deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2014-125006
Published: 2022-06-18
Description: A vulnerability, which was classified as problematic, has been found in FFmpeg 2.0. Affected by this issue is the function output_frame of the file libavcodec/h264.c. The manipulation leads to memory corruption. The attack may be launched remotely. It is recommended to apply a patch to fix this issue.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-119, CWE-787
References: http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=8c55ff393340998faae887dfac19e7ef128e1e58; https://vuldb.com/?id.12584; http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=8c55ff393340998faae887dfac19e7ef128e1e58
CVE: CVE-2014-125007
Published: 2022-06-18
Description: A vulnerability classified as problematic was found in FFmpeg 2.0. Affected by this vulnerability is the function intra_pred of the file libavcodec/hevcpred_template.c. The manipulation leads to memory corruption. The attack can be launched remotely. It is recommended to apply a patch to fix this issue.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-119, CWE-787
References: http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=dfefc9097e9b4bb20442e65454a40043bd189b3d; https://vuldb.com/?id.12583; http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=dfefc9097e9b4bb20442e65454a40043bd189b3d
CVE: CVE-2014-125008
Published: 2022-06-18
Description: A vulnerability classified as problematic has been found in FFmpeg 2.0. Affected is the function vorbis_header of the file libavformat/oggparsevorbis.c. The manipulation leads to memory corruption. It is possible to launch the attack remotely. It is recommended to apply a patch to fix this issue.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-119, CWE-787
References: http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=f5d1d1e4667ba346ea7e0f97e6d2756bc9d4abde; https://vuldb.com/?id.12582; http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=f5d1d1e4667ba346ea7e0f97e6d2756bc9d4abde
CVE: CVE-2014-125009
Published: 2022-06-18
Description: A vulnerability classified as problematic has been found in FFmpeg 2.0. This affects the function add_yblock of the file libavcodec/snow.h. The manipulation leads to memory corruption. It is possible to initiate the attack remotely. It is recommended to apply a patch to fix this issue.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-119, CWE-787
References: http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=61d59703c91869f4e5cdacd8d6be52f8b89d4ba4; https://vuldb.com/?id.12393; http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=61d59703c91869f4e5cdacd8d6be52f8b89d4ba4
CVE: CVE-2014-125010
Published: 2022-06-18
Description: A vulnerability was found in FFmpeg 2.0. It has been rated as critical. Affected by this issue is the function decode_slice_header of the file libavcodec/h64.c. The manipulation leads to memory corruption. The attack may be launched remotely. It is recommended to apply a patch to fix this issue.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-119, CWE-787
References: http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=91253839e14cce9793ee93f184cef609ca8195d5; https://vuldb.com/?id.12392; http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=91253839e14cce9793ee93f184cef609ca8195d5
CVE: CVE-2014-125011
Published: 2022-06-18
Description: A vulnerability was found in FFmpeg 2.0. It has been declared as problematic. Affected by this vulnerability is the function decode_frame of the file libavcodec/ansi.c. The manipulation leads to integer coercion error. The attack can be launched remotely. It is recommended to apply a patch to fix this issue.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-192, CWE-681
References: http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=d42ec8433c687fcbccefa51a7716d81920218e4f; https://vuldb.com/?id.12391; http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=d42ec8433c687fcbccefa51a7716d81920218e4f
CVE: CVE-2014-125012
Published: 2022-06-18
Description: A vulnerability was found in FFmpeg 2.0. It has been classified as problematic. Affected is an unknown function of the file libavcodec/dxtroy.c. The manipulation leads to integer coercion error. It is possible to launch the attack remotely. It is recommended to apply a patch to fix this issue.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-192, CWE-681
References: http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=a392bf657015c9a79a5a13adfbfb15086c1943b9; https://vuldb.com/?id.12390; http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=a392bf657015c9a79a5a13adfbfb15086c1943b9
CVE: CVE-2014-125013
Published: 2022-06-18
Description: A vulnerability was found in FFmpeg 2.0 and classified as problematic. This issue affects the function msrle_decode_frame of the file libavcodec/msrle.c. The manipulation leads to memory corruption. The attack may be initiated remotely. It is recommended to apply a patch to fix this issue.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-119, CWE-787
References: http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=c919e1ca2ecfc47d796382973ba0e48b8f6f92a2; https://vuldb.com/?id.12389; http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=c919e1ca2ecfc47d796382973ba0e48b8f6f92a2
CVE: CVE-2014-125014
Published: 2022-06-18
Description: A vulnerability classified as problematic was found in FFmpeg 2.0. Affected by this vulnerability is an unknown functionality of the component HEVC Video Decoder. The manipulation leads to memory corruption. The attack can be launched remotely. It is recommended to apply a patch to fix this issue.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-119, CWE-787
References: http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=d1e6602665; https://vuldb.com/?id.12367; http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=d1e6602665
CVE: CVE-2014-125015
Published: 2022-06-18
Description: A vulnerability classified as critical has been found in FFmpeg 2.0. Affected is the function read_var_block_data. The manipulation leads to memory corruption. It is possible to launch the attack remotely. It is recommended to apply a patch to fix this issue.
