deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-41641
Published: 2022-06-12
Description: Deno <=1.14.0 file sandbox does not handle symbolic links correctly. When running Deno with specific write access, the Deno.symlink method can be used to gain access to any directory.
CVSS Score: 8.4 (HIGH)
CWE: CWE-59
References: https://github.com/denoland/deno/issues/12152; https://hackers.report/report/614876917a7b150012836bb8; https://github.com/denoland/deno/issues/12152
CVE: CVE-2022-2054
Published: 2022-06-12
Description: Code Injection in GitHub repository nuitka/nuitka prior to 0.9.
CVSS Score: 8.4 (HIGH)
CWE: CWE-94, CWE-94
References: https://github.com/nuitka/nuitka/commit/09647745d7cbb6ff32f9fa948f19d5558b32bcad; https://huntr.dev/bounties/ea4a842c-c48c-4aae-a[PII_REDACTED]c63a7; https://github.com/nuitka/nuitka/commit/09647745d7cbb6ff32f9fa948f19d5558b32bcad
CVE: CVE-2022-2013
Published: 2022-06-13
Description: In Octopus Server after version 2022.1.1495 and before 2022.1.2647 if private spaces were enabled via the experimental feature flag all new users would have access to the Script Console within their private space.
CVSS Score: 7.5 (HIGH)
References: https://advisories.octopus.com/post/2022/sa2022-05/; https://advisories.octopus.com/post/2022/sa2022-05/
CVE: CVE-2022-26041
Published: 2022-06-13
Description: Directory traversal vulnerability in RCCMD 4.26 and earlier allows a remote authenticated attacker with an administrative privilege to read or alter an arbitrary file on the server via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://jvn.jp/en/jp/JVN60801132/index.html; https://www.generex.de/support/downloads/software/rccmd/update; https://jvn.jp/en/jp/JVN60801132/index.html
CVE: CVE-2022-26834
Published: 2022-06-13
Description: Improper access control vulnerability in Rakuten Casa version AP_F_V1_4_1 or AP_F_V2_0_0 allows a remote attacker to obtain the information stored in the product because the product is set to accept HTTP connections from the WAN side by default.
CVSS Score: 7.5 (HIGH)
References: https://jvn.jp/en/jp/JVN46892984/index.html; https://network.mobile.rakuten.co.jp/information/news/product/1033/; https://jvn.jp/en/jp/JVN46892984/index.html
CVE: CVE-2022-27174
Published: 2022-06-13
Description: Cross-site request forgery (CSRF) vulnerability in Easy Blog for EC-CUBE4 Ver.1.0.1 and earlier allows a remote unauthenticated attacker to hijack the authentication of the administrator and delete a blog article or a category via a specially crafted page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://jvn.jp/en/jp/JVN46241173/index.html; https://www.ec-cube.net/products/detail.php?product_id=2217; https://jvn.jp/en/jp/JVN46241173/index.html
CVE: CVE-2022-27231
Published: 2022-06-13
Description: Cross-site scripting vulnerability exists in WP Statistics versions prior to 13.2.0 because it improperly processes a platform parameter. By exploiting this vulnerability, an arbitrary script may be executed on the web browser of the user who is logging in to the website using the product.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://jvn.jp/en/jp/JVN15241647/index.html; https://wordpress.org/plugins/wp-statistics/; https://wordpress.org/plugins/wp-statistics/#developers
CVE: CVE-2022-28704
Published: 2022-06-13
Description: Improper access control vulnerability in Rakuten Casa version AP_F_V1_4_1 or AP_F_V2_0_0 allows a remote attacker to log in with the root privilege and perform an arbitrary operation if the product is in its default settings in which is set to accept SSH connections from the WAN side, and is also connected to the Internet with the authentication information unchanged from the default settings.
