuch/pdfmake/blob/802813970ac6de68a0bd0931b74150b33da0dd18/dev-playground/server.js#L32; https://securitylab.github.com/advisories/GHSL-2022-068_pdfmake/; https://github.com/bpampuch/pdfmake/blob/802813970ac6de68a0bd0931b74150b33da0dd18/dev-playground/server.js#L32
CVE: CVE-2022-4147
Published: 2022-12-06
Description: Quarkus CORS filter allows simple GET and POST requests with invalid Origin to proceed. Simple GET or POST requests made with XMLHttpRequest are the ones which have no event listeners registered on the object returned by the XMLHttpRequest upload property and have no ReadableStream object used in the request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1026
References: https://access.redhat.com/security/cve/CVE-2022-4147; https://access.redhat.com/security/cve/CVE-2022-4147
CVE: CVE-2022-23475
Published: 2022-12-06
Description: daloRADIUS is an open source RADIUS web management application. daloRadius 1.3 and prior are vulnerable to a combination cross site scripting (XSS) and cross site request forgery (CSRF) vulnerability which leads to account takeover in the mng-del.php file because of an unescaped variable reflected in the DOM on line 116. This issue has been addressed in commit `ec3b4a419e`. Users are advised to manually apply the commit in order to mitigate this issue. Users may also mitigate this issue with in two parts 1) The CSRF vulnerability can be mitigated  by making the daloRadius session cookie to samesite=Lax or by the implimentation of a CSRF token in all forms. 2) The XSS vulnerability may be mitigated by escaping it or by introducing a Content-Security policy.



CVSS Score: 8.8 (HIGH)
CWE: CWE-79, CWE-352
References: https://github.com/lirantal/daloradius/commit/ec3b4a419e20540cf28ce60e48998b893e3f1dea; https://github.com/lirantal/daloradius/security/advisories/GHSA-c9xx-6mvw-9v84; https://github.com/lirantal/daloradius/commit/ec3b4a419e20540cf28ce60e48998b893e3f1dea
CVE: CVE-2022-44900
Published: 2022-12-06
Description: A directory traversal vulnerability in the SevenZipFile.extractall() function of the python library py7zr v0.20.0 and earlier allows attackers to write arbitrary files via extracting a crafted 7z file.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-22, CWE-22
References: http://packetstormsecurity.com/files/170127/py7zr-0.20.0-Directory-Traversal.html; https://github.com/miurahr/py7zr/commit/1bb43f17515c7f69673a1c88ab9cc72a7bbef406; https://lessonsec.com/cve/cve-2022-44900/
CVE: CVE-2022-46332
Published: 2022-12-06
Description: The Admin Smart Search feature in Proofpoint Enterprise Protection (PPS/PoD) contains a stored cross-site scripting vulnerability that enables an anonymous email sender to gain admin privileges within the user interface.  This affects all versions 8.19.0 and below.


CVSS Score: 9.6 (CRITICAL)
CWE: CWE-79, CWE-79
References: https://www.proofpoint.com/security/security-advisories/pfpt-sa-2022-0002; https://www.proofpoint.com/security/security-advisories/pfpt-sa-2022-0002
CVE: CVE-2022-46333
Published: 2022-12-06
Description: The admin user interface in Proofpoint Enterprise Protection (PPS/PoD) contains a command injection vulnerability that enables an admin to execute commands beyond their allowed scope.  This affects all versions 8.19.0 and below.


CVSS Score: 7.2 (HIGH)
CWE: CWE-94, CWE-94
References: https://www.proofpoint.com/security/security-advisories/pfpt-sa-2022-0003; https://www.proofpoint.com/security/security-advisories/pfpt-sa-2022-0003
CVE: CVE-2022-42888
Published: 2022-12-06
Description: Unauth. Privilege Escalation vulnerability in ARMember premium plugin <= 5.5.1 on WordPress.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-269, CWE-269
References: https://patchstack.com/database/vulnerability/armember/wordpress-armember-premium-plugin-5-5-1-unauth-privilege-escalation-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/armember/wordpress-armember-premium-plugin-5-5-1-unauth-privilege-escalation-vulnerability?_s_id=cve
CVE: CVE-2022-45359
Published: 2022-12-06
Description: Unauth. Arbitrary File Upload vulnerability in YITH WooCommerce Gift Cards premium plugin <= 3.19.0 on WordPress.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/vulnerability/yith-woocommerce-gift-cards-premium/wordpress-yith-woocommerce-gift-cards-premium-plugin-3-19-0-unauth-arbitrary-file-upload-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/yith-woocommerce-gift-cards-premium/wordpress-yith-woocommerce-gift-cards-premium-plugin-3-19-0-unauth-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2022-45848
Published: 2022-12-06
Description: Unauth. Stored Cross-Site Scripting (XSS) vulnerability in Contest Gallery plugin <= 13.1.0.9 on WordPress.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/contest-gallery/wordpress-contest-gallery-plugin-13-1-0-9-unauth-stored-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/contest-gallery/wordpress-contest-gallery-plugin-13-1-0-9-unauth-stored-cross-site-scripting-xss-vulnerability?_s_id=cve