deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-21931
Published: 2022-01-11
Description: Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
CVSS Score: 4.2 (MEDIUM)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21931; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21931
CVE: CVE-2022-21932
Published: 2022-01-11
Description: Microsoft Dynamics 365 Customer Engagement Cross-Site Scripting Vulnerability
CVSS Score: 7.6 (HIGH)
CWE: CWE-79
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21932; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21932
CVE: CVE-2022-21954
Published: 2022-01-11
Description: Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
CVSS Score: 6.1 (MEDIUM)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21954; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21954
CVE: CVE-2022-21958
Published: 2022-01-11
Description: Windows Resilient File System (ReFS) Remote Code Execution Vulnerability
CVSS Score: 6.8 (MEDIUM)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21958; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21958
CVE: CVE-2022-21959
Published: 2022-01-11
Description: Windows Resilient File System (ReFS) Remote Code Execution Vulnerability
CVSS Score: 6.8 (MEDIUM)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21959; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21959
CVE: CVE-2022-21960
Published: 2022-01-11
Description: Windows Resilient File System (ReFS) Remote Code Execution Vulnerability
CVSS Score: 6.8 (MEDIUM)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21960; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21960
CVE: CVE-2022-21961
Published: 2022-01-11
Description: Windows Resilient File System (ReFS) Remote Code Execution Vulnerability
CVSS Score: 6.8 (MEDIUM)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21961; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21961
CVE: CVE-2022-21962
Published: 2022-01-11
Description: Windows Resilient File System (ReFS) Remote Code Execution Vulnerability
CVSS Score: 6.8 (MEDIUM)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21962; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21962
CVE: CVE-2022-21963
Published: 2022-01-11
Description: Windows Resilient File System (ReFS) Remote Code Execution Vulnerability
CVSS Score: 6.4 (MEDIUM)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21963; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21963
CVE: CVE-2022-21964
Published: 2022-01-11
Description: Remote Desktop Licensing Diagnoser Information Disclosure Vulnerability
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-668
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21964; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21964
CVE: CVE-2022-21969
Published: 2022-01-11
Description: Microsoft Exchange Server Remote Code Execution Vulnerability
CVSS Score: 9.0 (CRITICAL)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21969; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21969
CVE: CVE-2022-21970
Published: 2022-01-11
Description: Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-269
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21970; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21970
CVE: CVE-2021-41767
Published: 2022-01-11
Description: Apache Guacamole 1.3.0 and older may incorrectly include a private tunnel identifier in the non-private details of some REST responses. This may allow an authenticated user who already has permission to access a particular connection to read from or interact with another user's active use of that same connection.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200, CWE-200
References: http://www.openwall.com/lists/oss-security/2022/01/11/6; https://lists.apache.org/thread/5l31k4jmzdsfz0xt8osrbl878gb3b7ro; http://www.openwall.com/lists/oss-security/2022/01/11/6
CVE: CVE-2021-43999
Published: 2022-01-11
Description: Apache Guacamole 1.2.0 and 1.3.0 do not properly validate responses received from a SAML identity provider. If SAML support is enabled, this may allow a malicious user to assume the identity of another Guacamole user.
CVSS Score: 8.8 (HIGH)
CWE: CWE-287, CWE-287
References: http://www.openwall.com/lists/oss-security/2022/01/11/7; https://lists.apache.org/thread/4dt9h5mo4o9rxlgxm3rp8wfqdtdjn2z9; http://www.openwall.com/lists/oss-security/2022/01/11/7
CVE: CVE-2021-46283
Published: 2022-01-11
Description: nf_tables_newset in net/netfilter/nf_tables_api.c in the Linux kernel before 5.12.13 allows local users to cause a denial of service (NULL pointer dereference and general protection fault) because of the missing initialization for nft_set_elem_expr_alloc. A local user can set a netfilter table expression in their own namespace.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-665
References: https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.12.13; https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=ad9f151e560b016b6ad3280b48e42fa11e1a5440; https://syzkaller.appspot.com/bug?id=22c3987f75a7b90e238a26b5a5920525c2d1f345
CVE: CVE-2022-21646
Published: 2022-01-11
Description: SpiceDB is a database system for managing security-critical application permissions. Any user making use of a wildcard relationship under the right hand branch of an `exclusion` or within an `intersection` operation will see `Lookup`/`LookupResources` return a resource as "accessible" if it is *not* accessible by virtue of the inclusion of the wildcard in the intersection or the right side of the exclusion. In `v1.3.0`, the wildcard is ignored entirely in lookup's dispatch, resulting in the `banned` wildcard being ignored in the exclusion. Version 1.4.0 contains a patch for this issue. As a workaround, don't make use of wildcards on the right side of intersections or within exclusions.
