deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-3716
Published: 2022-03-02
Description: A flaw was found in nbdkit due to to improperly caching plaintext state across the STARTTLS encryption boundary. A MitM attacker could use this flaw to inject a plaintext NBD_OPT_STRUCTURED_REPLY before proxying everything else a client sends to the server, potentially leading the client to terminate the NBD session. The highest threat from this vulnerability is to system availability.
CVSS Score: 3.1 (LOW)
CWE: CWE-924
References: https://bugzilla.redhat.com/show_bug.cgi?id=1994695; https://gitlab.com/nbdkit/nbdkit/-/commit/09a13dafb7bb3a38ab52eb5501cba786365ba7fd; https://gitlab.com/nbdkit/nbdkit/-/commit/6c5faac6a37077cf2366388a80862bb00616d0d8
CVE: CVE-2021-3738
Published: 2022-03-02
Description: In DCE/RPC it is possible to share the handles (cookies for resource state) between multiple connections via a mechanism called 'association groups'. These handles can reference connections to our sam.ldb database. However while the database was correctly shared, the user credentials state was only pointed at, and when one connection within that association group ended, the database would be left pointing at an invalid 'struct session_info'. The most likely outcome here is a crash, but it is possible that the use-after-free could instead allow different user state to be pointed at and this might allow more privileged access.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://bugzilla.redhat.com/show_bug.cgi?id=2021726; https://bugzilla.samba.org/show_bug.cgi?id=14468; https://security.gentoo.org/glsa/202309-06
CVE: CVE-2021-3772
Published: 2022-03-02
Description: A flaw was found in the Linux SCTP stack. A blind attacker may be able to kill an existing SCTP association through invalid chunks if the attacker knows the IP-addresses and port numbers being used and the attacker can send packets with spoofed IP addresses.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-354, CWE-354
References: https://bugzilla.redhat.com/show_bug.cgi?id=2000694; https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=32f8807a48ae55be0e76880cfe8607a18b5bb0df; https://github.com/torvalds/linux/commit/32f8807a48ae55be0e76880cfe8607a18b5bb0df
CVE: CVE-2021-4076
Published: 2022-03-02
Description: A flaw exists in tang, a network-based cryptographic binding server, which could result in leak of private keys.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://bugzilla.redhat.com/show_bug.cgi?id=2029814; https://github.com/latchset/tang/commit/e82459fda10f0630c3414ed2afbc6320bb9ea7c9; https://github.com/latchset/tang/pull/81
CVE: CVE-2022-24722
Published: 2022-03-02
Description: VIewComponent is a framework for building view components in Ruby on Rails. Versions prior to 2.31.2 and 2.49.1 contain a cross-site scripting vulnerability that has the potential to impact anyone using translations with the view_component gem. Data received via user input and passed as an interpolation argument to the `translate` method is not properly sanitized before display. Versions 2.31.2 and 2.49.1 have been released and fully mitigate the vulnerability. As a workaround, avoid passing user input to the `translate` function, or sanitize the inputs before passing them.
