deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-0815
Published: 2022-03-10
Description: Improper access control vulnerability in McAfee WebAdvisor Chrome and Edge browser extensions up to 8.1.0.1895 allows a remote attacker to gain access to McAfee WebAdvisor settings and other details about the user’s system. This could lead to unexpected behaviors including; settings being changed, fingerprinting of the system leading to targeted scams, and not triggering the malicious software if McAfee software is detected.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-668, CWE-668
References: https://service.mcafee.com/?articleId=TS103273&page=shell&shell=article-view; https://service.mcafee.com/?articleId=TS103273&page=shell&shell=article-view
CVE: CVE-2022-0820
Published: 2022-03-11
Description: Cross-site Scripting (XSS) - Stored in GitHub repository orchardcms/orchardcore prior to 1.3.0.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/orchardcms/orchardcore/commit/b7096af1028d8f909f63dd076d1bbd573913a92d; https://huntr.dev/bounties/d00e7175-4764-4962-ae0d-a66501dda2e6; https://github.com/orchardcms/orchardcore/commit/b7096af1028d8f909f63dd076d1bbd573913a92d
CVE: CVE-2022-0821
Published: 2022-03-11
Description: Improper Authorization in GitHub repository orchardcms/orchardcore prior to 1.3.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-285
References: https://github.com/orchardcms/orchardcore/commit/b7096af1028d8f909f63dd076d1bbd573913a92d; https://huntr.dev/bounties/0019eb1c-8bf9-4bd0-a27f-aadc173515cb; https://github.com/orchardcms/orchardcore/commit/b7096af1028d8f909f63dd076d1bbd573913a92d
CVE: CVE-2022-25506
Published: 2022-03-11
Description: FreeTAKServer-UI v1.9.8 was discovered to contain a SQL injection vulnerability via the API endpoint /AuthenticateUser.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/FreeTAKTeam/UI/issues/27; https://github.com/FreeTAKTeam/UI/issues/27
CVE: CVE-2022-25507
Published: 2022-03-11
Description: FreeTAKServer-UI v1.9.8 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Callsign parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/FreeTAKTeam/UI/issues/28; https://github.com/FreeTAKTeam/UI/issues/28
CVE: CVE-2022-25508
Published: 2022-03-11
Description: An access control issue in the component /ManageRoute/postRoute of FreeTAKServer v1.9.8 allows unauthenticated attackers to cause a Denial of Service (DoS) via an unusually large amount of created routes, or create unsafe or false routes for legitimate users.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306
References: https://github.com/FreeTAKTeam/FreeTakServer/issues/291; https://github.com/FreeTAKTeam/FreeTakServer/issues/291
CVE: CVE-2022-25510
Published: 2022-03-11
Description: FreeTAKServer 1.9.8 contains a hardcoded Flask secret key which allows attackers to create crafted cookies to bypass authentication or escalate privileges.
CVSS Score: 8.8 (HIGH)
CWE: CWE-798
References: https://github.com/FreeTAKTeam/FreeTakServer/issues/292; https://github.com/FreeTAKTeam/FreeTakServer/issues/292
CVE: CVE-2022-25511
Published: 2022-03-11
Description: An issue in the ?filename= argument of the route /DataPackageTable in FreeTAKServer-UI v1.9.8 allows attackers to place arbitrary files anywhere on the system.
