deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-24857
Published: 2022-04-15
Description: django-mfa3 is a library that implements multi factor authentication for the django web framework. It achieves this by modifying the regular login view. Django however has a second login view for its admin area. This second login view was not modified, so the multi factor authentication can be bypassed. Users are affected if they have activated both django-mfa3 (< 0.5.0) and django.contrib.admin and have not taken any other measures to prevent users from accessing the admin login view. The issue has been fixed in django-mfa3 0.5.0. It is possible to work around the issue by overwriting the admin login route, e.g. by adding the following URL definition *before* the admin routes: url('admin/login/', lambda request: redirect(settings.LOGIN_URL)
CVSS Score: 7.3 (HIGH)
CWE: CWE-287, CWE-287
References: https://github.com/xi/django-mfa3/blob/main/CHANGES.md#050-2022-04-15; https://github.com/xi/django-mfa3/commit/32f656e22df120b84bdf010e014bb19bd97971de; https://github.com/xi/django-mfa3/security/advisories/GHSA-3r7g-wrpr-j5g4
CVE: CVE-2022-26783
Published: 2022-04-15
Description: Windows Hyper-V Shared Virtual Hard Disks Information Disclosure Vulnerability
CVSS Score: 6.5 (MEDIUM)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26783; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26783
CVE: CVE-2022-26784
Published: 2022-04-15
Description: Windows Cluster Shared Volume (CSV) Denial of Service Vulnerability
CVSS Score: 6.5 (MEDIUM)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26784; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26784
CVE: CVE-2022-26785
Published: 2022-04-15
Description: Windows Hyper-V Shared Virtual Hard Disks Information Disclosure Vulnerability
CVSS Score: 6.5 (MEDIUM)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26785; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26785
CVE: CVE-2022-26786
Published: 2022-04-15
Description: Windows Print Spooler Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26786; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26786
CVE: CVE-2022-26787
Published: 2022-04-15
Description: Windows Print Spooler Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26787; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26787
CVE: CVE-2022-26788
Published: 2022-04-15
Description: PowerShell Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26788; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26788
CVE: CVE-2022-26789
Published: 2022-04-15
Description: Windows Print Spooler Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26789; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26789
CVE: CVE-2022-26790
Published: 2022-04-15
Description: Windows Print Spooler Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26790; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26790
CVE: CVE-2022-26791
Published: 2022-04-15
Description: Windows Print Spooler Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26791; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26791
CVE: CVE-2022-26792
Published: 2022-04-15
Description: Windows Print Spooler Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26792; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26792
CVE: CVE-2022-26793
Published: 2022-04-15
Description: Windows Print Spooler Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26793; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26793
CVE: CVE-2022-26794
Published: 2022-04-15
Description: Windows Print Spooler Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26794; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26794
CVE: CVE-2022-26795
Published: 2022-04-15
Description: Windows Print Spooler Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26795; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26795
CVE: CVE-2022-26796
Published: 2022-04-15
Description: Windows Print Spooler Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26796; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26796
CVE: CVE-2022-26797
Published: 2022-04-15
Description: Windows Print Spooler Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26797; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26797
CVE: CVE-2022-26798
Published: 2022-04-15
Description: Windows Print Spooler Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26798; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26798
CVE: CVE-2022-26801
Published: 2022-04-15
Description: Windows Print Spooler Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26801; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26801
CVE: CVE-2022-26802
Published: 2022-04-15
Description: Windows Print Spooler Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26802; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26802
CVE: CVE-2022-26803
Published: 2022-04-15
Description: Windows Print Spooler Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26803; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26803
CVE: CVE-2022-26807
Published: 2022-04-15
Description: Windows Work Folder Service Elevation of Privilege Vulnerability
CVSS Score: 7.0 (HIGH)
CWE: CWE-362, CWE-362
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26807; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26807
CVE: CVE-2022-26808
Published: 2022-04-15
Description: Windows File Explorer Elevation of Privilege Vulnerability
CVSS Score: 7.0 (HIGH)
CWE: CWE-362
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26808; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26808
CVE: CVE-2022-26809
Published: 2022-04-15
Description: Remote Procedure Call Runtime Remote Code Execution Vulnerability