CVSS Score: 7.3 (HIGH)
CWE: CWE-119, CWE-787
References: http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=18f94df8af; https://vuldb.com/?id.12366; http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=18f94df8af
CVE: CVE-2014-125016
Published: 2022-06-18
Description: A vulnerability was found in FFmpeg 2.0. It has been rated as problematic. This issue affects the function ff_init_buffer_info of the file utils.c. The manipulation leads to memory corruption. The attack may be initiated remotely. It is recommended to apply a patch to fix this issue.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-119, CWE-787
References: http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=e5c7229999; https://vuldb.com/?id.12365; http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=e5c7229999
CVE: CVE-2014-125017
Published: 2022-06-18
Description: A vulnerability classified as critical was found in FFmpeg 2.0. This vulnerability affects the function rpza_decode_stream. The manipulation leads to memory corruption. The attack can be initiated remotely. The name of the patch is Fixes Invalid Writes. It is recommended to apply a patch to fix this issue.
CVSS Score: 7.3 (HIGH)
CWE: CWE-119, CWE-125
References: http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=77bb0004bbe18f1498cfecdc68db5f10808b6599; https://vuldb.com/?id.12340; http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=77bb0004bbe18f1498cfecdc68db5f10808b6599
CVE: CVE-2021-46822
Published: 2022-06-18
Description: The PPM reader in libjpeg-turbo through 2.0.90 mishandles use of tjLoadImage for loading a 16-bit binary PPM file into a grayscale buffer and loading a 16-bit binary PGM file into an RGB buffer. This is related to a heap-based buffer overflow in the get_word_rgb_row function in rdppm.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/221567; https://github.com/libjpeg-turbo/libjpeg-turbo/commit/f35fd27ec641c42d6b115bfa595e483ec58188d2; https://exchange.xforce.ibmcloud.com/vulnerabilities/221567
CVE: CVE-2021-46823
Published: 2022-06-18
Description: python-ldap before 3.4.0 is vulnerable to a denial of service when ldap.schema is used for untrusted schema definitions, because of a regular expression denial of service (ReDoS) flaw in the LDAP schema parser. By sending crafted regex input, a remote authenticated attacker could exploit this vulnerability to cause a denial of service condition.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-1333
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/221507; https://github.com/python-ldap/python-ldap/security/advisories/GHSA-r8wq-qrxc-hmcm; https://exchange.xforce.ibmcloud.com/vulnerabilities/221507
CVE: CVE-2022-33981
Published: 2022-06-18
Description: drivers/block/floppy.c in the Linux kernel before 5.17.6 is vulnerable to a denial of service, because of a concurrency use-after-free flaw after deallocating raw_cmd in the raw_cmd_ioctl function.
CVSS Score: 3.3 (LOW)
CWE: CWE-416, CWE-416
References: https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.17.6; https://exchange.xforce.ibmcloud.com/vulnerabilities/225362; https://github.com/torvalds/linux/commit/233087ca063686964a53c829d547c7571e3f67bf
CVE: CVE-2022-33987
Published: 2022-06-18
Description: The got package before 12.1.0 (also fixed in 11.8.5) for Node.js allows a redirect to a UNIX socket.
