deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-23003
Published: 2022-07-29
Description: When computing a shared secret or point multiplication on the NIST P-256 curve that results in an X coordinate of zero, the resulting output is not properly reduced modulo the P-256 field prime and is invalid. The resulting output may cause an error when used in other operations. This may be leveraged by an attacker to cause an error scenario or incorrect choice of session key in applications which use the library, resulting in a limited denial of service for an individual user. The scope of impact cannot extend to other components.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-703, CWE-682
References: https://www.westerndigital.com/support/product-security/wdc-22013-sweet-b-incorrect-output-vulnerabilities; https://www.westerndigital.com/support/product-security/wdc-22013-sweet-b-incorrect-output-vulnerabilities
CVE: CVE-2022-23004
Published: 2022-07-29
Description: When computing a shared secret or point multiplication on the NIST P-256 curve using a public key with an X coordinate of zero, an error is returned from the library, and an invalid unreduced value is written to the output buffer. This may be leveraged by an attacker to cause an error scenario, resulting in a limited denial of service for an individual user. The scope of impact cannot extend to other components.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-703, CWE-707, CWE-682
References: https://www.westerndigital.com/support/product-security/wdc-22013-sweet-b-incorrect-output-vulnerabilities; https://www.westerndigital.com/support/product-security/wdc-22013-sweet-b-incorrect-output-vulnerabilities
CVE: CVE-2022-2414
Published: 2022-07-29
Description: Access to external entities when parsing XML documents can lead to XML external entity (XXE) attacks. This flaw allows a remote attacker to potentially retrieve the content of arbitrary files by sending specially crafted HTTP requests.
CVSS Score: 7.5 (HIGH)
CWE: CWE-611, CWE-611
References: https://github.com/dogtagpki/pki/pull/4021; https://github.com/dogtagpki/pki/pull/4021
CVE: CVE-2022-36378
Published: 2022-07-29
Description: Authenticated (author or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in PluginlySpeaking Floating Div plugin <= 3.0 at WordPress.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/floating-div/wordpress-floating-div-plugin-3-0-authenticated-stored-cross-site-scripting-xss-vulnerability; https://wordpress.org/plugins/floating-div/#developers; https://patchstack.com/database/vulnerability/floating-div/wordpress-floating-div-plugin-3-0-authenticated-stored-cross-site-scripting-xss-vulnerability
CVE: CVE-2022-27864
Published: 2022-07-29
Description: A Double Free vulnerability allows remote attackers to execute arbitrary code through DesignReview.exe application on PDF files within affected installations. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-415
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0009; https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0009
CVE: CVE-2022-27865
Published: 2022-07-29
Description: A maliciously crafted TGA or PCX file may be used to write beyond the allocated buffer through DesignReview.exe application while parsing TGA and PCX files. This vulnerability may be exploited to execute arbitrary code.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0009; https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0009
CVE: CVE-2022-27866
Published: 2022-07-29
Description: A maliciously crafted TIFF file when consumed through DesignReview.exe application can be forced to read beyond allocated boundaries when parsing the TIFF file. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0009; https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0009
CVE: CVE-2022-2323
Published: 2022-07-29
Description: Improper neutralization of special elements used in a user input allows an authenticated malicious user to perform remote code execution in the host system. This vulnerability impacts SonicWall Switch 1.1.1.0-2s and earlier versions
CVSS Score: 8.8 (HIGH)
CWE: CWE-77, CWE-77
References: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0013; https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0013
CVE: CVE-2022-22280
Published: 2022-07-29
Description: Improper Neutralization of Special Elements used in an SQL Command leading to Unauthenticated SQL Injection vulnerability, impacting SonicWall GMS 9.3.1-SP2-Hotfix1, Analytics On-Prem 2.5.0.3-2520 and earlier versions.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0007; https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0007
CVE: CVE-2022-2324
Published: 2022-07-29
Description: Improperly Implemented Security Check vulnerability in the SonicWall Hosted Email Security leads to bypass of Capture ATP security service in the appliance. This vulnerability impacts 10.0.17.7319 and earlier versions
CVSS Score: 7.5 (HIGH)
CWE: CWE-358, CWE-290
References: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0014; https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0014
CVE: CVE-2022-36447
Published: 2022-07-29
Description: An inflation issue was discovered in Chia Network CAT1 Standard 1.0.0. Previously minted tokens minted on the Chia blockchain using the CAT1 standard can be inflated to an arbitrary extent by any holder of any amount of the token. The total amount of the token can be increased as high as the malicious actor pleases. This is true for every CAT1 on the Chia blockchain regardless of issuance rules. This attack is auditable on chain, so maliciously altered coins can potentially be marked by off-chain observers as malicious.
