deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-43564
Published: 2022-11-04
Description: In Splunk Enterprise versions below 8.1.12, 8.2.9, and 9.0.2, a remote user who can create search macros and schedule search reports can cause a denial of service through the use of specially crafted search macros.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-400, CWE-400
References: https://www.splunk.com/en_us/product-security/announcements/svd-2022-1104.html; https://www.splunk.com/en_us/product-security/announcements/svd-2022-1104.html
CVE: CVE-2022-43565
Published: 2022-11-04
Description: In Splunk Enterprise versions below 8.2.9 and 8.1.12, the way that the ‘tstats command handles Javascript Object Notation (JSON) lets an attacker bypass  SPL safeguards for risky commands https://docs.splunk.com/Documentation/SplunkCloud/latest/Security/SPLsafeguards . The vulnerability requires the attacker to phish the victim by tricking them into initiating a request within their browser. 

CVSS Score: 8.1 (HIGH)
CWE: CWE-20
References: https://www.splunk.com/en_us/product-security/announcements/svd-2022-1105.html; https://www.splunk.com/en_us/product-security/announcements/svd-2022-1105.html
CVE: CVE-2022-43566
Published: 2022-11-04
Description: In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can run risky commands using a more privileged user’s permissions to bypass  SPL safeguards for risky commands https://docs.splunk.com/Documentation/SplunkCloud/latest/Security/SPLsafeguards  in the Analytics Workspace. The vulnerability requires the attacker to phish the victim by tricking them into initiating a request within their browser. The attacker cannot exploit the vulnerability at will.

CVSS Score: 7.3 (HIGH)
CWE: CWE-20, CWE-20
References: https://research.splunk.com/application/b6d77c6c-f011-4b03-8650-8f10edb7c4a8/; https://www.splunk.com/en_us/product-security/announcements/svd-2022-1106.html; https://research.splunk.com/application/b6d77c6c-f011-4b03-8650-8f10edb7c4a8/
CVE: CVE-2022-43567
Published: 2022-11-04
Description: In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can run arbitrary operating system commands remotely through the use of specially crafted requests to the mobile alerts feature in the Splunk Secure Gateway app.

CVSS Score: 8.8 (HIGH)
CWE: CWE-502, CWE-502
References: https://research.splunk.com/application/baa41f09-df48-4375-8991-520beea161be/; https://www.splunk.com/en_us/product-security/announcements/svd-2022-1107.html; https://research.splunk.com/application/baa41f09-df48-4375-8991-520beea161be/
CVE: CVE-2022-43568
Published: 2022-11-04
Description: In Splunk Enterprise versions below 8.1.12, 8.2.9, and 9.0.2, a View allows for a Reflected Cross Site Scripting via JavaScript Object Notation (JSON) in a query parameter when output_mode=radio.

CVSS Score: 8.8 (HIGH)
CWE: CWE-79, CWE-79
References: https://research.splunk.com/application/d532d105-c63f-4049-a8c4-e249127ca425/; https://www.splunk.com/en_us/product-security/announcements/svd-2022-1108.html; https://research.splunk.com/application/d532d105-c63f-4049-a8c4-e249127ca425/
CVE: CVE-2022-43569
Published: 2022-11-04
Description: In Splunk Enterprise versions below 8.1.12, 8.2.9, and 9.0.2, an authenticated user can inject and store arbitrary scripts that can lead to persistent cross-site scripting (XSS) in the object name of a Data Model.

CVSS Score: 8.0 (HIGH)
CWE: CWE-79, CWE-79
References: https://research.splunk.com/application/062bff76-5f9c-496e-a386-cb1adcf69871/; https://www.splunk.com/en_us/product-security/announcements/svd-2022-1109.html; https://research.splunk.com/application/062bff76-5f9c-496e-a386-cb1adcf69871/
CVE: CVE-2022-43570
Published: 2022-11-04
Description: In Splunk Enterprise versions below 8.1.12, 8.2.9, and 9.0.2, an authenticated user can perform an extensible markup language (XML) external entity (XXE) injection via a custom View. The XXE injection causes Splunk Web to embed incorrect documents into an error.

