deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-4586
Published: 2022-12-17
Description: A vulnerability classified as problematic was found in Opencaching Deutschland oc-server3. This vulnerability affects unknown code of the file htdocs/templates2/ocstyle/cachelists.tpl of the component Cachelist Handler. The manipulation of the argument name_filter/by_filter leads to cross site scripting. The attack can be initiated remotely. The name of the patch is a9f79c7da78cd24a7ef1d298e6bc86006972ea73. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-216172.
CVSS Score: 3.5 (LOW)
CWE: CWE-707, CWE-79
References: https://github.com/OpencachingDeutschland/oc-server3/commit/a9f79c7da78cd24a7ef1d298e6bc86006972ea73; https://github.com/OpencachingDeutschland/oc-server3/pull/894; https://vuldb.com/?id.216172
CVE: CVE-2022-4587
Published: 2022-12-17
Description: A vulnerability, which was classified as problematic, has been found in Opencaching Deutschland oc-server3. This issue affects some unknown processing of the file htdocs/templates2/ocstyle/login.tpl of the component Login Page. The manipulation of the argument username leads to cross site scripting. The attack may be initiated remotely. The name of the patch is 3296ebd61e7fe49e93b5755d5d7766d6e94a7667. It is recommended to apply a patch to fix this issue. The identifier VDB-216173 was assigned to this vulnerability.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-707, CWE-79
References: https://github.com/OpencachingDeutschland/oc-server3/commit/3296ebd61e7fe49e93b5755d5d7766d6e94a7667; https://github.com/OpencachingDeutschland/oc-server3/pull/893; https://vuldb.com/?id.216173
CVE: CVE-2022-4588
Published: 2022-12-17
Description: A vulnerability, which was classified as problematic, was found in Boston Sleep slice up to 84.1.x. Affected is an unknown function of the component Layout Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 84.2.0 is able to address this issue. The name of the patch is 6523bb17d889e2ab13d767f38afefdb37083f1d0. It is recommended to upgrade the affected component. VDB-216174 is the identifier assigned to this vulnerability.
CVSS Score: 2.4 (LOW)
CWE: CWE-79
References: https://github.com/sleepepi/slice/commit/6523bb17d889e2ab13d767f38afefdb37083f1d0; https://github.com/sleepepi/slice/releases/tag/v84.2.0; https://vuldb.com/?id.216174
CVE: CVE-2022-4589
Published: 2022-12-17
Description: A vulnerability has been found in cyface Terms and Conditions Module up to 2.0.9 and classified as problematic. Affected by this vulnerability is the function returnTo of the file termsandconditions/views.py. The manipulation leads to open redirect. The attack can be launched remotely. Upgrading to version 2.0.10 is able to address this issue. The name of the patch is 03396a1c2e0af95e12a45c5faef7e47a4b513e1a. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-216175.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-601
References: https://github.com/cyface/django-termsandconditions/commit/03396a1c2e0af95e12a45c5faef7e47a4b513e1a; https://github.com/cyface/django-termsandconditions/pull/239; https://github.com/cyface/django-termsandconditions/releases/tag/v2.0.10
CVE: CVE-2021-4246
Published: 2022-12-17
Description: A vulnerability was found in roxlukas LMeve and classified as critical. Affected by this issue is some unknown functionality of the component Login Page. The manipulation of the argument X-Forwarded-For leads to sql injection. The attack may be launched remotely. The name of the patch is 29e1ead3bb1c1fad53b77dfc[PII_REDACTED]c5b5d. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-216176.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-707, CWE-89
References: https://github.com/roxlukas/lmeve/commit/29e1ead3bb1c1fad53b77dfc[PII_REDACTED]c5b5d; https://vuldb.com/?id.216176; https://github.com/roxlukas/lmeve/commit/29e1ead3bb1c1fad53b77dfc[PII_REDACTED]c5b5d
CVE: CVE-2022-4590
Published: 2022-12-17
Description: A vulnerability was found in mschaef toto up to 1.4.20. It has been classified as problematic. This affects an unknown part of the component Todo List Handler. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 1.4.21 is able to address this issue. The name of the patch is fdc825ac5249f40683377e8a526a06cdc6870125. It is recommended to upgrade the affected component. The identifier VDB-216177 was assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-707, CWE-79
References: https://github.com/mschaef/toto/commit/fdc825ac5249f40683377e8a526a06cdc6870125; https://github.com/mschaef/toto/releases/tag/1.4.21; https://vuldb.com/?id.216177
CVE: CVE-2022-4591
Published: 2022-12-17
Description: A vulnerability was found in mschaef toto up to 1.4.20. It has been declared as problematic. This vulnerability affects unknown code of the component Email Parameter Handler. The manipulation leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 1.4.21 is able to address this issue. The name of the patch is 1f27f37c1a06f54a76971f70eaa6139dc139bdf9. It is recommended to upgrade the affected component. VDB-216178 is the identifier assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-707, CWE-79
References: https://github.com/mschaef/toto/commit/1f27f37c1a06f54a76971f70eaa6139dc139bdf9; https://github.com/mschaef/toto/releases/tag/1.4.21; https://vuldb.com/?id.216178
CVE: CVE-2022-47514
Published: 2022-12-18
Description: An XML external entity (XXE) injection vulnerability in XML-RPC.NET before 2.5.0 allows remote authenticated users to conduct server-side request forgery (SSRF) attacks, as demonstrated by a pingback.aspx POST request.