CVSS Score: 6.5 (MEDIUM)
References: https://github.com/FreeTAKTeam/UI/issues/29; https://github.com/FreeTAKTeam/UI/issues/29
CVE: CVE-2022-25512
Published: 2022-03-11
Description: FreeTAKServer-UI v1.9.8 was discovered to leak sensitive API and Websocket keys.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://github.com/FreeTAKTeam/UI/issues/26; https://github.com/FreeTAKTeam/UI/issues/26
CVE: CVE-2022-0822
Published: 2022-03-11
Description: Cross-site Scripting (XSS) - Reflected in GitHub repository orchardcms/orchardcore prior to 1.3.0.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/orchardcms/orchardcore/commit/b7096af1028d8f909f63dd076d1bbd573913a92d; https://huntr.dev/bounties/06971613-b6ab-4b96-8aa6-4982bfcfeb73; https://github.com/orchardcms/orchardcore/commit/b7096af1028d8f909f63dd076d1bbd573913a92d
CVE: CVE-2018-25031
Published: 2022-03-11
Description: Swagger UI 4.1.2 and earlier could allow a remote attacker to conduct spoofing attacks. By persuading a victim to open a crafted URL, an attacker could exploit this vulnerability to display remote OpenAPI definitions. Note: This was originally claimed to be resolved in 4.1.3. However, third parties have indicated this is not resolved in 4.1.3 and even occurs in that version and possibly others.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20, CWE-20, CWE-918, CWE-922
References: https://github.com/swagger-api/swagger-ui/issues/4872; https://github.com/swagger-api/swagger-ui/releases/tag/v4.1.3; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2020-36518
Published: 2022-03-11
Description: jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-787
References: https://github.com/FasterXML/jackson-databind/issues/2816; https://lists.debian.org/debian-lts-announce/2022/05/msg00001.html; https://lists.debian.org/debian-lts-announce/2022/11/msg00035.html
CVE: CVE-2021-46708
Published: 2022-03-11
Description: The swagger-ui-dist package before 4.1.3 for Node.js could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-1021
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://security.snyk.io/vuln/SNYK-JS-SWAGGERUIDIST-2314884; https://www.npmjs.com/package/swagger-ui-dist/v/4.1.3
CVE: CVE-2022-26874
Published: 2022-03-11
Description: lib/Horde/Mime/Viewer/Ooo.php in Horde Mime_Viewer before 2.2.4 allows XSS via an OpenOffice document, leading to account takeover in Horde Groupware Webmail Edition. This occurs after XSLT rendering.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://blog.sonarsource.com/horde-webmail-account-takeover-via-email/; https://github.com/horde/Mime_Viewer/commit/02b46cec1a7e8f1a6835b628850cd56b85963bb5; https://lists.debian.org/debian-lts-announce/2022/06/msg00007.html
CVE: CVE-2022-26878
Published: 2022-03-11
Description: drivers/bluetooth/virtio_bt.c in the Linux kernel before 5.16.3 has a memory leak (socket buffers have memory allocated but not freed).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: http://www.openwall.com/lists/oss-security/2022/03/11/1; https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.17; https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.16.3
CVE: CVE-2022-21177
Published: 2022-03-11
Description: There is a path traversal vulnerability in CAMS for HIS Log Server contained in the following Yokogawa Electric products: CENTUM CS 3000 versions from R3.08.10 to R3.09.00, CENTUM VP versions from R4.01.00 to R4.03.00, from R5.01.00 to R5.04.20, andfrom R6.01.00 to R6.08.00, Exaopc versions from R3.72.00 to R3.79.00.
CVSS Score: 8.1 (HIGH)
CWE: CWE-23, CWE-22
References: https://web-material3.yokogawa.com/1/32094/files/YSAR-22-0001-E.pdf; https://web-material3.yokogawa.com/1/32094/files/YSAR-22-0001-E.pdf
CVE: CVE-2022-21194
Published: 2022-03-11
Description: The following Yokogawa Electric products do not change the passwords of the internal Windows accounts from the initial configuration: CENTUM VP versions from R5.01.00 to R5.04.20 and versions from R6.01.00 to R6.08.0, Exaopc versions from R3.72.00 to R3.79.00.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798, CWE-798
References: https://web-material3.yokogawa.com/1/32094/files/YSAR-22-0001-E.pdf; https://web-material3.yokogawa.com/1/32094/files/YSAR-22-0001-E.pdf
CVE: CVE-2022-21808
Published: 2022-03-11
Description: Path traversal vulnerability exists in CAMS for HIS Server contained in the following Yokogawa Electric products: CENTUM CS 3000 versions from R3.08.10 to R3.09.00, CENTUM VP versions from R4.01.00 to R4.03.00, from R5.01.00 to R5.04.20, and from R6.01.00 to R6.08.00, Exaopc versions from R3.72.00 to R3.79.00.
