deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-24987
Published: 2022-04-11
Description: The Social Share, Social Login and Social Comments Plugin WordPress plugin before 7.13.30 does not sanitise and escape the urls parameter in its the_champ_sharing_count AJAX action (available to both unauthenticated and authenticated users) before outputting it back in the response, leading to a Reflected Cross-Site Scripting issue.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://wpscan.com/vulnerability/a14b668f-812f-46ee-827e-0996b378f7f0; https://wpscan.com/vulnerability/a14b668f-812f-46ee-827e-0996b378f7f0
CVE: CVE-2021-25090
Published: 2022-04-11
Description: The Portfolio Gallery, Product Catalog WordPress plugin before 2.1.0 does not have authorisation and CSRF checks in various functions related to AJAX actions, allowing any authenticated users, such as subscriber, to call them. Due to the lack of sanitisation and escaping, it could also allows attackers to perform Cross-Site Scripting attacks on pages where a Portfolio is embed
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/32a4a2b5-ef65-4e29-af4a-f003dbd0809c; https://wpscan.com/vulnerability/32a4a2b5-ef65-4e29-af4a-f003dbd0809c
CVE: CVE-2021-34250
Published: 2022-04-11
Description: Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: CVE-2021-33396. Reason: This record is a duplicate of CVE-2021-33396. Notes: All CVE users should reference CVE-2021-33396 instead of this record. All references and descriptions in this record have been removed to prevent accidental usage.
CVE: CVE-2022-0246
Published: 2022-04-11
Description: The settings of the iQ Block Country WordPress plugin before 1.2.13 can be exported or imported using its backup functionality. An authorized user can import preconfigured settings of the plugin by uploading a zip file. After the uploading process, files in the uploaded zip file are extracted one by one. During the extraction process, existence of a file is checked. If the file exists, it is deleted without any security control by only considering the name of the extracted file. This behavior leads to "Zip Slip" vulnerability.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-73
References: https://wpscan.com/vulnerability/892802b1-26e2-4ce1-be6f-71ce29687776; https://wpscan.com/vulnerability/892802b1-26e2-4ce1-be6f-71ce29687776
CVE: CVE-2022-0271
Published: 2022-04-11
Description: The LearnPress WordPress plugin before 4.1.6 does not sanitise and escape the lp-dismiss-notice before outputting it back via the lp_background_single_email AJAX action, leading to a Reflected Cross-Site Scripting
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/ad07d9cd-8a75-4f7c-bbbe-3b6b89b699f2; https://wpscan.com/vulnerability/ad07d9cd-8a75-4f7c-bbbe-3b6b89b699f2
CVE: CVE-2022-0314
Published: 2022-04-11
Description: The Nimble Page Builder WordPress plugin before 3.2.2 does not sanitise and escape the preview-level-guid parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/17585f16-c62c-422d-ad9c-9138b6da97b7; https://wpscan.com/vulnerability/17585f16-c62c-422d-ad9c-9138b6da97b7
CVE: CVE-2022-0447
Published: 2022-04-11
Description: The Post Grid WordPress plugin before 2.1.16 does not sanitise and escape the post_types parameter before outputting it back in the response of the post_grid_update_taxonomies_terms_by_posttypes AJAX action, available to any authenticated users, leading to a Reflected Cross-Site Scripting
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/91ca2cc9-951e-4e96-96ff-3bf131209dbe; https://wpscan.com/vulnerability/91ca2cc9-951e-4e96-96ff-3bf131209dbe
CVE: CVE-2022-0471
Published: 2022-04-11
Description: The Favicon by RealFaviconGenerator WordPress plugin before 1.3.23 does not properly sanitise and escape the json_result_url parameter before outputting it back in the Favicon admin dashboard, leading to a Reflected Cross-Site Scripting issue
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/2695862; https://wpscan.com/vulnerability/499bfee4-b481-4276-b6ad-0eead6680f66; https://plugins.trac.wordpress.org/changeset/2695862
CVE: CVE-2022-0531
Published: 2022-04-11
Description: The Migration, Backup, Staging WordPress plugin before 0.9.70 does not sanitise and escape the sub_page parameter before outputting it back in the page, leading to a reflected Cross-Site Scripting
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/ac5c2a5d-09b6-470b-a[PII_REDACTED]413ca; https://wpscan.com/vulnerability/ac5c2a5d-09b6-470b-a[PII_REDACTED]413ca
CVE: CVE-2022-0728
Published: 2022-04-11
Description: The Easy Smooth Scroll Links WordPress plugin before 2.23.1 does not sanitise and escape its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/c6d3d308-4bf1-493f-86e9-dd623526e3c6; https://wpscan.com/vulnerability/c6d3d308-4bf1-493f-86e9-dd623526e3c6
CVE: CVE-2022-0828
Published: 2022-04-11
Description: The Download Manager WordPress plugin before 3.2.34 uses the uniqid php function to generate the master key for a download, allowing an attacker to brute force the key with reasonable resources giving direct download access regardless of role based restrictions or password protections set for the download.
