deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2015-10019
Published: 2023-01-07
Description: A vulnerability, which was classified as problematic, has been found in foxoverflow MySimplifiedSQL. This issue affects some unknown processing of the file MySimplifiedSQL_Examples.php. The manipulation of the argument FirstName/LastName leads to cross site scripting. The attack may be initiated remotely. The patch is named 3b7481c72786f88041b7c2d83bb4f219f77f1293. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217595.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/foxoverflow/MySimplifiedSQL/commit/3b7481c72786f88041b7c2d83bb4f219f77f1293; https://vuldb.com/?ctiid.217595; https://vuldb.com/?id.217595
CVE: CVE-2018-25069
Published: 2023-01-07
Description: A vulnerability classified as critical has been found in Netis Netcore Router. This affects an unknown part. The manipulation leads to use of hard-coded password. It is possible to initiate the attack remotely. The identifier VDB-217593 was assigned to this vulnerability.
CVSS Score: 7.3 (HIGH)
CWE: CWE-259
References: https://advisories.checkpoint.com/advisory/cpai-2018-0721/; https://vuldb.com/?ctiid.217593; https://vuldb.com/?id.217593
CVE: CVE-2023-0113
Published: 2023-01-07
Description: A vulnerability was found in Netis Netcore Router up to 2.2.6. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file param.file.tgz of the component Backup Handler. The manipulation leads to information disclosure. The attack can be launched remotely. The associated identifier of this vulnerability is VDB-217591.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://vuldb.com/?ctiid.217591; https://vuldb.com/?id.217591; https://vuldb.com/?ctiid.217591
CVE: CVE-2023-0114
Published: 2023-01-07
Description: A vulnerability was found in Netis Netcore Router. It has been rated as problematic. Affected by this issue is some unknown functionality of the file param.file.tgz of the component Backup Handler. The manipulation leads to cleartext storage in a file or on disk. Local access is required to approach this attack. The identifier of this vulnerability is VDB-217592.
CVSS Score: 3.3 (LOW)
CWE: CWE-313
References: https://vuldb.com/?ctiid.217592; https://vuldb.com/?id.217592; https://vuldb.com/?ctiid.217592
CVE: CVE-2014-125056
Published: 2023-01-07
Description: A vulnerability was found in Pylons horus and classified as problematic. Affected by this issue is some unknown functionality of the file horus/flows/local/services.py. The manipulation leads to observable timing discrepancy. The complexity of an attack is rather high. The exploitation is known to be difficult. The patch is identified as fd56ccb62ce3cbdab0484fe4f9c25c4eda6c57ec. It is recommended to apply a patch to fix this issue. VDB-217598 is the identifier assigned to this vulnerability.
CVSS Score: 2.6 (LOW)
CWE: CWE-208
References: https://github.com/Pylons/horus/commit/fd56ccb62ce3cbdab0484fe4f9c25c4eda6c57ec; https://vuldb.com/?ctiid.217598; https://vuldb.com/?id.217598
CVE: CVE-2014-125057
Published: 2023-01-07
Description: A vulnerability was found in mrobit robitailletheknot. It has been classified as problematic. This affects an unknown part of the file app/filters.php of the component CSRF Token Handler. The manipulation of the argument _token leads to incorrect comparison. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The patch is named 6b2813696ccb88d0576dfb305122ee880eb36197. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217599.