CVSS Score: 8.1 (HIGH)
CWE: CWE-79, CWE-79
References: https://github.com/github/view_component/commit/3f82a6e62578ff6f361aba24a1feb2caccf83ff9; https://github.com/github/view_component/releases/tag/v2.31.2; https://github.com/github/view_component/releases/tag/v2.49.1
CVE: CVE-2022-25114
Published: 2022-03-02
Description: Event Management v1.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the full_name parameter under register.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/PuneethReddyHC/event-management-1.0; https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/PuneethReddyHC/event-management-1.0
CVE: CVE-2022-25115
Published: 2022-03-02
Description: A remote code execution (RCE) vulnerability in the Avatar parameter under /admin/?page=user/manage_user of Home Owners Collection Management System v1.0 allows attackers to execute arbitrary code via a crafted PNG file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-434
References: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/2022/Home-Owners-Collection-Management; https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/2022/Home-Owners-Collection-Management
CVE: CVE-2022-25393
Published: 2022-03-02
Description: Simple Bakery Shop Management v1.0 was discovered to contain a SQL injection vulnerability via the username parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/2022/Simple-Bakery-Shop-Management; https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/2022/Simple-Bakery-Shop-Management
CVE: CVE-2022-25394
Published: 2022-03-02
Description: Medical Store Management System v1.0 was discovered to contain a SQL injection vulnerability via the cid parameter under customer-add.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/abhisheks008/2022/Medical-Store-Management-System; https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/abhisheks008/2022/Medical-Store-Management-System
CVE: CVE-2022-25395
Published: 2022-03-02
Description: Cosmetics and Beauty Product Online Store v1.0 was discovered to contain multiple reflected cross-site scripting (XSS) attacks via the search parameter under the /cbpos/ app.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-79
References: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/2022/Cosmetics-and-Beauty-Product-Online-Store; https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/2022/Cosmetics-and-Beauty-Product-Online-Store
CVE: CVE-2022-25396
Published: 2022-03-02
Description: Cosmetics and Beauty Product Online Store v1.0 was discovered to contain a SQL injection vulnerability via the search parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/2022/Cosmetics-and-Beauty-Product-Online-Store/SQL-Injection; https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/2022/Cosmetics-and-Beauty-Product-Online-Store/SQL-Injection
CVE: CVE-2022-25398
Published: 2022-03-02
Description: Auto Spare Parts Management v1.0 was discovered to contain a SQL injection vulnerability via the user parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/pavanpatil45/Auto-Spare-Parts-Management; https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/pavanpatil45/Auto-Spare-Parts-Management
CVE: CVE-2022-25399
Published: 2022-03-02
Description: Simple Real Estate Portal System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/2022/Simple-Real-Estate-Portal-System; https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/2022/Simple-Real-Estate-Portal-System
CVE: CVE-2022-26169
Published: 2022-03-02
Description: Air Cargo Management System v1.0 was discovered to contain a SQL injection vulnerability via the ref_code parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/2022/Air-Cargo-Management-System; https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/2022/Air-Cargo-Management-System
CVE: CVE-2022-26170
Published: 2022-03-02
Description: Simple Mobile Comparison Website v1.0 was discovered to contain a SQL injection vulnerability via the search parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/2022/Simple-Mobile-Comparison-Website; https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/2022/Simple-Mobile-Comparison-Website
CVE: CVE-2022-26171
Published: 2022-03-02
Description: Bank Management System v1.o was discovered to contain a SQL injection vulnerability via the email parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/campcodes.com/Bank-Management-System; https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/campcodes.com/Bank-Management-System
CVE: CVE-2021-38263
Published: 2022-03-03
Description: Cross-site scripting (XSS) vulnerability in the Server module's script console in Liferay Portal 7.3.2 and earlier, and Liferay DXP 7.0 before fix pack 101, 7.1 before fix pack 20 and 7.2 before fix pack 10 allows remote attackers to inject arbitrary web script or HTML via the output of a script.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://liferay.com; https://issues.liferay.com/browse/LPE-17061; https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2021-38263-reflected-xss-with-script-page
CVE: CVE-2021-38264
Published: 2022-03-03
Description: Cross-site scripting (XSS) vulnerability in the Frontend Taglib module in Liferay Portal 7.4.0 and 7.4.1 allows remote attackers to inject arbitrary web script or HTML into the management toolbar search via the `keywords` parameter. This issue is caused by an incomplete fix in CVE-2021-35463.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://liferay.com; https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2021-38264-reflected-xss-with-keywords-in-search; http://liferay.com
CVE: CVE-2021-38265
Published: 2022-03-03
Description: Cross-site scripting (XSS) vulnerability in the Asset module in Liferay Portal 7.3.4 through 7.3.6 allow remote attackers to inject arbitrary web script or HTML when creating a collection page via the _com_liferay_asset_list_web_portlet_AssetListPortlet_title parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://liferay.com; https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2021-38265-stored-xss-with-collection-name; http://liferay.com
CVE: CVE-2021-38267
Published: 2022-03-03
Description: Cross-site scripting (XSS) vulnerability in the Blogs module's edit blog entry page in Liferay Portal 7.3.2 through 7.3.6, and Liferay DXP 7.3 before fix pack 2 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_blogs_web_portlet_BlogsAdminPortlet_title and _com_liferay_blogs_web_portlet_BlogsAdminPortlet_subtitle parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://liferay.com; https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2021-38267-stored-xss-with-title-and-subtitle-of-blog-entry; http://liferay.com
CVE: CVE-2021-38269
Published: 2022-03-03
Description: Cross-site scripting (XSS) vulnerability in the Gogo Shell module in Liferay Portal 7.1.0 through 7.3.6 and 7.4.0, and Liferay DXP 7.1 before fix pack 23, 7.2 before fix pack 13, and 7.3 before fix pack 2 allows remote attackers to inject arbitrary web script or HTML via the output of a Gogo Shell command.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://liferay.com; https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2021-38269-stored-xss-with-gogo-shell-output; http://liferay.com
CVE: CVE-2021-44335
Published: 2022-03-03
Description: David Brackeen ok-file-formats 203defd is vulnerable to Buffer Overflow. When the function of the ok-file-formats project is used, a heap-buffer-overflow occurs in function ok_png_transform_scanline() in "/ok_png.c:533".
