deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-23011
Published: 2022-01-25
Description: On certain hardware BIG-IP platforms, in version 15.1.x before 15.1.4 and 14.1.x before 14.1.3, virtual servers may stop responding while processing TCP traffic due to an issue in the SYN Cookie Protection feature. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 7.5 (HIGH)
CWE: CWE-682, CWE-682
References: https://support.f5.com/csp/article/K68755210; https://support.f5.com/csp/article/K68755210
CVE: CVE-2022-23012
Published: 2022-01-25
Description: On BIG-IP versions 15.1.x before 15.1.4.1 and 14.1.x before 14.1.4.5, when the HTTP/2 profile is configured on a virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 7.5 (HIGH)
CWE: CWE-415, CWE-415
References: https://support.f5.com/csp/article/K26310765; https://support.f5.com/csp/article/K26310765
CVE: CVE-2022-23013
Published: 2022-01-25
Description: On BIG-IP DNS & GTM version 16.x before 16.1.0, 15.1.x before 15.1.4, 14.1.x before 14.1.4.4, and all versions of 13.1.x, 12.1.x, and 11.6.x, a DOM-based cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to execute JavaScript in the context of the currently logged-in user. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 8.8 (HIGH)
CWE: CWE-79, CWE-79
References: https://support.f5.com/csp/article/K29500533; https://support.f5.com/csp/article/K29500533
CVE: CVE-2022-23014
Published: 2022-01-25
Description: On versions 16.1.x before 16.1.2 and 15.1.x before 15.1.4.1, when BIG-IP APM portal access is configured on a virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20, CWE-20
References: https://support.f5.com/csp/article/K93526903; https://support.f5.com/csp/article/K93526903
CVE: CVE-2022-23015
Published: 2022-01-25
Description: On BIG-IP versions 16.x before 16.1.0, 15.1.x before 15.1.4.1, and 14.1.2.6-14.1.4.4, when a Client SSL profile is configured on a virtual server with Client Certificate Authentication set to request/require and Session Ticket enabled and configured, processing SSL traffic can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-400
References: https://support.f5.com/csp/article/K08476614; https://support.f5.com/csp/article/K08476614
CVE: CVE-2022-23016
Published: 2022-01-25
Description: On versions 16.1.x before 16.1.2 and 15.1.x before 15.1.4.1, when BIG-IP SSL Forward Proxy with TLS 1.3 is configured on a virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476, CWE-476
References: https://support.f5.com/csp/article/K91013510; https://support.f5.com/csp/article/K91013510
CVE: CVE-2022-23017
Published: 2022-01-25
Description: On BIG-IP version 16.x before 16.1.0, 15.1.x before 15.1.4.1, 14.1.x before 14.1.4.5, and all versions of 13.1.x, when a virtual server is configured with a DNS profile with the Rapid Response Mode setting enabled and is configured on a BIG-IP system, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476, CWE-476
References: https://support.f5.com/csp/article/K28042514; https://support.f5.com/csp/article/K28042514
CVE: CVE-2022-23018
Published: 2022-01-25
Description: On BIG-IP AFM version 16.1.x before 16.1.2, 15.1.x before 15.1.4.1, 14.1.x before 14.1.4.5, and 13.1.x beginning in 13.1.3.4, when a virtual server is configured with both HTTP protocol security and HTTP Proxy Connect profiles, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 7.5 (HIGH)
CWE: CWE-755, CWE-755
References: https://support.f5.com/csp/article/K24358905; https://support.f5.com/csp/article/K24358905
CVE: CVE-2022-23019
Published: 2022-01-25
Description: On BIG-IP version 16.1.x before 16.1.2, 15.1.x before 15.1.4.1, 14.1.x before 14.1.4.4, and all versions of 13.1.x and 12.1.x, when a message routing type virtual server is configured with both Diameter Session and Router Profiles, undisclosed traffic can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-20
References: https://support.f5.com/csp/article/K82793463; https://support.f5.com/csp/article/K82793463
CVE: CVE-2022-23020
Published: 2022-01-25