CVSS Score: 5.3 (MEDIUM)
References: https://github.com/sindresorhus/got/compare/v12.0.3...v12.1.0; https://github.com/sindresorhus/got/pull/2047; https://github.com/sindresorhus/got/releases/tag/v11.8.5
CVE: CVE-2014-125018
Published: 2022-06-19
Description: A vulnerability, which was classified as problematic, has been found in FFmpeg 2.0. Affected by this issue is the function decode_slice_header. The manipulation leads to memory corruption. The attack may be launched remotely. It is recommended to apply a patch to fix this issue.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-119, CWE-787
References: http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=8a3b85f3a7; https://vuldb.com/?id.12296; http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=8a3b85f3a7
CVE: CVE-2014-125019
Published: 2022-06-19
Description: A vulnerability, which was classified as problematic, was found in FFmpeg 2.0. This affects the function decode_nal_unit of the component Slice Segment Handler. The manipulation leads to memory corruption. It is possible to initiate the attack remotely. It is recommended to apply a patch to fix this issue.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-119, CWE-787
References: http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=b25e84b739; https://vuldb.com/?id.12297; http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=b25e84b739
CVE: CVE-2014-125020
Published: 2022-06-19
Description: A vulnerability has been found in FFmpeg 2.0 and classified as critical. This vulnerability affects the function decode_update_thread_context. The manipulation leads to memory corruption. The attack can be initiated remotely. It is recommended to apply a patch to fix this issue.
CVSS Score: 7.3 (HIGH)
CWE: CWE-119, CWE-787
References: http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=1f097d168d; https://vuldb.com/?id.12298; http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=1f097d168d
CVE: CVE-2014-125021
Published: 2022-06-19
Description: A vulnerability was found in FFmpeg 2.0 and classified as problematic. This issue affects the function cmv_process_header. The manipulation leads to memory corruption. The attack may be initiated remotely. It is recommended to apply a patch to fix this issue.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-119, CWE-787
References: http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=[PII_REDACTED]; https://vuldb.com/?id.12299; http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=[PII_REDACTED]
CVE: CVE-2014-125022
Published: 2022-06-19
Description: A vulnerability was found in FFmpeg 2.0. It has been classified as problematic. Affected is the function shorten_decode_frame of the component Bitstream Buffer. The manipulation leads to memory corruption. It is possible to launch the attack remotely. It is recommended to apply a patch to fix this issue.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-119, CWE-787
References: http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=1713eec29a; https://vuldb.com/?id.12300; http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=1713eec29a
CVE: CVE-2014-125023
Published: 2022-06-19
Description: A vulnerability was found in FFmpeg 2.0. It has been declared as problematic. Affected by this vulnerability is the function truemotion1_decode_header of the component Truemotion1 Handler. The manipulation leads to memory corruption. The attack can be launched remotely. It is recommended to apply a patch to fix this issue.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-119, CWE-787
References: http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=2240e2078d; https://vuldb.com/?id.12301; http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=2240e2078d
CVE: CVE-2014-125024
Published: 2022-06-19
Description: A vulnerability was found in FFmpeg 2.0. It has been rated as critical. Affected by this issue is the function lag_decode_frame. The manipulation leads to memory corruption. The attack may be launched remotely. It is recommended to apply a patch to fix this issue.
CVSS Score: 7.3 (HIGH)
CWE: CWE-119, CWE-787
References: http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=4c3e1956ee; https://vuldb.com/?id.12302; http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=4c3e1956ee
CVE: CVE-2014-125025
Published: 2022-06-19
Description: A vulnerability classified as problematic has been found in FFmpeg 2.0. This affects the function decode_pulses. The manipulation leads to memory corruption. It is possible to initiate the attack remotely. It is recommended to apply a patch to fix this issue.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-119, CWE-787
References: http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=6e42ccb9db; https://vuldb.com/?id.12303; http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=6e42ccb9db
CVE: CVE-2022-2124
Published: 2022-06-19
Description: Buffer Over-read in GitHub repository vim/vim prior to 8.2.
