deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-29315
Published: 2022-04-19
Description: Invicti Acunetix before 14 allows CSV injection via the Description field on the Add Targets page, if the Export CSV feature is used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-1236
References: https://the-it-wonders.blogspot.com/2022/04/csv-injection-in-acunetix-version.html; https://the-it-wonders.blogspot.com/2022/04/csv-injection-in-acunetix-version.html
CVE: CVE-2021-44519
Published: 2022-04-19
Description: In Citrix XenMobile Server through 10.12 RP9, there is an Authenticated Directory Traversal vulnerability, leading to remote code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22
References: https://docs.citrix.com/en-us/xenmobile/server/document-history.html; https://gist.github.com/tree-chtsec/30932b9c94b8c7e4209d22b8b52d597f; https://support.citrix.com/article/CTX370551
CVE: CVE-2022-29153
Published: 2022-04-19
Description: HashiCorp Consul and Consul Enterprise up to 1.9.16, 1.10.9, and 1.11.4 may allow server side request forgery when the Consul client agent follows redirects returned by HTTP health check endpoints. Fixed in 1.9.17, 1.10.10, and 1.11.5.
CVSS Score: 7.5 (HIGH)
CWE: CWE-918
References: https://discuss.hashicorp.com; https://discuss.hashicorp.com/t/hcsec-2022-10-consul-s-http-health-check-may-allow-server-side-request-forgery/; https://discuss.hashicorp.com/t/hcsec-2022-10-consul-s-http-health-check-may-allow-server-side-request-forgery/38393
CVE: CVE-2021-39033
Published: 2022-04-19
Description: IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.5 and 6.1.0.0 through 6.1.1.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 213963.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-209
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/213963; https://www.ibm.com/support/pages/node/6573049; https://exchange.xforce.ibmcloud.com/vulnerabilities/213963
CVE: CVE-2021-39072
Published: 2022-04-19
Description: IBM Security Guardium 11.3 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 215581.
CVSS Score: 5.9 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/215581; https://www.ibm.com/support/pages/node/6573005; https://exchange.xforce.ibmcloud.com/vulnerabilities/215581
CVE: CVE-2021-39076
Published: 2022-04-19
Description: IBM Security Guardium 10.5 and 11.3 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt sensitive information. IBM X-Force ID: 215585.
CVSS Score: 7.5 (HIGH)
CWE: CWE-327
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/215585; https://www.ibm.com/support/pages/node/6572979; https://exchange.xforce.ibmcloud.com/vulnerabilities/215585
CVE: CVE-2021-39078
Published: 2022-04-19
Description: IBM Security Guardium 10.5 stores user credentials in plain clear text which can be read by a local privileged user. IBM X-Force ID: 215589.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-312
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/215589; https://www.ibm.com/support/pages/node/6572983; https://exchange.xforce.ibmcloud.com/vulnerabilities/215589
CVE: CVE-2022-25648
Published: 2022-04-19
Description: The package git before 1.11.0 are vulnerable to Command Injection via git argument injection. When calling the fetch(remote = 'origin', opts = {}) function, the remote parameter is passed to the git fetch subcommand in a way that additional flags can be set. The additional flags can be used to perform a command injection.