CVSS Score: 3.1 (LOW)
CWE: CWE-697, CWE-697
References: https://github.com/mrobit/robitailletheknot/commit/6b2813696ccb88d0576dfb305122ee880eb36197; https://vuldb.com/?ctiid.217599; https://vuldb.com/?id.217599
CVE: CVE-2020-36644
Published: 2023-01-07
Description: A vulnerability has been found in jamesmartin Inline SVG up to 1.7.1 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file lib/inline_svg/action_view/helpers.rb of the component URL Parameter Handler. The manipulation of the argument filename leads to cross site scripting. The attack can be launched remotely. Upgrading to version 1.7.2 is able to address this issue. The identifier of the patch is f5363b[PII_REDACTED]21f99e083c92068cf2943621. It is recommended to upgrade the affected component. The identifier VDB-217597 was assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/jamesmartin/inline_svg/commit/f5363b[PII_REDACTED]21f99e083c92068cf2943621; https://github.com/jamesmartin/inline_svg/pull/117; https://github.com/jamesmartin/inline_svg/releases/tag/v1.7.2
CVE: CVE-2014-125058
Published: 2023-01-07
Description: A vulnerability was found in LearnMeSomeCodes project3 and classified as critical. This issue affects the function search_first_name of the file search.rb. The manipulation leads to sql injection. The patch is named d3efa17ae9f6b2fc25a6bbcf165cefed17c7035e. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217607. NOTE: Maintainer is aware of this issue as remarked in the source code.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/LearnMeSomeCodes/project3/commit/d3efa17ae9f6b2fc25a6bbcf165cefed17c7035e; https://vuldb.com/?ctiid.217607; https://vuldb.com/?id.217607
CVE: CVE-2018-25070
Published: 2023-01-07
Description: A vulnerability has been found in polterguy Phosphorus Five up to 8.2 and classified as critical. This vulnerability affects the function csv.Read of the file plugins/extras/p5.mysql/NonQuery.cs of the component CSV Import. The manipulation leads to sql injection. Upgrading to version 8.3 is able to address this issue. The patch is identified as c179a3d0703db55cfe0cb939b89593f2e7a87246. It is recommended to upgrade the affected component. VDB-217606 is the identifier assigned to this vulnerability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://github.com/polterguy/phosphorusfive/commit/c179a3d0703db55cfe0cb939b89593f2e7a87246; https://github.com/polterguy/phosphorusfive/releases/tag/v8.3; https://vuldb.com/?ctiid.217606
CVE: CVE-2015-10021
Published: 2023-01-07
Description: A vulnerability was found in ritterim definely. It has been classified as problematic. Affected is an unknown function of the file src/database.js. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The name of the patch is b31a022ba4d8d17148445a13ebb5a42ad593dbaa. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-217608.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/ritterim/definely/commit/b31a022ba4d8d17148445a13ebb5a42ad593dbaa; https://github.com/ritterim/definely/pull/51; https://vuldb.com/?ctiid.217608
CVE: CVE-2015-10022
Published: 2023-01-07
Description: A vulnerability was found in IISH nlgis2. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file scripts/etl/custom_import.pl. The manipulation leads to sql injection. The identifier of the patch is 8bdb6fcf7209584eaf1232437f0f53e735b2b34c. It is recommended to apply a patch to fix this issue. The identifier VDB-217609 was assigned to this vulnerability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/IISH/nlgis2/commit/8bdb6fcf7209584eaf1232437f0f53e735b2b34c; https://vuldb.com/?ctiid.217609; https://vuldb.com/?id.217609
CVE: CVE-2015-10023
Published: 2023-01-07
Description: A vulnerability classified as critical has been found in Fumon trello-octometric. This affects the function main of the file metrics-ui/server/srv.go. The manipulation of the argument num leads to sql injection. The patch is named a1f1754933fbf21e2221fbc671c81a47de6a04ef. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217611.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/Fumon/trello-octometric/commit/a1f1754933fbf21e2221fbc671c81a47de6a04ef; https://vuldb.com/?ctiid.217611; https://vuldb.com/?id.217611
CVE: CVE-2018-25071
Published: 2023-01-07
Description: A vulnerability was found in roxlukas LMeve up to 0.1.58. It has been rated as critical. Affected by this issue is the function insert_log of the file wwwroot/ccpwgl/proxy.php. The manipulation of the argument fetch leads to sql injection. Upgrading to version 0.1.59-beta is able to address this issue. The patch is identified as c25ff7fe83a2cda1fcb365b182365adc3ffae332. It is recommended to upgrade the affected component. VDB-217610 is the identifier assigned to this vulnerability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://github.com/roxlukas/lmeve/commit/c25ff7fe83a2cda1fcb365b182365adc3ffae332; https://github.com/roxlukas/lmeve/releases/tag/0.1.59-beta; https://vuldb.com/?ctiid.217610
CVE: CVE-2014-125059
Published: 2023-01-07
Description: A vulnerability, which was classified as problematic, has been found in sternenseemann sternenblog. This issue affects the function blog_index of the file main.c. The manipulation of the argument post_path leads to file inclusion. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. Upgrading to version 0.1.0 is able to address this issue. The identifier of the patch is cf715d911d8ce17969a7926dea651e930c27e71a. It is recommended to upgrade the affected component. The identifier VDB-217613 was assigned to this vulnerability. NOTE: This case is rather theoretical and probably won't happen. Maybe only on obscure Web servers.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-73
References: https://github.com/sternenseemann/sternenblog/commit/cf715d911d8ce17969a7926dea651e930c27e71a; https://github.com/sternenseemann/sternenblog/releases/tag/0.1.0; https://vuldb.com/?ctiid.217613
CVE: CVE-2014-125060
Published: 2023-01-07
Description: A vulnerability, which was classified as critical, was found in holdennb CollabCal. Affected is the function handleGet of the file calenderServer.cpp. The manipulation leads to improper authentication. It is possible to launch the attack remotely. The patch is identified as b80f6d1893607c99e[PII_REDACTED]417d0fe310ce6. It is recommended to apply a patch to fix this issue. VDB-217614 is the identifier assigned to this vulnerability.