CVSS Score: 8.8 (HIGH)
CWE: CWE-611
References: https://github.com/jumpycastle/xmlrpc.net-poc; https://papercutsoftware.github.io/XML-RPC.NET/download.html; https://github.com/jumpycastle/xmlrpc.net-poc
CVE: CVE-2022-47515
Published: 2022-12-18
Description: An issue was discovered in drachtio-server before 0.8.20. It allows remote attackers to cause a denial of service (daemon crash) via a long message in a TCP request that leads to std::length_error.
CVSS Score: 7.5 (HIGH)
CWE: CWE-170
References: https://github.com/drachtio/drachtio-server/commit/4cf9fe2c420b86c16442215d449d40be777c1911; https://github.com/drachtio/drachtio-server/issues/245; https://github.com/drachtio/drachtio-server/commit/4cf9fe2c420b86c16442215d449d40be777c1911
CVE: CVE-2022-47516
Published: 2022-12-18
Description: An issue was discovered in the libsofia-sip fork in drachtio-server before 0.8.20. It allows remote attackers to cause a denial of service (daemon crash) via a crafted UDP message that leads to a failure of the libsofia-sip-ua/tport/tport.c self assertion.
CVSS Score: 7.5 (HIGH)
CWE: CWE-617, CWE-617
References: https://github.com/davehorton/sofia-sip/commit/13b2a135287caa2d67ac6cd[PII_REDACTED]e25b377; https://github.com/drachtio/drachtio-server/issues/244; https://lists.debian.org/debian-lts-announce/2023/02/msg00028.html
CVE: CVE-2022-47517
Published: 2022-12-18
Description: An issue was discovered in the libsofia-sip fork in drachtio-server before 0.8.19. It allows remote attackers to cause a denial of service (daemon crash) via a crafted UDP message that causes a url_canonize2 heap-based buffer over-read because of an off-by-one error.
CVSS Score: 7.5 (HIGH)
CWE: CWE-193, CWE-193
References: https://github.com/davehorton/sofia-sip/commit/22c1bd191f0acbf11f0c0fbea1845d9bf9dcd47e; https://github.com/davehorton/sofia-sip/commit/bfc79d85c8f3a4798a3305fb98f5a11c11d0d29f; https://github.com/drachtio/drachtio-server/issues/243
CVE: CVE-2022-47518
Published: 2022-12-18
Description: An issue was discovered in the Linux kernel before 6.0.11. Missing validation of the number of channels in drivers/net/wireless/microchip/wilc1000/cfg80211.c in the WILC1000 wireless driver can trigger a heap-based buffer overflow when copying the list of operating channels from Wi-Fi management frames.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://github.com/torvalds/linux/commit/0cdfa9e6f0915e3d243e2393bfa8a22e12d553b0; https://lists.debian.org/debian-lts-announce/2022/12/msg00031.html; https://lore.kernel.org/r/[PII_REDACTED]3543.8568-5-philipturnbull%40github.com
CVE: CVE-2022-47519
Published: 2022-12-18
Description: An issue was discovered in the Linux kernel before 6.0.11. Missing validation of IEEE80211_P2P_ATTR_OPER_CHANNEL in drivers/net/wireless/microchip/wilc1000/cfg80211.c in the WILC1000 wireless driver can trigger an out-of-bounds write when parsing the channel list attribute from Wi-Fi management frames.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://github.com/torvalds/linux/commit/051ae669e4505abbe05165bebf6be7922de11f41; https://lists.debian.org/debian-lts-announce/2022/12/msg00031.html; https://lore.kernel.org/r/[PII_REDACTED]3543.8568-3-philipturnbull%40github.com
CVE: CVE-2022-47520
Published: 2022-12-18
Description: An issue was discovered in the Linux kernel before 6.0.11. Missing offset validation in drivers/net/wireless/microchip/wilc1000/hif.c in the WILC1000 wireless driver can trigger an out-of-bounds read when parsing a Robust Security Network (RSN) information element from a Netlink packet.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125, CWE-125
References: https://github.com/torvalds/linux/commit/cd21d99e595ec1d8721e1058dcdd4f1f7de1d793; https://lists.debian.org/debian-lts-announce/2022/12/msg00031.html; https://lore.kernel.org/r/[PII_REDACTED]3543.8568-2-philipturnbull%40github.com
CVE: CVE-2022-47521
Published: 2022-12-18
Description: An issue was discovered in the Linux kernel before 6.0.11. Missing validation of IEEE80211_P2P_ATTR_CHANNEL_LIST in drivers/net/wireless/microchip/wilc1000/cfg80211.c in the WILC1000 wireless driver can trigger a heap-based buffer overflow when parsing the operating channel attribute from Wi-Fi management frames.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://github.com/torvalds/linux/commit/f9b62f9843c7b0afdaecabbcebf1dbba18599408; https://lists.debian.org/debian-lts-announce/2022/12/msg00031.html; https://lore.kernel.org/r/[PII_REDACTED]3543.8568-4-philipturnbull%40github.com
CVE: CVE-2021-4247
Published: 2022-12-18