CVSS Score: 8.8 (HIGH)
CWE: CWE-23, CWE-22
References: https://web-material3.yokogawa.com/1/32094/files/YSAR-22-0001-E.pdf; https://web-material3.yokogawa.com/1/32094/files/YSAR-22-0001-E.pdf
CVE: CVE-2022-22141
Published: 2022-03-11
Description: 'Long-term Data Archive Package' service implemented in the following Yokogawa Electric products creates some named pipe with imporper ACL configuration. CENTUM CS 3000 versions from R3.08.10 to R3.09.00, CENTUM VP versions from R4.01.00 to R4.03.00, from R5.01.00 to R5.04.20, and from R6.01.00 to R6.08.00, Exaopc versions from R3.72.00 to R3.79.00.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732, CWE-269
References: https://web-material3.yokogawa.com/1/32094/files/YSAR-22-0001-E.pdf; https://web-material3.yokogawa.com/1/32094/files/YSAR-22-0001-E.pdf
CVE: CVE-2022-22145
Published: 2022-03-11
Description: CAMS for HIS Log Server contained in the following Yokogawa Electric products is vulnerable to uncontrolled resource consumption. CENTUM CS 3000 versions from R3.08.10 to R3.09.00, CENTUM VP versions from R4.01.00 to R4.03.00, from R5.01.00 to R5.04.20, from R6.01.00 to R6.08.00, Exaopc versions from R3.72.00 to R3.79.00.
CVSS Score: 8.1 (HIGH)
CWE: CWE-400, CWE-400
References: https://web-material3.yokogawa.com/1/32094/files/YSAR-22-0001-E.pdf; https://web-material3.yokogawa.com/1/32094/files/YSAR-22-0001-E.pdf
CVE: CVE-2022-22148
Published: 2022-03-11
Description: 'Root Service' service implemented in the following Yokogawa Electric products creates some named pipe with improper ACL configuration. CENTUM CS 3000 versions from R3.08.10 to R3.09.00, CENTUM VP versions from R4.01.00 to R4.03.00, from R5.01.00 to R5.04.20, and from R6.01.00 to R6.08.00, Exaopc versions from R3.72.00 to R3.79.00.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732, CWE-732
References: https://web-material3.yokogawa.com/1/32094/files/YSAR-22-0001-E.pdf; https://web-material3.yokogawa.com/1/32094/files/YSAR-22-0001-E.pdf
CVE: CVE-2022-22151
Published: 2022-03-11
Description: CAMS for HIS Log Server contained in the following Yokogawa Electric products fails to properly neutralize log outputs: CENTUM CS 3000 versions from R3.08.10 to R3.09.00, CENTUM VP versions from R4.01.00 to R4.03.00, from R5.01.00 to R5.04.20, and from R6.01.00 to R6.08.00, and Exaopc versions from R3.72.00 to R3.79.00.
CVSS Score: 8.1 (HIGH)
CWE: CWE-117, CWE-116
References: https://web-material3.yokogawa.com/1/32094/files/YSAR-22-0001-E.pdf; https://web-material3.yokogawa.com/1/32094/files/YSAR-22-0001-E.pdf
CVE: CVE-2022-22729
Published: 2022-03-11
Description: CAMS for HIS Server contained in the following Yokogawa Electric products improperly authenticate the receiving packets. The authentication may be bypassed via some crafted packets: CENTUM CS 3000 versions from R3.08.10 to R3.09.00, CENTUM VP versions from R4.01.00 to R4.03.00, from R5.01.00 to R5.04.20, and from R6.01.00 to R6.08.00, and Exaopc versions from R3.72.00 to R3.79.00.
