deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-41184
Published: 2022-10-11
Description: Due to lack of proper memory management, when a victim opens a manipulated Windows Cursor File (.cur, ico.x3d) file received from untrusted sources in SAP 3D Visual Enterprise Author - version 9, it is possible that a Remote Code Execution can be triggered when payload forces a stack-based overflow or a re-use of dangling pointer which refers to overwritten space in memory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-787, CWE-119, CWE-787
References: https://launchpad.support.sap.com/#/notes/3245929; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3245929
CVE: CVE-2022-41185
Published: 2022-10-11
Description: Due to lack of proper memory management, when a victim opens a manipulated Visual Design Stream (.vds, MataiPersistence.dll) file received from untrusted sources in SAP 3D Visual Enterprise Author - version 9, it is possible that a Remote Code Execution can be triggered when payload forces a stack-based overflow or a re-use of dangling pointer which refers to overwritten space in memory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-787, CWE-119, CWE-787
References: https://launchpad.support.sap.com/#/notes/3245929; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3245929
CVE: CVE-2022-41186
Published: 2022-10-11
Description: Due to lack of proper memory management, when a victim opens manipulated Computer Graphics Metafile (.cgm, CgmCore.dll) file received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9, a Remote Code Execution can be triggered when payload forces a stack-based overflow and or a re-use of dangling pointer which refers to overwritten space in memory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-787, CWE-119, CWE-787
References: https://launchpad.support.sap.com/#/notes/3245928; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3245928
CVE: CVE-2022-41187
Published: 2022-10-11
Description: Due to lack of proper memory management, when a victim opens a manipulated Wavefront Object (.obj, ObjTranslator.exe) file received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9, it is possible that a Remote Code Execution can be triggered when payload forces a stack-based overflow or a re-use of dangling pointer which refers to overwritten space in memory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-787, CWE-119, CWE-787
References: https://launchpad.support.sap.com/#/notes/3245928; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3245928
CVE: CVE-2022-41188
Published: 2022-10-11
Description: Due to lack of proper memory management, when a victim opens manipulated Wavefront Object (.obj, ObjTranslator.exe) file received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9, it is possible for the application to crash and becomes temporarily unavailable to the user until restart of the application.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://launchpad.support.sap.com/#/notes/3245928; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3245928
CVE: CVE-2022-41189
Published: 2022-10-11
Description: Due to lack of proper memory management, when a victim opens a manipulated AutoCAD (.dwg, TeighaTranslator.exe) file received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9, it is possible that a Remote Code Execution can be triggered when payload forces a stack-based overflow or a re-use of dangling pointer which refers to overwritten space in memory.


CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-787, CWE-119, CWE-787
References: https://launchpad.support.sap.com/#/notes/3245928; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3245928
CVE: CVE-2022-41190
Published: 2022-10-11
Description: Due to lack of proper memory management, when a victim opens a manipulated AutoCAD (.dxf, TeighaTranslator.exe) file received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9, it is possible that a Remote Code Execution can be triggered when payload forces a stack-based overflow or a re-use of dangling pointer which refers to overwritten space in memory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-787, CWE-119, CWE-787
References: https://launchpad.support.sap.com/#/notes/3245928; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3245928
CVE: CVE-2022-41191
Published: 2022-10-11
Description: Due to lack of proper memory management, when a victim opens a manipulated Jupiter Tesselation (.jt, JTReader.x3d) file received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9, it is possible that a Remote Code Execution can be triggered when payload forces a stack-based overflow or a re-use of dangling pointer which refers to overwritten space in memory.


CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-787, CWE-119, CWE-787
References: https://launchpad.support.sap.com/#/notes/3245928; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3245928
CVE: CVE-2022-41192
Published: 2022-10-11
Description: Due to lack of proper memory management, when a victim opens manipulated Jupiter Tesselation (.jt, JTReader.x3d) file received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9, it is possible for the application to crash and becomes temporarily unavailable to the user until restart of the application.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://launchpad.support.sap.com/#/notes/3245928; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3245928
CVE: CVE-2022-41193
Published: 2022-10-11
Description: Due to lack of proper memory management, when a victim opens a manipulated Encapsulated Post Script (.eps, ai.x3d) file received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9, it is possible that a Remote Code Execution can be triggered when payload forces a stack-based overflow or a re-use of dangling pointer which refers to overwritten space in memory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-787, CWE-119, CWE-787
References: https://launchpad.support.sap.com/#/notes/3245928; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3245928
CVE: CVE-2022-41194
Published: 2022-10-11
Description: Due to lack of proper memory management, when a victim opens a manipulated Encapsulated Postscript (.eps, ai.x3d) file received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9, it is possible for the application to crash and becomes temporarily unavailable to the user until restart of the application.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://launchpad.support.sap.com/#/notes/3245928; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3245928
CVE: CVE-2022-41195
Published: 2022-10-11
Description: Due to lack of proper memory management, when a victim opens a manipulated EAAmiga Interchange File Format (.iff, 2d.x3d) file received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9, it is possible that a Remote Code Execution can be triggered when payload forces a stack-based overflow or a re-use of dangling pointer which refers to overwritten space in memory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-787, CWE-119, CWE-787
References: https://launchpad.support.sap.com/#/notes/3245928; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3245928
CVE: CVE-2022-41196
Published: 2022-10-11
Description: Due to lack of proper memory management, when a victim opens a manipulated VRML Worlds (.wrl, vrml.x3d) file received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9, it is possible that a Remote Code Execution can be triggered when payload forces a stack-based overflow or a re-use of dangling pointer which refers to overwritten space in memory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-787, CWE-119, CWE-787
References: https://launchpad.support.sap.com/#/notes/3245928; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3245928
CVE: CVE-2022-41197
Published: 2022-10-11
Description: Due to lack of proper memory management, when a victim opens a manipulated VRML Worlds (.wrl, vrml.x3d) file received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9, it is possible for the application to crash and becomes temporarily unavailable to the user until restart of the application.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://launchpad.support.sap.com/#/notes/3245928; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3245928
CVE: CVE-2022-41198
Published: 2022-10-11
Description: Due to lack of proper memory management, when a victim opens a manipulated SketchUp (.skp, SketchUp.x3d) file received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9, it is possible that a Remote Code Execution can be triggered when payload forces a stack-based overflow or a re-use of dangling pointer which refers to overwritten space in memory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-787, CWE-119, CWE-787
References: https://launchpad.support.sap.com/#/notes/3245928; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3245928
CVE: CVE-2022-41199
Published: 2022-10-11
Description: Due to lack of proper memory management, when a victim opens a manipulated Open Inventor File (.iv, vrml.x3d) file received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9, it is possible that a Remote Code Execution can be triggered when payload forces a stack-based overflow or a re-use of dangling pointer which refers to overwritten space in memory.


CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-787, CWE-119, CWE-787
References: https://launchpad.support.sap.com/#/notes/3245928; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3245928
CVE: CVE-2022-41200
Published: 2022-10-11
Description: Due to lack of proper memory management, when a victim opens a manipulated Scalable Vector Graphic (.svg, svg.x3d) file received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9, it is possible that a Remote Code Execution can be triggered when payload forces a stack-based overflow or a re-use of dangling pointer which refers to overwritten space in memory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-787, CWE-119, CWE-787
References: https://launchpad.support.sap.com/#/notes/3245928; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3245928
CVE: CVE-2022-41201
Published: 2022-10-11
Description: Due to lack of proper memory management, when a victim opens a manipulated Right Hemisphere Binary (.rh, rh.x3d) file received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9, it is possible that a Remote Code Execution can be triggered when payload forces a stack-based overflow or a re-use of dangling pointer which refers to overwritten space in memory.


CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-787, CWE-119, CWE-787
References: https://launchpad.support.sap.com/#/notes/3245928; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3245928
CVE: CVE-2022-41202
Published: 2022-10-11
Description: Due to lack of proper memory management, when a victim opens a manipulated Visual Design Stream (.vds, vds.x3d) file received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9, it is possible that a Remote Code Execution can be triggered when payload forces a stack-based overflow or a re-use of dangling pointer which refers to overwritten space in memory.


CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-787, CWE-119, CWE-787
References: https://launchpad.support.sap.com/#/notes/3245928; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3245928
CVE: CVE-2022-41204
Published: 2022-10-11
Description: An attacker can change the content of an SAP Commerce - versions 1905, 2005, 2105, 2011, 2205, login page through a manipulated URL. They can inject code that allows them to redirect submissions from the affected login form to their own server. This allows them to steal credentials and hijack accounts. A successful attack could compromise the Confidentiality, Integrity, and Availability of the system.
CVSS Score: 8.8 (HIGH)
CWE: CWE-601
References: https://launchpad.support.sap.com/#/notes/3239152; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3239152
CVE: CVE-2022-41206
Published: 2022-10-11
Description: SAP BusinessObjects Business Intelligence platform (Analysis for OLAP) - versions 420, 430, allows an authenticated attacker to send user-controlled inputs when OLAP connections are created and edited in the Central Management Console. On successful exploitation, there could be a limited impact on confidentiality and integrity of the application.


CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://launchpad.support.sap.com/#/notes/3229425; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3229425
CVE: CVE-2022-41209
Published: 2022-10-11
Description: SAP Customer Data Cloud (Gigya mobile app for Android) - version 7.4, uses encryption method which lacks proper diffusion and does not hide the patterns well. This can lead to information disclosure. In certain scenarios, application might also be susceptible to replay attacks.


CVSS Score: 5.2 (MEDIUM)
CWE: CWE-326
References: https://launchpad.support.sap.com/#/notes/3248970; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3248970
CVE: CVE-2022-41210
Published: 2022-10-11
Description: SAP Customer Data Cloud (Gigya mobile app for Android) - version 7.4, uses insecure random number generator program which makes it easy for the attacker to predict future random numbers. This can lead to information disclosure and modification of certain user settings.