CVSS Score: 7.5 (HIGH)
References: https://chia.net; https://www.chia.net/2022/07/25/upgrading-the-cat-standard.en.html; https://chia.net
CVE: CVE-2022-34496
Published: 2022-07-29
Description: Hiby R3 PRO firmware v1.5 to v1.7 was discovered to contain a file upload vulnerability via the file upload feature.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://github.com/feric/Findings/tree/main/Hiby/Web%20Server/File%20uploading; https://github.com/vext01/hiby-issues/issues/52; https://github.com/feric/Findings/tree/main/Hiby/Web%20Server/File%20uploading
CVE: CVE-2022-34526
Published: 2022-07-29
Description: A stack overflow was discovered in the _TIFFVGetField function of Tiffsplit v4.4.0. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted TIFF file parsed by the "tiffsplit" or "tiffcrop" utilities.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787
References: https://gitlab.com/libtiff/libtiff/-/issues/433; https://gitlab.com/libtiff/libtiff/-/issues/486; https://lists.debian.org/debian-lts-announce/2023/01/msg00018.html
CVE: CVE-2022-34527
Published: 2022-07-29
Description: D-Link DSL-3782 v1.03 and below was discovered to contain a command injection vulnerability via the function byte_4C0160.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://github.com/[PII_REDACTED]/Vuls/blob/main/D-Link/DSL-3782/CMDi_in_D-Link%20DSL-3782.md; https://www.dlink.com/en/security-bulletin/; https://github.com/[PII_REDACTED]/Vuls/blob/main/D-Link/DSL-3782/CMDi_in_D-Link%20DSL-3782.md
CVE: CVE-2022-34528
Published: 2022-07-29
Description: D-Link DSL-3782 v1.03 and below was discovered to contain a stack overflow via the function getAttrValue.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://github.com/[PII_REDACTED]/Vuls/blob/main/D-Link/DSL-3782/BOF_in_D-Link%20DSL-3782.md; https://www.dlink.com/en/security-bulletin/; https://github.com/[PII_REDACTED]/Vuls/blob/main/D-Link/DSL-3782/BOF_in_D-Link%20DSL-3782.md
CVE: CVE-2022-34531
Published: 2022-07-29
Description: DedeCMS v5.7.95 was discovered to contain a remote code execution (RCE) vulnerability via the component mytag_ main.php.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/Airrudder/vuls/blob/main/dedecms/DedeCMS-v5.7.95-RCE.md; https://github.com/Airrudder/vuls/blob/main/dedecms/DedeCMS-v5.7.95-RCE.md
CVE: CVE-2021-27785
Published: 2022-07-30
Description: HCL Commerce's Remote Store server could allow a local attacker to obtain sensitive personal information. The vulnerability requires the victim to first perform a particular operation on the website.
CVSS Score: 3.9 (LOW)
CWE: CWE-522, CWE-522
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0099765; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0099765
CVE: CVE-2022-30083
Published: 2022-07-30
Description: EllieGrid Android Application version 3.4.1 is vulnerable to Code Injection. The application appears to evaluate user input as code (remote).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://portswigger.net/support/using-burp-to-test-for-code-injection-vulnerabilities; https://portswigger.net/support/using-burp-to-test-for-code-injection-vulnerabilities
CVE: CVE-2022-33158
Published: 2022-07-30
Description: Trend Micro VPN Proxy Pro version 5.2.1026 and below contains a vulnerability involving some overly permissive folders in a key directory which could allow a local attacker to obtain privilege escalation on an affected system.