CVSS Score: 8.1 (HIGH)
CWE: CWE-20, CWE-155
References: https://github.com/authzed/spicedb/commit/15bba2e2d2a4bda336a37a7fe8ef8a35028cd970; https://github.com/authzed/spicedb/issues/358; https://github.com/authzed/spicedb/releases/tag/v1.4.0
CVE: CVE-2022-0087
Published: 2022-01-12
Description: keystone is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/keystonejs/keystone/commit/96bf833a23b1a0a5d365cf394467a943cc481b38; https://huntr.dev/bounties/c9d7374f-2cb9-4bac-9c90-a965942f413e; https://github.com/keystonejs/keystone/commit/96bf833a23b1a0a5d365cf394467a943cc481b38
CVE: CVE-2022-0159
Published: 2022-01-12
Description: orchardcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/orchardcms/orchardcore/commit/4da927d39a49138527c30db09c962ff706f95202; https://huntr.dev/bounties/00937280-e2ab-49fe-8d43-8235b3c3db4b; https://github.com/orchardcms/orchardcore/commit/4da927d39a49138527c30db09c962ff706f95202
CVE: CVE-2022-0179
Published: 2022-01-12
Description: snipe-it is vulnerable to Missing Authorization
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://github.com/snipe/snipe-it/commit/cf14a0222c67472086cd08b2155f045edaf75f2e; https://huntr.dev/bounties/efdf2ead-f9d1-4767-9f02-d11f762d15e7; https://github.com/snipe/snipe-it/commit/cf14a0222c67472086cd08b2155f045edaf75f2e
CVE: CVE-2021-3852
Published: 2022-01-12
Description: growi is vulnerable to Authorization Bypass Through User-Controlled Key
CVSS Score: 7.5 (HIGH)
CWE: CWE-639
References: https://github.com/weseek/growi/commit/863bfd7f622f413bd159b9446166fb1ce78ec863; https://huntr.dev/bounties/d44def81-2834-4031-9037-e923975c3852; https://github.com/weseek/growi/commit/863bfd7f622f413bd159b9446166fb1ce78ec863
CVE: CVE-2021-44648
Published: 2022-01-12
Description: GNOME gdk-pixbuf 2.42.6 is vulnerable to a heap-buffer overflow vulnerability when decoding the lzw compressed stream of image data in GIF files with lzw minimum code size equals to 12.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/issues/136; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JEVTOGIJITK2N5AOOLKKMDIICZDQE6CH/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PEKBMOO52RXONWKB6ZKKHTVPLF6WC3KF/
CVE: CVE-2021-44649
Published: 2022-01-12
Description: Django CMS 3.7.3 does not validate the plugin_type parameter while generating error messages for an invalid plugin type, resulting in a Cross Site Scripting (XSS) vulnerability. The vulnerability allows an attacker to execute arbitrary JavaScript code in the web browser of the affected user.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://sahildhar.github.io/blogpost/Django-CMS-Reflected-XSS-Vulnerability/; https://www.django-cms.org/en/blog/2020/07/22/django-cms-security-updates-1/; https://sahildhar.github.io/blogpost/Django-CMS-Reflected-XSS-Vulnerability/
CVE: CVE-2021-44650
Published: 2022-01-12
Description: Zoho ManageEngine M365 Manager Plus before Build 4419 allows remote command execution when updating proxy settings through the Admin ProxySettings and Tenant ProxySettings components.
CVSS Score: 7.2 (HIGH)
References: https://www.manageengine.com/microsoft-365-management-reporting/release-notes.html?Build=4419; https://www.manageengine.com/microsoft-365-management-reporting/release-notes.html?Build=4419
CVE: CVE-2021-4080
Published: 2022-01-12
Description: crater is vulnerable to Unrestricted Upload of File with Dangerous Type
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://github.com/crater-invoice/crater/commit/cdc913d16cf624aee852bc9163a7c6ffc8d1da9d; https://huntr.dev/bounties/d7453360-baca-4e56-985f-481275fa38db; https://github.com/crater-invoice/crater/commit/cdc913d16cf624aee852bc9163a7c6ffc8d1da9d
CVE: CVE-2021-44651
Published: 2022-01-12
Description: Zoho ManageEngine CloudSecurityPlus before Build 4117 allows remote code execution through the updatePersonalizeSettings component due to an improper security patch for CVE-2021-40175.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://sahildhar.github.io/blogpost/Zoho-ManageEngine-CloudSecurityPlus-Remote-Code-Execution-via-Security-Misconfiguration/; https://sahildhar.github.io/blogpost/Zoho-ManageEngine-CloudSecurityPlus-Remote-Code-Execution-via-Security-Misconfiguration/
CVE: CVE-2021-44652
Published: 2022-01-12
Description: Zoho ManageEngine O365 Manager Plus before Build 4416 allows remote code execution via BCP file overwrite through the ChangeDBAPI component.