Description: A vulnerability has been found in OWASP NodeGoat and classified as problematic. This vulnerability affects unknown code of the file app/routes/research.js of the component Query Parameter Handler. The manipulation leads to denial of service. The attack can be initiated remotely. The name of the patch is 4a4d1db74c63fb4ff8d366551c3af006c25ead12. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-216184.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-404
References: https://github.com/OWASP/NodeGoat/commit/4a4d1db74c63fb4ff8d366551c3af006c25ead12; https://github.com/OWASP/NodeGoat/issues/225; https://vuldb.com/?id.216184
CVE: CVE-2022-4592
Published: 2022-12-18
Description: A vulnerability was found in luckyshot CRMx and classified as critical. This issue affects the function get/save/delete/comment/commentdelete of the file index.php. The manipulation leads to sql injection. The attack may be initiated remotely. The name of the patch is 8c62d274986137d6a1d06958a6f75c3553f45f8f. It is recommended to apply a patch to fix this issue. The identifier VDB-216185 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-707, CWE-89
References: https://github.com/luckyshot/CRMx/commit/8c62d274986137d6a1d06958a6f75c3553f45f8f; https://vuldb.com/?id.216185; https://github.com/luckyshot/CRMx/commit/8c62d274986137d6a1d06958a6f75c3553f45f8f
CVE: CVE-2022-4593
Published: 2022-12-18
Description: A vulnerability was found in retra-system. It has been classified as problematic. Affected is an unknown function. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The name of the patch is a6d94ab88f4a6f631a14c59b72461140fb57ae1f. It is recommended to apply a patch to fix this issue. VDB-216186 is the identifier assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-707, CWE-79
References: https://github.com/retra/retra-system/commit/a6d94ab88f4a6f631a14c59b72461140fb57ae1f; https://vuldb.com/?id.216186; https://github.com/retra/retra-system/commit/a6d94ab88f4a6f631a14c59b72461140fb57ae1f
CVE: CVE-2022-4594
Published: 2022-12-18
Description: A vulnerability was found in drogatkin TJWS2. It has been declared as critical. Affected by this vulnerability is the function deployWar of the file 1.x/src/rogatkin/web/WarRoller.java. The manipulation leads to path traversal. The attack can be launched remotely. The name of the patch is 1bac15c496ec54efe21ad7fab4e[PII_REDACTED]fc. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-216187.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-22
References: https://github.com/drogatkin/TJWS2/commit/1bac15c496ec54efe21ad7fab4e[PII_REDACTED]fc; https://vuldb.com/?id.216187; https://github.com/drogatkin/TJWS2/commit/1bac15c496ec54efe21ad7fab4e[PII_REDACTED]fc
CVE: CVE-2021-4248
Published: 2022-12-18
Description: A vulnerability was found in kapetan dns up to 6.1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file DNS/Protocol/Request.cs. The manipulation leads to insufficient entropy in prng. The attack may be launched remotely. Upgrading to version 7.0.0 is able to address this issue. The name of the patch is cf7105aa2aae90d6656088fe5a8ee1d5730773b6. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-216188.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-330
References: https://github.com/kapetan/dns/commit/cf7105aa2aae90d6656088fe5a8ee1d5730773b6; https://github.com/kapetan/dns/pull/88; https://github.com/kapetan/dns/releases/tag/v7.0.0
CVE: CVE-2022-4595
Published: 2022-12-18
Description: A vulnerability classified as problematic has been found in django-openipam. This affects an unknown part of the file openipam/report/templates/report/exposed_hosts.html. The manipulation of the argument description leads to cross site scripting. It is possible to initiate the attack remotely. The name of the patch is a6223a1150d60cd036106ba6a8e676c1bfc3cc85. It is recommended to apply a patch to fix this issue. The identifier VDB-216189 was assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-707
References: https://github.com/openipam/django-openipam/commit/a6223a1150d60cd036106ba6a8e676c1bfc3cc85; https://github.com/openipam/django-openipam/pull/205; https://vuldb.com/?id.216189
CVE: CVE-2022-4596
Published: 2022-12-18
Description: A vulnerability, which was classified as problematic, has been found in Shoplazza 1.1. This issue affects some unknown processing of the file /admin/api/admin/articles/ of the component Add Blog Post Handler. The manipulation of the argument Title leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-216191.