CVSS Score: 7.8 (HIGH)
CWE: CWE-552
References: https://helpcenter.trendmicro.com/en-us/article/tmka-11042; https://www.zerodayinitiative.com/advisories/ZDI-22-853/; https://helpcenter.trendmicro.com/en-us/article/tmka-11042
CVE: CVE-2022-35234
Published: 2022-07-30
Description: Trend Micro Security 2021 and 2022 (Consumer) is vulnerable to an Out-Of-Bounds Read Information Disclosure Vulnerability that could allow an attacker to read sensitive information from other memory locations and cause a crash on an affected machine.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125
References: https://helpcenter.trendmicro.com/en-us/article/tmka-11058; https://www.zerodayinitiative.com/advisories/ZDI-22-962/; https://helpcenter.trendmicro.com/en-us/article/tmka-11058
CVE: CVE-2022-36336
Published: 2022-07-30
Description: A link following vulnerability in the scanning function of Trend Micro Apex One and Worry-Free Business Security agents could allow a local attacker to escalate privileges on affected installations. The resolution for this issue has been deployed automatically via ActiveUpdate to customers in an updated Spyware pattern. Customers who are up-to-date on detection patterns are not required to take any additional steps to mitigate this issue.
CVSS Score: 7.8 (HIGH)
CWE: CWE-59
References: https://success.trendmicro.com/solution/000291267; https://www.zerodayinitiative.com/advisories/ZDI-22-1033/; https://success.trendmicro.com/solution/000291267
CVE: CVE-2022-33994
Published: 2022-07-30
Description: The Gutenberg plugin through 13.7.3 for WordPress allows stored XSS by the Contributor role via an SVG document to the "Insert from URL" feature. NOTE: the XSS payload does not execute in the context of the WordPress instance's domain; however, analogous attempts by low-privileged users to reference SVG documents are blocked by some similar products, and this behavioral difference might have security relevance to some WordPress site administrators.
CVSS Score: 3.0 (LOW)
CWE: CWE-79
References: https://blog.jitendrapatro.me/cve-2022-33994-stored-xss-in-wordpress/; https://patchstack.com/articles/patchstack-weekly-svg-xss-reported-in-gutenberg/; https://blog.jitendrapatro.me/cve-2022-33994-stored-xss-in-wordpress/
CVE: CVE-2022-22326
Published: 2022-08-01
Description: IBM Datapower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.5, and 2018.4.1.0 through 2018.4.1.18 could allow unauthorized viewing of logs and files due to insufficient authorization checks. IBM X-Force ID: 218856.
CVSS Score: 3.3 (LOW)
CWE: CWE-863
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/218856; https://www.ibm.com/support/pages/node/6560048; https://www.ibm.com/support/pages/node/6608598
CVE: CVE-2022-22334
Published: 2022-08-01
Description: IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 could allow a user to access information from a tenant of which they should not have access. IBM X-Force ID: 219391.
CVSS Score: 4.3 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/219391; https://www.ibm.com/support/pages/node/6608550; https://exchange.xforce.ibmcloud.com/vulnerabilities/219391
CVE: CVE-2022-22505
Published: 2022-08-01
Description: IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 contains a vulnerability that could allow IBM tenant credentials to be exposed. IBM X-Force ID: 227288.
CVSS Score: 7.5 (HIGH)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/227288; https://www.ibm.com/support/pages/node/6608404; https://exchange.xforce.ibmcloud.com/vulnerabilities/227288
CVE: CVE-2022-2591
Published: 2022-08-01
Description: A vulnerability classified as critical has been found in TEM FLEX-1085 1.6.0. Affected is an unknown function of the file /sistema/flash/reboot. The manipulation leads to denial of service. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.5 (HIGH)
CWE: CWE-404, CWE-404
References: http://packetstormsecurity.com/files/172323/FLEX-Denial-Of-Service.html; https://vuldb.com/?id.205344; http://packetstormsecurity.com/files/172323/FLEX-Denial-Of-Service.html
CVE: CVE-2022-30616
Published: 2022-08-01
Description: IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 could allow a privileged user to elevate their privilege to platform administrator through manipulation of APIs. IBM X-Force ID: 227978.