CVSS Score: 8.1 (HIGH)
CWE: CWE-88
References: https://github.com/ruby-git/ruby-git/pull/569; https://github.com/ruby-git/ruby-git/releases/tag/v1.11.0; https://lists.debian.org/debian-lts-announce/2023/01/msg00043.html
CVE: CVE-2022-27055
Published: 2022-04-19
Description: ecjia-daojia 1.38.[PII_REDACTED]9 is vulnerable to information leakage via content/apps/installer/classes/Helper.php. When the web program is installed, a new environment file is created, and the database information is recorded, including the database record password. NOTE: the vendor disputes this because the environment file is in the data directory, which is not intended for access by website visitors (only the statics directory can be accessed by website visitors)
CVSS Score: 7.5 (HIGH)
CWE: CWE-863
References: https://github.com/ecjia/ecjia-daojia/blob/dfb322387e8d3d50719e44d23d793072616ff789/content/apps/installer/classes/Controllers/IndexController.php#L74-L78; https://github.com/ecjia/ecjia-daojia/blob/dfb322387e8d3d50719e44d23d793072616ff789/content/apps/installer/classes/Helper.php#L312-L318; https://github.com/ecjia/ecjia-daojia/issues/20
CVE: CVE-2022-27104
Published: 2022-04-19
Description: An Unauthenticated time-based blind SQL injection vulnerability exists in Forma LMS prior to v.1.4.3.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.formalms.org/download.html; https://www.swascan.com/it/security-blog/; https://www.swascan.com/security-advisory-forma-lms/
CVE: CVE-2022-24825
Published: 2022-04-19
Description: Smokescreen is a simple HTTP proxy that fogs over naughty URLs. The primary use case for Smokescreen is to prevent server-side request forgery (SSRF) attacks in which external attackers leverage the behavior of applications to connect to or scan internal infrastructure. Smokescreen also offers an option to deny access to additional (e.g., external) URLs by way of a deny list. There was an issue in Smokescreen that made it possible to bypass the deny list feature by appending a dot to the end of user-supplied URLs, or by providing input in a different letter case. Recommended to upgrade Smokescreen to version 0.0.3 or later.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-918, CWE-918
References: https://github.com/stripe/smokescreen; https://github.com/stripe/smokescreen/security/advisories/GHSA-gcj7-j438-hjj2; https://github.com/stripe/smokescreen
CVE: CVE-2021-23283
Published: 2022-04-19
Description: Eaton Intelligent Power Protector (IPP) prior to version 1.69 is vulnerable to stored Cross Site Scripting. The vulnerability exists due to insufficient validation of user input and improper encoding of the output for certain resources within the IPP software.
CVSS Score: 5.2 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/Eaton-Intelligent-Power-Protector-Vulnerability-Advisory_1001b_V1.0.pdf; https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/Eaton-Intelligent-Power-Protector-Vulnerability-Advisory_1001b_V1.0.pdf
CVE: CVE-2021-26625
Published: 2022-04-19
Description: Insufficient Verification of input Data leading to arbitrary file download and execute was discovered in Nexacro platform. This vulnerability is caused by an automatic update function that does not verify input data except version information. Remote attackers can use this incomplete validation logic to download and execute arbitrary malicious file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-345, CWE-345
References: https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=66661; https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=66661
CVE: CVE-2021-26626
Published: 2022-04-19
Description: Improper input validation vulnerability in XPLATFORM's execBrowser method can cause execute arbitrary commands. IF the second parameter value of the execBrowser function is ‘default’, the first parameter value could be passed to the ShellExecuteW API. The passed parameter is an arbitrary code to be executed. Remote attackers can use this vulnerability to execute arbitrary remote code.
CVSS Score: 8.1 (HIGH)
CWE: CWE-20, CWE-20
References: https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=66662; https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=66662
CVE: CVE-2021-26627
Published: 2022-04-19
Description: Real-time image information exposure is caused by insufficient authentication for activated RTSP port. This vulnerability could allow to remote attackers to send the RTSP requests using ffplay command and lead to leakage a live image.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284, CWE-287
References: https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=66663; https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=66663
CVE: CVE-2021-4096
Published: 2022-04-19
Description: The Fancy Product Designer plugin for WordPress is vulnerable to Cross-Site Request Forgery via the FPD_Admin_Import class that makes it possible for attackers to upload malicious files that could be used to gain webshell access to a server in versions up to, and including, 4.7.5.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-434, CWE-352
References: https://support.fancyproductdesigner.com/support/discussions/topics/[PII_REDACTED]; https://www.wordfence.com/vulnerability-advisories/#CVE-2021-4096; https://support.fancyproductdesigner.com/support/discussions/topics/[PII_REDACTED]
CVE: CVE-2022-0992
Published: 2022-04-19
Description: The SiteGround Security plugin for WordPress is vulnerable to authentication bypass that allows unauthenticated users to log in as administrative users due to missing identity verification on initial 2FA set-up that allows unauthenticated and unauthorized users to configure 2FA for pending accounts. Upon successful configuration, the attacker is logged in as that user without access to a username/password pair which is the expected first form of authentication. This affects versions up to, and including, 1.2.5.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-288, CWE-306, CWE-306
References: https://plugins.trac.wordpress.org/changeset/2706302; https://www.wordfence.com/blog/2022/04/critical-authentication-bypass-vulnerability-patched-in-siteground-security-plugin/; https://www.wordfence.com/threat-intel/vulnerabilities/id/6e5c6bf7-a653-4571-9566-574d2bb35c4f?source=cve
CVE: CVE-2022-0993
Published: 2022-04-19
Description: The SiteGround Security plugin for WordPress is vulnerable to authentication bypass that allows unauthenticated users to log in as administrative users due to missing identity verification on the 2FA back-up code implementation that logs users in upon success. This affects versions up to, and including, 1.2.5.