CVSS Score: 7.8 (HIGH)
CWE: CWE-126, CWE-125
References: http://seclists.org/fulldisclosure/2022/Oct/28; http://seclists.org/fulldisclosure/2022/Oct/41; http://seclists.org/fulldisclosure/2022/Oct/43
CVE: CVE-2022-23071
Published: 2022-06-19
Description: In Recipes, versions 0.9.1 through 1.2.5 are vulnerable to Server Side Request Forgery (SSRF), in the “Import Recipe” functionality. When an attacker enters the localhost URL, a low privileged attacker can access/read the internal file system to access sensitive information.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-918
References: https://github.com/TandoorRecipes/recipes/commit/d48fe26a3529cc1ee903ffb2758dfd8f7efaba8c; https://www.mend.io/vulnerability-database/CVE-2022-23071; https://github.com/TandoorRecipes/recipes/commit/d48fe26a3529cc1ee903ffb2758dfd8f7efaba8c
CVE: CVE-2022-2125
Published: 2022-06-19
Description: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: http://seclists.org/fulldisclosure/2022/Oct/28; http://seclists.org/fulldisclosure/2022/Oct/41; http://seclists.org/fulldisclosure/2022/Oct/43
CVE: CVE-2022-2126
Published: 2022-06-19
Description: Out-of-bounds Read in GitHub repository vim/vim prior to 8.2.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125, CWE-125
References: http://seclists.org/fulldisclosure/2022/Oct/28; http://seclists.org/fulldisclosure/2022/Oct/41; http://seclists.org/fulldisclosure/2022/Oct/43
CVE: CVE-2022-2129
Published: 2022-06-19
Description: Out-of-bounds Write in GitHub repository vim/vim prior to 8.2.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://github.com/vim/vim/commit/d6211a52ab9f53b82f884561ed43d2fe4d24ff7d; https://huntr.dev/bounties/3aaf06e7-9ae1-454d-b8ca-8709c98e5352; https://lists.debian.org/debian-lts-announce/2022/11/msg00032.html
CVE: CVE-2022-34000
Published: 2022-06-19
Description: libjxl 0.6.1 has an assertion failure in LowMemoryRenderPipeline::Init() in render_pipeline/low_memory_render_pipeline.cc.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-617
References: https://github.com/libjxl/libjxl/issues/1477; https://security.gentoo.org/glsa/202210-36; https://github.com/libjxl/libjxl/issues/1477
CVE: CVE-2022-34005
Published: 2022-06-19
Description: An issue was discovered in TitanFTP (aka Titan FTP) NextGen before 1.2.1050. There is Remote Code Execution due to a hardcoded password for the sa account on the Microsoft SQL Express 2019 instance installed by default during TitanFTP NextGen installation, aka NX-I674 (sub-issue 1). NOTE: as of 2022-06-21, the 1.2.1050 release corrects this vulnerability in a new installation, but not in an upgrade installation.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://www.southrivertech.com/software/nextgen/titanftp/en/relnotes.pdf; https://www.southrivertech.com/software/nextgen/titanftp/en/relnotes.pdf
CVE: CVE-2022-34006
Published: 2022-06-19
Description: An issue was discovered in TitanFTP (aka Titan FTP) NextGen before 1.2.1050. When installing, Microsoft SQL Express 2019 installs by default with an SQL instance running as SYSTEM with BUILTIN\Users as sysadmin, thus enabling unprivileged Windows users to execute commands locally as NT AUTHORITY\SYSTEM, aka NX-I674 (sub-issue 2). NOTE: as of 2022-06-21, the 1.2.1050 release corrects this vulnerability in a new installation, but not in an upgrade installation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://www.southrivertech.com/software/nextgen/titanftp/en/relnotes.pdf; https://www.southrivertech.com/software/nextgen/titanftp/en/relnotes.pdf
CVE: CVE-2022-1836
Published: 2022-06-19
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2022-33981. Reason: This candidate is a reservation duplicate of CVE-2022-33981. Notes: All CVE users should reference CVE-2022-33981 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2022-2023
Published: 2022-06-20
Description: Incorrect Use of Privileged APIs in GitHub repository polonel/trudesk prior to 1.2.4.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-648, CWE-269
References: https://github.com/polonel/trudesk/commit/83fd5a89319ba2c2f5934722e39b08aba9b3a4ac; https://huntr.dev/bounties/0f35b1d3-56e6-49e4-bc5a-830f52e094b3; https://github.com/polonel/trudesk/commit/83fd5a89319ba2c2f5934722e39b08aba9b3a4ac
CVE: CVE-2017-20057
Published: 2022-06-20
Description: A vulnerability classified as problematic has been found in Elefant CMS 1.3.12-RC. Affected is an unknown function. The manipulation of the argument username leads to basic cross site scripting (Persistent). It is possible to launch the attack remotely. Upgrading to version 1.3.13 is able to address this issue. It is recommended to upgrade the affected component.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-80, CWE-79
References: http://seclists.org/fulldisclosure/2017/Feb/36; https://vuldb.com/?id.97254; http://seclists.org/fulldisclosure/2017/Feb/36
CVE: CVE-2017-20058
Published: 2022-06-20
Description: A vulnerability classified as problematic was found in Elefant CMS 1.3.12-RC. Affected by this vulnerability is an unknown functionality of the component Version Comparison. The manipulation leads to basic cross site scripting (Persistent). The attack can be launched remotely. Upgrading to version 1.3.13 is able to address this issue. It is recommended to upgrade the affected component.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-80, CWE-79
References: http://seclists.org/fulldisclosure/2017/Feb/36; https://vuldb.com/?id.97255; http://seclists.org/fulldisclosure/2017/Feb/36
CVE: CVE-2017-20059
Published: 2022-06-20
Description: A vulnerability, which was classified as problematic, has been found in Elefant CMS 1.3.12-RC. Affected by this issue is some unknown functionality of the component Title Handler. The manipulation with the input </title><img src=no onerror=alert(1)> leads to basic cross site scripting (Persistent). The attack may be launched remotely. Upgrading to version 1.3.13 is able to address this issue. It is recommended to upgrade the affected component.