CVSS Score: 7.2 (HIGH)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/227978; https://www.ibm.com/support/pages/node/6608430; https://exchange.xforce.ibmcloud.com/vulnerabilities/227978
CVE: CVE-2022-31774
Published: 2022-08-01
Description: IBM DataPower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.8, 10.5.0.0, and 2018.4.1.0 through 2018.4.1.21 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 228358.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/228358; https://www.ibm.com/support/pages/node/6608600; https://exchange.xforce.ibmcloud.com/vulnerabilities/228358
CVE: CVE-2022-31775
Published: 2022-08-01
Description: IBM DataPower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.8, 10.5.0.0, and 2018.4.1.0 through 2018.4.1.21 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 228359.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-611
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/228359; https://www.ibm.com/support/pages/node/6608608; https://exchange.xforce.ibmcloud.com/vulnerabilities/228359
CVE: CVE-2022-31776
Published: 2022-08-01
Description: IBM DataPower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.8, 10.5.0.0, and 2018.4.1.0 through 2018.4.1.21 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 228433.
CVSS Score: 8.8 (HIGH)
CWE: CWE-918
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/228433; https://www.ibm.com/support/pages/node/6608604; https://exchange.xforce.ibmcloud.com/vulnerabilities/228433
CVE: CVE-2022-32750
Published: 2022-08-01
Description: IBM DataPower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.8, 10.5.0.0, and 2018.4.1.0 through 2018.4.1.21 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 228435.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/228435; https://www.ibm.com/support/pages/node/6608600; https://exchange.xforce.ibmcloud.com/vulnerabilities/228435
CVE: CVE-2022-33169
Published: 2022-08-01
Description: IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 is vulnerable to insufficiently protected credentials for users created via a bulk upload. IBM X-Force ID: 228888.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-522
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/228888; https://www.ibm.com/support/pages/node/6608454; https://exchange.xforce.ibmcloud.com/vulnerabilities/228888
CVE: CVE-2022-34338
Published: 2022-08-01
Description: IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 could disclose sensitive information due to improper privilege management for storage provider types. IBM X-Force ID: 229962.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-269
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/229962; https://www.ibm.com/support/pages/node/6608606; https://exchange.xforce.ibmcloud.com/vulnerabilities/229962
CVE: CVE-2022-35716
Published: 2022-08-01
Description: IBM UrbanCode Deploy (UCD) 6.2.0.0 through 6.2.7.16, 7.0.0.0 through 7.0.5.11, 7.1.0.0 through 7.1.2.7, and 7.2.0.0 through 7.2.3.0 could allow an authenticated user to obtain sensitive information in some instances due to improper security checking. IBM X-Force ID: 231360.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-863
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/231360; https://www.ibm.com/support/pages/node/6608584; https://exchange.xforce.ibmcloud.com/vulnerabilities/231360
CVE: CVE-2022-36799
Published: 2022-08-01
Description: This issue exists to document that a security improvement in the way that Jira Server and Data Center use templates has been implemented. Affected versions of Atlassian Jira Server and Data Center allowed remote attackers with system administrator permissions to execute arbitrary code via Template Injection leading to Remote Code Execution (RCE) in the Email Templates feature. In this case the security improvement was to protect against using the XStream library to be able to execute arbitrary code in velocity templates. The affected versions are before version 8.13.19, from version 8.14.0 before 8.20.7, and from version 8.21.0 before 8.22.1.
