deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-29768
Published: 2022-06-24
Description: IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 could allow a low level user to obtain sensitive information from the details of the 'Cloud Storage' page for which they should not have access. IBM X-Force ID: 202682.
CVSS Score: 6.5 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/202682; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.ibm.com/support/pages/node/6597241
CVE: CVE-2021-38945
Published: 2022-06-24
Description: IBM Cognos Analytics 11.2.1, 11.2.0, and 11.1.7 could allow a remote attacker to upload arbitrary files, caused by improper content validation. IBM X-Force ID: 211238.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/211238; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.ibm.com/support/pages/node/6597241
CVE: CVE-2021-39047
Published: 2022-06-24
Description: IBM Planning Analytics 2.0 and IBM Cognos Analytics 11.2.1, 11.2.0, and 11.1.7 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 214349.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/214349; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.ibm.com/support/pages/node/6565099
CVE: CVE-2022-20828
Published: 2022-06-24
Description: A vulnerability in the CLI parser of Cisco FirePOWER Software for Adaptive Security Appliance (ASA) FirePOWER module could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected ASA FirePOWER module as the root user. This vulnerability is due to improper handling of undefined command parameters. An attacker could exploit this vulnerability by using a crafted command on the CLI or by submitting a crafted HTTPS request to the web-based management interface of the Cisco ASA that is hosting the ASA FirePOWER module. Note: To exploit this vulnerability, the attacker must have administrative access to the Cisco ASA. A user who has administrative access to a particular Cisco ASA is also expected to have administrative access to the ASA FirePOWER module that is hosted by that Cisco ASA.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-236
References: http://packetstormsecurity.com/files/168256/Cisco-ASA-X-With-FirePOWER-Services-Authenticated-Command-Injection.html; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asasfr-cmd-inject-PE4GfdG; https://www.rapid7.com/blog/post/2022/08/11/rapid7-discovered-vulnerabilities-in-cisco-asa-asdm-and-firepower-services-software/
CVE: CVE-2022-20829
Published: 2022-06-24
Description: A vulnerability in the packaging of Cisco Adaptive Security Device Manager (ASDM) images and the validation of those images by Cisco Adaptive Security Appliance (ASA) Software could allow an authenticated, remote attacker with administrative privileges to upload an ASDM image that contains malicious code to a device that is running Cisco ASA Software. This vulnerability is due to insufficient validation of the authenticity of an ASDM image during its installation on a device that is running Cisco ASA Software. An attacker could exploit this vulnerability by installing a crafted ASDM image on the device that is running Cisco ASA Software and then waiting for a targeted user to access that device using ASDM. A successful exploit could allow the attacker to execute arbitrary code on the machine of the targeted user with the privileges of that user on that machine. Notes: To successfully exploit this vulnerability, the attacker must have administrative privileges on the device that is running Cisco ASA Software. Potential targets are limited to users who manage the same device that is running Cisco ASA Software using ASDM. Cisco has released and will release software updates that address this vulnerability.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-345, CWE-345
References: https://github.com/jbaines-r7/theway; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asa-asdm-sig-NPKvwDjm; https://www.rapid7.com/blog/post/2022/08/11/rapid7-discovered-vulnerabilities-in-cisco-asa-asdm-and-firepower-services-software/
CVE: CVE-2022-22502
Published: 2022-06-24
Description: IBM Robotic Process Automation 21.0.1 and 21.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 227124.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/227124; https://www.ibm.com/support/pages/node/6597667; https://exchange.xforce.ibmcloud.com/vulnerabilities/227124
CVE: CVE-2022-27238
Published: 2022-06-24
Description: BigBlueButton version 2.4.7 (or earlier) is vulnerable to stored Cross-Site Scripting (XSS) in the private chat functionality. A threat actor could inject JavaScript payload in his/her username. The payload gets executed in the browser of the victim each time the attacker sends a private message to the victim or when notification about the attacker leaving room is displayed.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.mgm-sp.com/en/cve-2022-27238-bigbluebutton-xss/; https://www.mgm-sp.com/en/cve-2022-27238-bigbluebutton-xss/
CVE: CVE-2022-29330
Published: 2022-06-24
Description: Missing access control in the backup system of Telesoft VitalPBX before 3.2.1 allows attackers to access the PJSIP and SIP extension credentials, cryptographic keys and voicemails files via unspecified vectors.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-330
References: http://vitalpbx.com; https://www.arsouyes.org/blog/2022/2022-06-30-VitalPBX-0day; http://vitalpbx.com
CVE: CVE-2022-31767
Published: 2022-06-24
Description: IBM CICS TX Standard and Advanced 11.1 could allow a remote attacker to execute arbitrary commands on the system by sending a specially crafted request. IBM X-Force ID: 227980.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/227980; https://www.ibm.com/support/pages/node/6597531; https://www.ibm.com/support/pages/node/6597533
CVE: CVE-2022-33953
Published: 2022-06-24