Description: On BIG-IP version 16.1.x before 16.1.2, when the 'Respond on Error' setting is enabled on the Request Logging profile and configured on a virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476, CWE-476
References: https://support.f5.com/csp/article/K17514331; https://support.f5.com/csp/article/K17514331
CVE: CVE-2022-23021
Published: 2022-01-25
Description: On BIG-IP version 16.1.x before 16.1.2, when any of the following configurations are configured on a virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate: HTTP redirect rule in an LTM policy, BIG-IP APM Access Profile, and Explicit HTTP Proxy in HTTP Profile. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476, CWE-476
References: https://support.f5.com/csp/article/K57111075; https://support.f5.com/csp/article/K57111075
CVE: CVE-2022-23022
Published: 2022-01-25
Description: On BIG-IP version 16.1.x before 16.1.2, when an HTTP profile is configured on a virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476, CWE-476
References: https://support.f5.com/csp/article/K96924184; https://support.f5.com/csp/article/K96924184
CVE: CVE-2022-23023
Published: 2022-01-25
Description: On BIG-IP version 16.1.x before 16.1.2.1, 15.1.x before 15.1.5, 14.1.x before 14.1.4.5, and all versions of 13.1.x and 12.1.x, and BIG-IQ all versions of 8.x and 7.x, undisclosed requests by an authenticated iControl REST user can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400, CWE-400
References: https://support.f5.com/csp/article/K11742742; https://support.f5.com/csp/article/K11742742
CVE: CVE-2022-23024
Published: 2022-01-25
Description: On BIG-IP AFM version 16.x before 16.1.0, 15.1.x before 15.1.4.1, 14.1.x before 14.1.4.2, and all versions of 13.1.x, when the IPsec application layer gateway (ALG) logging profile is configured on an IPsec ALG virtual server, undisclosed IPsec traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-400
References: https://support.f5.com/csp/article/K54892865; https://support.f5.com/csp/article/K54892865
CVE: CVE-2022-23025
Published: 2022-01-25
Description: On BIG-IP version 16.1.x before 16.1.1, 15.1.x before 15.1.4, 14.1.x before 14.1.4.4, and all versions of 13.1.x, when a SIP ALG profile is configured on a virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476, CWE-476
References: https://support.f5.com/csp/article/K44110411; https://support.f5.com/csp/article/K44110411
CVE: CVE-2022-23026
Published: 2022-01-25
Description: On BIG-IP ASM & Advanced WAF version 16.1.x before 16.1.2, 15.1.x before 15.1.4.1, 14.1.x before 14.1.4.5, and all versions of 13.1.x and 12.1.x, an authenticated user with low privileges, such as a guest, can upload data using an undisclosed REST endpoint causing an increase in disk resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-434, CWE-434
References: https://support.f5.com/csp/article/K08402414; https://support.f5.com/csp/article/K08402414
CVE: CVE-2022-23027
Published: 2022-01-25
Description: On BIG-IP versions 15.1.x before 15.1.4, 14.1.x before 14.1.4.4, 13.1.x beginning in 13.1.3.6, 12.1.5.3-12.1.6, and 11.6.5.2, when a FastL4 profile and an HTTP, FIX, and/or hash persistence profile are configured on the same virtual server, undisclosed requests can cause the virtual server to stop processing new client connections. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-697, CWE-697
References: https://support.f5.com/csp/article/K30573026; https://support.f5.com/csp/article/K30573026
CVE: CVE-2022-23028
Published: 2022-01-25
Description: On BIG-IP AFM version 16.x before 16.1.0, 15.1.x before 15.1.5, 14.1.x before 14.1.4.5, and all versions of 13.1.x, when global AFM SYN cookie protection (TCP Half Open flood vector) is activated in the AFM Device Dos or DOS profile, certain types of TCP connections will fail. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-682, CWE-682
References: https://support.f5.com/csp/article/K16101409; https://support.f5.com/csp/article/K16101409
CVE: CVE-2022-23029
Published: 2022-01-25