CVSS Score: 8.8 (HIGH)
CWE: CWE-302, CWE-287
References: https://web-material3.yokogawa.com/1/32094/files/YSAR-22-0001-E.pdf; https://web-material3.yokogawa.com/1/32094/files/YSAR-22-0001-E.pdf
CVE: CVE-2022-23401
Published: 2022-03-11
Description: The following Yokogawa Electric products contain insecure DLL loading issues. CENTUM CS 3000 versions from R3.08.10 to R3.09.00, CENTUM VP versions from R4.01.00 to R4.03.00, from R5.01.00 to R5.04.20, and from R6.01.00 to R6.08.00, Exaopc versions from R3.72.00 to R3.79.00.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427, CWE-427
References: https://web-material3.yokogawa.com/1/32094/files/YSAR-22-0001-E.pdf; https://web-material3.yokogawa.com/1/32094/files/YSAR-22-0001-E.pdf
CVE: CVE-2022-23402
Published: 2022-03-11
Description: The following Yokogawa Electric products hard-code the password for CAMS server applications: CENTUM VP versions from R5.01.00 to R5.04.20 and versions from R6.01.00 to R6.08.00, Exaopc versions from R3.72.00 to R3.79.00
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798, CWE-798
References: https://web-material3.yokogawa.com/1/32094/files/YSAR-22-0001-E.pdf; https://web-material3.yokogawa.com/1/32094/files/YSAR-22-0001-E.pdf
CVE: CVE-2022-0912
Published: 2022-03-11
Description: Unrestricted Upload of File with Dangerous Type in GitHub repository microweber/microweber prior to 1.2.11.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-434, CWE-434
References: https://github.com/microweber/microweber/commit/[PII_REDACTED]1f5dc88bb3a2b20d0e4e25b0ebc789; https://huntr.dev/bounties/ae5bb359-7e53-498b-848e-540c05b44c54; https://github.com/microweber/microweber/commit/[PII_REDACTED]1f5dc88bb3a2b20d0e4e25b0ebc789
CVE: CVE-2022-0913
Published: 2022-03-11
Description: Integer Overflow or Wraparound in GitHub repository microweber/microweber prior to 1.3.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190, CWE-190
References: https://github.com/microweber/microweber/commit/7559e141d0707f8eeff2f9aeaa5a0ca2e3fe6583; https://huntr.dev/bounties/f5f3e468-663b-4df0-8340-a2d77e4cc75f; https://github.com/microweber/microweber/commit/7559e141d0707f8eeff2f9aeaa5a0ca2e3fe6583
CVE: CVE-2022-0870
Published: 2022-03-11
Description: Server-Side Request Forgery (SSRF) in GitHub repository gogs/gogs prior to 0.12.5.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-918, CWE-918
References: https://github.com/gogs/gogs/commit/91f2cde5e95f146bfe4765e837e7282df6c7cabb; https://huntr.dev/bounties/327797d7-ae41-498f-9bff-cc0bf98cf531; https://github.com/gogs/gogs/commit/91f2cde5e95f146bfe4765e837e7282df6c7cabb
CVE: CVE-2022-0928
Published: 2022-03-11
Description: Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.2.12.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/microweber/microweber/commit/fc9137c031f7edec5f50d73b300919fb519c924a; https://huntr.dev/bounties/085aafdd-ba50-44c7-9650-fa573da29bcd; https://github.com/microweber/microweber/commit/fc9137c031f7edec5f50d73b300919fb519c924a
CVE: CVE-2022-0871
Published: 2022-03-11
Description: Missing Authorization in GitHub repository gogs/gogs prior to 0.12.5.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-862, CWE-862
References: https://github.com/gogs/gogs/commit/64102be2c90e1b47dbdd379873ba76c80d4b0e78; https://huntr.dev/bounties/ea82cfc9-b55c-41fe-ae58-0d0e0bd7ab62; https://github.com/gogs/gogs/commit/64102be2c90e1b47dbdd379873ba76c80d4b0e78
CVE: CVE-2022-0860
Published: 2022-03-11
Description: Improper Authorization in GitHub repository cobbler/cobbler prior to 3.3.2.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-285, CWE-863
References: https://github.com/cobbler/cobbler/commit/9044aa990a94752fa5bd5a24051adde099280bfa; https://huntr.dev/bounties/c458b868-63df-414e-af10-47e3745caa1d; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/D4KCNZYBQC2FM5SEEDRQZO4LRZ4ZECMG/
CVE: CVE-2022-21819
Published: 2022-03-11
Description: NVIDIA distributions of Jetson Linux contain a vulnerability where an error in the IOMMU configuration may allow an unprivileged attacker with physical access to the board direct read/write access to the entire system address space through the PCI bus. Such an attack could result in denial of service, code execution, escalation of privileges, and impact to data integrity and confidentiality. The scope impact may extend to other components.