CVSS Score: 7.2 (HIGH)
References: https://jvn.jp/en/jp/JVN46892984/index.html; https://network.mobile.rakuten.co.jp/information/news/product/1033/; https://jvn.jp/en/jp/JVN46892984/index.html
CVE: CVE-2022-29525
Published: 2022-06-13
Description: Rakuten Casa version AP_F_V1_4_1 or AP_F_V2_0_0 uses a hard-coded credential which may allow a remote unauthenticated attacker to log in with the root privilege and perform an arbitrary operation.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://jvn.jp/en/jp/JVN46892984/index.html; https://network.mobile.rakuten.co.jp/information/news/product/1033/; https://jvn.jp/en/jp/JVN46892984/index.html
CVE: CVE-2022-29894
Published: 2022-06-13
Description: Strapi v3.x.x versions and earlier contain a stored cross-site scripting vulnerability in file upload function. By exploiting this vulnerability, an arbitrary script may be executed on the web browser of the user who is logging in to the product with the administrative privilege.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/strapi/strapi; https://jvn.jp/en/jp/JVN44550983/index.html; https://strapi.io/
CVE: CVE-2017-20041
Published: 2022-06-13
Description: A vulnerability was found in Ucweb UC Browser 11.2.5.932. It has been classified as critical. Affected is an unknown function of the component HTML Handler. The manipulation of the argument title leads to improper restriction of rendered ui layers (URL). It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-1021, CWE-1021
References: http://seclists.org/fulldisclosure/2017/Mar/36; https://vuldb.com/?id.98214; http://seclists.org/fulldisclosure/2017/Mar/36
CVE: CVE-2017-20042
Published: 2022-06-13
Description: A vulnerability has been found in Navetti PricePoint 4.6.0.0 and classified as critical. Affected by this vulnerability is an unknown functionality. The manipulation leads to sql injection (Blind). The attack can be launched remotely. Upgrading to version 4.7.0.0 is able to address this issue. It is recommended to upgrade the affected component.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89, CWE-89
References: http://seclists.org/fulldisclosure/2017/Mar/24; https://vuldb.com/?id.97861; http://seclists.org/fulldisclosure/2017/Mar/24
CVE: CVE-2017-20043
Published: 2022-06-13
Description: A vulnerability was found in Navetti PricePoint 4.6.0.0 and classified as problematic. Affected by this issue is some unknown functionality. The manipulation leads to basic cross site scripting (Persistent). The attack may be launched remotely. Upgrading to version 4.7.0.0 is able to address this issue. It is recommended to upgrade the affected component.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-80, CWE-79
References: http://seclists.org/fulldisclosure/2017/Mar/24; https://vuldb.com/?id.97862; http://seclists.org/fulldisclosure/2017/Mar/24
CVE: CVE-2017-20044
Published: 2022-06-13
Description: A vulnerability was found in Navetti PricePoint 4.6.0.0. It has been classified as problematic. This affects an unknown part. The manipulation leads to basic cross site scripting (Reflected). It is possible to initiate the attack remotely. Upgrading to version 4.7.0.0 is able to address this issue. It is recommended to upgrade the affected component.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-80, CWE-79
References: http://seclists.org/fulldisclosure/2017/Mar/24; https://vuldb.com/?id.97863; http://seclists.org/fulldisclosure/2017/Mar/24
CVE: CVE-2017-20045
Published: 2022-06-13
Description: A vulnerability was found in Navetti PricePoint 4.6.0.0. It has been declared as critical. This vulnerability affects unknown code. The manipulation leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.7.0.0 is able to address this issue. It is recommended to upgrade the affected component.
CVSS Score: 7.3 (HIGH)
CWE: CWE-352, CWE-352
References: http://seclists.org/fulldisclosure/2017/Mar/24; https://vuldb.com/?id.97864; http://seclists.org/fulldisclosure/2017/Mar/24
CVE: CVE-2021-37404
Published: 2022-06-13
Description: There is a potential heap buffer overflow in Apache Hadoop libhdfs native code. Opening a file path provided by user without validation may result in a denial of service or arbitrary code execution. Users should upgrade to Apache Hadoop 2.10.2, 3.2.3, 3.3.2 or higher.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://lists.apache.org/thread/2h56ztcj3ojc66qzf1nno88vjw9vd4wo; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://lists.apache.org/thread/2h56ztcj3ojc66qzf1nno88vjw9vd4wo
CVE: CVE-2022-32739
Published: 2022-06-13
Description: When Secure::DisableBanner system configuration has been disabled and agent shares his calendar via public URL, received ICS file contains OTRS release number.
CVSS Score: 3.5 (LOW)
CWE: CWE-200
References: https://otrs.com/release-notes/otrs-security-advisory-2022-07/; https://otrs.com/release-notes/otrs-security-advisory-2022-07/
CVE: CVE-2022-32740
Published: 2022-06-13
Description: A reply to a forwarded email article by a 3rd party could unintensionally expose the email content to the ticket customer under certain circumstances.