Description: On BIG-IP version 16.x before 16.1.0, 15.1.x before 15.1.4.1, 14.1.x before 14.1.4.4, and all versions of 13.1.x, 12.1.x, and 11.6.x, when a FastL4 profile is configured on a virtual server, undisclosed traffic can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-367, CWE-367
References: https://support.f5.com/csp/article/K50343028; https://support.f5.com/csp/article/K50343028
CVE: CVE-2022-23030
Published: 2022-01-25
Description: On version 16.1.x before 16.1.2, 15.1.x before 15.1.4.1, 14.1.x before 14.1.4.5, and all versions of 13.1.x, when the BIG-IP Virtual Edition (VE) uses the ixlv driver (which is used in SR-IOV mode and requires Intel X710/XL710/XXV710 family of network adapters on the Hypervisor) and TCP Segmentation Offload configuration is enabled, undisclosed requests may cause an increase in CPU resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-400, CWE-400
References: https://support.f5.com/csp/article/K53442005; https://support.f5.com/csp/article/K53442005
CVE: CVE-2022-23031
Published: 2022-01-25
Description: On BIG-IP FPS, ASM, and Advanced WAF versions 16.1.x before 16.1.1, 15.1.x before 15.1.4, and 14.1.x before 14.1.4.4, an XML External Entity (XXE) vulnerability exists in an undisclosed page of the F5 Advanced Web Application Firewall (Advanced WAF) and BIG-IP ASM Traffic Management User Interface (TMUI), also referred to as the Configuration utility, that allows an authenticated high-privileged attacker to read local files and force BIG-IP to send HTTP requests. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-611, CWE-611
References: https://support.f5.com/csp/article/K61112120; https://support.f5.com/csp/article/K61112120
CVE: CVE-2022-23032
Published: 2022-01-25
Description: In all versions before 7.2.1.4, when proxy settings are configured in the network access resource of a BIG-IP APM system, connecting BIG-IP Edge Client on Mac and Windows is vulnerable to a DNS rebinding attack. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-346, CWE-346
References: https://support.f5.com/csp/article/K30525503; https://support.f5.com/csp/article/K30525503
CVE: CVE-2021-43799
Published: 2022-01-25
Description: Zulip is an open-source team collaboration tool. Zulip Server installs RabbitMQ for internal message passing. In versions of Zulip Server prior to 4.9, the initial installation (until first reboot, or restart of RabbitMQ) does not successfully limit the default ports which RabbitMQ opens; this includes port 25672, the RabbitMQ distribution port, which is used as a management port. RabbitMQ's default "cookie" which protects this port is generated using a weak PRNG, which limits the entropy of the password to at most 36 bits; in practicality, the seed for the randomizer is biased, resulting in approximately 20 bits of entropy. If other firewalls (at the OS or network level) do not protect port 25672, a remote attacker can brute-force the 20 bits of entropy in the "cookie" and leverage it for arbitrary execution of code as the rabbitmq user. They can also read all data which is sent through RabbitMQ, which includes all message traffic sent by users. Version 4.9 contains a patch for this vulnerability. As a workaround, ensure that firewalls prevent access to ports 5672 and 25672 from outside the Zulip server.
CVSS Score: 8.6 (HIGH)
CWE: CWE-338, CWE-338
References: https://github.com/gteissier/erl-matter; https://github.com/zulip/zulip/commit/a5496f4098e3998c9b84e8dc564aa983d6cdf6e8; https://github.com/zulip/zulip/releases/tag/4.9
CVE: CVE-2022-23258
Published: 2022-01-25
Description: Microsoft Edge for Android Spoofing Vulnerability
CVSS Score: 4.3 (MEDIUM)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23258; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-23258
CVE: CVE-2021-36289
Published: 2022-01-25
Description: Dell VNX2 OE for File versions 8.1.21.266 and earlier, contain a sensitive information disclosure vulnerability. A local malicious user may exploit this vulnerability to read sensitive information and use it.