CVSS Score: 7.6 (HIGH)
CWE: CWE-732, CWE-732
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5321; https://www.thegoodpenguin.co.uk/blog/pcie-dma-attack-against-a-secured-jetson-nano-cve-2022-21819/; https://nvidia.custhelp.com/app/answers/detail/a_id/5321
CVE: CVE-2022-0932
Published: 2022-03-11
Description: Missing Authorization in GitHub repository saleor/saleor prior to 3.1.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://github.com/saleor/saleor/commit/521dfd6394f3926a77c60d8633c058e16d0f916d; https://huntr.dev/bounties/88ae4cbc-c697-401b-8b04-7dc4e03ad8eb; https://github.com/saleor/saleor/commit/521dfd6394f3926a77c60d8633c058e16d0f916d
CVE: CVE-2021-44618
Published: 2022-03-11
Description: A Server-side Template Injection (SSTI) vulnerability exists in Nystudio107 Seomatic 3.4.12 in src/helpers/UrlHelper.php via the host header.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://github.com/nystudio107/craft-seomatic/commit/0c5c0c0e0cb61000d12ec55ebf174745a5bf6469; https://github.com/nystudio107/craft-seomatic/releases/tag/3.4.12; https://github.com/nystudio107/craft-seomatic/commit/0c5c0c0e0cb61000d12ec55ebf174745a5bf6469
CVE: CVE-2021-44620
Published: 2022-03-11
Description: A Command Injection vulnerability exits in TOTOLINK A3100R <=V4.1.2cu.5050_B20200504 in adm/ntm.asp via the hosTime parameters.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: http://a3100r.com; http://totolink.com; https://drive.google.com/file/d/1_9ru2GRZ13T1KQKXPq2E14-opgf9ih45/view?usp=sharing
CVE: CVE-2022-24433
Published: 2022-03-11
Description: The package simple-git before 3.3.0 are vulnerable to Command Injection via argument injection. When calling the .fetch(remote, branch, handlerFn) function, both the remote and branch parameters are passed to the git fetch subcommand. By injecting some git options it was possible to get arbitrary command execution.
CVSS Score: 8.1 (HIGH)
CWE: CWE-88
References: https://github.com/steveukx/git-js/pull/767; https://github.com/steveukx/git-js/releases/tag/simple-git%403.3.0; https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2421245
CVE: CVE-2021-23246
Published: 2022-03-11
Description: In ACE2 ColorOS11, the attacker can obtain the foreground package name through permission promotion, resulting in user information disclosure.
CVSS Score: 7.5 (HIGH)
References: https://security.oppo.com/en/noticeDetail?notice_only_key=NOTICE[PII_REDACTED]851247104; https://security.oppo.com/en/noticeDetail?notice_only_key=NOTICE[PII_REDACTED]851247104
CVE: CVE-2021-26341
Published: 2022-03-11
Description: Some AMD CPUs may transiently execute beyond unconditional direct branches, which may potentially result in data leakage.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-212
References: http://www.openwall.com/lists/oss-security/2022/03/18/2; https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1026; http://www.openwall.com/lists/oss-security/2022/03/18/2
CVE: CVE-2021-26401
Published: 2022-03-11
Description: LFENCE/JMP (mitigation V2-2) may not sufficiently mitigate CVE-2017-5715 on some AMD CPUs.