CVSS Score: 3.5 (LOW)
CWE: CWE-707
References: https://seclists.org/fulldisclosure/2022/Dec/11; https://seclists.org/fulldisclosure/2022/Dec/att-11/proof-of-concept-shoplazza.txt; https://vuldb.com/?id.216191
CVE: CVE-2022-4597
Published: 2022-12-18
Description: A vulnerability, which was classified as problematic, was found in Shoplazza LifeStyle 1.1. Affected is an unknown function of the file /admin/api/admin/v2_products of the component Create Product Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-216192.
CVSS Score: 3.5 (LOW)
CWE: CWE-707, CWE-79
References: https://seclists.org/fulldisclosure/2022/Dec/11; https://seclists.org/fulldisclosure/2022/Dec/att-11/proof-of-concept-shoplazza.txt; https://vuldb.com/?id.216192
CVE: CVE-2022-4598
Published: 2022-12-18
Description: A vulnerability has been found in Shoplazza LifeStyle 1.1 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/api/theme-edit/ of the component Announcement Handler. The manipulation of the argument Text/Mobile Text leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-216193 was assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-707, CWE-79
References: https://seclists.org/fulldisclosure/2022/Dec/11; https://seclists.org/fulldisclosure/2022/Dec/att-11/proof-of-concept-shoplazza.txt; https://vuldb.com/?id.216193
CVE: CVE-2022-4599
Published: 2022-12-18
Description: A vulnerability was found in Shoplazza LifeStyle 1.1 and classified as problematic. Affected by this issue is some unknown functionality of the file /admin/api/theme-edit/ of the component Product Handler. The manipulation of the argument Subheading/Heading/Text/Button Text/Label leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-216194 is the identifier assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-707, CWE-79
References: https://seclists.org/fulldisclosure/2022/Dec/11; https://seclists.org/fulldisclosure/2022/Dec/att-11/proof-of-concept-shoplazza.txt; https://vuldb.com/?id.216194
CVE: CVE-2022-4600
Published: 2022-12-18
Description: A vulnerability was found in Shoplazza LifeStyle 1.1. It has been classified as problematic. This affects an unknown part of the file /admin/api/theme-edit/ of the component Product Carousel Handler. The manipulation of the argument Heading/Description leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-216195.
CVSS Score: 3.5 (LOW)
CWE: CWE-707, CWE-79
References: https://seclists.org/fulldisclosure/2022/Dec/11; https://seclists.org/fulldisclosure/2022/Dec/att-11/proof-of-concept-shoplazza.txt; https://vuldb.com/?id.216195
CVE: CVE-2022-4601
Published: 2022-12-18
Description: A vulnerability was found in Shoplazza LifeStyle 1.1. It has been declared as problematic. This vulnerability affects unknown code of the file /admin/api/theme-edit/ of the component Shipping/Member Discount/Icon. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-216196.