CVSS Score: 8.1 (HIGH)
CWE: CWE-285, CWE-306
References: https://plugins.trac.wordpress.org/changeset/2706302; https://www.wordfence.com/blog/2022/04/critical-authentication-bypass-vulnerability-patched-in-siteground-security-plugin/; https://www.wordfence.com/threat-intel/vulnerabilities/id/8e3a5566-eee5-4f71-9c93-e59abf913d04?source=cve
CVE: CVE-2022-1019
Published: 2022-04-19
Description: Automated Logic's WebCtrl Server Version 6.1 'Help' index pages are vulnerable to open redirection. The vulnerability allows an attacker to send a maliciously crafted URL which could result in redirecting the user to a malicious webpage or downloading a malicious file.
CVSS Score: 5.2 (MEDIUM)
CWE: CWE-601
References: https://www.corporate.carrier.com/Images/CARR-PSA-ALC-WebCTRL-001-1121_tcm558-149395.pdf; https://www.corporate.carrier.com/Images/CARR-PSA-ALC-WebCTRL-001-1121_tcm558-149395.pdf
CVE: CVE-2022-1119
Published: 2022-04-19
Description: The Simple File List WordPress plugin is vulnerable to Arbitrary File Download via the eeFile parameter found in the ~/includes/ee-downloader.php file due to missing controls which makes it possible unauthenticated attackers to supply a path to a file that will subsequently be downloaded, in versions up to and including 3.2.7.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://docs.google.com/document/d/1qIZXTzEpI4tO6832vk1KfsSAroT0FY2l--THlhJ8z3c/edit; https://plugins.trac.wordpress.org/browser/simple-file-list/trunk/includes/ee-downloader.php?rev=2071880; https://wpscan.com/vulnerability/075a3cc5-1970-4b64-a16f-3ec97e22b606
CVE: CVE-2022-1186
Published: 2022-04-19
Description: The WordPress plugin Be POPIA Compliant exposed sensitive information to unauthenticated users consisting of site visitors emails and usernames via an API route, in versions up to an including 1.1.5.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2701343%40be-popia-compliant&new=2701343%40be-popia-compliant&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/0fcdd6b5-a273-4916-a894-a753be0a7921?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2701343%40be-popia-compliant&new=2701343%40be-popia-compliant&sfp_email=&sfph_mail=
CVE: CVE-2022-1187
Published: 2022-04-19
Description: The WordPress WP YouTube Live Plugin is vulnerable to Reflected Cross-Site Scripting via POST data found in the ~/inc/admin.php file which allows unauthenticated attackers to inject arbitrary web scripts in versions up to, and including, 1.7.21.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79, CWE-79
References: https://github.com/macbookandrew/wp-youtube-live/commit/2d8ccb7b12742bf16b5a6068f9fdeeac69bc11b1; https://plugins.trac.wordpress.org/browser/wp-youtube-live/trunk/inc/admin.php#L355; https://www.wordfence.com/threat-intel/vulnerabilities/id/2d540b53-5c39-43d5-a055-cc5eccfa65b8?source=cve
CVE: CVE-2022-1329
Published: 2022-04-19
Description: The Elementor Website Builder plugin for WordPress is vulnerable to unauthorized execution of several AJAX actions due to a missing capability check in the ~/core/app/modules/onboarding/module.php file that make it possible for attackers to modify site data in addition to uploading malicious files that can be used to obtain remote code execution, in versions 3.6.0 to 3.6.2.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434, CWE-862, CWE-862
References: http://packetstormsecurity.com/files/168615/WordPress-Elementor-3.6.2-Shell-Upload.html; https://plugins.trac.wordpress.org/changeset/2708766/elementor/trunk/core/app/modules/onboarding/module.php; https://www.pluginvulnerabilities.com/2022/04/12/5-million-install-wordpress-plugin-elementor-contains-authenticated-remote-code-execution-rce-vulnerability/
CVE: CVE-2022-1384
Published: 2022-04-19
Description: Mattermost version 6.4.x and earlier fails to properly check the plugin version when a plugin is installed from the Marketplace, which allows an authenticated and an authorized user to install and exploit an old plugin version from the Marketplace which might have known vulnerabilities.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-477, CWE-862
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2022-1385
Published: 2022-04-19
Description: Mattermost 6.4.x and earlier fails to properly invalidate pending email invitations when the action is performed from the system console, which allows accidentally invited users to join the workspace and access information from the public teams and channels.