CVSS Score: 7.8 (HIGH)
CWE: CWE-532, CWE-532
References: https://www.dell.com/support/kbdoc/en-us/000191155/dsa-2021-164-dell-vnx2-control-station-security-update-for-multiple-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000191155/dsa-2021-164-dell-vnx2-control-station-security-update-for-multiple-vulnerabilities
CVE: CVE-2021-36294
Published: 2022-01-25
Description: Dell VNX2 OE for File versions 8.1.21.266 and earlier, contain an authentication bypass vulnerability. A remote unauthenticated attacker may exploit this vulnerability by forging a cookie to login as any user.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-331, CWE-330
References: https://www.dell.com/support/kbdoc/en-us/000191155/dsa-2021-164-dell-vnx2-control-station-security-update-for-multiple-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000191155/dsa-2021-164-dell-vnx2-control-station-security-update-for-multiple-vulnerabilities
CVE: CVE-2021-36295
Published: 2022-01-25
Description: Dell VNX2 OE for File versions 8.1.21.266 and earlier, contain an authenticated remote code execution vulnerability. A remote malicious user with privileges may exploit this vulnerability to execute commands on the system.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78, CWE-78
References: https://www.dell.com/support/kbdoc/en-us/000191155/dsa-2021-164-dell-vnx2-control-station-security-update-for-multiple-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000191155/dsa-2021-164-dell-vnx2-control-station-security-update-for-multiple-vulnerabilities
CVE: CVE-2021-36296
Published: 2022-01-25
Description: Dell VNX2 OE for File versions 8.1.21.266 and earlier, contain an authenticated remote code execution vulnerability. A remote malicious user with privileges may exploit this vulnerability to execute commands on the system.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78, CWE-78
References: https://www.dell.com/support/kbdoc/en-us/000191155/dsa-2021-164-dell-vnx2-control-station-security-update-for-multiple-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000191155/dsa-2021-164-dell-vnx2-control-station-security-update-for-multiple-vulnerabilities
CVE: CVE-2021-36346
Published: 2022-01-25
Description: Dell iDRAC 8 prior to version 2.82.82.82 contain a denial of service vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerability to deny access to the iDRAC webserver.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-287
References: https://www.dell.com/support/kbdoc/en-us/000194038/dsa-2021-259; https://www.dell.com/support/kbdoc/en-us/000194038/dsa-2021-259
CVE: CVE-2021-36347
Published: 2022-01-25
Description: iDRAC9 versions prior to 5.00.20.00 and iDRAC8 versions prior to 2.82.82.82 contain a stack-based buffer overflow vulnerability. An authenticated remote attacker with high privileges could potentially exploit this vulnerability to control process execution and gain access to the iDRAC operating system.
CVSS Score: 7.2 (HIGH)
CWE: CWE-121, CWE-787
References: https://www.dell.com/support/kbdoc/000194038; https://www.dell.com/support/kbdoc/000194038
CVE: CVE-2021-36348
Published: 2022-01-25
Description: iDRAC9 versions prior to 5.00.20.00 contain an input injection vulnerability. A remote authenticated malicious user with low privileges may potentially exploit this vulnerability to cause information disclosure or denial of service by supplying specially crafted input data to iDRAC.
CVSS Score: 8.1 (HIGH)
CWE: CWE-89, CWE-74
References: https://www.dell.com/support/kbdoc/000194038; https://www.dell.com/support/kbdoc/000194038
CVE: CVE-2022-23959
Published: 2022-01-26
Description: In Varnish Cache before 6.6.2 and 7.x before 7.0.2, Varnish Cache 6.0 LTS before 6.0.10, and and Varnish Enterprise (Cache Plus) 4.1.x before 4.1.11r6 and 6.0.x before 6.0.9r4, request smuggling can occur for HTTP/1 connections.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-444
References: https://docs.varnish-software.com/security/VSV00008/; https://lists.debian.org/debian-lts-announce/2022/02/msg00014.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UMMDMQWNAE3BTSZUHXQHVAMZC5TLHLYT/
CVE: CVE-2021-46559
Published: 2022-01-26
Description: The firmware on Moxa TN-5900 devices through 3.1 has a weak algorithm that allows an attacker to defeat an inspection mechanism for integrity protection.
CVSS Score: 7.5 (HIGH)
CWE: CWE-345
References: https://www.moxa.com/en/support/product-support/security-advisory/tn-5900-secure-routers-vulnerabilities; https://www.moxa.com/en/support/product-support/security-advisory/tn-5900-secure-routers-vulnerabilities
CVE: CVE-2021-46560
Published: 2022-01-26
Description: The firmware on Moxa TN-5900 devices through 3.1 allows command injection that could lead to device damage.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://www.moxa.com/en/support/product-support/security-advisory/tn-5900-secure-routers-vulnerabilitiestxt; https://www.moxa.com/en/support/product-support/security-advisory/tn-5900-secure-routers-vulnerabilitiestxt
CVE: CVE-2022-0355
Published: 2022-01-26
Description: Improper Removal of Sensitive Information Before Storage or Transfer in NPM simple-get prior to 4.0.1.
