deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-4818
Published: 2022-12-28
Description: A vulnerability was found in Talend Open Studio for MDM. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file org.talend.mdm.core/src/com/amalto/core/storage/SystemStorageWrapper.java. The manipulation leads to xml external entity reference. Upgrading to version 20221220_1938 is able to address this issue. The name of the patch is 95590db2ad6a582c371273ceab1a73ad6ed47853. It is recommended to upgrade the affected component. The identifier VDB-216997 was assigned to this vulnerability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-611
References: https://github.com/Talend/tmdm-server-se/commit/95590db2ad6a582c371273ceab1a73ad6ed47853; https://github.com/Talend/tmdm-server-se/pull/1598; https://github.com/Talend/tmdm-server-se/releases/tag/snap%2Fmaster%2F20221220_1938
CVE: CVE-2022-4819
Published: 2022-12-28
Description: A vulnerability was found in HotCRP. It has been rated as problematic. Affected by this issue is some unknown functionality. The manipulation leads to cross site scripting. The attack may be launched remotely. The name of the patch is d4ffdb0ef806453c54ddca7fdda3e5c60356285c. It is recommended to apply a patch to fix this issue. VDB-216998 is the identifier assigned to this vulnerability.
CVSS Score: 2.4 (LOW)
CWE: CWE-79
References: https://github.com/kohler/hotcrp/commit/d4ffdb0ef806453c54ddca7fdda3e5c60356285c; https://vuldb.com/?ctiid.216998; https://vuldb.com/?id.216998
CVE: CVE-2022-4820
Published: 2022-12-28
Description: A vulnerability classified as problematic has been found in FlatPress. This affects an unknown part of the file admin/panels/entry/admin.entry.list.php of the component Admin Area. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The name of the patch is 229752b51025e[PII_REDACTED]84d42f8ebb231f67f. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-216999.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/flatpressblog/flatpress/commit/229752b51025e[PII_REDACTED]84d42f8ebb231f67f; https://github.com/flatpressblog/flatpress/issues/180; https://vuldb.com/?ctiid.216999
CVE: CVE-2022-4821
Published: 2022-12-28
Description: A vulnerability classified as problematic was found in FlatPress. This vulnerability affects the function onupload of the file admin/panels/uploader/admin.uploader.php of the component XML File Handler/MD File Handler. The manipulation leads to cross site scripting. The attack can be initiated remotely. The name of the patch is 3cc223dec5260e533a84b5cf5780d3a4fbf21241. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-217000.
CVSS Score: 2.4 (LOW)
CWE: CWE-79
References: https://github.com/flatpressblog/flatpress/commit/3cc223dec5260e533a84b5cf5780d3a4fbf21241; https://github.com/flatpressblog/flatpress/issues/178; https://vuldb.com/?ctiid.217000
CVE: CVE-2022-4822
Published: 2022-12-28
Description: A vulnerability, which was classified as problematic, has been found in FlatPress. This issue affects some unknown processing of the file setup/lib/main.lib.php of the component Setup. The manipulation leads to cross site scripting. The attack may be initiated remotely. The name of the patch is 5f23b4c2eac294cc0ba5e541f83a6f8a26f9fed1. It is recommended to apply a patch to fix this issue. The identifier VDB-217001 was assigned to this vulnerability.
CVSS Score: 2.4 (LOW)
CWE: CWE-79
References: https://github.com/flatpressblog/flatpress/commit/5f23b4c2eac294cc0ba5e541f83a6f8a26f9fed1; https://github.com/flatpressblog/flatpress/issues/176; https://vuldb.com/?ctiid.217001
CVE: CVE-2022-4823
Published: 2022-12-28
Description: A vulnerability, which was classified as problematic, was found in InSTEDD Nuntium. Affected is an unknown function of the file app/controllers/geopoll_controller.rb. The manipulation of the argument signature leads to observable timing discrepancy. It is possible to launch the attack remotely. The name of the patch is 77236f7fd71a0e2eefeea07f9866b069d612cf0d. It is recommended to apply a patch to fix this issue. VDB-217002 is the identifier assigned to this vulnerability.
CVSS Score: 3.1 (LOW)
CWE: CWE-208, CWE-203
References: https://github.com/instedd/nuntium/commit/77236f7fd71a0e2eefeea07f9866b069d612cf0d; https://vuldb.com/?ctiid.217002; https://vuldb.com/?id.217002
CVE: CVE-2022-4778
Published: 2022-12-29
Description: StreamX applications from versions 6.02.01 to 6.04.34 are affected by a path traversal vulnerability that allows authenticated users to get unauthorized access to files on the server's filesystem.