CVSS Score: 3.7 (LOW)
CWE: CWE-664, CWE-668
References: https://hackerone.com/reports/1486820; https://mattermost.com/security-updates/; https://hackerone.com/reports/1486820
CVE: CVE-2022-21404
Published: 2022-04-19
Description: Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Reactive WebServer). Supported versions that are affected are 1.4.10 and 2.0.0-RC1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in takeover of Helidon. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVSS Score: 8.1 (HIGH)
References: https://www.oracle.com/security-alerts/cpuapr2022.html; https://www.oracle.com/security-alerts/cpuapr2022.html
CVE: CVE-2022-21405
Published: 2022-04-19
Description: Vulnerability in the OSS Support Tools product of Oracle Support Tools (component: Oracle Explorer). The supported version that is affected is 18.3. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where OSS Support Tools executes to compromise OSS Support Tools. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in OSS Support Tools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all OSS Support Tools accessible data. CVSS 3.1 Base Score 5.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N).
CVSS Score: 5.5 (MEDIUM)
References: https://www.oracle.com/security-alerts/cpuapr2022.html; https://www.oracle.com/security-alerts/cpuapr2022.html
CVE: CVE-2022-21409
Published: 2022-04-19
Description: Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime). The supported version that is affected is Prior to 9.2.6.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in JD Edwards EnterpriseOne Tools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of JD Edwards EnterpriseOne Tools accessible data as well as unauthorized read access to a subset of JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
CVSS Score: 6.1 (MEDIUM)
References: https://www.oracle.com/security-alerts/cpuapr2022.html; https://www.oracle.com/security-alerts/cpuapr2022.html
CVE: CVE-2022-21410
Published: 2022-04-19
Description: Vulnerability in the Oracle Database - Enterprise Edition Sharding component of Oracle Database Server. The supported version that is affected is 19c. Easily exploitable vulnerability allows high privileged attacker having Create Any Procedure privilege with network access via Oracle Net to compromise Oracle Database - Enterprise Edition Sharding. Successful attacks of this vulnerability can result in takeover of Oracle Database - Enterprise Edition Sharding. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
CVSS Score: 7.2 (HIGH)
References: https://www.oracle.com/security-alerts/cpuapr2022.html; https://www.oracle.com/security-alerts/cpuapr2022.html
CVE: CVE-2022-21411
Published: 2022-04-19
Description: Vulnerability in the RDBMS Gateway / Generic ODBC Connectivity component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 19c and 21c. Easily exploitable vulnerability allows low privileged attacker having Create Session privilege with network access via Oracle Net to compromise RDBMS Gateway / Generic ODBC Connectivity. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of RDBMS Gateway / Generic ODBC Connectivity accessible data as well as unauthorized read access to a subset of RDBMS Gateway / Generic ODBC Connectivity accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).
CVSS Score: 5.4 (MEDIUM)
References: https://www.oracle.com/security-alerts/cpuapr2022.html; https://www.oracle.com/security-alerts/cpuapr2022.html
CVE: CVE-2022-21412
Published: 2022-04-19
Description: Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.28 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
CVSS Score: 4.9 (MEDIUM)
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.oracle.com/security-alerts/cpuapr2022.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2022-21413
Published: 2022-04-19
Description: Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 8.0.28 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
CVSS Score: 4.9 (MEDIUM)
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.oracle.com/security-alerts/cpuapr2022.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2022-21414
Published: 2022-04-19
Description: Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.28 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
CVSS Score: 4.9 (MEDIUM)
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.oracle.com/security-alerts/cpuapr2022.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2022-21415
Published: 2022-04-19
Description: Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are 8.0.28 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
CVSS Score: 4.9 (MEDIUM)
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.oracle.com/security-alerts/cpuapr2022.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2022-21416
Published: 2022-04-19
Description: Vulnerability in the Oracle Solaris product of Oracle Systems (component: Utility). The supported version that is affected is 11. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Solaris accessible data. CVSS 3.1 Base Score 5.0 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N).
CVSS Score: 5.0 (MEDIUM)
References: https://www.oracle.com/security-alerts/cpuapr2022.html; https://www.oracle.com/security-alerts/cpuapr2022.html