CVSS Score: 3.5 (LOW)
CWE: CWE-80, CWE-79
References: http://seclists.org/fulldisclosure/2017/Feb/36; https://vuldb.com/?id.97256; http://seclists.org/fulldisclosure/2017/Feb/36
CVE: CVE-2017-20060
Published: 2022-06-20
Description: A vulnerability, which was classified as problematic, was found in Elefant CMS 1.3.12-RC. This affects an unknown part of the component Blog Post Handler. The manipulation leads to basic cross site scripting (Persistent). It is possible to initiate the attack remotely. Upgrading to version 1.3.13 is able to address this issue. It is recommended to upgrade the affected component.
CVSS Score: 3.5 (LOW)
CWE: CWE-80, CWE-79
References: http://seclists.org/fulldisclosure/2017/Feb/36; https://vuldb.com/?id.97257; http://seclists.org/fulldisclosure/2017/Feb/36
CVE: CVE-2017-20061
Published: 2022-06-20
Description: A vulnerability has been found in Elefant CMS 1.3.12-RC and classified as problematic. This vulnerability affects unknown code of the file /admin/extended. The manipulation of the argument name with the input %3Cimg%20src=no%20onerror=alert(1)%3E leads to basic cross site scripting (Reflected). The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.3.13 is able to address this issue. It is recommended to upgrade the affected component.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-80, CWE-79
References: http://seclists.org/fulldisclosure/2017/Feb/36; https://vuldb.com/?id.97258; http://seclists.org/fulldisclosure/2017/Feb/36
CVE: CVE-2017-20062
Published: 2022-06-20
Description: A vulnerability was found in Elefant CMS 1.3.12-RC and classified as problematic. This issue affects some unknown processing. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.3.13 is able to address this issue. It is recommended to upgrade the affected component.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-352, CWE-352
References: http://seclists.org/fulldisclosure/2017/Feb/37; https://vuldb.com/?id.97259; http://seclists.org/fulldisclosure/2017/Feb/37
CVE: CVE-2017-20063
Published: 2022-06-20
Description: A vulnerability was found in Elefant CMS 1.3.12-RC. It has been classified as critical. Affected is an unknown function of the file /filemanager/upload/drop of the component File Upload. The manipulation leads to improper privilege management. It is possible to launch the attack remotely. Upgrading to version 1.3.13 is able to address this issue. It is recommended to upgrade the affected component.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-269, CWE-434
References: http://seclists.org/fulldisclosure/2017/Feb/39; https://vuldb.com/?id.97260; http://seclists.org/fulldisclosure/2017/Feb/39
CVE: CVE-2017-20064
Published: 2022-06-20
Description: A vulnerability was found in Elefant CMS 1.3.12-RC. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /designer/add/layout. The manipulation leads to code injection. The attack can be launched remotely. Upgrading to version 1.3.13 is able to address this issue. It is recommended to upgrade the affected component.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-94, CWE-94
References: http://seclists.org/fulldisclosure/2017/Feb/39; https://vuldb.com/?id.97261; http://seclists.org/fulldisclosure/2017/Feb/39
CVE: CVE-2021-45918
Published: 2022-06-20
Description: NHI’s health insurance web service component has insufficient validation for input string length, which can result in heap-based buffer overflow attack. A remote attacker can exploit this vulnerability to flood the memory space reserved for the program, in order to terminate service without authentication, which requires a system restart to recover service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-122, CWE-1284
References: https://www.twcert.org.tw/tw/cp-132-6227-eaf49-1.html; https://www.twcert.org.tw/tw/cp-132-6227-eaf49-1.html