CVSS Score: 3.5 (LOW)
CWE: CWE-200
References: https://otrs.com/release-notes/otrs-security-advisory-2022-08/; https://otrs.com/release-notes/otrs-security-advisory-2022-08/
CVE: CVE-2022-32741
Published: 2022-06-13
Description: Attacker is able to determine if the provided username exists (and it's valid) using Request New Password feature, based on the response time.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://otrs.com/release-notes/otrs-security-advisory-2022-09/; https://otrs.com/release-notes/otrs-security-advisory-2022-09/
CVE: CVE-2022-2060
Published: 2022-06-13
Description: Cross-site Scripting (XSS) - Stored in GitHub repository dolibarr/dolibarr prior to 16.0.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/dolibarr/dolibarr/commit/2b5b9957c3010a5db9d1988c2efe5b209b16b47f; https://huntr.dev/bounties/2acfc8fe-247c-4f88-aeaa-042b6b8690a0; https://github.com/dolibarr/dolibarr/commit/2b5b9957c3010a5db9d1988c2efe5b209b16b47f
CVE: CVE-2022-2061
Published: 2022-06-13
Description: Heap-based Buffer Overflow in GitHub repository hpjansson/chafa prior to 1.12.0.
CVSS Score: 3.3 (LOW)
CWE: CWE-122, CWE-787
References: https://github.com/hpjansson/chafa/commit/e6ce3746cdcf0836b9dae659a5aed15d73a080d8; https://huntr.dev/bounties/365ab61f-9a63-421c-97e6-21d4653021f0; https://github.com/hpjansson/chafa/commit/e6ce3746cdcf0836b9dae659a5aed15d73a080d8
CVE: CVE-2022-2062
Published: 2022-06-13
Description: Generation of Error Message Containing Sensitive Information in GitHub repository nocodb/nocodb prior to 0.91.7+.
CVSS Score: 7.5 (HIGH)
CWE: CWE-209, CWE-209
References: https://github.com/nocodb/nocodb/commit/a18f5dd53811b9ec1c1bb2fdbfb328c0c87d7fb4; https://huntr.dev/bounties/35593b4c-f127-4699-8ad3-f0b2203a8ef6; https://github.com/nocodb/nocodb/commit/a18f5dd53811b9ec1c1bb2fdbfb328c0c87d7fb4
CVE: CVE-2022-2063
Published: 2022-06-13
Description: Improper Privilege Management in GitHub repository nocodb/nocodb prior to 0.91.7+.
CVSS Score: 8.8 (HIGH)
CWE: CWE-269, CWE-269
References: https://github.com/nocodb/nocodb/commit/269a19c2ad89a0e8a7596498e3806ff2ec1040c2; https://huntr.dev/bounties/156f405b-21d6-4384-9bff-17ebfe484e20; https://github.com/nocodb/nocodb/commit/269a19c2ad89a0e8a7596498e3806ff2ec1040c2
CVE: CVE-2022-2064
Published: 2022-06-13
Description: Insufficient Session Expiration in GitHub repository nocodb/nocodb prior to 0.91.7+.
CVSS Score: 8.8 (HIGH)
CWE: CWE-613, CWE-613
References: https://github.com/nocodb/nocodb/commit/c9b5111b25aea2781e19395a8e9107ddbd235a2b; https://huntr.dev/bounties/39523d51-fc5c-48b8-a082-171da79761bb; https://github.com/nocodb/nocodb/commit/c9b5111b25aea2781e19395a8e9107ddbd235a2b
CVE: CVE-2022-31040
Published: 2022-06-13
Description: Open Forms is an application for creating and publishing smart forms. Prior to versions 1.0.9 and 1.1.1, the cookie consent page in Open Forms contains an open redirect by injecting a `referer` querystring parameter and failing to validate the value. A malicious actor is able to redirect users to a website under their control, opening them up for phishing attacks. The redirect is initiated by the open forms backend which is a legimate page, making it less obvious to end users they are being redirected to a malicious website. Versions 1.0.9 and 1.1.1 contain patches for this issue. There are no known workarounds avaialble.