CVSS Score: 7.3 (HIGH)
CWE: CWE-287
References: https://github.com/holdennb/CollabCal/commit/b80f6d1893607c99e[PII_REDACTED]417d0fe310ce6; https://vuldb.com/?ctiid.217614; https://vuldb.com/?id.217614
CVE: CVE-2014-125061
Published: 2023-01-07
Description: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in peel filebroker and classified as critical. Affected by this issue is the function select_transfer_status_desc of the file lib/common.rb. The manipulation leads to sql injection. The name of the patch is 91097e26a6c84d3208a351afaa52e0f62e5853ef. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-217616. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/peel/filebroker/commit/91097e26a6c84d3208a351afaa52e0f62e5853ef; https://vuldb.com/?ctiid.217616; https://vuldb.com/?id.217616
CVE: CVE-2015-10024
Published: 2023-01-07
Description: A vulnerability classified as critical was found in hoffie larasync. This vulnerability affects unknown code of the file repository/content/file_storage.go. The manipulation leads to path traversal. The name of the patch is 776bad422f4bd4930d[PII_REDACTED]6bbeb1be9ba5. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-217612.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-22
References: https://github.com/hoffie/larasync/commit/776bad422f4bd4930d[PII_REDACTED]6bbeb1be9ba5; https://vuldb.com/?ctiid.217612; https://vuldb.com/?id.217612
CVE: CVE-2015-10025
Published: 2023-01-07
Description: A vulnerability has been found in luelista miniConf up to 1.7.6 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file miniConf/MessageView.cs of the component URL Scanning. The manipulation leads to denial of service. Upgrading to version 1.7.7 and 1.8.0 is able to address this issue. The patch is named c06c2e5116c306e4e1bc79779f0eda2d1182f655. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-217615.
CVSS Score: 3.5 (LOW)
CWE: CWE-404
References: https://github.com/luelista/miniConf/commit/c06c2e5116c306e4e1bc79779f0eda2d1182f655; https://vuldb.com/?ctiid.217615; https://vuldb.com/?id.217615
CVE: CVE-2015-10026
Published: 2023-01-07
Description: A vulnerability was found in tiredtyrant flairbot. It has been declared as critical. This vulnerability affects unknown code of the file flair.py. The manipulation leads to sql injection. The patch is identified as 5e112b68c6faad1d4699d02c1ebbb7daf48ef8fb. It is recommended to apply a patch to fix this issue. VDB-217618 is the identifier assigned to this vulnerability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/tiredtyrant/flairbot/commit/5e112b68c6faad1d4699d02c1ebbb7daf48ef8fb; https://vuldb.com/?ctiid.217618; https://vuldb.com/?id.217618
CVE: CVE-2016-15012
Published: 2023-01-07
Description: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in forcedotcom SalesforceMobileSDK-Windows up to 4.x. It has been rated as critical. This issue affects the function ComputeCountSql of the file SalesforceSDK/SmartStore/Store/QuerySpec.cs. The manipulation leads to sql injection. Upgrading to version 5.0.0 is able to address this issue. The patch is named 83b3e91e0c1e84873a6d3ca3c5887eb5b4f5a3d8. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-217619. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/forcedotcom/SalesforceMobileSDK-Windows/commit/83b3e91e0c1e84873a6d3ca3c5887eb5b4f5a3d8; https://github.com/forcedotcom/SalesforceMobileSDK-Windows/releases/tag/v5.0.0; https://vuldb.com/?ctiid.217619
CVE: CVE-2022-4880
Published: 2023-01-07
Description: A vulnerability was found in stakira OpenUtau. It has been classified as critical. This affects the function VoicebankInstaller of the file OpenUtau.Core/Classic/VoicebankInstaller.cs of the component ZIP Archive Handler. The manipulation leads to path traversal. Upgrading to version 0.0.991 is able to address this issue. The identifier of the patch is 849a0a6912aac8b1c28cc32aa1132a3140caff4a. It is recommended to upgrade the affected component. The identifier VDB-217617 was assigned to this vulnerability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://github.com/stakira/OpenUtau/commit/849a0a6912aac8b1c28cc32aa1132a3140caff4a; https://github.com/stakira/OpenUtau/pull/544; https://github.com/stakira/OpenUtau/releases/tag/build%2F0.0.991