Description: IBM Robotic Process Automation 21.0.1 and 21.0.2 could allow a user with psychical access to the system to obtain sensitive information due to insufficiently protected access tokens. IBM X-Force ID: 229198.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-522
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/229198; https://www.ibm.com/support/pages/node/6597669; https://exchange.xforce.ibmcloud.com/vulnerabilities/229198
CVE: CVE-2021-20355
Published: 2022-06-24
Description: IBM Jazz Team Server 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 could allow a remote attacker to obtain sensitive information, caused by the failure to set the HTTPOnly flag. A remote attacker could exploit this vulnerability to obtain sensitive information from the cookie. IBM X-Force ID: 194891.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-732
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/194891; https://www.ibm.com/support/pages/node/6597583; https://exchange.xforce.ibmcloud.com/vulnerabilities/194891
CVE: CVE-2021-20421
Published: 2022-06-24
Description: IBM Jazz Team Server 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-918
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/196300; https://www.ibm.com/support/pages/node/6597507; https://exchange.xforce.ibmcloud.com/vulnerabilities/196300
CVE: CVE-2021-20543
Published: 2022-06-24
Description: IBM Jazz Team Server 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site. IBM X-Force ID: 198929.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/198929; https://www.ibm.com/support/pages/node/6597515; https://exchange.xforce.ibmcloud.com/vulnerabilities/198929
CVE: CVE-2021-20544
Published: 2022-06-24
Description: IBM Jazz Team Server 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 198931.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-918
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/198931; https://www.ibm.com/support/pages/node/6597513; https://exchange.xforce.ibmcloud.com/vulnerabilities/198931
CVE: CVE-2021-20551
Published: 2022-06-24
Description: IBM Jazz Team Server 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 199149.
CVSS Score: 3.3 (LOW)
CWE: CWE-668
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/199169; https://www.ibm.com/support/pages/node/6597511; https://exchange.xforce.ibmcloud.com/vulnerabilities/199169
CVE: CVE-2021-29865
Published: 2022-06-24
Description: IBM Jazz Team Server 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim. IBM X-Force ID: 206091.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-1021
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/206091; https://www.ibm.com/support/pages/node/6597505; https://exchange.xforce.ibmcloud.com/vulnerabilities/206091
CVE: CVE-2021-38871
Published: 2022-06-24
Description: IBM Jazz Team Server 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 208345.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/208345; https://www.ibm.com/support/pages/node/6597503; https://exchange.xforce.ibmcloud.com/vulnerabilities/208345
CVE: CVE-2021-38879
Published: 2022-06-24
Description: IBM Jazz Team Server 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 could allow a remote attacker to obtain sensitive information, caused by the failure to set the HTTPOnly flag. A remote attacker could exploit this vulnerability to obtain sensitive information from the cookie. IBM X-Force ID: 209057.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-732
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/209057; https://www.ibm.com/support/pages/node/6597501; https://exchange.xforce.ibmcloud.com/vulnerabilities/209057
CVE: CVE-2021-39408
Published: 2022-06-24
Description: Cross Site Scripting (XSS) vulnerability exists in Online Student Rate System 1.0 via the page parameter on the index.php file
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/StefanDorresteijn/CVE-2021-39408; https://github.com/StefanDorresteijn/CVE-2021-39408
CVE: CVE-2021-39409
Published: 2022-06-24
Description: A vulnerability exists in Online Student Rate System v1.0 that allows any user to register as an administrator without needing to be authenticated.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/StefanDorresteijn/CVE-2021-39409; https://github.com/StefanDorresteijn/CVE-2021-39409
CVE: CVE-2021-40893
Published: 2022-06-24
Description: A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in validate-data v0.1.1 when validating crafted invalid emails.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1333
References: https://github.com/yetingli/SaveResults/blob/main/js/validate-data.js; https://github.com/yetingli/SaveResults/blob/main/js/validate-data.js
CVE: CVE-2021-42056
Published: 2022-06-24
Description: Thales Safenet Authentication Client (SAC) for Linux and Windows through 10.7.7 creates insecure temporary hid and lock files allowing a local attacker, through a symlink attack, to overwrite arbitrary files, and potentially achieve arbitrary command execution with high privileges.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-59
References: https://github.com/z00z00z00/Safenet_SAC_CVE-2021-42056; https://github.com/z00z00z00/Safenet_SAC_CVE-2021-42056
CVE: CVE-2022-22389
Published: 2022-06-24
Description: IBM Db2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, 11.1, and 11.5 is vulnerable to a denial of service as the server may terminate abnormally when executing specially crafted SQL statements by an authenticated user. IBM X-Force ID: 2219740.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/221970; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.ibm.com/support/pages/node/6598047
CVE: CVE-2022-22390
Published: 2022-06-24
Description: IBM Db2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, 11.1, and 11.5 may be vulnerable to an information disclosure caused by improper privilege management when table function is used. IBM X-Force ID: 221973.