CVSS Score: 9.8 (CRITICAL)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26809; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26809
CVE: CVE-2022-26810
Published: 2022-04-15
Description: Windows File Server Resource Management Service Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26810; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26810
CVE: CVE-2022-26811
Published: 2022-04-15
Description: Windows DNS Server Remote Code Execution Vulnerability
CVSS Score: 7.2 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26811; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26811
CVE: CVE-2022-26812
Published: 2022-04-15
Description: Windows DNS Server Remote Code Execution Vulnerability
CVSS Score: 7.2 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26812; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26812
CVE: CVE-2022-26813
Published: 2022-04-15
Description: Windows DNS Server Remote Code Execution Vulnerability
CVSS Score: 7.2 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26813; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26813
CVE: CVE-2022-26814
Published: 2022-04-15
Description: Windows DNS Server Remote Code Execution Vulnerability
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-362
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26814; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26814
CVE: CVE-2022-26815
Published: 2022-04-15
Description: Windows DNS Server Remote Code Execution Vulnerability
CVSS Score: 7.2 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26815; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26815
CVE: CVE-2022-26816
Published: 2022-04-15
Description: Windows DNS Server Information Disclosure Vulnerability
CVSS Score: 6.5 (MEDIUM)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26816; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26816
CVE: CVE-2022-26817
Published: 2022-04-15
Description: Windows DNS Server Remote Code Execution Vulnerability
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-362
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26817; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26817
CVE: CVE-2022-26818
Published: 2022-04-15
Description: Windows DNS Server Remote Code Execution Vulnerability
CVSS Score: 6.6 (MEDIUM)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26818; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26818
CVE: CVE-2022-26819
Published: 2022-04-15
Description: Windows DNS Server Remote Code Execution Vulnerability
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-362
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26819; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26819
CVE: CVE-2022-26820
Published: 2022-04-15
Description: Windows DNS Server Remote Code Execution Vulnerability
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-362
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26820; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26820
CVE: CVE-2022-26821
Published: 2022-04-15
Description: Windows DNS Server Remote Code Execution Vulnerability
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-362, CWE-362
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26821; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26821
CVE: CVE-2022-26822
Published: 2022-04-15
Description: Windows DNS Server Remote Code Execution Vulnerability
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-362
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26822; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26822
CVE: CVE-2022-26823
Published: 2022-04-15
Description: Windows DNS Server Remote Code Execution Vulnerability
CVSS Score: 7.2 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26823; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26823
CVE: CVE-2022-26824
Published: 2022-04-15
Description: Windows DNS Server Remote Code Execution Vulnerability
CVSS Score: 7.2 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26824; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26824
CVE: CVE-2022-26825
Published: 2022-04-15
Description: Windows DNS Server Remote Code Execution Vulnerability
CVSS Score: 7.2 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26825; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26825
CVE: CVE-2022-26826
Published: 2022-04-15
Description: Windows DNS Server Remote Code Execution Vulnerability
CVSS Score: 7.2 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26826; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26826
CVE: CVE-2022-26827
Published: 2022-04-15
Description: Windows File Server Resource Management Service Elevation of Privilege Vulnerability
CVSS Score: 7.0 (HIGH)
CWE: CWE-362
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26827; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26827
CVE: CVE-2022-26828
Published: 2022-04-15
Description: Windows Bluetooth Driver Elevation of Privilege Vulnerability
CVSS Score: 7.0 (HIGH)
CWE: CWE-362
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26828; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26828
CVE: CVE-2022-26829
Published: 2022-04-15
Description: Windows DNS Server Remote Code Execution Vulnerability
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-362
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26829; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26829
CVE: CVE-2022-26830
Published: 2022-04-15
Description: DiskUsage.exe Remote Code Execution Vulnerability
CVSS Score: 7.5 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26830; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26830
CVE: CVE-2022-26831
Published: 2022-04-15