CVSS Score: 8.8 (HIGH)
CWE: CWE-611, CWE-611
References: https://www.splunk.com/en_us/product-security/announcements/svd-2022-1110.html; https://www.splunk.com/en_us/product-security/announcements/svd-2022-1110.html
CVE: CVE-2022-43572
Published: 2022-11-04
Description: In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, sending a malformed file through the Splunk-to-Splunk (S2S) or HTTP Event Collector (HEC) protocols to an indexer results in a blockage or denial-of-service preventing further indexing.

CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-94
References: https://www.splunk.com/en_us/product-security/announcements/svd-2022-1111.html; https://www.splunk.com/en_us/product-security/announcements/svd-2022-1111.html
CVE: CVE-2022-3868
Published: 2022-11-05
Description: A vulnerability classified as critical has been found in SourceCodester Sanitization Management System. Affected is an unknown function of the file /php-sms/classes/Master.php?f=save_quote. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-213012.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-707
References: https://github.com/x9AD8/Sanitization-Management-System/blob/main/README.md; https://vuldb.com/?id.213012; https://github.com/x9AD8/Sanitization-Management-System/blob/main/README.md
CVE: CVE-2022-3869
Published: 2022-11-05
Description: Code Injection in GitHub repository froxlor/froxlor prior to 0.10.38.2.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-94, CWE-79
References: https://github.com/froxlor/froxlor/commit/3f10a4adede9df83408d60ded78b51b812a763a8; https://huntr.dev/bounties/7de20f21-4a9b-445d-ae2b-15ade648900b; https://github.com/froxlor/froxlor/commit/3f10a4adede9df83408d60ded78b51b812a763a8
CVE: CVE-2022-42707
Published: 2022-11-06
Description: In Mahara 21.04 before 21.04.7, 21.10 before 21.10.5, 22.04 before 22.04.3, and 22.10 before 22.10.0, embedded images are accessible without a sufficient permission check under certain conditions.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://bugs.launchpad.net/mahara/+bug/1991157; https://mahara.org/interaction/forum/topic.php?id=9199; https://bugs.launchpad.net/mahara/+bug/1991157
CVE: CVE-2022-44544
Published: 2022-11-06
Description: Mahara 21.04 before 21.04.7, 21.10 before 21.10.5, 22.04 before 22.04.3, and 22.10 before 22.10.0 potentially allow a PDF export to trigger a remote shell if the site is running on Ubuntu and the flag -dSAFER is not set with Ghostscript.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-250
References: https://bugs.launchpad.net/mahara/+bug/1979575; https://mahara.org/interaction/forum/topic.php?id=9198; https://bugs.launchpad.net/mahara/+bug/1979575
CVE: CVE-2022-40284
Published: 2022-11-06
Description: A buffer overflow was discovered in NTFS-3G before 2022.10.3. Crafted metadata in an NTFS image can cause code execution. A local attacker can exploit this if the ntfs-3g binary is setuid root. A physically proximate attacker can exploit this if NTFS-3G software is configured to execute upon attachment of an external storage device.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120, CWE-120
References: http://www.openwall.com/lists/oss-security/2022/10/31/2; https://github.com/tuxera/ntfs-3g/releases; https://lists.debian.org/debian-lts-announce/2022/11/msg00029.html
CVE: CVE-2022-37710
Published: 2022-11-07
Description: Patterson Dental Eaglesoft 21 has AES-256 encryption but there are two ways to obtain a keyfile: (1) keybackup.data > License > Encryption Key or (2) Eaglesoft.Server.Configuration.data > DbEncryptKeyPrimary > Encryption Key. Applicable files are encrypted with keys and salt that are hardcoded into a DLL or EXE file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-798, CWE-798
References: https://justinshafer.blogspot.com/2022/08/eaglesofts-automatic-aes-256-encryption.html; https://justinshafer.blogspot.com/2022/08/eaglesofts-automatic-aes-256-encryption.html
CVE: CVE-2022-42905
Published: 2022-11-07
Description: In wolfSSL before 5.5.2, if callback functions are enabled (via the WOLFSSL_CALLBACKS flag), then a malicious TLS 1.3 client or network attacker can trigger a buffer over-read on the heap of 5 bytes. (WOLFSSL_CALLBACKS is only intended for debugging.)