CVSS Score: 7.2 (HIGH)
CWE: CWE-94, CWE-94
References: https://jira.atlassian.com/browse/JRASERVER-73582; https://jira.atlassian.com/browse/JRASERVER-73582
CVE: CVE-2022-27255
Published: 2022-08-01
Description: In Realtek eCos RSDK 1.5.7p1 and MSDK 4.9.4p1, the SIP ALG function that rewrites SDP data has a stack-based buffer overflow. This allows an attacker to remotely execute code without authentication via a crafted SIP packet that contains malicious SDP data.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: https://forum.defcon.org/node/241835; https://www.realtek.com/images/safe-report/Realtek_APRouter_SDK_Advisory-CVE-2022-27255.pdf; https://forum.defcon.org/node/241835
CVE: CVE-2022-0598
Published: 2022-08-01
Description: The Login with phone number WordPress plugin before 1.3.8 does not sanitise and escape plugin settings which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://wpscan.com/vulnerability/4688d39e-ac9b-47f5-a4c1-f9548b63c68c; https://wpscan.com/vulnerability/4688d39e-ac9b-47f5-a4c1-f9548b63c68c
CVE: CVE-2022-1324
Published: 2022-08-01
Description: The Event Timeline WordPress plugin through 1.1.5 does not sanitize and escape Timeline Text, which could allow high-privileged users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/2ce2a387-acc8-482a-9452-a4d9acb187fd; https://wpscan.com/vulnerability/2ce2a387-acc8-482a-9452-a4d9acb187fd
CVE: CVE-2022-1561
Published: 2022-08-01
Description: Lura and KrakenD-CE versions older than v2.0.2 and KrakenD-EE versions older than v2.0.0 do not sanitize URL parameters correctly, allowing a malicious user to alter the backend URL defined for a pipe when remote users send crafty URL requests. The vulnerability does not affect KrakenD itself, but the consumed backend might be vulnerable.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-471
References: https://www.incibe-cert.es/en/early-warning/security-advisories/crafted-backend-urls-lura-project; https://www.krakend.io/blog/cve-2022-1561-crafted-backend-urls/; https://www.incibe-cert.es/en/early-warning/security-advisories/crafted-backend-urls-lura-project
CVE: CVE-2022-1585
Published: 2022-08-01
Description: The Project Source Code Download WordPress plugin through 1.0.0 does not protect its backup generation and download functionalities, which may allow any visitors on the site to download the entire site, including sensitive files like wp-config.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-552, CWE-552
References: https://wpscan.com/vulnerability/e709958c-7bce-45d7-9a0a-6e0ed12cd03f; https://wpscan.com/vulnerability/e709958c-7bce-45d7-9a0a-6e0ed12cd03f
CVE: CVE-2022-1600
Published: 2022-08-01
Description: The YOP Poll WordPress plugin before 6.4.3 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDR, which makes it possible to bypass IP-based limitations to vote in certain situations.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-639
References: https://wpscan.com/vulnerability/2b7445fd-0992-47cd-9a48-f5f18d8171f7; https://wpscan.com/vulnerability/2b7445fd-0992-47cd-9a48-f5f18d8171f7
CVE: CVE-2022-1906
Published: 2022-08-01
Description: The Copyright Proof WordPress plugin through 4.16 does not sanitise and escape a parameter before outputting it back via an AJAX action available to both unauthenticated and authenticated users, leading to a Reflected Cross-Site Scripting when a specific setting is enabled.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/af4f459e-e60b-4384-aad9-0dc18aa3b338; https://wpscan.com/vulnerability/af4f459e-e60b-4384-aad9-0dc18aa3b338
CVE: CVE-2022-1950
Published: 2022-08-01
Description: The Youzify WordPress plugin before 1.2.0 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to an unauthenticated SQL injection
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://wpscan.com/vulnerability/4352283f-dd43-4827-b417-0c55d0f4637d; https://wpscan.com/vulnerability/4352283f-dd43-4827-b417-0c55d0f4637d
CVE: CVE-2022-26308
Published: 2022-08-01
Description: Pandora FMS v7.0NG.760 and below allows an improper access control in Configuration (Credential store) where a user with the role of Operator (Write) could create, delete, view existing keys which are outside the intended role.
CVSS Score: 3.7 (LOW)
CWE: CWE-284
References: https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/; https://www.incibe.es/en/cve-assignment-publication/coordinated-cves; https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/
CVE: CVE-2022-26309
Published: 2022-08-01
Description: Pandora FMS v7.0NG.759 allows Cross-Site Request Forgery in Bulk operation (User operation) resulting in elevation of privilege to Administrator group.
CVSS Score: 3.7 (LOW)
CWE: CWE-352, CWE-352
References: https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/; https://www.incibe.es/en/cve-assignment-publication/coordinated-cves; https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/