StreamX applications using StreamView HTML component with the public web server feature activated are affected.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://elvexys.com/products/xpg-gateway-rtu-protocol-converter/streamx-release-notes/; https://elvexys.com/products/xpg-gateway-rtu-protocol-converter/streamx-release-notes/
CVE: CVE-2022-4779
Published: 2022-12-29
Description: StreamX applications from versions 6.02.01 to 6.04.34 are affected by a logic bug that allows to bypass the implemented authentication scheme.
StreamX applications using StreamView HTML component with the public web server feature activated are affected. 
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://elvexys.com/products/xpg-gateway-rtu-protocol-converter/streamx-release-notes/; https://elvexys.com/products/xpg-gateway-rtu-protocol-converter/streamx-release-notes/
CVE: CVE-2022-4780
Published: 2022-12-29
Description: ISOS firmwares from versions 1.81 to 2.00 contain hardcoded credentials from embedded StreamX installer that integrators are not forced to change.

CVSS Score: 4.5 (MEDIUM)
CWE: CWE-798
References: https://elvexys.com/products/xpg-gateway-rtu-protocol-converter/isos-release-notes/; https://elvexys.com/products/xpg-gateway-rtu-protocol-converter/isos-release-notes/
CVE: CVE-2018-25058
Published: 2022-12-29
Description: A vulnerability classified as problematic has been found in Twitter-Post-Fetcher up to 17.x. This affects an unknown part of the file js/twitterFetcher.js of the component Link Target Handler. The manipulation leads to use of web link to untrusted target with window.opener access. It is possible to initiate the attack remotely. Upgrading to version 18.0.0 is able to address this issue. The name of the patch is 7d281c6fb5acbc29a2cad295262c1f0c19ca56f3. It is recommended to upgrade the affected component. The identifier VDB-217017 was assigned to this vulnerability.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-1022
References: https://github.com/jasonmayes/Twitter-Post-Fetcher/commit/7d281c6fb5acbc29a2cad295262c1f0c19ca56f3; https://github.com/jasonmayes/Twitter-Post-Fetcher/pull/170; https://github.com/jasonmayes/Twitter-Post-Fetcher/releases/tag/18.0.0
CVE: CVE-2021-4295
Published: 2022-12-29
Description: A vulnerability classified as problematic was found in ONC code-validator-api up to 1.0.30. This vulnerability affects the function vocabularyValidationConfigurations of the file src/main/java/org/sitenv/vocabularies/configuration/CodeValidatorApiConfiguration.java of the component XML Handler. The manipulation leads to xml external entity reference. Upgrading to version 1.0.31 is able to address this issue. The name of the patch is fbd8ea121755a2d3d116b13f235bc8b61d8449af. It is recommended to upgrade the affected component. VDB-217018 is the identifier assigned to this vulnerability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-611, CWE-611
References: https://github.com/onc-healthit/code-validator-api/commit/fbd8ea121755a2d3d116b13f235bc8b61d8449af; https://github.com/onc-healthit/code-validator-api/pull/97; https://github.com/onc-healthit/code-validator-api/releases/tag/1.0.31
CVE: CVE-2021-4296
Published: 2022-12-29
Description: A vulnerability, which was classified as problematic, has been found in w3c Unicorn. This issue affects the function ValidatorNuMessage of the file src/org/w3c/unicorn/response/impl/ValidatorNuMessage.java. The manipulation of the argument message leads to cross site scripting. The attack may be initiated remotely. The name of the patch is 51f75c31f7fc33859a9a571311c67ae4e95d9c68. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217019.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/w3c/Unicorn/commit/51f75c31f7fc33859a9a571311c67ae4e95d9c68; https://github.com/w3c/Unicorn/pull/212; https://vuldb.com/?ctiid.217019
CVE: CVE-2022-4839
Published: 2022-12-29
Description: Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.1.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/usememos/memos/commit/64e5c343c5f74b0abdf3ac0d21a6139daea58cf8; https://huntr.dev/bounties/ad954cab-f026-4895-8003-99f5e3b507ed; https://github.com/usememos/memos/commit/64e5c343c5f74b0abdf3ac0d21a6139daea58cf8
CVE: CVE-2022-4840
Published: 2022-12-29
Description: Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.1.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/usememos/memos/commit/64e5c343c5f74b0abdf3ac0d21a6139daea58cf8; https://huntr.dev/bounties/b42aa2e9-c783-464c-915c-a80cb464ee01; https://github.com/usememos/memos/commit/64e5c343c5f74b0abdf3ac0d21a6139daea58cf8