CVSS Score: 7.8 (HIGH)
References: https://www.manageengine.com/microsoft-365-management-reporting/release-notes.html?Build=4416; https://www.manageengine.com/microsoft-365-management-reporting/release-notes.html?Build=4416
CVE: CVE-2021-38892
Published: 2022-01-12
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2021-43436
Published: 2022-01-12
Description: MartDevelopers Inc iResturant v1.0 allows Stored XSS by placing a payload in the username field during a login attempt. When an administrator looks at the log of failed logins, the XSS payload will be executed.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/MartDevelopers-Inc/iResturant; https://medium.com/%40mayhem7999/cve-2021-43436-56dc43aeac81; https://github.com/MartDevelopers-Inc/iResturant
CVE: CVE-2021-45388
Published: 2022-01-12
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2021-45608. Reason: This candidate is a reservation duplicate of CVE-2021-45608. Notes: All CVE users should reference CVE-2021-45608 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2021-45411
Published: 2022-01-12
Description: In Sourcecodetester Printable Staff ID Card Creator System 1.0 after compromising the database via SQLi, an attacker can log in and leverage an arbitrary file upload vulnerability to obtain remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://www.exploit-db.com/exploits/49877; https://www.sourcecodester.com/php/12802/php-staff-id-card-creation-and-printing-system.html; https://www.exploit-db.com/exploits/49877
CVE: CVE-2021-28376
Published: 2022-01-12
Description: ChronoForms 7.0.7 allows fname Directory Traversal to read arbitrary files.
CVSS Score: 2.7 (LOW)
CWE: CWE-22
References: https://herolab.usd.de/en/security-advisories/usd-2021-0006; https://herolab.usd.de/en/security-advisories/usd-2021-0006
CVE: CVE-2021-28377
Published: 2022-01-12
Description: ChronoForums 2.0.11 allows av Directory Traversal to read arbitrary files.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: https://herolab.usd.de/en/security-advisories/usd-2021-0007/; https://herolab.usd.de/en/security-advisories/usd-2021-0007/
CVE: CVE-2021-45445
Published: 2022-01-12
Description: Unisys ClearPath MCP TCP/IP Networking Services 59.1, 60.0, and 62.0 has an Infinite Loop.
CVSS Score: 7.5 (HIGH)
CWE: CWE-835
References: https://public.support.unisys.com/common/public/vulnerability/NVD_Detail_Rpt.aspx?ID=68; https://unisys.com; https://public.support.unisys.com/common/public/vulnerability/NVD_Detail_Rpt.aspx?ID=68
CVE: CVE-2022-0012
Published: 2022-01-12
Description: An improper link resolution before file access vulnerability exists in the Palo Alto Networks Cortex XDR agent on Windows platforms that enables a local user to delete arbitrary system files and impact the system integrity or cause a denial of service condition. This issue impacts: Cortex XDR agent 5.0 versions earlier than Cortex XDR agent 5.0.12; Cortex XDR agent 6.1 versions earlier than Cortex XDR agent 6.1.9; Cortex XDR agent 7.2 versions earlier than Cortex XDR agent 7.2.4; Cortex XDR agent 7.3 versions earlier than Cortex XDR agent 7.3.2.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-59, CWE-59
References: https://security.paloaltonetworks.com/CVE-2022-0012; https://security.paloaltonetworks.com/CVE-2022-0012
CVE: CVE-2022-0013
Published: 2022-01-12
Description: A file information exposure vulnerability exists in the Palo Alto Networks Cortex XDR agent that enables a local attacker to read the contents of arbitrary files on the system with elevated privileges when generating a support file. This issue impacts: Cortex XDR agent 5.0 versions earlier than Cortex XDR agent 5.0.12; Cortex XDR agent 6.1 versions earlier than Cortex XDR agent 6.1.9; Cortex XDR agent 7.2 versions earlier than Cortex XDR agent 7.2.4; Cortex XDR agent 7.3 versions earlier than Cortex XDR agent 7.3.2.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-538, CWE-200