CVSS Score: 5.2 (MEDIUM)
CWE: CWE-338
References: https://launchpad.support.sap.com/#/notes/3248384; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3248384
CVE: CVE-2022-41380
Published: 2022-10-11
Description: The d8s-yaml package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-file-system package. The affected version is 0.1.0.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434, CWE-434
References: https://github.com/democritus-project/d8s-yaml/issues/4; https://pypi.org/project/d8s-yaml/; https://pypi.org/project/democritus-file-system/
CVE: CVE-2022-41381
Published: 2022-10-11
Description: The d8s-utility package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-file-system package. The affected version is 0.1.0.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434, CWE-434
References: https://github.com/democritus-project/d8s-utility/issues/10; https://pypi.org/project/d8s-utility/; https://pypi.org/project/democritus-file-system/
CVE: CVE-2022-41382
Published: 2022-10-11
Description: The d8s-json package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-file-system package. The affected version is 0.1.0.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434, CWE-434
References: https://github.com/democritus-project/d8s-json/issues/10; https://pypi.org/project/d8s-json/; https://pypi.org/project/democritus-file-system/
CVE: CVE-2022-41383
Published: 2022-10-11
Description: The d8s-archives package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-file-system package. The affected version is 0.1.0.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434, CWE-434
References: https://github.com/democritus-project/d8s-archives/issues/13; https://pypi.org/project/d8s-archives/; https://pypi.org/project/democritus-file-system/
CVE: CVE-2022-41384
Published: 2022-10-11
Description: The d8s-domains package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-urls package. The affected version is 0.1.0.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434, CWE-434
References: https://github.com/democritus-project/d8s-domains/issues/9; https://pypi.org/project/d8s-domains/; https://pypi.org/project/democritus-urls/
CVE: CVE-2022-41385
Published: 2022-10-11
Description: The d8s-html package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-urls package. The affected version is 0.1.0.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434, CWE-434
References: https://github.com/democritus-project/d8s-html/issues/12; https://pypi.org/project/d8s-html/; https://pypi.org/project/democritus-urls/
CVE: CVE-2022-41386
Published: 2022-10-11
Description: The d8s-utility package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-urls package. The affected version is 0.1.0.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434, CWE-434
References: https://github.com/democritus-project/d8s-utility/issues/11; https://pypi.org/project/d8s-utility/; https://pypi.org/project/democritus-urls/
CVE: CVE-2022-41387
Published: 2022-10-11
Description: The d8s-pdfs package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-urls package. The affected version is 0.1.0.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434, CWE-434
References: https://github.com/democritus-project/d8s-pdfs/issues/7; https://pypi.org/project/d8s-pdfs/; https://pypi.org/project/democritus-urls/
CVE: CVE-2022-41550
Published: 2022-10-11
Description: GNU oSIP v5.3.0 was discovered to contain an integer overflow via the component osip_body_parse_header.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-190, CWE-190
References: https://savannah.gnu.org/bugs/?63103; https://savannah.gnu.org/bugs/?63103
CVE: CVE-2022-42036
Published: 2022-10-11
Description: The d8s-urls package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-csv package. The affected version is 0.1.0.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://github.com/democritus-project/d8s-urls/issues/12; https://pypi.org/project/d8s-urls/; https://pypi.org/project/democritus-csv/
CVE: CVE-2022-42037
Published: 2022-10-11
Description: The d8s-asns package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-csv package. The affected version is 0.1.0.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434, CWE-434
References: https://github.com/democritus-project/d8s-asns/issues/9; https://pypi.org/project/d8s-asns/; https://pypi.org/project/democritus-csv/
CVE: CVE-2022-42038
Published: 2022-10-11
Description: The d8s-ip-addresses package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-csv package. The affected version is 0.1.0.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434, CWE-434
References: https://github.com/democritus-project/d8s-ip-addresses/issues/14; https://pypi.org/project/d8s-ip-addresses/; https://pypi.org/project/democritus-csv/
CVE: CVE-2022-42039
Published: 2022-10-11
Description: The d8s-lists package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-dicts package. The affected version is 0.1.0.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434, CWE-434
References: https://github.com/democritus-project/d8s-lists/issues/18; https://pypi.org/project/d8s-lists/; https://pypi.org/project/democritus-dicts/
CVE: CVE-2022-42040
Published: 2022-10-11
Description: The d8s-algorithms package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-dicts package. The affected version is 0.1.0.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434, CWE-434
References: https://github.com/dadadadada111/info/issues/1; https://pypi.org/project/d8s-algorithms/; https://pypi.org/project/democritus-dicts/
CVE: CVE-2022-42041
Published: 2022-10-11
Description: The d8s-file-system package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-hashes package. The affected version is 0.1.0.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/dadadadada111/info/issues/2; https://pypi.org/project/d8s-file-system/; https://pypi.org/project/democritus-hashes/
CVE: CVE-2022-42042
Published: 2022-10-11
Description: The d8s-networking package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-hashes package. The affected version is 0.1.0.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/dadadadada111/info/issues/3; https://pypi.org/project/d8s-networking/; https://pypi.org/project/democritus-hashes/
CVE: CVE-2022-42043
Published: 2022-10-11
Description: The d8s-xml package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-html package. The affected version is 0.1.0.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434, CWE-434
References: https://github.com/dadadadada111/info/issues/5; https://pypi.org/project/d8s-xml/; https://pypi.org/project/democritus-html/
CVE: CVE-2022-42044
Published: 2022-10-11
Description: The d8s-asns package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-html package. The affected version is 0.1.0.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434, CWE-434
References: https://github.com/dadadadada111/info/issues/4; https://pypi.org/project/d8s-asns/; https://pypi.org/project/democritus-html/
CVE: CVE-2022-37617
Published: 2022-10-11
Description: Prototype pollution vulnerability in function resolveShims in resolve-shims.js in thlorenz browserify-shim 3.8.15 via the k variable in resolve-shims.js.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1321
References: https://github.com/thlorenz/browserify-shim/blob/464b32bbe142664cd[PII_REDACTED]f6c738ea3de8f/lib/resolve-shims.js#L130; https://github.com/thlorenz/browserify-shim/blob/464b32bbe142664cd[PII_REDACTED]f6c738ea3de8f/lib/resolve-shims.js#L158; https://github.com/thlorenz/browserify-shim/issues/245
CVE: CVE-2022-40777
Published: 2022-10-11
Description: Interspire Email Marketer through 6.5.0 allows arbitrary file upload via a surveys_submit.php "create survey and submit survey" operation, which can cause a .php file to be accessible under a /admin/temp/surveys/ URI. NOTE: this issue exists because of an incomplete fix for CVE-2018-19550.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://twitter.com/huyvinhptit; https://www.interspire.com/security-bulletin-20220918/; https://twitter.com/huyvinhptit