CVSS Score: 8.8 (HIGH)
CWE: CWE-212, CWE-212
References: https://github.com/advisories/GHSA-wpg7-2c88-r8xv; https://github.com/feross/simple-get/commit/e4af095e06cd69a9235013e8507e220a79b9684f; https://huntr.dev/bounties/42c79c23-6646-46c4-871d-219c0d4b4e31
CVE: CVE-2019-25056
Published: 2022-01-26
Description: In Bromite through 78.0.3904.130, there are adblock rules in the release APK; therefore, probing which resources are blocked and which aren't can identify the application version and defeat the User-Agent protection mechanism.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-203
References: https://github.com/bromite/bromite/issues/2#issuecomment-524102774; https://github.com/bromite/bromite/issues/2#issuecomment-524102774
CVE: CVE-2022-23968
Published: 2022-01-26
Description: Xerox VersaLink devices on specific versions of firmware before 2022-01-26 allow remote attackers to brick the device via a crafted TIFF file in an unauthenticated HTTP POST request. There is a permanent denial of service because image parsing causes a reboot, but image parsing is restarted as soon as the boot process finishes. However, this boot loop can be resolved by a field technician. The TIFF file must have an incomplete Image Directory. Affected firmware versions include xx.42.01 and xx.50.61. NOTE: the 2022-01-24 NeoSmart article included "believed to affect all previous and later versions as of the date of this posting" but a 2022-01-26 vendor statement reports "the latest versions of firmware are not vulnerable to this issue."
CVSS Score: 7.5 (HIGH)
CWE: CWE-835
References: https://neosmart.net/blog/2022/xerox-vulnerability-allows-unauthenticated-network-users-to-remotely-brick-printers/; https://twitter.com/mqudsi/status/[PII_REDACTED]87695618; https://neosmart.net/blog/2022/xerox-vulnerability-allows-unauthenticated-network-users-to-remotely-brick-printers/
CVE: CVE-2022-21944
Published: 2022-01-26
Description: A UNIX Symbolic Link (Symlink) Following vulnerability in the systemd service file for watchman of openSUSE Backports SLE-15-SP3, Factory allows local attackers to escalate to root. This issue affects: openSUSE Backports SLE-15-SP3 watchman versions prior to 4.9.0. openSUSE Factory watchman versions prior to 4.9.0-9.1.
CVSS Score: 7.8 (HIGH)
CWE: CWE-59, CWE-59
References: https://bugzilla.suse.com/show_bug.cgi?id=1194470; https://bugzilla.suse.com/show_bug.cgi?id=1194470
CVE: CVE-2022-0374
Published: 2022-01-26
Description: Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/livehelperchat/livehelperchat/commit/bbfaa26ce54a2a86ce1a42a16496038f5bdfc102; https://huntr.dev/bounties/f8b560a6-aa19-4262-8ae4-cf88204310ef; https://github.com/livehelperchat/livehelperchat/commit/bbfaa26ce54a2a86ce1a42a16496038f5bdfc102
CVE: CVE-2022-0375
Published: 2022-01-26
Description: Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/livehelperchat/livehelperchat/commit/bbfaa26ce54a2a86ce1a42a16496038f5bdfc102; https://huntr.dev/bounties/28e1c356-6eaa-4d93-af56-938e3b4d40a7; https://github.com/livehelperchat/livehelperchat/commit/bbfaa26ce54a2a86ce1a42a16496038f5bdfc102
CVE: CVE-2021-41766
Published: 2022-01-26
Description: Apache Karaf allows monitoring of applications and the Java runtime by using the Java Management Extensions (JMX). JMX is a Java RMI based technology that relies on Java serialized objects for client server communication. Whereas the default JMX implementation is hardened against unauthenticated deserialization attacks, the implementation used by Apache Karaf is not protected against this kind of attack. The impact of Java deserialization vulnerabilities strongly depends on the classes that are available within the targets class path. Generally speaking, deserialization of untrusted data does always represent a high security risk and should be prevented. The risk is low as, by default, Karaf uses a limited set of classes in the JMX server class path. It depends of system scoped classes (e.g. jar in the lib folder).
CVSS Score: 8.1 (HIGH)
CWE: CWE-502
References: https://karaf.apache.org/security/cve-2021-41766.txt; https://karaf.apache.org/security/cve-2021-41766.txt