CVSS Score: 7.5 (HIGH)
CWE: CWE-338
References: https://wpscan.com/vulnerability/7f0742ad-6fd7-4258-9e44-d42e138789bb; https://wpscan.com/vulnerability/7f0742ad-6fd7-4258-9e44-d42e138789bb
CVE: CVE-2022-0840
Published: 2022-04-11
Description: The Easy Social Icons WordPress plugin before 3.2.1 does not properly escape the image_file field when adding a new social icon, allowing high privileged users to inject arbitrary javascript even when the unfiltered_html capability is disallowed.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/9da884a9-b4dd-4de0-9afa-722f772cf2df; https://wpscan.com/vulnerability/9da884a9-b4dd-4de0-9afa-722f772cf2df
CVE: CVE-2022-0892
Published: 2022-04-11
Description: The Export All URLs WordPress plugin before 4.2 does not sanitise and escape the CSV filename before outputting it back in the page, leading to a Reflected Cross-Site Scripting
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/e5d95261-a243-493f-be6a-3c15ccb65435; https://wpscan.com/vulnerability/e5d95261-a243-493f-be6a-3c15ccb65435
CVE: CVE-2022-0914
Published: 2022-04-11
Description: The Export All URLs WordPress plugin before 4.3 does not have CSRF in place when exporting data, which could allow attackers to make a logged in admin export all posts and pages (including private and draft) into an arbitrary CSV file, which the attacker can then download and retrieve the list of titles for example
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/c328be28-75dd-43db-a5b9-c1ba0636c930; https://wpscan.com/vulnerability/c328be28-75dd-43db-a5b9-c1ba0636c930
CVE: CVE-2022-0919
Published: 2022-04-11
Description: The Salon booking system Free and pro WordPress plugins before 7.6.3 do not have proper authorisation when searching bookings, allowing any unauthenticated users to search other's booking, as well as retrieve sensitive information about the bookings, such as the full name, email and phone number of the person who booked it.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://wpscan.com/vulnerability/e8f32e0b-4a89-460b-bb78-7c83ef5e16b4; https://wpscan.com/vulnerability/e8f32e0b-4a89-460b-bb78-7c83ef5e16b4
CVE: CVE-2022-0920
Published: 2022-04-11
Description: The Salon booking system Free and Pro WordPress plugins before 7.6.3 do not have proper authorisation in some of its endpoints, which could allow customers to access all bookings and other customer's data
CVSS Score: 7.5 (HIGH)
CWE: CWE-863
References: https://wpscan.com/vulnerability/5a5ab7a8-be67-4f70-925c-9cb1eff2fbe0; https://wpscan.com/vulnerability/5a5ab7a8-be67-4f70-925c-9cb1eff2fbe0
CVE: CVE-2022-0949
Published: 2022-04-11
Description: The Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection WordPress plugin before 6.930 does not properly sanitise and escape the fingerprint parameter before using it in a SQL statement via the stopbadbots_grava_fingerprint AJAX action, available to unauthenticated users, leading to a SQL injection
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://wpscan.com/vulnerability/a0fbb79a-e160-49df-9cf2-18ab64ea66cb; https://wpscan.com/vulnerability/a0fbb79a-e160-49df-9cf2-18ab64ea66cb
CVE: CVE-2022-0969
Published: 2022-04-11
Description: The Image optimization & Lazy Load by Optimole WordPress plugin before 3.3.2 does not sanitise and escape its "Lazyload background images for selectors" settings, which could allow high privilege users such as admin to perform Cross-Site scripting attacks even when the unfiltered_html capability is disallowed.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/2695242; https://wpscan.com/vulnerability/59a7a441-7384-4006-89b4-15345f70fabf; https://plugins.trac.wordpress.org/changeset/2695242
CVE: CVE-2022-0989
Published: 2022-04-11
Description: An unprivileged user could use the functionality of the NS WooCommerce Watermark WordPress plugin through 2.11.3 to load images that hide malware for example from passing malicious domains to hide their trace, by making them pass through the vulnerable domain.