CVSS Score: 7.5 (HIGH)
CWE: CWE-269
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/221973; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.ibm.com/support/pages/node/6597993
CVE: CVE-2022-29096
Published: 2022-06-24
Description: Dell Wyse Management Suite 3.6.1 and below contains a Reflected Cross-Site Scripting Vulnerability in saveGroupConfigurations page. An authenticated attacker could potentially exploit this vulnerability, leading to the execution of malicious HTML or JavaScript code in a victim user's web browser in the context of the vulnerable web application. Exploitation may lead to information disclosure, session theft, or client-side request forgery.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.dell.com/support/kbdoc/en-us/000200215/dsa-2022-143-dell-wyse-management-suite-security-update-for-multiple-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000200215/dsa-2022-143-dell-wyse-management-suite-security-update-for-multiple-vulnerabilities
CVE: CVE-2022-29097
Published: 2022-06-24
Description: Dell WMS 3.6.1 and below contains a Path Traversal vulnerability in Device API. A remote attacker could potentially exploit this vulnerability, to gain unauthorized read access to the files stored on the server filesystem, with the privileges of the running web application.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-23, CWE-22
References: https://www.dell.com/support/kbdoc/en-us/000200215/dsa-2022-143-dell-wyse-management-suite-security-update-for-multiple-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000200215/dsa-2022-143-dell-wyse-management-suite-security-update-for-multiple-vulnerabilities
CVE: CVE-2022-29578
Published: 2022-06-24
Description: Meridian Cooperative Utility Software versions 22.02 and 22.03 allows remote attackers to obtain sensitive information such as name, address, and daily energy usage.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-287
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-165-02; https://www.cisa.gov/uscert/ics/advisories/icsa-22-165-02
CVE: CVE-2022-30028
Published: 2022-06-24
Description: Dradis Professional Edition before 4.3.0 allows attackers to change an account password via reusing a password reset token.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-362
References: https://dradisframework.com/ce/security_reports.html; https://dradisframework.com/ce/security_reports.html
CVE: CVE-2022-33910
Published: 2022-06-24
Description: An XSS vulnerability in MantisBT before 2.25.5 allows remote attackers to attach crafted SVG documents to issue reports or bugnotes. When a user or an admin clicks on the attachment, file_download.php opens the SVG document in a browser tab instead of downloading it as a file, causing the JavaScript code to execute.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://mantisbt.org/blog/archives/mantisbt/719; https://mantisbt.org/bugs/view.php?id=29135; https://mantisbt.org/bugs/view.php?id=30384
CVE: CVE-2022-21231
Published: 2022-06-24
Description: All versions of package deep-get-set are vulnerable to Prototype Pollution via the 'deep' function. **Note:** This vulnerability derives from an incomplete fix of [CVE-2020-7715](https://security.snyk.io/vuln/SNYK-JS-DEEPGETSET-598666)
CVSS Score: 7.5 (HIGH)
CWE: CWE-1321
References: https://snyk.io/vuln/SNYK-JS-DEEPGETSET-2342655; https://snyk.io/vuln/SNYK-JS-DEEPGETSET-2342655
CVE: CVE-2022-30885
Published: 2022-06-24
Description: The pyesasky for python, as distributed on PyPI, included a code-execution backdoor inserted by a third party. The current version, without this backdoor, is 1.2.0-1.4.2.
CVSS Score: 9.8 (CRITICAL)
References: http://pypi.doubanio.com/simple/request; https://github.com/esdc-esac-esa-int/pyesasky/issues/39; https://pypi.org/project/pyesasky/
CVE: CVE-2022-32996
Published: 2022-06-24
Description: The django-navbar-client package of v0.9.50 to v1.0.1 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well as escalate privileges.
CVSS Score: 9.8 (CRITICAL)
References: http://pypi.doubanio.com/simple/request; https://github.com/josubg/django_navbar_client/issues/1; https://pypi.org/project/django-navbar-client/
CVE: CVE-2022-32997
Published: 2022-06-24
Description: The RootInteractive package in PyPI v0.0.5 to v0.0.19b0 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well as escalate privileges.