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-125, CWE-125
References: http://packetstormsecurity.com/files/170610/wolfSSL-WOLFSSL_CALLBACKS-Heap-Buffer-Over-Read.html; http://seclists.org/fulldisclosure/2023/Jan/11; https://blog.trailofbits.com/2023/01/12/wolfssl-vulnerabilities-tlspuffin-fuzzing-ssh/
CVE: CVE-2022-42919
Published: 2022-11-07
Description: Python 3.9.x before 3.9.16 and 3.10.x before 3.10.9 on Linux allows local privilege escalation in a non-default configuration. The Python multiprocessing library, when used with the forkserver start method on Linux, allows pickles to be deserialized from any user in the same machine local network namespace, which in many system configurations means any user on the same machine. Pickles can execute arbitrary code. Thus, this allows for local user privilege escalation to the user that any forkserver process is running as. Setting multiprocessing.util.abstract_sockets_supported to False is a workaround. The forkserver start method for multiprocessing is not the default start method. This issue is Linux specific because only Linux supports abstract namespace sockets. CPython before 3.9 does not make use of Linux abstract namespace sockets by default. Support for users manually specifying an abstract namespace socket was added as a bugfix in 3.7.8 and 3.8.3, but users would need to make specific uncommon API calls in order to do that in CPython before 3.9.
CVSS Score: 7.8 (HIGH)
CWE: CWE-502
References: https://github.com/python/cpython/compare/v3.10.8...v3.10.9; https://github.com/python/cpython/compare/v3.9.15...v3.9.16; https://github.com/python/cpython/issues/97514
CVE: CVE-2022-44792
Published: 2022-11-07
Description: handle_ipDefaultTTL in agent/mibgroup/ip-mib/ip_scalars.c in Net-SNMP 5.8 through 5.9.3 has a NULL Pointer Exception bug that can be used by a remote attacker (who has write access) to cause the instance to crash via a crafted UDP packet, resulting in Denial of Service.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://gist.github.com/menglong2234/b7bc13ae1a144f47cc3c95a7ea062428; https://github.com/net-snmp/net-snmp/issues/474; https://lists.debian.org/debian-lts-announce/2023/01/msg00010.html
CVE: CVE-2022-44793
Published: 2022-11-07
Description: handle_ipv6IpForwarding in agent/mibgroup/ip-mib/ip_scalars.c in Net-SNMP 5.4.3 through 5.9.3 has a NULL Pointer Exception bug that can be used by a remote attacker to cause the instance to crash via a crafted UDP packet, resulting in Denial of Service.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://gist.github.com/menglong2234/d07a65b5028145c9f4e1d1db8c4c202f; https://github.com/net-snmp/net-snmp/issues/475; https://lists.debian.org/debian-lts-announce/2023/01/msg00010.html
CVE: CVE-2022-44794
Published: 2022-11-07
Description: An issue was discovered in Object First Ootbi BETA build 1.0.7.712. Management protocol has a flow which allows a remote attacker to execute arbitrary Bash code with root privileges. The command that sets the hostname doesn't validate input parameters. As a result, arbitrary data goes directly to the Bash interpreter. An attacker would need credentials to exploit this vulnerability. This is fixed in Object First Ootbi BETA build 1.0.13.1611.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: https://objectfirst.com/security/of-20[PII_REDACTED]/; https://objectfirst.com/security/of-20[PII_REDACTED]/
CVE: CVE-2022-44795
Published: 2022-11-07