CVSS Score: 7.1 (HIGH)
CWE: CWE-601, CWE-601
References: https://github.com/open-formulieren/open-forms/commit/3e8c9cce386e[PII_REDACTED]54694fbb9d7a6ea7d3; https://github.com/open-formulieren/open-forms/security/advisories/GHSA-c97h-m5qf-j8mf; https://github.com/open-formulieren/open-forms/commit/3e8c9cce386e[PII_REDACTED]54694fbb9d7a6ea7d3
CVE: CVE-2021-25116
Published: 2022-06-13
Description: The Enqueue Anything WordPress plugin through 1.0.1 does not have authorisation and CSRF checks in the remove_asset AJAX action, and does not ensure that the item to be deleted is actually an asset. As a result, low privilege users such as subscriber could delete arbitrary assets, as well as put arbitrary posts in the trash.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352, CWE-862
References: https://wpscan.com/vulnerability/140a15b6-12c8-4f03-a877-3876db866852; https://wpscan.com/vulnerability/140a15b6-12c8-4f03-a877-3876db866852
CVE: CVE-2021-40902
Published: 2022-06-13
Description: flatCore-CMS version 2.0.8 is affected by Cross Site Scripting (XSS) in the "Create New Page" option through the index page.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/flatCore/flatCore-CMS/issues/57; https://github.com/flatCore/flatCore-CMS/issues/57
CVE: CVE-2021-46816
Published: 2022-06-13
Description: Adobe Premiere Pro version 15.4 (and earlier) are affected by a memory corruption vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious M4A file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://helpx.adobe.com/security/products/premiere_pro/apsb21-67.html; https://helpx.adobe.com/security/products/premiere_pro/apsb21-67.html
CVE: CVE-2021-46817
Published: 2022-06-13
Description: Adobe Media Encoder version 15.4 (and earlier) are affected by a memory corruption vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious M4A file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://helpx.adobe.com/security/products/media-encoder/apsb21-70.html; https://helpx.adobe.com/security/products/media-encoder/apsb21-70.html
CVE: CVE-2021-46818
Published: 2022-06-13
Description: Adobe Media Encoder version 15.4 (and earlier) are affected by a memory corruption vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious M4A file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://helpx.adobe.com/security/products/media-encoder/apsb21-70.html; https://helpx.adobe.com/security/products/media-encoder/apsb21-70.html
CVE: CVE-2022-0626
Published: 2022-06-13
Description: The Advanced Admin Search WordPress plugin before 1.1.6 does not sanitize and escape some parameters before outputting them back in an admin page, leading to a Reflected Cross-Site Scripting.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/d72164e2-8449-4fb1-aad3-bfa86d645e47; https://wpscan.com/vulnerability/d72164e2-8449-4fb1-aad3-bfa86d645e47
CVE: CVE-2022-0745
Published: 2022-06-13
Description: The Like Button Rating WordPress plugin before 2.6.45 allows any logged-in user, such as subscriber, to send arbitrary e-mails to any recipient, with any subject and body
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://wpscan.com/vulnerability/180f8e87-1463-43bb-a[PII_REDACTED]7723a; https://wpscan.com/vulnerability/180f8e87-1463-43bb-a[PII_REDACTED]7723a
CVE: CVE-2022-0786
Published: 2022-06-13
Description: The KiviCare WordPress plugin before 2.3.9 does not sanitise and escape some parameters before using them in SQL statements via the ajax_post AJAX action with the get_doctor_details route, leading to SQL Injections exploitable by unauthenticated users
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://wpscan.com/vulnerability/53f493e9-273b-4349-8a59-f2207e8f8f30; https://wpscan.com/vulnerability/53f493e9-273b-4349-8a59-f2207e8f8f30
CVE: CVE-2022-0827
Published: 2022-06-13
Description: The Bestbooks WordPress plugin through 2.6.3 does not sanitise and escape some parameters before using them in a SQL statement via an AJAX action, leading to an SQL Injection exploitable by unauthenticated users
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://wpscan.com/vulnerability/0d208ebc-7805-457b-aa5f-ffd5adb2f3be; https://wpscan.com/vulnerability/0d208ebc-7805-457b-aa5f-ffd5adb2f3be
CVE: CVE-2022-0863
Published: 2022-06-13
Description: The WP SVG Icons WordPress plugin through 3.2.3 does not properly validate uploaded custom icon packs, allowing an high privileged user like an admin to upload a zip file containing malicious php code, leading to remote code execution.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434, CWE-434
References: https://wpscan.com/vulnerability/a30212a0-c910-4657-aee1-4a2d72c77983; https://wpscan.com/vulnerability/a30212a0-c910-4657-aee1-4a2d72c77983
CVE: CVE-2022-0885
Published: 2022-06-13
Description: The Member Hero WordPress plugin through 1.0.9 lacks authorization checks, and does not validate the a request parameter in an AJAX action, allowing unauthenticated users to call arbitrary PHP functions with no arguments.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94, CWE-862
