deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-4258
Published: 2022-12-19
Description: A vulnerability was found in whohas. It has been rated as problematic. This issue affects some unknown processing of the component Package Information Handler. The manipulation leads to cleartext transmission of sensitive information. The attack may be initiated remotely. The real existence of this vulnerability is still doubted at the moment. The name of the patch is 667c3e2e9178f15c23d7918b5db25cd0792c8472. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-216251. NOTE: Most sources redirect to the encrypted site which limits the possibilities of an attack.
CVSS Score: 3.7 (LOW)
CWE: CWE-310, CWE-319
References: https://github.com/whohas/whohas/commit/667c3e2e9178f15c23d7918b5db25cd0792c8472; https://vuldb.com/?id.216251; https://github.com/whohas/whohas/commit/667c3e2e9178f15c23d7918b5db25cd0792c8472
CVE: CVE-2021-4259
Published: 2022-12-19
Description: A vulnerability was found in phpRedisAdmin up to 1.16.1. It has been classified as problematic. This affects the function authHttpDigest of the file includes/login.inc.php. The manipulation of the argument response leads to use of wrong operator in string comparison. Upgrading to version 1.16.2 is able to address this issue. The name of the patch is 31aa7661e6db6f4dffbf9a635817832a0a11c7d9. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-216267.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-597
References: https://github.com/erikdubbelboer/phpRedisAdmin/commit/31aa7661e6db6f4dffbf9a635817832a0a11c7d9; https://github.com/erikdubbelboer/phpRedisAdmin/releases/tag/v1.16.2; https://vuldb.com/?id.216267
CVE: CVE-2021-4260
Published: 2022-12-19
Description: A vulnerability was found in oils-js. It has been declared as critical. This vulnerability affects unknown code of the file core/Web.js. The manipulation leads to open redirect. The attack can be initiated remotely. The name of the patch is fad8fbae824a7d367dacb90d56cb02c5cb999d42. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-216268.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-601
References: https://github.com/mannyvergel/oils-js/commit/fad8fbae824a7d367dacb90d56cb02c5cb999d42; https://vuldb.com/?id.216268; https://github.com/mannyvergel/oils-js/commit/fad8fbae824a7d367dacb90d56cb02c5cb999d42
CVE: CVE-2021-4261
Published: 2022-12-19
Description: A vulnerability classified as critical has been found in pacman-canvas up to 1.0.5. Affected is the function addHighscore of the file data/db-handler.php. The manipulation leads to sql injection. It is possible to launch the attack remotely. Upgrading to version 1.0.6 is able to address this issue. The name of the patch is 29522c90ca1cebfce6453a5af5a45281d99b0646. It is recommended to upgrade the affected component. VDB-216270 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-707, CWE-89
References: https://github.com/platzhersh/pacman-canvas/commit/29522c90ca1cebfce6453a5af5a45281d99b0646; https://github.com/platzhersh/pacman-canvas/releases/tag/1.0.6; https://vuldb.com/?id.216270
CVE: CVE-2021-4262
Published: 2022-12-19
Description: A vulnerability classified as critical was found in laravel-jqgrid. Affected by this vulnerability is the function getRows of the file src/Mgallegos/LaravelJqgrid/Repositories/EloquentRepositoryAbstract.php. The manipulation leads to sql injection. The name of the patch is fbc2d94f43d0dc772767a5bdb[PII_REDACTED]f935e. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-216271.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-707, CWE-89
References: https://github.com/mgallegos/laravel-jqgrid/commit/fbc2d94f43d0dc772767a5bdb[PII_REDACTED]f935e; https://github.com/mgallegos/laravel-jqgrid/pull/72; https://vuldb.com/?id.216271
CVE: CVE-2022-3832
Published: 2022-12-19
Description: The External Media WordPress plugin before 1.0.36 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.8 (MEDIUM)
References: https://wpscan.com/vulnerability/458ec2fd-4175-4cb4-b334-b63f6e643b92; https://wpscan.com/vulnerability/458ec2fd-4175-4cb4-b334-b63f6e643b92
CVE: CVE-2022-3937
Published: 2022-12-19
Description: The Easy Video Player WordPress plugin before 1.2.2.3 does not sanitize and escapes some parameters, which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks.