CVSS Score: 7.5 (HIGH)
CWE: CWE-80
References: https://wpscan.com/vulnerability/a6bfc150-8e3f-4b2d-a6e1-09406af41dd4; https://wpscan.com/vulnerability/a6bfc150-8e3f-4b2d-a6e1-09406af41dd4
CVE: CVE-2022-1006
Published: 2022-04-11
Description: The Advanced Booking Calendar WordPress plugin before 1.7.1 does not sanitise and escape the id parameter when editing Calendars, which could allow high privilege users such as admin to perform SQL injection attacks
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://plugins.trac.wordpress.org/changeset/2695427; https://wpscan.com/vulnerability/c5569317-b8c8-4524-8375-3e2369bdcc68; https://plugins.trac.wordpress.org/changeset/2695427
CVE: CVE-2022-1007
Published: 2022-04-11
Description: The Advanced Booking Calendar WordPress plugin before 1.7.1 does not sanitise and escape the room parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting issue
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/2695427; https://wpscan.com/vulnerability/6f5b764b-d13b-4371-9cc5-91204d9d6358; https://plugins.trac.wordpress.org/changeset/2695427
CVE: CVE-2022-1008
Published: 2022-04-11
Description: The One Click Demo Import WordPress plugin before 3.1.0 does not validate the imported file, allowing high privilege users such as admin to upload arbitrary files (such as PHP) even when FILE_MODS and FILE_EDIT are disallowed
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: https://plugins.trac.wordpress.org/changeset/2695999; https://wpscan.com/vulnerability/0c2e2b4d-49eb-4fd9-b9f0-3feae80c1082; https://plugins.trac.wordpress.org/changeset/2695999
CVE: CVE-2022-1023
Published: 2022-04-11
Description: The Podcast Importer SecondLine WordPress plugin before 1.3.8 does not sanitise and properly escape some imported data, which could allow SQL injection attacks to be performed by imported a malicious podcast file
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://plugins.trac.wordpress.org/changeset/2696254; https://wpscan.com/vulnerability/163069cd-98a8-4cfb-8b58-a6727a7d5c48; https://plugins.trac.wordpress.org/changeset/2696254
CVE: CVE-2022-27111
Published: 2022-04-11
Description: Jfinal_CMS 5.1.0 allows attackers to use the feedback function to send malicious XSS code to the administrator backend and execute it.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/jflyfox/jfinal_cms/issues/32; https://github.com/jflyfox/jfinal_cms/issues/32
CVE: CVE-2022-27115
Published: 2022-04-11
Description: In Studio-42 elFinder 2.1.60, there is a vulnerability that causes remote code execution through file name bypass for file upload.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://github.com/Studio-42/elFinder/issues/3458; https://github.com/Studio-42/elFinder/issues/3458
CVE: CVE-2022-27156
Published: 2022-04-11
Description: Daylight Studio Fuel CMS 1.5.1 is vulnerable to HTML Injection.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/daylightstudio/FUEL-CMS/issues/593; https://github.com/daylightstudio/FUEL-CMS/issues/593
CVE: CVE-2021-40219
Published: 2022-04-11
Description: Bolt CMS <= 4.2 is vulnerable to Remote Code Execution. Unsafe theme rendering allows an authenticated attacker to edit theme to inject server-side template injection that leads to remote code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: http://boltcms.com; https://github.com/bolt/core; https://github.com/bolt/core/blob/3b21a73ebf519b76756d3ad2841312d10ef11461/src/Controller/Frontend/TemplateController.php
CVE: CVE-2021-37291
Published: 2022-04-11
Description: An SQL Injection vulnerability exists in KevinLAB Inc Building Energy Management System 4ST BEMS 1.0.0 ivia the input_id POST parameter in index.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://www.kevinlab.com; https://www.zeroscience.mk/en/vulnerabilities/; http://www.kevinlab.com
CVE: CVE-2021-37292
Published: 2022-04-11
Description: An Access Control vulnerability exists in KevinLAB Inc Building Energy Management System 4ST BEMS 1.0.0 due to an undocumented backdoor account. A malicious user can log in using the backdor account with admin highest privileges and obtain system control.