Description: An issue was discovered in Object First Ootbi BETA build 1.0.7.712. A flaw was found in the Web Service, which could lead to local information disclosure. The command that creates the URL for the support bundle uses an insecure RNG. That can lead to prediction of the generated URL. As a result, an attacker can get access to system logs. An attacker would need credentials to exploit this vulnerability. This is fixed in Object First Ootbi BETA build 1.0.13.1611. Important note - This vulnerability is related to the Object First Ootbi BETA version, which is not released for production and therefore has no impact on the production environment. The production-ready Object First Ootbi version will have this vulnerability fixed.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-330, CWE-330
References: https://objectfirst.com/security/of-20[PII_REDACTED]/; https://objectfirst.com/security/of-20[PII_REDACTED]/
CVE: CVE-2022-44796
Published: 2022-11-07
Description: An issue was discovered in Object First Ootbi BETA build 1.0.7.712. The authorization service has a flow that allows getting access to the Web UI without knowing credentials. For signing, the JWT token uses a secret key that is generated through a function that doesn't produce cryptographically strong sequences. An attacker can predict these sequences and generate a JWT token. As a result, an attacker can get access to the Web UI. This is fixed in Object First Ootbi BETA build 1.0.13.1611.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-338, CWE-338
References: https://objectfirst.com/security/of-20[PII_REDACTED]/; https://objectfirst.com/security/of-20[PII_REDACTED]/
CVE: CVE-2022-44797
Published: 2022-11-07
Description: btcd before 0.23.2, as used in Lightning Labs lnd before 0.15.2-beta and other Bitcoin-related products, mishandles witness size checking.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/btcsuite/btcd/pull/1896; https://github.com/btcsuite/btcd/releases/tag/v0.23.2; https://github.com/lightningnetwork/lnd/issues/7002
CVE: CVE-2020-12509
Published: 2022-11-07
Description: In s::can moni::tools in versions below 4.2 an unauthenticated attacker could get any file from the device by path traversal in the camera-file module.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://www.s-can.at/en/the-new-monitool-v4-2-security-first/; https://www.s-can.at/en/the-new-monitool-v4-2-security-first/
CVE: CVE-2022-2387
Published: 2022-11-07
Description: The Easy Digital Downloads WordPress plugin before 3.0 does not have CSRF check in place when deleting payment history, and does not ensure that the post to be deleted is actually a payment history. As a result, attackers could make a logged in admin delete arbitrary post via a CSRF attack
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/db3c3c78-1724-4791-9ab6-ebb2e8a4c8b8; https://wpscan.com/vulnerability/db3c3c78-1724-4791-9ab6-ebb2e8a4c8b8
CVE: CVE-2022-2711
Published: 2022-11-07
Description: The Import any XML or CSV File to WordPress plugin before 3.6.9 is not validating the paths of files contained in uploaded zip archives, allowing highly privileged users, such as admins, to write arbitrary files to any part of the file system accessible by the web server via a path traversal vector.
CVSS Score: 7.2 (HIGH)
CWE: CWE-22
References: https://wpscan.com/vulnerability/11e73c23-ff5f-42e5-a4b0-0971652dcea1; https://wpscan.com/vulnerability/11e73c23-ff5f-42e5-a4b0-0971652dcea1
CVE: CVE-2022-3418
Published: 2022-11-07
Description: The Import any XML or CSV File to WordPress plugin before 3.6.9 is not properly filtering which file extensions are allowed to be imported on the server, which could allow administrators in multi-site WordPress installations to upload arbitrary files
CVSS Score: 7.2 (HIGH)
CWE: CWE-94, CWE-94
References: https://wpscan.com/vulnerability/ccbb74f5-1b8f-4ea6-96bc-ddf62af7f94d; https://wpscan.com/vulnerability/ccbb74f5-1b8f-4ea6-96bc-ddf62af7f94d
CVE: CVE-2022-3451
Published: 2022-11-07
Description: The Product Stock Manager WordPress plugin before 1.0.5 does not have authorisation and proper CSRF checks in multiple AJAX actions, allowing users with a role as low as subscriber to call them. One action in particular could allow to update arbitrary options