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/brackeen/ok-file-formats/issues/17; https://github.com/brackeen/ok-file-formats/issues/17
CVE: CVE-2021-44343
Published: 2022-03-03
Description: David Brackeen ok-file-formats 203defd is vulnerable to Buffer Overflow. When the function of the ok-file-formats project is used, a heap-buffer-overflow occurred in function ok_png_read_data() in "/ok_png.c".
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://github.com/brackeen/ok-file-formats/issues/18; https://github.com/brackeen/ok-file-formats/issues/18
CVE: CVE-2022-22909
Published: 2022-03-03
Description: HotelDruid v3.0.3 was discovered to contain a remote code execution (RCE) vulnerability which is exploited via an attacker inserting a crafted payload into the name field under the Create New Room module.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: https://github.com/0z09e/CVE-2022-22909; https://www.hoteldruid.com; https://github.com/0z09e/CVE-2022-22909
CVE: CVE-2022-25089
Published: 2022-03-03
Description: Printix Secure Cloud Print Management through 1.3.1106.0 incorrectly uses Privileged APIs to modify values in HKEY_LOCAL_MACHINE via UITasks.PersistentRegistryData.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-269
References: http://packetstormsecurity.com/files/167013/Printix-1.3.1106.0-Privileged-API-Abuse.html; http://printix.com; https://github.com/ComparedArray/printix-CVE-2022-25089
CVE: CVE-2022-25146
Published: 2022-03-03
Description: The Remote App module in Liferay Portal Liferay Portal v7.4.3.4 through v7.4.3.8 and Liferay DXP 7.4 before update 5 does not check if the origin of event messages it receives matches the origin of the Remote App, allowing attackers to exfiltrate the CSRF token via a crafted event message.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-346
References: http://liferay.com; https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-25146-csrf-token-exfiltration-via-remote-apps; https://www.securitum.pl
CVE: CVE-2022-25471
Published: 2022-03-03
Description: An Insecure Direct Object Reference (IDOR) vulnerability in OpenEMR 6.0.0 allows any authenticated attacker to access and modify unauthorized areas via a crafted POST request to /modules/zend_modules/public/Installer/register.
CVSS Score: 8.1 (HIGH)
CWE: CWE-639
References: https://github.com/openemr/openemr; https://securityforeveryone.com/blog/inactive-post-test/openemr-0-day-idor-vulnerability; https://www.open-emr.org/
CVE: CVE-2022-24563
Published: 2022-03-03
Description: In Genixcms v1.1.11, a stored Cross-Site Scripting (XSS) vulnerability exists in /gxadmin/index.php?page=themes&view=options" via the intro_title and intro_image parameters.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://genix.me/; https://github.com/truonghuuphuc/CVE; https://github.com/truonghuuphuc/CVE/blob/main/CVE-2022-24563.pdf
CVE: CVE-2022-24573
Published: 2022-03-03
Description: A stored cross-site scripting (XSS) vulnerability in the admin interface in Element-IT HTTP Commander 7.0.0 allows unauthenticated users to get admin access by injecting a malicious script in the User-Agent field.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://element-it.com; https://www.element-it.com/news.aspx; http://element-it.com
CVE: CVE-2021-42950
Published: 2022-03-03
Description: Remote Code Execution (RCE) vulnerability exists in Zepl Notebooks all previous versions before October 25 2021. Users can register for an account and are allocated a set number of credits to try the product. Once users authenticate, they can proceed to create a new organization by which additional users can be added for various collaboration abilities, which allows malicious user to create new Zepl Notebooks with various languages, contexts, and deployment scenarios. Upon creating a new notebook with specially crafted malicious code, a user can then launch remote code execution.