CVSS Score: 7.2 (HIGH)
References: http://www.kevinlab.com; https://www.zeroscience.mk/en/vulnerabilities/; http://www.kevinlab.com
CVE: CVE-2021-37293
Published: 2022-04-11
Description: A Directory Traversal vulnerability exists in KevinLAB Inc Building Energy Management System 4ST BEMS 1.0.0 via the page GET parameter in index.php.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: http://www.kevinlab.com; https://www.zeroscience.mk/en/vulnerabilities/; http://www.kevinlab.com
CVE: CVE-2021-38929
Published: 2022-04-11
Description: IBM System Storage DS8000 Management Console (HMC) R8.5 88.5x.x.x, R9.1 89.1x.0.0, and R9.2 89.2x.0.0 could allow a remote attacker to obtain sensitive information through unpublished URLs. IBM X-Force ID: 210330.
CVSS Score: 7.5 (HIGH)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/210330; https://www.ibm.com/support/pages/node/6570741; https://exchange.xforce.ibmcloud.com/vulnerabilities/210330
CVE: CVE-2021-38930
Published: 2022-04-11
Description: IBM System Storage DS8000 Management Console (HMC) R8.5 88.5x.x.x, R9.1 89.1x.0.0, and R9.2 89.2x.0.0 could allow a remote attacker to obtain sensitive information through unpublished URLs. IBM X-Force ID: 210331.
CVSS Score: 7.5 (HIGH)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/210331; https://www.ibm.com/support/pages/node/6570741; https://exchange.xforce.ibmcloud.com/vulnerabilities/210331
CVE: CVE-2021-39068
Published: 2022-04-11
Description: IBM Curam Social Program Management 8.0.1 and 7.0.11 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 215306.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/215306; https://www.ibm.com/support/pages/node/6570589; https://exchange.xforce.ibmcloud.com/vulnerabilities/215306
CVE: CVE-2021-43442
Published: 2022-04-11
Description: A Logic Flaw vulnerability exists in i3 International Inc Annexxus Camera V5.2.0 build 150317 (Ax46), V5.0.9 build 151106 (Ax68), and V5.0.9 build 150615 (Ax78) due to a failure to allow the creation of more than one administrator account; however, this can be bypassed by parameter maniulation using PUT and DELETE and by calling the 'UserPermission' endpoint with the ID of created account and set it to 'admin' userType, successfully adding a second administrative account.
CVSS Score: 8.1 (HIGH)
References: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5688.php; https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5688.php
CVE: CVE-2022-29035
Published: 2022-04-11
Description: In JetBrains Ktor Native before version 2.0.0 random values used for nonce generation weren't using SecureRandom implementations
CVSS Score: 3.3 (LOW)
CWE: CWE-330, CWE-330
References: https://github.com/ktorio/ktor/pull/2776; https://www.jetbrains.com/privacy-security/issues-fixed/; https://github.com/ktorio/ktor/pull/2776
CVE: CVE-2021-22055
Published: 2022-04-11
Description: The SchedulerServer in Vmware photon allows remote attackers to inject logs through \r in the package parameter. Attackers can also insert malicious data and fake entries.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-74
References: https://github.com/vmware/photon/wiki/log_injection_vulnerability; https://github.com/vmware/photon/wiki/log_injection_vulnerability
CVE: CVE-2021-36846
Published: 2022-04-11
Description: Authenticated (admin or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in Premio Chaty (WordPress plugin) <= 2.8.3
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/chaty/wordpress-chaty-plugin-2-8-3-authenticated-stored-cross-site-scripting-xss-vulnerability; https://wordpress.org/plugins/chaty/; https://patchstack.com/database/vulnerability/chaty/wordpress-chaty-plugin-2-8-3-authenticated-stored-cross-site-scripting-xss-vulnerability
CVE: CVE-2021-36848
Published: 2022-04-11
Description: Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Social Media Feather (WordPress plugin) versions <= 2.0.4
CVSS Score: 3.4 (LOW)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/social-media-feather/wordpress-social-media-feather-plugin-2-0-4-authenticated-stored-cross-site-scripting-xss-vulnerability; https://wordpress.org/plugins/social-media-feather/#developers; https://patchstack.com/database/vulnerability/social-media-feather/wordpress-social-media-feather-plugin-2-0-4-authenticated-stored-cross-site-scripting-xss-vulnerability
CVE: CVE-2021-36893
Published: 2022-04-11
Description: Authenticated (author or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in Responsive Tabs (WordPress plugin) <= 4.0.5
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/responsive-tabs/wordpress-responsive-tabs-plugin-4-0-5-cross-site-scripting-xss-vulnerability; https://wordpress.org/plugins/responsive-tabs/; https://patchstack.com/database/vulnerability/responsive-tabs/wordpress-responsive-tabs-plugin-4-0-5-cross-site-scripting-xss-vulnerability
CVE: CVE-2021-36896
Published: 2022-04-11
Description: Authenticated (author or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in Pricing Table (WordPress plugin) versions <= 1.5.2
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/pricing-table/wordpress-pricing-table-plugin-1-5-2-authenticated-stored-cross-site-scripting-xss-vulnerability; https://wordpress.org/plugins/pricing-table/#developers; https://patchstack.com/database/vulnerability/pricing-table/wordpress-pricing-table-plugin-1-5-2-authenticated-stored-cross-site-scripting-xss-vulnerability
CVE: CVE-2021-36910
Published: 2022-04-11
Description: Authenticated (admin user role) Stored Cross-Site Scripting (XSS) in WP-Appbox (WordPress plugin) <= 4.3.20.