CVSS Score: 3.5 (LOW)
CWE: CWE-707, CWE-79
References: https://seclists.org/fulldisclosure/2022/Dec/11; https://seclists.org/fulldisclosure/2022/Dec/att-11/proof-of-concept-shoplazza.txt; https://vuldb.com/?id.216196
CVE: CVE-2022-4602
Published: 2022-12-18
Description: A vulnerability was found in Shoplazza LifeStyle 1.1. It has been rated as problematic. This issue affects some unknown processing of the file /admin/api/theme-edit/ of the component Review Flow Handler. The manipulation of the argument Title leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-216197 was assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-707, CWE-79
References: https://seclists.org/fulldisclosure/2022/Dec/11; https://seclists.org/fulldisclosure/2022/Dec/att-11/proof-of-concept-shoplazza.txt; https://vuldb.com/?id.216197
CVE: CVE-2022-4603
Published: 2022-12-18
Description: A vulnerability classified as problematic has been found in ppp. Affected is the function dumpppp of the file pppdump/pppdump.c of the component pppdump. The manipulation of the argument spkt.buf/rpkt.buf leads to improper validation of array index. The real existence of this vulnerability is still doubted at the moment. The name of the patch is a75fb7b198eed50d769c80c36629f38346882cbf. It is recommended to apply a patch to fix this issue. VDB-216198 is the identifier assigned to this vulnerability. NOTE: pppdump is not used in normal process of setting up a PPP connection, is not installed setuid-root, and is not invoked automatically in any scenario.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119, CWE-119
References: https://github.com/ppp-project/ppp/commit/a75fb7b198eed50d769c80c36629f38346882cbf; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J43NP7ABHOCIWOFHWCH6ZCZOYKZH6723/; https://vuldb.com/?id.216198
CVE: CVE-2022-4604
Published: 2022-12-18
Description: A vulnerability classified as problematic was found in wp-english-wp-admin Plugin up to 1.5.1. Affected by this vulnerability is the function register_endpoints of the file english-wp-admin.php. The manipulation leads to cross-site request forgery. The attack can be launched remotely. Upgrading to version 1.5.2 is able to address this issue. The name of the patch is ad4ba171c974c65c3456e7c6228f59f40783b33d. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-216199.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://github.com/khromov/wp-english-wp-admin/commit/ad4ba171c974c65c3456e7c6228f59f40783b33d; https://github.com/khromov/wp-english-wp-admin/releases/tag/1.5.2; https://vuldb.com/?id.216199
CVE: CVE-2022-4606
Published: 2022-12-18
Description: PHP Remote File Inclusion in GitHub repository flatpressblog/flatpress prior to 1.3.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-98
References: https://github.com/flatpressblog/flatpress/commit/c30d52b28483e1e512d0d81758d4c149f02b4068; https://huntr.dev/bounties/3dab0466-c35d-4163-b3c7-a8666e2f7d95; https://github.com/flatpressblog/flatpress/commit/c30d52b28483e1e512d0d81758d4c149f02b4068
CVE: CVE-2022-4605
Published: 2022-12-18
Description: Cross-site Scripting (XSS) - Stored in GitHub repository flatpressblog/flatpress prior to 1.3.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/flatpressblog/flatpress/commit/742f8b04f233e3cc52bed11f79fcc9911faee776; https://huntr.dev/bounties/df455d44-0dec-470c-b576-8ea86ec5a367; https://github.com/flatpressblog/flatpress/commit/742f8b04f233e3cc52bed11f79fcc9911faee776
CVE: CVE-2020-36617
Published: 2022-12-18
Description: A vulnerability was found in ewxrjk sftpserver. It has been declared as problematic. Affected by this vulnerability is the function sftp_parse_path of the file parse.c. The manipulation leads to uninitialized pointer. The real existence of this vulnerability is still doubted at the moment. The name of the patch is bf4032f34832ee11d79aa60a226cc018e7ec5eed. It is recommended to apply a patch to fix this issue. The identifier VDB-216205 was assigned to this vulnerability. NOTE: In some deployment models this would be a vulnerability. README specifically warns about avoiding such deployment models.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-908
References: https://github.com/ewxrjk/sftpserver/commit/bf4032f34832ee11d79aa60a226cc018e7ec5eed; https://vuldb.com/?id.216205; https://github.com/ewxrjk/sftpserver/commit/bf4032f34832ee11d79aa60a226cc018e7ec5eed
CVE: CVE-2021-4249
Published: 2022-12-18
Description: A vulnerability was found in xml-conduit. It has been classified as problematic. Affected is an unknown function of the file xml-conduit/src/Text/XML/Stream/Parse.hs of the component DOCTYPE Entity Expansion Handler. The manipulation leads to infinite loop. It is possible to launch the attack remotely. Upgrading to version 1.9.1.0 is able to address this issue. The name of the patch is 4be1021791dcdee8b164d239433a2043dc0939ea. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-216204.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-404
References: https://github.com/snoyberg/xml/commit/4be1021791dcdee8b164d239433a2043dc0939ea; https://github.com/snoyberg/xml/pull/161; https://hackage.haskell.org/package/xml-conduit-1.9.1.0