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-862, CWE-352, CWE-862
References: https://wpscan.com/vulnerability/d8005cd0-8232-4d43-a4e4-14728eaf1300; https://wpscan.com/vulnerability/d8005cd0-8232-4d43-a4e4-14728eaf1300
CVE: CVE-2022-3462
Published: 2022-11-07
Description: The Highlight Focus WordPress plugin through 1.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://wpscan.com/vulnerability/b583de48-1332-4984-8c0c-a7ed4a2397cd; https://wpscan.com/vulnerability/b583de48-1332-4984-8c0c-a7ed4a2397cd
CVE: CVE-2022-3463
Published: 2022-11-07
Description: The Contact Form Plugin WordPress plugin before 4.3.13 does not validate and escape fields when exporting form entries as CSV, leading to a CSV injection
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1236
References: https://wpscan.com/vulnerability/e2a59481-db45-4b8e-b17a[PII_REDACTED]64; https://wpscan.com/vulnerability/e2a59481-db45-4b8e-b17a[PII_REDACTED]64
CVE: CVE-2022-3481
Published: 2022-11-07
Description: The WooCommerce Dropshipping WordPress plugin before 4.4 does not properly sanitise and escape a parameter before using it in a SQL statement via a REST endpoint available to unauthenticated users, leading to a SQL injection
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://wpscan.com/vulnerability/c5e395f8-257e-49eb-afbd-9c1e26045373; https://wpscan.com/vulnerability/c5e395f8-257e-49eb-afbd-9c1e26045373
CVE: CVE-2022-3489
Published: 2022-11-07
Description: The WP Hide WordPress plugin through 0.0.2 does not have authorisation and CSRF checks in place when updating the custom_wpadmin_slug settings, allowing unauthenticated attackers to update it with a crafted request
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-352, CWE-862, CWE-352, CWE-862
References: https://wpscan.com/vulnerability/36d78b6c-0da5-44f8-b7b3-eae78edac505; https://wpscan.com/vulnerability/36d78b6c-0da5-44f8-b7b3-eae78edac505
CVE: CVE-2022-3494
Published: 2022-11-07
Description: The Complianz WordPress plugin before 6.3.4, and Complianz Premium WordPress plugin before 6.3.6 allow a translators to inject arbitrary SQL through an unsanitized translation. SQL can be injected through an infected translation file, or by a user with a translator role through translation plugins such as Loco Translate or WPML.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://wpscan.com/vulnerability/71db75c0-5907-4237-884f-8db88b1a9b34; https://wpscan.com/vulnerability/71db75c0-5907-4237-884f-8db88b1a9b34
CVE: CVE-2022-3536
Published: 2022-11-07
Description: The Role Based Pricing for WooCommerce WordPress plugin before 1.6.3 does not have authorisation and proper CSRF checks, as well as does not validate path given via user input, allowing any authenticated users like subscriber to perform PHAR deserialization attacks when they can upload a file, and a suitable gadget chain is present on the blog
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-502
References: https://wpscan.com/vulnerability/6af63aab-b7a6-4ef6-8604-4b4b99467a34; https://wpscan.com/vulnerability/6af63aab-b7a6-4ef6-8604-4b4b99467a34
CVE: CVE-2022-3537
Published: 2022-11-07
Description: The Role Based Pricing for WooCommerce WordPress plugin before 1.6.2 does not have authorisation and proper CSRF checks, and does not validate files to be uploaded, allowing any authenticated users like subscriber to upload arbitrary files, such as PHP
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-434
References: https://wpscan.com/vulnerability/696868f7-409d-422d-87f4-92fc6bf6e74e; https://wpscan.com/vulnerability/696868f7-409d-422d-87f4-92fc6bf6e74e
CVE: CVE-2022-3558
Published: 2022-11-07
Description: The Import and export users and customers WordPress plugin before 1.20.5 does not properly escape data when exporting it via CSV files.