CVE: CVE-2014-125062
Published: 2023-01-07
Description: A vulnerability classified as critical was found in ananich bitstorm. Affected by this vulnerability is an unknown functionality of the file announce.php. The manipulation of the argument event leads to sql injection. The identifier of the patch is ea8da92f94cdb78ee7831e1f7af6258473ab396a. It is recommended to apply a patch to fix this issue. The identifier VDB-217621 was assigned to this vulnerability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://github.com/ananich/bitstorm/commit/ea8da92f94cdb78ee7831e1f7af6258473ab396a; https://vuldb.com/?ctiid.217621; https://vuldb.com/?id.217621
CVE: CVE-2015-10027
Published: 2023-01-07
Description: A vulnerability, which was classified as problematic, has been found in hydrian TTRSS-Auth-LDAP. Affected by this issue is some unknown functionality of the component Username Handler. The manipulation leads to ldap injection. Upgrading to version 2.0b1 is able to address this issue. The patch is identified as a7f7a5a82d9202a5c40d606a5c519ba61b224eb8. It is recommended to upgrade the affected component. VDB-217622 is the identifier assigned to this vulnerability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-90, CWE-74
References: https://github.com/hydrian/TTRSS-Auth-LDAP/commit/a7f7a5a82d9202a5c40d606a5c519ba61b224eb8; https://github.com/hydrian/TTRSS-Auth-LDAP/pull/14; https://github.com/hydrian/TTRSS-Auth-LDAP/releases/tag/2.0b1
CVE: CVE-2021-4306
Published: 2023-01-07
Description: A vulnerability classified as problematic has been found in cronvel terminal-kit up to 2.1.7. Affected is an unknown function. The manipulation leads to inefficient regular expression complexity. Upgrading to version 2.1.8 is able to address this issue. The name of the patch is a2e446cc3927b559d0281683feb9b821e83b758c. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-217620.
CVSS Score: 3.5 (LOW)
CWE: CWE-1333
References: https://github.com/cronvel/terminal-kit/commit/a2e446cc3927b559d0281683feb9b821e83b758c; https://github.com/cronvel/terminal-kit/releases/tag/v2.1.8; https://vuldb.com/?ctiid.217620
CVE: CVE-2014-125063
Published: 2023-01-07
Description: A vulnerability was found in ada-l0velace Bid and classified as critical. This issue affects some unknown processing. The manipulation leads to sql injection. The identifier of the patch is abd71140b8219fa8741d0d8a57ab27d5bfd34222. It is recommended to apply a patch to fix this issue. The identifier VDB-217625 was assigned to this vulnerability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/ada-l0velace/Bid/commit/abd71140b8219fa8741d0d8a57ab27d5bfd34222; https://vuldb.com/?ctiid.217625; https://vuldb.com/?id.217625
CVE: CVE-2015-10028
Published: 2023-01-07
Description: A vulnerability has been found in ss15-this-is-sparta and classified as problematic. This vulnerability affects unknown code of the file js/roomElement.js of the component Main Page. The manipulation leads to cross site scripting. The attack can be initiated remotely. The name of the patch is ba2f71ad3a46e5949ee0c510b544fa4ea973baaa. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-217624.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/mauriciosoares/ss15-this-is-sparta/commit/ba2f71ad3a46e5949ee0c510b544fa4ea973baaa; https://github.com/mauriciosoares/ss15-this-is-sparta/pull/1; https://vuldb.com/?ctiid.217624
CVE: CVE-2020-36645
Published: 2023-01-07
Description: A vulnerability, which was classified as critical, was found in square squalor. This affects an unknown part. The manipulation leads to sql injection. Upgrading to version v0.0.0 is able to address this issue. The patch is named f6f0a47cc344711042eb0970cb423e6950ba3f93. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-217623.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/square/squalor/commit/f6f0a47cc344711042eb0970cb423e6950ba3f93; https://github.com/square/squalor/pull/76; https://github.com/square/squalor/releases/tag/v0.0.0
CVE: CVE-2013-10009
Published: 2023-01-07