CVSS Score: 5.6 (MEDIUM)
References: http://www.openwall.com/lists/oss-security/2022/03/18/2; https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1036; http://www.openwall.com/lists/oss-security/2022/03/18/2
CVE: CVE-2021-27414
Published: 2022-03-11
Description: An attacker could trick a user of Hitachi ABB Power Grids Ellipse Enterprise Asset Management (EAM) versions prior to and including 9.0.25 into visiting a malicious website posing as a login page for the Ellipse application and gather authentication credentials.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-451, CWE-1021
References: https://search.abb.com/library/Download.aspx?DocumentID=9AKK107991A7777&LanguageCode=en&DocumentPartId=&Action=Launch; https://www.cisa.gov/uscert/ics/advisories/icsa-21-061-01; https://search.abb.com/library/Download.aspx?DocumentID=9AKK107991A7777&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2021-27416
Published: 2022-03-11
Description: An attacker could exploit this vulnerability in Hitachi ABB Power Grids Ellipse Enterprise Asset Management (EAM) versions prior to and including 9.0.25 by tricking a user to click on a link containing malicious code that would then be run by the web browser. This can result in the compromise of confidential information, or even the takeover of the user’s session.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://search.abb.com/library/Download.aspx?DocumentID=9AKK107991A7777&LanguageCode=en&DocumentPartId=&Action=Launch; https://www.cisa.gov/uscert/ics/advisories/icsa-21-061-01; https://search.abb.com/library/Download.aspx?DocumentID=9AKK107991A7777&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2021-32009
Published: 2022-03-11
Description: Cross-site Scripting (XSS) vulnerability in firmware section of Secomea GateManager allows logged in user to inject javascript in browser session. This issue affects: Secomea GateManager Version 9.6.621421014 and all prior versions.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.secomea.com/support/cybersecurity-advisory; https://www.secomea.com/support/cybersecurity-advisory
CVE: CVE-2021-32472
Published: 2022-03-11
Description: Teachers exporting a forum in CSV format could receive a CSV of forums from all courses in some circumstances. Moodle versions 3.10 to 3.10.3, 3.9 to 3.9.6 and 3.8 to 3.8.8 are affected.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://moodle.org/mod/forum/discuss.php?d=422305; https://moodle.org/mod/forum/discuss.php?d=422305
CVE: CVE-2021-32473
Published: 2022-03-11
Description: It was possible for a student to view their quiz grade before it had been released, using a quiz web service. Moodle 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8, 3.5 to 3.5.17 and earlier unsupported versions are affected
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://moodle.org/mod/forum/discuss.php?d=422307; https://moodle.org/mod/forum/discuss.php?d=422307
CVE: CVE-2021-32474
Published: 2022-03-11
Description: An SQL injection risk existed on sites with MNet enabled and configured, via an XML-RPC call from the connected peer host. Note that this required site administrator access or access to the keypair. Moodle 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8, 3.5 to 3.5.17 and earlier unsupported versions are affected.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://moodle.org/mod/forum/discuss.php?d=422308; https://moodle.org/mod/forum/discuss.php?d=422308
CVE: CVE-2021-32475
Published: 2022-03-11
Description: ID numbers displayed in the quiz grading report required additional sanitizing to prevent a stored XSS risk. Moodle 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8, 3.5 to 3.5.17 and earlier unsupported versions are affected.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-78, CWE-79
References: https://moodle.org/mod/forum/discuss.php?d=422309; https://moodle.org/mod/forum/discuss.php?d=422309
CVE: CVE-2021-32476
Published: 2022-03-11
Description: A denial-of-service risk was identified in the draft files area, due to it not respecting user file upload limits. Moodle versions 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8, 3.5 to 3.5.17 and earlier unsupported versions are affected.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770, CWE-770
References: https://moodle.org/mod/forum/discuss.php?d=422310; https://moodle.org/mod/forum/discuss.php?d=422310
CVE: CVE-2021-32477
Published: 2022-03-11
Description: The last time a user accessed the mobile app is displayed on their profile page, but should be restricted to users with the relevant capability (site administrators by default). Moodle versions 3.10 to 3.10.3 are affected.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200, CWE-862
References: https://moodle.org/mod/forum/discuss.php?d=422313; https://moodle.org/mod/forum/discuss.php?d=422313
CVE: CVE-2021-32478
Published: 2022-03-11
Description: The redirect URI in the LTI authorization endpoint required extra sanitizing to prevent reflected XSS and open redirect risks. Moodle versions 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8 and earlier unsupported versions are affected.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79, CWE-601
References: https://moodle.org/mod/forum/discuss.php?d=422314; https://moodle.org/mod/forum/discuss.php?d=422314
CVE: CVE-2021-33150
Published: 2022-03-11
Description: Hardware allows activation of test or debug logic at runtime for some Intel(R) Trace Hub instances which may allow an unauthenticated user to potentially enable escalation of privilege via physical access.
CVSS Score: 6.8 (MEDIUM)
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00609.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00609.html