CVSS Score: 3.4 (LOW)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/wp-appbox/wordpress-wp-appbox-plugin-4-3-20-authenticated-stored-cross-site-scripting-xss-vulnerability; https://wordpress.org/plugins/wp-appbox/#developers; https://patchstack.com/database/vulnerability/wp-appbox/wordpress-wp-appbox-plugin-4-3-20-authenticated-stored-cross-site-scripting-xss-vulnerability
CVE: CVE-2021-38125
Published: 2022-04-11
Description: Unauthenticated remote code execution in Micro Focus Operations Bridge containerized, affecting versions 2021.05, 2021.08, and newer versions of Micro Focus Operations Bridge containerized if the deployment was upgraded from 2021.05 or 2021.08. The vulnerability could be exploited to unauthenticated remote code execution.
CVSS Score: 9.8 (CRITICAL)
References: https://portal.microfocus.com/s/article/KM000005303?language=en_US; https://portal.microfocus.com/s/article/KM000005303?language=en_US
CVE: CVE-2021-40065
Published: 2022-04-11
Description: The communication module has a service logic error vulnerability.Successful exploitation of this vulnerability may affect data confidentiality.
CVSS Score: 7.5 (HIGH)
References: https://consumer.huawei.com/en/support/bulletin/2022/4/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202204-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2022/4/
CVE: CVE-2021-43177
Published: 2022-04-11
Description: As a result of an incomplete fix for CVE-2015-7225, in versions of devise-two-factor prior to 4.0.2 it is possible to reuse a One-Time-Password (OTP) for one (and only one) immediately trailing interval. CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N)
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-254
References: https://github.com/tinfoil/devise-two-factor/security/advisories/GHSA-jm35-h8q2-73mp; https://github.com/tinfoil/devise-two-factor/security/advisories/GHSA-jm35-h8q2-73mp
CVE: CVE-2021-46740
Published: 2022-04-11
Description: The device authentication service module has a defect vulnerability introduced in the design process.Successful exploitation of this vulnerability may affect data confidentiality.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: https://consumer.huawei.com/en/support/bulletin/2022/4/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202204-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2022/4/
CVE: CVE-2021-46742
Published: 2022-04-11
Description: The multi-window module has a vulnerability of unauthorized insertion and tampering of Settings.Secure data.Successful exploitation of this vulnerability may affect the availability.
CVSS Score: 9.1 (CRITICAL)
References: https://consumer.huawei.com/en/support/bulletin/2022/4/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202204-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2022/4/
CVE: CVE-2021-4047
Published: 2022-04-11
Description: The release of OpenShift 4.9.6 included four CVE fixes for the haproxy package, however the patch for CVE-2021-39242 was missing. This issue only affects Red Hat OpenShift 4.9.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://bugzilla.redhat.com/show_bug.cgi?id=2027881; https://bugzilla.redhat.com/show_bug.cgi?id=2027881
CVE: CVE-2022-0552
Published: 2022-04-11
Description: A flaw was found in the original fix for the netty-codec-http CVE-2021-21409, where the OpenShift Logging openshift-logging/elasticsearch6-rhel8 container was incomplete. The vulnerable netty-codec-http maven package was not removed from the image content. This flaw affects origin-aggregated-logging versions 3.11.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-444, CWE-444
References: https://access.redhat.com/security/cve/CVE-2021-21409; https://bugzilla.redhat.com/show_bug.cgi?id=2052539; https://github.com/openshift/origin-aggregated-logging/commit/d6b72d6c32e7c06b65324294d[PII_REDACTED]004d