References: https://security.paloaltonetworks.com/CVE-2022-0013; https://security.paloaltonetworks.com/CVE-2022-0013
CVE: CVE-2022-0014
Published: 2022-01-12
Description: An untrusted search path vulnerability exists in the Palo Alto Networks Cortex XDR agent that enables a local attacker with file creation privilege in the Windows root directory (such as C:\) to store a program that can then be unintentionally executed by another local user when that user utilizes a Live Terminal session. This issue impacts: Cortex XDR agent 5.0 versions earlier than Cortex XDR agent 5.0.12; Cortex XDR agent 6.1 versions earlier than Cortex XDR agent 6.1.9; Cortex XDR agent 7.2 versions earlier than Cortex XDR agent 7.2.4; Cortex XDR agent 7.3 versions earlier than Cortex XDR agent 7.3.2.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-426, CWE-426
References: https://security.paloaltonetworks.com/CVE-2022-0014; https://security.paloaltonetworks.com/CVE-2022-0014
CVE: CVE-2022-0015
Published: 2022-01-12
Description: A local privilege escalation (PE) vulnerability exists in the Palo Alto Networks Cortex XDR agent that enables an authenticated local user to execute programs with elevated privileges. This issue impacts: Cortex XDR agent 5.0 versions earlier than Cortex XDR agent 5.0.12; Cortex XDR agent 6.1 versions earlier than Cortex XDR agent 6.1.9.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427, CWE-427
References: https://security.paloaltonetworks.com/CVE-2022-0015; https://security.paloaltonetworks.com/CVE-2022-0015
CVE: CVE-2021-35500
Published: 2022-01-12
Description: The Data Virtualization Server component of TIBCO Software Inc.'s TIBCO Data Virtualization, TIBCO Data Virtualization, TIBCO Data Virtualization, and TIBCO Data Virtualization for AWS Marketplace contains a difficult to exploit vulnerability that allows a low privileged attacker with local access to download arbitrary files outside of the scope of the user's permissions on the affected system. Affected releases are TIBCO Software Inc.'s TIBCO Data Virtualization: versions 8.3.0 and below, TIBCO Data Virtualization: version 8.4.0, TIBCO Data Virtualization: version 8.5.0, and TIBCO Data Virtualization for AWS Marketplace: versions 8.5.0 and below.
CVSS Score: 6.3 (MEDIUM)
References: https://www.tibco.com/services/support/advisories; https://www.tibco.com/support/advisories/2022/01/tibco-security-advisory-january-12-2022-tibco-data-virtualization-2021-35500; https://www.tibco.com/services/support/advisories
CVE: CVE-2021-36417
Published: 2022-01-12
Description: A heap-based buffer overflow vulnerability exists in GPAC v1.0.1 in the gf_isom_dovi_config_get function in MP4Box, which causes a denial of service or execute arbitrary code via a crafted file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/gpac/gpac/issues/1846; https://www.debian.org/security/2023/dsa-5411; https://github.com/gpac/gpac/issues/1846
CVE: CVE-2021-42560
Published: 2022-01-12
Description: An issue was discovered in CALDERA 2.9.0. The Debrief plugin receives base64 encoded "SVG" parameters when generating a PDF document. These SVG documents are parsed in an unsafe manner and can be leveraged for XXE attacks (e.g., File Exfiltration, Server Side Request Forgery, Out of Band Exfiltration, etc.).
CVSS Score: 8.8 (HIGH)
CWE: CWE-611
References: https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2021-42560-Unsafe%20XML%20Parsing-MITRE%20Caldera; https://github.com/mitre/caldera/releases; https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2021-42560-Unsafe%20XML%20Parsing-MITRE%20Caldera
CVE: CVE-2021-42561
Published: 2022-01-12
Description: An issue was discovered in CALDERA 2.8.1. When activated, the Human plugin passes the unsanitized name parameter to a python "os.system" function. This allows attackers to use shell metacharacters (e.g., backticks "``" or dollar parenthesis "$()" ) in order to escape the current command and execute arbitrary shell commands.