CVSS Score: 8.0 (HIGH)
CWE: CWE-1236
References: https://plugins.trac.wordpress.org/changeset?new=2798139%40import-users-from-csv-with-meta&old=2785785%40import-users-from-csv-with-meta; https://wpscan.com/vulnerability/e3d72e04-9cdf-4b7d-953e-876e26abdfc6; https://plugins.trac.wordpress.org/changeset?new=2798139%40import-users-from-csv-with-meta&old=2785785%40import-users-from-csv-with-meta
CVE: CVE-2022-37865
Published: 2022-11-07
Description: With Apache Ivy 2.4.0 an optional packaging attribute has been introduced that allows artifacts to be unpacked on the fly if they used pack200 or zip packaging. For artifacts using the "zip", "jar" or "war" packaging Ivy prior to 2.5.1 doesn't verify the target path when extracting the archive. An archive containing absolute paths or paths that try to traverse "upwards" using ".." sequences can then write files to any location on the local fie system that the user executing Ivy has write access to. Ivy users of version 2.4.0 to 2.5.0 should upgrade to Ivy 2.5.1.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-22, CWE-22
References: https://lists.apache.org/thread/gqvvv7qsm2dfjg6xzsw1s2h08tbr0sdy; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YDIFDL5WSBEKBUVKTABUFDDD25SBNJLS/; https://lists.apache.org/thread/gqvvv7qsm2dfjg6xzsw1s2h08tbr0sdy
CVE: CVE-2022-3873
Published: 2022-11-07
Description: Cross-site Scripting (XSS) - DOM in GitHub repository jgraph/drawio prior to 20.5.2.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/jgraph/drawio/commit/d37894baf125430e85840c2635563b10d1a6523d; https://huntr.dev/bounties/52a4085e-b687-489b-9ed6-f0987583ed77; https://github.com/jgraph/drawio/commit/d37894baf125430e85840c2635563b10d1a6523d
CVE: CVE-2022-2188
Published: 2022-11-07
Description: Privilege escalation vulnerability in DXL Broker for Windows prior to 6.0.0.280 allows local users to gain elevated privileges by exploiting weak directory controls in the logs directory. This can lead to a denial-of-service attack on the DXL Broker.

CVSS Score: 6.5 (MEDIUM)
CWE: CWE-732
References: https://kcm.trellix.com/corporate/index?page=content&id=SB10383; https://kcm.trellix.com/corporate/index?page=content&id=SB10383
CVE: CVE-2022-42920
Published: 2022-11-07
Description: Apache Commons BCEL has a number of APIs that would normally only allow changing specific class characteristics. However, due to an out-of-bounds writing issue, these APIs can be used to produce arbitrary bytecode. This could be abused in applications that pass attacker-controllable data to those APIs, giving the attacker more control over the resulting bytecode than otherwise expected. Update to Apache Commons BCEL 6.6.0.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: http://www.openwall.com/lists/oss-security/2022/11/07/2; https://lists.apache.org/thread/lfxk7q8qmnh5bt9jm6nmjlv5hsxjhrz4; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LX3HEB4TV2BVCGDTK5BCLSYOZNQTOBN4/
CVE: CVE-2022-42955
Published: 2022-11-07
Description: The PassWork extension 5.0.9 for Chrome and other browsers allows an attacker to obtain cleartext cached credentials.
CVSS Score: 7.5 (HIGH)
CWE: CWE-312, CWE-312
References: https://chrome.google.com/webstore/detail/passwork-self-hosted/ibiipnmmlnehmeonnhbdajcfagcgihkl; https://passwork.canny.io/changelog/version-5110; https://chrome.google.com/webstore/detail/passwork-self-hosted/ibiipnmmlnehmeonnhbdajcfagcgihkl
CVE: CVE-2022-42956
Published: 2022-11-07
Description: The PassWork extension 5.0.9 for Chrome and other browsers allows an attacker to obtain the cleartext master password.
CVSS Score: 7.5 (HIGH)
CWE: CWE-312, CWE-312
References: https://chrome.google.com/webstore/detail/passwork-self-hosted/ibiipnmmlnehmeonnhbdajcfagcgihkl; https://passwork.canny.io/changelog/version-5110; https://chrome.google.com/webstore/detail/passwork-self-hosted/ibiipnmmlnehmeonnhbdajcfagcgihkl