CVE: CVE-2022-4841
Published: 2022-12-29
Description: Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.1.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/usememos/memos/commit/64e5c343c5f74b0abdf3ac0d21a6139daea58cf8; https://huntr.dev/bounties/fa46b3ef-c621-443a-be3a-0a83fb78ba62; https://github.com/usememos/memos/commit/64e5c343c5f74b0abdf3ac0d21a6139daea58cf8
CVE: CVE-2022-4843
Published: 2022-12-29
Description: NULL Pointer Dereference in GitHub repository radareorg/radare2 prior to 5.8.2.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://github.com/radareorg/radare2/commit/842f809d4ec6a12af2906f948657281c9ebc8a24; https://huntr.dev/bounties/075b2760-66a0-4d38-b3b5-e9934956ab7f; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FOXRDPI3OYYKO4PKXE3XD2IFONL6BCHR/
CVE: CVE-2022-4844
Published: 2022-12-29
Description: Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.9.1.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/usememos/memos/commit/c9bb2b785dc[PII_REDACTED]d5c9ab127a2d5aa3948; https://huntr.dev/bounties/8e8df1f4-07ab-4b75-aec8-75b1229e93a3; https://github.com/usememos/memos/commit/c9bb2b785dc[PII_REDACTED]d5c9ab127a2d5aa3948
CVE: CVE-2022-4845
Published: 2022-12-29
Description: Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.9.1.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://github.com/usememos/memos/commit/c9bb2b785dc[PII_REDACTED]d5c9ab127a2d5aa3948; https://huntr.dev/bounties/075dbd51-b078-436c-9e3d-7f25cd2e7e1b; https://github.com/usememos/memos/commit/c9bb2b785dc[PII_REDACTED]d5c9ab127a2d5aa3948
CVE: CVE-2022-4846
Published: 2022-12-29
Description: Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.9.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://github.com/usememos/memos/commit/c9bb2b785dc[PII_REDACTED]d5c9ab127a2d5aa3948; https://huntr.dev/bounties/38c685fc-7065-472d-a46e-e26bf0b556d3; https://github.com/usememos/memos/commit/c9bb2b785dc[PII_REDACTED]d5c9ab127a2d5aa3948
CVE: CVE-2022-4847
Published: 2022-12-29
Description: Incorrectly Specified Destination in a Communication Channel in GitHub repository usememos/memos prior to 0.9.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-941
References: https://github.com/usememos/memos/commit/c9bb2b785dc[PII_REDACTED]d5c9ab127a2d5aa3948; https://huntr.dev/bounties/ff6d4b5a-5e75-4a14-b5ce-f318f8613b73; https://github.com/usememos/memos/commit/c9bb2b785dc[PII_REDACTED]d5c9ab127a2d5aa3948
CVE: CVE-2022-4848
Published: 2022-12-29
Description: Improper Verification of Source of a Communication Channel in GitHub repository usememos/memos prior to 0.9.1.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-940
References: https://github.com/usememos/memos/commit/c9bb2b785dc[PII_REDACTED]d5c9ab127a2d5aa3948; https://huntr.dev/bounties/25de88cc-8d0d-41a1-b069-9ef1327770bc; https://github.com/usememos/memos/commit/c9bb2b785dc[PII_REDACTED]d5c9ab127a2d5aa3948
CVE: CVE-2022-4849
Published: 2022-12-29
Description: Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.9.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://github.com/usememos/memos/commit/c9bb2b785dc[PII_REDACTED]d5c9ab127a2d5aa3948; https://huntr.dev/bounties/404ce7dd-f345-4d98-ad80-c53ac74f4e5c; https://github.com/usememos/memos/commit/c9bb2b785dc[PII_REDACTED]d5c9ab127a2d5aa3948
CVE: CVE-2022-4850
Published: 2022-12-29
Description: Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.9.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://github.com/usememos/memos/commit/c9bb2b785dc[PII_REDACTED]d5c9ab127a2d5aa3948; https://huntr.dev/bounties/46dc4728-eacc-43f5-9831-c203fdbcc346; https://github.com/usememos/memos/commit/c9bb2b785dc[PII_REDACTED]d5c9ab127a2d5aa3948
CVE: CVE-2022-4851
Published: 2022-12-29
Description: Improper Handling of Values in GitHub repository usememos/memos prior to 0.9.1.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-229
References: https://github.com/usememos/memos/commit/3556ae4e651d9443dc3bb8a170dd3cc726517a53; https://huntr.dev/bounties/e3cebc1a-1326-4a08-abad-0414a717fa0f; https://github.com/usememos/memos/commit/3556ae4e651d9443dc3bb8a170dd3cc726517a53
CVE: CVE-2022-46178
Published: 2022-12-29
Description: MeterSphere is a one-stop open source continuous testing platform, covering test management, interface testing, UI testing and performance testing. Versions prior to 2.5.1 allow users to upload a file, but do not validate the file name, which may lead to upload file to any path. The vulnerability has been fixed in v2.5.1. There are no workarounds.