CVSS Score: 8.8 (HIGH)
References: http://zepl.com; https://seclists.org/fulldisclosure/2022/Feb/31; http://zepl.com
CVE: CVE-2022-23849
Published: 2022-03-03
Description: The biometric lock in Devolutions Password Hub for iOS before 2021.3.4 allows attackers to access the application because of authentication bypass. An attacker must rapidly make failed biometric authentication attempts.
CVSS Score: 6.6 (MEDIUM)
References: https://devolutions.net/security/advisories/; https://devolutions.net/security/advisories/DEVO-2022-0001; https://devolutions.net/security/advisories/
CVE: CVE-2022-0528
Published: 2022-03-03
Description: Server-Side Request Forgery (SSRF) in GitHub repository transloadit/uppy prior to 3.3.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-918, CWE-918
References: https://github.com/transloadit/uppy/commit/267c34045a1e62c98406d8c31261c604a11e544a; https://huntr.dev/bounties/8b060cc3-2420-468e-8293-b[PII_REDACTED]b; https://github.com/transloadit/uppy/commit/267c34045a1e62c98406d8c31261c604a11e544a
CVE: CVE-2021-40635
Published: 2022-03-03
Description: OS4ED openSIS 8.0 is affected by SQL injection in ChooseCpSearch.php, ChooseRequestSearch.php. An attacker can inject a SQL query to extract information from the database.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://github.com/OS4ED/openSIS-Classic/issues/195; https://github.com/OS4ED/openSIS-Classic/issues/195
CVE: CVE-2021-40636
Published: 2022-03-03
Description: OS4ED openSIS 8.0 is affected by SQL Injection in CheckDuplicateName.php, which can extract information from the database.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://github.com/OS4ED/openSIS-Classic/issues/198; https://github.com/OS4ED/openSIS-Classic/issues/198
CVE: CVE-2022-23648
Published: 2022-03-03
Description: containerd is a container runtime available as a daemon for Linux and Windows. A bug was found in containerd prior to versions 1.6.1, 1.5.10, and 1.14.12 where containers launched through containerd’s CRI implementation on Linux with a specially-crafted image configuration could gain access to read-only copies of arbitrary files and directories on the host. This may bypass any policy-based enforcement on container setup (including a Kubernetes Pod Security Policy) and expose potentially sensitive information. Kubernetes and crictl can both be configured to use containerd’s CRI implementation. This bug has been fixed in containerd 1.6.1, 1.5.10, and 1.4.12. Users should update to these versions to resolve the issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://packetstormsecurity.com/files/166421/containerd-Image-Volume-Insecure-Handling.html; https://github.com/containerd/containerd/commit/10f428dac7cec44c864e1b830a4623af27a9fc70; https://github.com/containerd/containerd/releases/tag/v1.4.13
CVE: CVE-2021-40637
Published: 2022-03-03
Description: OS4ED openSIS 8.0 is affected by cross-site scripting (XSS) in EmailCheckOthers.php. An attacker can inject JavaScript code to get the user's cookie and take over the working session of user.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/OS4ED/openSIS-Classic/issues/199; https://github.com/OS4ED/openSIS-Classic/issues/199
CVE: CVE-2021-43774
Published: 2022-03-03
Description: A risky-algorithm issue was discovered on Fujifilm DocuCentre-VI C4471 1.8 devices. An attacker that obtained access to the administrative web interface of a printer (e.g., by using the default credentials) can download the address book file, which contains the list of users (domain users, FTP users, etc.) stored on the printer, together with their encrypted passwords. The passwords are protected by a weak cipher, such as ROT13, which requires minimal effort to instantly retrieve the original password, giving the attacker a list of valid domain or FTP usernames and passwords.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-327
References: https://www.foregenix.com/blog; https://www.foregenix.com/blogs-new-2021/dude-its-just-a-printer; https://www.fujifilm.com/fbglobal/eng/company/news/notice/2022/0302_addressbook_announce.html
CVE: CVE-2021-45819
Published: 2022-03-03
Description: Wordline HIDCCEMonitorSVC before v5.2.4.3 contains an unquoted service path which allows attackers to escalate privileges to the system level.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-428
References: https://hansesecure.de/2021/12/vulnerability-wordline/?lang=en; https://hansesecure.de/2021/12/vulnerability-wordline/?lang=en
CVE: CVE-2022-22706
Published: 2022-03-03
Description: Arm Mali GPU Kernel Driver allows a non-privileged user to achieve write access to read-only memory pages. This affects Midgard r26p0 through r31p0, Bifrost r0p0 through r35p0, and Valhall r19p0 through r35p0.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-119
References: https://developer.arm.com/support/arm-security-updates; https://developer.arm.com/support/arm-security-updates/mali-gpu-kernel-driver; https://developer.arm.com/support/arm-security-updates
CVE: CVE-2022-25031
Published: 2022-03-03
Description: Remote Desktop Commander Suite Agent before v4.8 contains an unquoted service path which allows attackers to escalate privileges to the system level.