Description: Windows Lightweight Directory Access Protocol (LDAP) Denial of Service Vulnerability
CVSS Score: 7.5 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26831; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26831
CVE: CVE-2022-26832
Published: 2022-04-15
Description: .NET Framework Denial of Service Vulnerability
CVSS Score: 7.5 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26832; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-26832
CVE: CVE-2022-26896
Published: 2022-04-15
Description: Azure Site Recovery Information Disclosure Vulnerability
CVSS Score: 4.9 (MEDIUM)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26896; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26896
CVE: CVE-2022-26897
Published: 2022-04-15
Description: Azure Site Recovery Information Disclosure Vulnerability
CVSS Score: 4.9 (MEDIUM)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26897; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26897
CVE: CVE-2022-26898
Published: 2022-04-15
Description: Azure Site Recovery Remote Code Execution Vulnerability
CVSS Score: 7.2 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26898; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26898
CVE: CVE-2022-26901
Published: 2022-04-15
Description: Microsoft Excel Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26901; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26901
CVE: CVE-2022-26903
Published: 2022-04-15
Description: Windows Graphics Component Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26903; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26903
CVE: CVE-2022-26904
Published: 2022-04-15
Description: Windows User Profile Service Elevation of Privilege Vulnerability
CVSS Score: 7.0 (HIGH)
CWE: CWE-362, CWE-362
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26904; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26904; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-26904
CVE: CVE-2022-26907
Published: 2022-04-15
Description: Azure SDK for .NET Information Disclosure Vulnerability
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-532
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26907; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26907
CVE: CVE-2022-26910
Published: 2022-04-15
Description: Skype for Business and Lync Spoofing Vulnerability
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-290
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26910; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26910
CVE: CVE-2022-26911
Published: 2022-04-15
Description: Skype for Business Information Disclosure Vulnerability
CVSS Score: 6.5 (MEDIUM)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26911; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26911
CVE: CVE-2022-26914
Published: 2022-04-15
Description: Win32k Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26914; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26914
CVE: CVE-2022-26915
Published: 2022-04-15
Description: Windows Secure Channel Denial of Service Vulnerability
CVSS Score: 7.5 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26915; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26915
CVE: CVE-2022-26916
Published: 2022-04-15
Description: Windows Fax Compose Form Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26916; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26916
CVE: CVE-2022-26917
Published: 2022-04-15
Description: Windows Fax Compose Form Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26917; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26917
CVE: CVE-2022-26918
Published: 2022-04-15
Description: Windows Fax Compose Form Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26918; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26918
CVE: CVE-2022-26919
Published: 2022-04-15
Description: Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability
CVSS Score: 8.1 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26919; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26919
CVE: CVE-2022-26920
Published: 2022-04-15
Description: Windows Graphics Component Information Disclosure Vulnerability
CVSS Score: 5.5 (MEDIUM)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26920; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26920
CVE: CVE-2022-26921
Published: 2022-04-15
Description: Visual Studio Code Elevation of Privilege Vulnerability
CVSS Score: 7.3 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26921; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26921
CVE: CVE-2022-26924
Published: 2022-04-15
Description: YARP Denial of Service Vulnerability
CVSS Score: 7.5 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26924; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26924
CVE: CVE-2022-27048
Published: 2022-04-15
Description: A vulnerability has been discovered in Moxa MGate which allows an attacker to perform a man-in-the-middle (MITM) attack on the device. This affects MGate MB3170 Series Firmware Version 4.2 or lower. and MGate MB3270 Series Firmware Version 4.2 or lower. and MGate MB3280 Series Firmware Version 4.1 or lower. and MGate MB3480 Series Firmware Version 3.2 or lower.
CVSS Score: 7.4 (HIGH)
References: https://www.moxa.com/en/support/product-support/security-advisory/mgate-mb3170-mb3270-mb3280-mb3480-protocol-gateways-vulnerability; https://www.moxa.com/en/support/product-support/security-advisory/mgate-mb3170-mb3270-mb3280-mb3480-protocol-gateways-vulnerability
CVE: CVE-2022-28113
Published: 2022-04-15
Description: An issue in upload.csp of FANTEC GmbH MWiD25-DS Firmware v2.000.030 allows attackers to write files and reset the user passwords without having a valid session cookie.