CVSS Score: 7.4 (HIGH)
CWE: CWE-22
References: https://github.com/metersphere/metersphere/security/advisories/GHSA-9p62-x3c5-hr5p; https://github.com/metersphere/metersphere/security/advisories/GHSA-9p62-x3c5-hr5p
CVE: CVE-2022-46181
Published: 2022-12-29
Description: Gotify server is a simple server for sending and receiving messages in real-time per WebSocket. Versions prior to 2.2.2 contain an XSS vulnerability that allows authenticated users to upload .html files. An attacker could execute client side scripts **if** another user opened a link. The attacker could potentially take over the account of the user that clicked the link. The Gotify UI won't natively expose such a malicious link, so an attacker has to get the user to open the malicious link in a context outside of Gotify. The vulnerability has been fixed in version 2.2.2. As a workaround, you can block access to non image files via a reverse proxy in the `./image` directory.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/gotify/server/pull/534; https://github.com/gotify/server/pull/535; https://github.com/gotify/server/security/advisories/GHSA-xv6x-456v-24xh
CVE: CVE-2022-38203
Published: 2022-12-29
Description: Protections against potential Server-Side Request Forgery (SSRF) vulnerabilities in Esri Portal for ArcGIS versions 10.8.1 and below were not fully honored and may allow a remote, unauthenticated attacker to forge requests to arbitrary URLs from the system, potentially leading to network enumeration or reading from hosts inside the network perimeter, a different issue than CVE-2022-38211 and CVE-2022-38212.
CVSS Score: 7.5 (HIGH)
CWE: CWE-918, CWE-918
References: https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/portal-for-arcgis-security-2022-update-2-patch-is-now-available; https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/portal-for-arcgis-security-2022-update-2-patch-is-now-available
CVE: CVE-2022-38204
Published: 2022-12-29
Description: There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.8.1 and 10.7.1 which may allow a remote, unauthenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/portal-for-arcgis-security-2022-update-2-patch-is-now-available; https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/portal-for-arcgis-security-2022-update-2-patch-is-now-available
CVE: CVE-2022-38205
Published: 2022-12-29
Description: In some non-default installations of Esri Portal for ArcGIS versions 10.9.1 and below, a directory traversal issue may allow a remote, unauthenticated attacker to traverse the file system and lead to the disclosure of sensitive data (not customer-published content).
CVSS Score: 8.6 (HIGH)
CWE: CWE-23, CWE-22
References: https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/portal-for-arcgis-security-2022-update-2-patch-is-now-available; https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/portal-for-arcgis-security-2022-update-2-patch-is-now-available
CVE: CVE-2022-38206
Published: 2022-12-29
Description: There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.9.1 and below which may allow a remote remote, unauthenticated attacker to create a crafted link which when clicked could execute arbitrary JavaScript code in the victim’s browser.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/portal-for-arcgis-security-2022-update-2-patch-is-now-available; https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/portal-for-arcgis-security-2022-update-2-patch-is-now-available
CVE: CVE-2022-38207
Published: 2022-12-29
Description: There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.8.1 and 10.7.1 which may allow a remote remote, unauthenticated attacker to create a crafted link which when clicked which could execute arbitrary JavaScript code in the victim’s browser.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/portal-for-arcgis-security-2022-update-2-patch-is-now-available; https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/portal-for-arcgis-security-2022-update-2-patch-is-now-available
CVE: CVE-2022-38208
Published: 2022-12-29
Description: There is an unvalidated redirect vulnerability in Esri Portal for ArcGIS 11 and below that may allow a remote, unauthenticated attacker to craft a URL that could redirect a victim to an arbitrary website, simplifying phishing attacks.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/portal-for-arcgis-security-2022-update-2-patch-is-now-available; https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/portal-for-arcgis-security-2022-update-2-patch-is-now-available
CVE: CVE-2022-38209
Published: 2022-12-29
Description: There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.9.1 and below which may allow a remote, unauthenticated attacker to create a crafted link which when clicked could execute arbitrary JavaScript code in the victim’s browser.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/portal-for-arcgis-security-2022-update-2-patch-is-now-available; https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/portal-for-arcgis-security-2022-update-2-patch-is-now-available
CVE: CVE-2022-38210
Published: 2022-12-29
Description: There is a reflected HTML injection vulnerability in Esri Portal for ArcGIS versions 10.9.1 and below that may allow a remote, unauthenticated attacker to create a crafted link which when clicked could render arbitrary HTML in the victim’s browser.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-80, CWE-79
References: https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/portal-for-arcgis-security-2022-update-2-patch-is-now-available; https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/portal-for-arcgis-security-2022-update-2-patch-is-now-available
CVE: CVE-2022-38211
Published: 2022-12-29
Description: Protections against potential Server-Side Request Forgery (SSRF) vulnerabilities in Esri Portal for ArcGIS versions 10.9.1 and below were not fully honored and may allow a remote, unauthenticated attacker to forge requests to arbitrary URLs from the system, potentially leading to network enumeration or reading from hosts inside the network perimeter, a different issue than CVE-2022-38211 and CVE-2022-38212.