CVSS Score: 7.8 (HIGH)
CWE: CWE-428
References: https://hansesecure.de/2022/02/vulnerability-in-remote-desktop-commander-suite-agent/?lang=en; https://www.rdpsoft.com/uqspvuln/; https://hansesecure.de/2022/02/vulnerability-in-remote-desktop-commander-suite-agent/?lang=en
CVE: CVE-2022-0753
Published: 2022-03-03
Description: Cross-site Scripting (XSS) - Reflected in GitHub repository hestiacp/hestiacp prior to 1.5.9.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/hestiacp/hestiacp/commit/ee10e[PII_REDACTED]fc9a2d32169d0da702cea5ad2; https://huntr.dev/bounties/8ce4b776-1c53-45ec-bc5f-783077e2d324; https://github.com/hestiacp/hestiacp/commit/ee10e[PII_REDACTED]fc9a2d32169d0da702cea5ad2
CVE: CVE-2022-0841
Published: 2022-03-03
Description: OS Command Injection in GitHub repository ljharb/npm-lockfile in v2.0.3 and v2.0.4.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://github.com/ljharb/npm-lockfile/commit/bfdb84813260f0edbf759f2fde1e8c816c1478b8; https://huntr.dev/bounties/4f806dc9-2ecd-4e79-997e-5292f1bea9f1; https://github.com/ljharb/npm-lockfile/commit/bfdb84813260f0edbf759f2fde1e8c816c1478b8
CVE: CVE-2022-25138
Published: 2022-03-03
Description: Axelor Open Suite v5.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Name parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://forum.axelor.com/t/vuln-sur-axelor-je-suis-gentil/4768; https://github.com/ArianeBlow/Axelor_Stored_XSS/blob/main/README.md; https://forum.axelor.com/t/vuln-sur-axelor-je-suis-gentil/4768
CVE: CVE-2022-26125
Published: 2022-03-03
Description: Buffer overflow vulnerabilities exist in FRRouting through 8.1.0 due to wrong checks on the input packet length in isisd/isis_tlvs.c.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-1284
References: https://github.com/FRRouting/frr/issues/10507; https://lists.debian.org/debian-lts-announce/2024/04/msg00019.html; https://github.com/FRRouting/frr/issues/10507
CVE: CVE-2022-26126
Published: 2022-03-03
Description: Buffer overflow vulnerabilities exist in FRRouting through 8.1.0 due to the use of strdup with a non-zero-terminated binary string in isis_nb_notifications.c.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-119
References: https://github.com/FRRouting/frr/issues/10505; https://lists.debian.org/debian-lts-announce/2024/04/msg00019.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MIEQNIWUSBQTFR65HM2LLIB7PH27CZUZ/
CVE: CVE-2022-26127
Published: 2022-03-03
Description: A buffer overflow vulnerability exists in FRRouting through 8.1.0 due to missing a check on the input packet length in the babel_packet_examin function in babeld/message.c.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-1284
References: https://github.com/FRRouting/frr/issues/10487; https://lists.debian.org/debian-lts-announce/2024/04/msg00019.html; https://github.com/FRRouting/frr/issues/10487