CVSS Score: 9.8 (CRITICAL)
References: http://pypi.doubanio.com/simple/request; https://github.com/miranov25/RootInteractive/issues/206; https://pypi.org/project/RootInteractive/
CVE: CVE-2022-32998
Published: 2022-06-24
Description: The cryptoasset-data-downloader package in PyPI v1.0.0 to v1.0.1 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well as escalate privileges.
CVSS Score: 9.8 (CRITICAL)
References: http://pypi.doubanio.com/simple/request; https://github.com/serhatci/cryptocurrency-historical-data-downloader/issues/8; https://pypi.org/project/cryptoasset-data-downloader/
CVE: CVE-2022-32999
Published: 2022-06-24
Description: The cloudlabeling package in PyPI v0.0.1 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well as escalate privileges.
CVSS Score: 9.8 (CRITICAL)
References: http://pypi.doubanio.com/simple/request; https://github.com/SilvioGiancola/CloudLabeling-API/issues/1; https://pypi.org/project/cloudlabeling/
CVE: CVE-2022-33000
Published: 2022-06-24
Description: The ML-Scanner package in PyPI v0.1.0 to v0.1.5 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well as escalate privileges.
CVSS Score: 9.8 (CRITICAL)
References: http://pypi.doubanio.com/simple/request; https://github.com/bOrionis/mls/issues/1; https://pypi.org/project/ml-scanner/
CVE: CVE-2022-33001
Published: 2022-06-24
Description: The AAmiles package in PyPI v0.1.0 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well as escalate privileges.
CVSS Score: 9.8 (CRITICAL)
References: http://pypi.doubanio.com/simple/request; https://github.com/bOrionis/AAmiles/issues/1; https://pypi.org/project/AAmiles/
CVE: CVE-2022-33002
Published: 2022-06-24
Description: The KGExplore package in PyPI v0.1.1 to v0.1.2 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well as escalate privileges.
CVSS Score: 9.8 (CRITICAL)
References: http://pypi.doubanio.com/simple/request; https://github.com/smoothnlp/KGExplore/issues/13; https://pypi.org/project/kgexplore/
CVE: CVE-2022-33003
Published: 2022-06-24
Description: The watools package in PyPI v0.0.1 to v0.0.8 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well as escalate privileges.
CVSS Score: 9.8 (CRITICAL)
References: http://pypi.doubanio.com/simple/request; https://github.com/wateraccounting/watools/issues/5; https://pypi.org/project/watools/
CVE: CVE-2022-33004
Published: 2022-06-24
Description: The Beginner package in PyPI v0.0.2 to v0.0.4 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well as escalate privileges.
CVSS Score: 9.8 (CRITICAL)
References: http://pypi.doubanio.com/simple/request; https://github.com/Dreambuilder4028/coder/issues/1; https://pypi.org/project/beginner/
CVE: CVE-2022-33121
Published: 2022-06-24
Description: A Cross-Site Request Forgery (CSRF) in MiniCMS v1.11 allows attackers to arbitrarily delete local .dat files via clicking on a malicious link.
CVSS Score: 8.1 (HIGH)
CWE: CWE-352
References: https://github.com/bg5sbk/MiniCMS/issues/45; https://github.com/bg5sbk/MiniCMS/issues/45
CVE: CVE-2022-33122
Published: 2022-06-24
Description: A stored cross-site scripting (XSS) vulnerability in eyoucms v1.5.6 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the URL field under the login page.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/eyoucms/eyoucms/issues/24; https://github.com/eyoucms/eyoucms/issues/24
CVE: CVE-2022-34053
Published: 2022-06-24
Description: The DR-Web-Engine package in PyPI v0.2.0b0 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well as escalate privileges.
CVSS Score: 9.8 (CRITICAL)
References: http://pypi.doubanio.com/simple/request; https://github.com/ylliprifti/dr-web-engine/issues/4; https://pypi.org/project/dr-web-engine/
CVE: CVE-2022-34054
Published: 2022-06-24
Description: The Perdido package in PyPI v0.0.1 to v0.0.2 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well as escalate privileges.
CVSS Score: 9.8 (CRITICAL)
References: http://pypi.doubanio.com/simple/request; https://github.com/ludovicmoncla/perdido/issues/1; https://pypi.org/project/perdido/
CVE: CVE-2022-34055
Published: 2022-06-24
Description: The drxhello package in PyPI v0.0.1 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well as escalate privileges.
CVSS Score: 9.8 (CRITICAL)
References: http://pypi.doubanio.com/simple/request; https://github.com/drewxa/summer-tasks/issues/4; https://pypi.org/project/drxhello/