CVSS Score: 8.8 (HIGH)
CWE: CWE-74
References: https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2021-42561-Command%20Injection%20Via%20the%20Human%20Plugin-MITRE%20Caldera; https://github.com/mitre/caldera/releases; https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2021-42561-Command%20Injection%20Via%20the%20Human%20Plugin-MITRE%20Caldera
CVE: CVE-2021-42562
Published: 2022-01-12
Description: An issue was discovered in CALDERA 2.8.1. It does not properly segregate user privileges, resulting in non-admin users having access to read and modify configuration or other components that should only be accessible by admin users.
CVSS Score: 8.1 (HIGH)
CWE: CWE-269
References: https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2021-42562-Improper%20Access%20Control-MITRE%20Caldera; https://github.com/mitre/caldera/releases; https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2021-42562-Improper%20Access%20Control-MITRE%20Caldera
CVE: CVE-2021-43960
Published: 2022-01-12
Description: Lorensbergs Connect2 3.13.7647.20190 is affected by an XSS vulnerability. Exploitation requires administrator privileges and is performed through the Wizard editor of the application. The attack requires an administrator to go into the Wizard editor and enter an XSS payload within the Page title, Page Instructions, Text before, Text after, or Text on side box. Once this has been done, the administrator must click save and finally wait until any user of the application performs a booking for rental items in the booking area of the application, where the XSS triggers. NOTE: another perspective is that the administrator may require JavaScript to customize any aspect of the page rendering. There is no effective way for the product to defend users in the face of a malicious administrator
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://www.lorensbergs.co.uk/products/connect2-academic/; https://www.surecloud.com/resources/blog/lorensbergs-connect2-cross-site-scripting; https://www.lorensbergs.co.uk/products/connect2-academic/
CVE: CVE-2022-21675
Published: 2022-01-12
Description: Bytecode Viewer (BCV) is a Java/Android reverse engineering suite. Versions of the package prior to 2.11.0 are vulnerable to Arbitrary File Write via Archive Extraction (AKA "Zip Slip"). The vulnerability is exploited using a specially crafted archive that holds directory traversal filenames (e.g. ../../evil.exe). The Zip Slip vulnerability can affect numerous archive formats, including zip, jar, tar, war, cpio, apk, rar and 7z. The attacker can then overwrite executable files and either invoke them remotely or wait for the system or user to call them, thus achieving remote command execution on the victim’s machine. The impact of a Zip Slip vulnerability would allow an attacker to create or overwrite existing files on the filesystem. In the context of a web application, a web shell could be placed within the application directory to achieve code execution. All users should upgrade to BCV v2.11.0 when possible to receive a patch. There are no recommended workarounds aside from upgrading.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-22, CWE-22
References: https://github.com/Konloch/bytecode-viewer/commit/1ec02658fe6858162f5e6a24f97928de6696c5cb; https://github.com/Konloch/bytecode-viewer/commit/c968e94b2c93da434a4ecfac6d08eda162d615d0; https://github.com/Konloch/bytecode-viewer/releases/tag/v2.11.0
CVE: CVE-2022-21676
Published: 2022-01-12
Description: Engine.IO is the implementation of transport-based cross-browser/cross-device bi-directional communication layer for Socket.IO. A specially crafted HTTP request can trigger an uncaught exception on the Engine.IO server, thus killing the Node.js process. This impacts all the users of the `engine.io` package starting from version `4.0.0`, including those who uses depending packages like `socket.io`. Versions prior to `4.0.0` are not impacted. A fix has been released for each major branch, namely `4.1.2` for the `4.x.x` branch, `5.2.1` for the `5.x.x` branch, and `6.1.1` for the `6.x.x` branch. There is no known workaround except upgrading to a safe version.
CVSS Score: 7.5 (HIGH)
CWE: CWE-754, CWE-755
References: https://github.com/socketio/engine.io/commit/66f889fc1d966bf5bfa0de[PII_REDACTED]43874ab; https://github.com/socketio/engine.io/commit/a70800d7e96da32f6e6622804ef659ebc58659db; https://github.com/socketio/engine.io/commit/c0e194d44933bd83bf9a4b126fca68ba7bf5098c
CVE: CVE-2021-41597
Published: 2022-01-12
Description: SuiteCRM through 7.11.21 is vulnerable to CSRF, with resultant remote code execution, via the UpgradeWizard functionality, if a PHP file is included in a ZIP archive.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://docs.suitecrm.com/admin/releases/; https://docs.suitecrm.com/admin/releases/7.10.x/#_7_10_35; https://github.com/ach-ing/cves/blob/main/CVE-2021-41597.md