CVSS Score: 7.2 (HIGH)
CWE: CWE-565
References: https://code-byter.com/2022/04/06/fantec-wifi.html; https://drive.google.com/file/d/1OvpNieX3pYFaZprglr5T0lV0WuLoLcLu/view?usp=sharing; https://drive.google.com/file/d/1s1AgI5Dw7_GNenmI-mw0Sx2B9MkNTbc7/view?usp=sharing
CVE: CVE-2022-24279
Published: 2022-04-15
Description: The package madlib-object-utils before 0.1.8 are vulnerable to Prototype Pollution via the setValue method, as it allows an attacker to merge object prototypes into it. *Note:* This vulnerability derives from an incomplete fix of [CVE-2020-7701](https://security.snyk.io/vuln/SNYK-JS-MADLIBOBJECTUTILS-598676)
CVSS Score: 7.5 (HIGH)
CWE: CWE-1321
References: https://github.com/Qwerios/madlib-object-utils/commit/8d5d54c11c8fb9a7980a99778329acd13e3ef98f; https://snyk.io/vuln/SNYK-JS-MADLIBOBJECTUTILS-2388572; https://github.com/Qwerios/madlib-object-utils/commit/8d5d54c11c8fb9a7980a99778329acd13e3ef98f
CVE: CVE-2022-27421
Published: 2022-04-15
Description: Chamilo LMS v1.11.13 lacks validation on the user modification form, allowing attackers to escalate privileges to Platform Admin.
CVSS Score: 7.2 (HIGH)
CWE: CWE-20
References: https://support.chamilo.org/projects/1/wiki/Security_issues; https://support.chamilo.org/projects/1/wiki/Security_issues
CVE: CVE-2022-27422
Published: 2022-04-15
Description: A reflected cross-site scripting (XSS) vulnerability in Chamilo LMS v1.11.13 allows attackers to execute arbitrary web scripts or HTML via user interaction with a crafted URL.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://support.chamilo.org/projects/1/wiki/Security_issues; https://support.chamilo.org/projects/1/wiki/Security_issues
CVE: CVE-2022-27423
Published: 2022-04-15
Description: Chamilo LMS v1.11.13 was discovered to contain a SQL injection vulnerability via the blog_id parameter at /blog/blog.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://support.chamilo.org/projects/1/wiki/Security_issues; https://support.chamilo.org/projects/1/wiki/Security_issues
CVE: CVE-2022-27425
Published: 2022-04-15
Description: Chamilo LMS v1.11.13 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /blog/blog.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://support.chamilo.org/projects/1/wiki/Security_issues; https://support.chamilo.org/projects/1/wiki/Security_issues
CVE: CVE-2022-27426
Published: 2022-04-15
Description: A Server-Side Request Forgery (SSRF) in Chamilo LMS v1.11.13 allows attackers to enumerate the internal network and execute arbitrary system commands via a crafted Phar file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-918
References: https://support.chamilo.org/projects/1/wiki/Security_issues; https://support.chamilo.org/projects/1/wiki/Security_issues
CVE: CVE-2022-27427
Published: 2022-04-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2021-38745. Reason: This candidate is a duplicate of CVE-2021-38745. Notes: All CVE users should reference CVE-2021-38745 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2022-29072
Published: 2022-04-15
Description: 7-Zip through 21.07 on Windows allows privilege escalation and command execution when a file with the .7z extension is dragged to the Help>Contents area. This is caused by misconfiguration of 7z.dll and a heap overflow. The command runs in a child process under the 7zFM.exe process. NOTE: multiple third parties have reported that no privilege escalation can occur
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: http://packetstormsecurity.com/files/166763/7-Zip-21.07-Code-Execution-Privilege-Escalation.html; https://github.com/kagancapar/CVE-2022-29072; https://news.ycombinator.com/item?id=31070256