References: https://wpscan.com/vulnerability/8b08b72e-5584-4f25-ab73-5ab0f47412df; https://wpscan.com/vulnerability/8b08b72e-5584-4f25-ab73-5ab0f47412df
CVE: CVE-2022-1202
Published: 2022-06-13
Description: The WP-CRM WordPress plugin through 1.2.1 does not validate and sanitise fields when exporting people to a CSV file, leading to a CSV injection vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-1236
References: https://wpscan.com/vulnerability/53c8190c-baef-4807-970b-f01ab440576a; https://wpscan.com/vulnerability/53c8190c-baef-4807-970b-f01ab440576a
CVE: CVE-2022-1208
Published: 2022-06-13
Description: The Ultimate Member plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Biography field featured on individual user profile pages due to insufficient input sanitization and output escaping that allows users to encode malicious web scripts with HTML encoding that is reflected back on the page. This affects versions up to, and including, 2.3.2. Please note this issue was only partially fixed in version 2.3.2.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/H4de5-7/vulnerabilities/blob/main/Ultimate%20Member%20%3C%3D%202.3.1%20-%20Stored%20Cross-Site%20Scripting.md; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2735896%40ultimate-member&new=2735896%40ultimate-member&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/93cf6dce-892e-4106-bb37-b7952e5ea5a1?source=cve
CVE: CVE-2022-1335
Published: 2022-06-13
Description: The Slideshow CK WordPress plugin before 1.4.10 does not sanitize and escape Slide's descriptions, which could allow high-privileged users such as admin to perform Cross-Site Scripting attacks when unfiltered_html is disallowed
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/cfc80857-8674-478f-9604-7a8849e5b85e; https://wpscan.com/vulnerability/cfc80857-8674-478f-9604-7a8849e5b85e
CVE: CVE-2022-1336
Published: 2022-06-13
Description: The Carousel CK WordPress plugin through 1.1.0 does not sanitize and escape Slide's descriptions, which could allow high-privileged users such as admin to perform Cross-Site Scripting attacks when unfiltered_html is disallowed
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/39e127f1-c36e-4699-892f-3755ee17bab6; https://wpscan.com/vulnerability/39e127f1-c36e-4699-892f-3755ee17bab6
CVE: CVE-2022-1412
Published: 2022-06-13
Description: The Log WP_Mail WordPress plugin through 0.1 saves sent email in a publicly accessible directory using predictable filenames, allowing any unauthenticated visitor to obtain potentially sensitive information like generated passwords.
CVSS Score: 7.5 (HIGH)
CWE: CWE-732
References: https://wpscan.com/vulnerability/ee10f21f-4476-4f3d-85ed-94d438c61ec2; https://wpscan.com/vulnerability/ee10f21f-4476-4f3d-85ed-94d438c61ec2
CVE: CVE-2022-1532
Published: 2022-06-13
Description: Themify WordPress plugin before 1.3.8 does not sanitise and escape the page parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/d106cd93-cb9b-4558-9a29-0d556fd7c9e1; https://wpscan.com/vulnerability/d106cd93-cb9b-4558-9a29-0d556fd7c9e1
CVE: CVE-2022-1549
Published: 2022-06-13
Description: The WP Athletics WordPress plugin through 1.1.7 does not sanitize parameters before storing them in the database, nor does it escape the values when outputting them back in the admin dashboard, leading to a Stored Cross-Site Scripting vulnerability.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/afef06f5-71a6-4372-9648-0db59f9b254f; https://wpscan.com/vulnerability/afef06f5-71a6-4372-9648-0db59f9b254f
CVE: CVE-2022-1594
Published: 2022-06-13
Description: The HC Custom WP-Admin URL WordPress plugin through 1.4 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack, allowing them to change the login URL
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/bb0efc5e-044b-47dc-9101-9aae40cdbaa5; https://wpscan.com/vulnerability/bb0efc5e-044b-47dc-9101-9aae40cdbaa5
CVE: CVE-2022-1595
Published: 2022-06-13
Description: The HC Custom WP-Admin URL WordPress plugin through 1.4 leaks the secret login URL when sending a specific crafted request
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://wpscan.com/vulnerability/0218c90c-8f79-4f37-9a6f-60cf2f47d47b; https://wpscan.com/vulnerability/0218c90c-8f79-4f37-9a6f-60cf2f47d47b
CVE: CVE-2022-1604
Published: 2022-06-13
Description: The MailerLite WordPress plugin before 1.5.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://wpscan.com/vulnerability/557c1c49-7195-4085-b67a-9fd8aca57845; https://wpscan.com/vulnerability/557c1c49-7195-4085-b67a-9fd8aca57845
CVE: CVE-2022-1605
Published: 2022-06-13
Description: The Email Users WordPress plugin through 4.8.8 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and change the notification settings of arbitrary users
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/a1b69615-690a-423b-afdf-729dcd32bc2f; https://wpscan.com/vulnerability/a1b69615-690a-423b-afdf-729dcd32bc2f
CVE: CVE-2022-1608
Published: 2022-06-13
Description: The OnePress Social Locker WordPress plugin through 5.6.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/56d2d55b-bd09-47af-988c-7f47eec4151f; https://wpscan.com/vulnerability/56d2d55b-bd09-47af-988c-7f47eec4151f