CVSS Score: 7.5 (HIGH)
CWE: CWE-918
References: https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/portal-for-arcgis-security-2022-update-2-patch-is-now-available; https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/portal-for-arcgis-security-2022-update-2-patch-is-now-available
CVE: CVE-2022-38212
Published: 2022-12-29
Description: Protections against potential Server-Side Request Forgery (SSRF) vulnerabilities in Esri Portal for ArcGIS versions 10.8.1 and below were not fully honored and may allow a remote, unauthenticated attacker to forge requests to arbitrary URLs from the system, potentially leading to network enumeration or reading from hosts inside the network perimeter, a different issue than CVE-2022-38211 and CVE-2022-38203.
CVSS Score: 7.5 (HIGH)
CWE: CWE-918
References: https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/portal-for-arcgis-security-2022-update-2-patch-is-now-available; https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/portal-for-arcgis-security-2022-update-2-patch-is-now-available
CVE: CVE-2022-30519
Published: 2022-12-29
Description: XSS in signing form in Reprise Software RLM License Administration v14.2BL4 allows remote attacker to inject arbitrary code via password field.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://packetstormsecurity.com/files/171627/Reprise-Software-RLM-14.2BL4-Cross-Site-Scripting.html; https://github.com/earth2sky/Disclosed/blob/main/CVE-2022-30519; http://packetstormsecurity.com/files/171627/Reprise-Software-RLM-14.2BL4-Cross-Site-Scripting.html
CVE: CVE-2022-36437
Published: 2022-12-29
Description: The Connection handler in Hazelcast and Hazelcast Jet allows a remote unauthenticated attacker to access and manipulate data in the cluster with the identity of another already authenticated connection. The affected Hazelcast versions are through 4.0.6, 4.1.9, 4.2.5, 5.0.3, and 5.1.2. The affected Hazelcast Jet versions are through 4.5.3.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-384, CWE-384
References: https://github.com/hazelcast/hazelcast/security/advisories/GHSA-c5hg-mr8r-f6jp; https://github.com/hazelcast/hazelcast/security/advisories/GHSA-c5hg-mr8r-f6jp
CVE: CVE-2022-44137
Published: 2022-12-30
Description: SourceCodester Sanitization Management System 1.0 is vulnerable to SQL Injection.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/y1s3m0/vulnfind/blob/main/Sanitization%20Management%20System%20Project%20CMS/sqli_view_inquiry.md; https://github.com/y1s3m0/vulnfind/blob/main/Sanitization%20Management%20System%20Project%20CMS/sqli_view_inquiry.md
CVE: CVE-2022-48194
Published: 2022-12-30
Description: TP-Link TL-WR902AC devices through V3 0.9.1 allow remote authenticated attackers to execute arbitrary code or cause a Denial of Service (DoS) by uploading a crafted firmware update because the signature check is inadequate.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434, CWE-434
References: http://packetstormsecurity.com/files/171623/TP-Link-TL-WR902AC-Remote-Code-Execution.html; https://github.com/otsmr/internet-of-vulnerable-things/tree/main/exploits; http://packetstormsecurity.com/files/171623/TP-Link-TL-WR902AC-Remote-Code-Execution.html