Description: A vulnerability was found in DrAzraelTod pyChao and classified as critical. Affected by this issue is the function klauen/lesen of the file mod_fun/__init__.py. The manipulation leads to sql injection. The patch is identified as 9d8adbc07c384ba51c2583ce0819c9abb77dc648. It is recommended to apply a patch to fix this issue. VDB-217634 is the identifier assigned to this vulnerability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/DrAzraelTod/pyChao/commit/9d8adbc07c384ba51c2583ce0819c9abb77dc648; https://github.com/DrAzraelTod/pyChao/pull/1; https://vuldb.com/?ctiid.217634
CVE: CVE-2014-125064
Published: 2023-01-07
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2014-125065
Published: 2023-01-07
Description: A vulnerability, which was classified as critical, was found in john5223 bottle-auth. Affected is an unknown function. The manipulation leads to sql injection. The name of the patch is 99cfbcc0c1429096e[PII_REDACTED]ffb4fda276875. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-217632.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/john5223/bottle-auth/commit/99cfbcc0c1429096e[PII_REDACTED]ffb4fda276875; https://vuldb.com/?ctiid.217632; https://vuldb.com/?id.217632
CVE: CVE-2015-10029
Published: 2023-01-07
Description: A vulnerability classified as problematic was found in kelvinmo simplexrd up to 3.1.0. This vulnerability affects unknown code of the file simplexrd/simplexrd.class.php. The manipulation leads to xml external entity reference. Upgrading to version 3.1.1 is able to address this issue. The patch is identified as 4c9f2e028523ed705b555eca2c18c64e71f1a35d. It is recommended to upgrade the affected component. VDB-217630 is the identifier assigned to this vulnerability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-611
References: https://github.com/kelvinmo/simplexrd/commit/4c9f2e028523ed705b555eca2c18c64e71f1a35d; https://github.com/kelvinmo/simplexrd/releases/tag/v3.1.1; https://vuldb.com/?ctiid.217630
CVE: CVE-2016-15013
Published: 2023-01-07
Description: A vulnerability was found in ForumHulp searchresults. It has been rated as critical. Affected by this issue is the function list_keywords of the file event/listener.php. The manipulation of the argument word leads to sql injection. The name of the patch is dd8a312bb285ad9735a8e1da58e9e955837b7322. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-217628.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/ForumHulp/searchresults/commit/dd8a312bb285ad9735a8e1da58e9e955837b7322; https://github.com/ForumHulp/searchresults/pull/2; https://vuldb.com/?ctiid.217628
CVE: CVE-2016-15014
Published: 2023-01-07
Description: A vulnerability has been found in CESNET theme-cesnet up to 1.x on ownCloud and classified as problematic. Affected by this vulnerability is an unknown functionality of the file cesnet/core/lostpassword/templates/resetpassword.php. The manipulation leads to insufficiently protected credentials. Attacking locally is a requirement. Upgrading to version 2.0.0 is able to address this issue. The identifier of the patch is 2b857f2233ce5083b4d5bc9bfc4152f933c3e4a6. It is recommended to upgrade the affected component. The identifier VDB-217633 was assigned to this vulnerability.
CVSS Score: 3.3 (LOW)
CWE: CWE-522
References: https://github.com/CESNET/theme-cesnet/commit/2b857f2233ce5083b4d5bc9bfc4152f933c3e4a6; https://github.com/CESNET/theme-cesnet/pull/1; https://github.com/CESNET/theme-cesnet/releases/tag/2.0.0
CVE: CVE-2017-20164
Published: 2023-01-07
Description: A vulnerability was found in Symbiote Seed up to 6.0.2. It has been classified as critical. Affected is the function onBeforeSecurityLogin of the file code/extensions/SecurityLoginExtension.php of the component Login. The manipulation of the argument URL leads to open redirect. It is possible to launch the attack remotely. Upgrading to version 6.0.3 is able to address this issue. The patch is identified as b065ebd82da53009d273aa7e989191f701485244. It is recommended to upgrade the affected component. VDB-217626 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-601, CWE-601
References: https://github.com/symbiote/silverstripe-seed/commit/b065ebd82da53009d273aa7e989191f701485244; https://github.com/symbiote/silverstripe-seed/releases/tag/6.0.3; https://vuldb.com/?ctiid.217626