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/ac7158c5-3d11-4865-b26f-41ab5a8120af; https://wpscan.com/vulnerability/ac7158c5-3d11-4865-b26f-41ab5a8120af
CVE: CVE-2022-3961
Published: 2022-12-19
Description: The Directorist WordPress plugin before 7.4.4 does not prevent users with low privileges (like subscribers) from accessing sensitive system information.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://wpscan.com/vulnerability/6aad6454-de1b-4304-9c14-05e28d08b253; https://wpscan.com/vulnerability/6aad6454-de1b-4304-9c14-05e28d08b253
CVE: CVE-2022-3983
Published: 2022-12-19
Description: The Checkout for PayPal WordPress plugin before 1.0.14 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/0b48bbd6-7c77-44b8-a5d6-34e4a0747cf1; https://wpscan.com/vulnerability/0b48bbd6-7c77-44b8-a5d6-34e4a0747cf1
CVE: CVE-2022-3984
Published: 2022-12-19
Description: The Flowplayer Video Player WordPress plugin before 1.0.5 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/b4694e9d-3f38-4295-929d-0ad37b3cbbaa; https://wpscan.com/vulnerability/b4694e9d-3f38-4295-929d-0ad37b3cbbaa
CVE: CVE-2022-3985
Published: 2022-12-19
Description: The Videojs HTML5 Player WordPress plugin before 1.1.9 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/58f82e13-153e-41e8-a22b-a2e96b46a6dc; https://wpscan.com/vulnerability/58f82e13-153e-41e8-a22b-a2e96b46a6dc
CVE: CVE-2022-3986
Published: 2022-12-19
Description: The WP Stripe Checkout WordPress plugin before 1.2.2.21 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/ad8077a1-7cbe-4aa1-ad7d-acb41027ed0a; https://wpscan.com/vulnerability/ad8077a1-7cbe-4aa1-ad7d-acb41027ed0a
CVE: CVE-2022-3987
Published: 2022-12-19
Description: The Responsive Lightbox2 WordPress plugin before 1.0.4 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/d9309a09-34ba-4e56-b683-e677ad277b29; https://wpscan.com/vulnerability/d9309a09-34ba-4e56-b683-e677ad277b29
CVE: CVE-2022-4024
Published: 2022-12-19
Description: The Registration Forms WordPress plugin before 3.8.1.3 does not have authorisation and CSRF when deleting users via an init action handler, allowing unauthenticated attackers to delete arbitrary users (along with their posts)
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352, CWE-862
References: https://wpscan.com/vulnerability/a087fb45-6f6c-40ac-b48b-2cbceda86cbe; https://wpscan.com/vulnerability/a087fb45-6f6c-40ac-b48b-2cbceda86cbe
CVE: CVE-2022-4050
Published: 2022-12-19
Description: The JoomSport WordPress plugin before 5.2.8 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users
CVSS Score: 9.8 (CRITICAL)
References: https://wpscan.com/vulnerability/5c96bb40-4c2d-4e91-8339-e0ddce25912f; https://wpscan.com/vulnerability/5c96bb40-4c2d-4e91-8339-e0ddce25912f
CVE: CVE-2022-4058
Published: 2022-12-19
Description: The Photo Gallery by 10Web WordPress plugin before 1.8.3 does not validate and escape some parameters before outputting them back in in JS code later on in another page, which could lead to Stored XSS issue when an attacker makes a logged in admin open a malicious URL or page under their control.
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/89656cb3-4611-4ae7-b7f8-1b22eb75cfc4; https://wpscan.com/vulnerability/89656cb3-4611-4ae7-b7f8-1b22eb75cfc4
CVE: CVE-2022-4061
Published: 2022-12-19
Description: The JobBoardWP WordPress plugin before 1.2.2 does not properly validate file names and types in its file upload functionalities, allowing unauthenticated users to upload arbitrary files such as PHP.
CVSS Score: 7.5 (HIGH)
References: https://wpscan.com/vulnerability/fec68e6e-f612-43c8-8301-80f7ae3be665; https://wpscan.com/vulnerability/fec68e6e-f612-43c8-8301-80f7ae3be665
CVE: CVE-2022-4063
Published: 2022-12-19
Description: The InPost Gallery WordPress plugin before 2.1.4.1 insecurely uses PHP's extract() function when rendering HTML views, allowing attackers to force the inclusion of malicious files & URLs, which may enable them to run code on servers.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://wpscan.com/vulnerability/6bb07ec1-f1aa-4f4b-9717-c92f651a90a7; https://wpscan.com/vulnerability/6bb07ec1-f1aa-4f4b-9717-c92f651a90a7
CVE: CVE-2022-4106
Published: 2022-12-19
Description: The Wholesale Market for WooCommerce WordPress plugin before 1.0.7 does not have authorisation check, as well as does not validate user input used to generate system path, allowing unauthenticated attackers to download arbitrary file from the server.
CVSS Score: 7.5 (HIGH)
CWE: CWE-552
References: https://wpscan.com/vulnerability/b60a0d3d-148f-4e9b-baee[PII_REDACTED]ed; https://wpscan.com/vulnerability/b60a0d3d-148f-4e9b-baee[PII_REDACTED]ed
CVE: CVE-2022-4107
Published: 2022-12-19
Description: The SMSA Shipping for WooCommerce WordPress plugin before 1.0.5 does not have authorisation and proper CSRF checks, as well as does not validate the file to be downloaded, allowing any authenticated users, such as subscriber to download arbitrary file from the server
CVSS Score: 6.5 (MEDIUM)
References: https://wpscan.com/vulnerability/0b432858-722c-4bda-aa95-ad48e2097302; https://wpscan.com/vulnerability/0b432858-722c-4bda-aa95-ad48e2097302
CVE: CVE-2022-4108
Published: 2022-12-19
Description: The Wholesale Market for WooCommerce WordPress plugin before 1.0.8 does not validate user input used to generate system path, allowing high privilege users such as admin to download arbitrary file from the server even when they should not be able to (for example in multisite)
CVSS Score: 4.9 (MEDIUM)
References: https://wpscan.com/vulnerability/9d1770df-91f0-41e3-af0d-522ae4e62470; https://wpscan.com/vulnerability/9d1770df-91f0-41e3-af0d-522ae4e62470
CVE: CVE-2022-4112
Published: 2022-12-19
Description: The Quizlord WordPress plugin through 2.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.8 (MEDIUM)
References: https://wpscan.com/vulnerability/4cbce79d-9b7a-41f5-9c52-08933ea7c28e; https://wpscan.com/vulnerability/4cbce79d-9b7a-41f5-9c52-08933ea7c28e
CVE: CVE-2022-4124
Published: 2022-12-19
Description: The Popup Manager WordPress plugin through 1.6.6 does not have authorisation and CSRF checks when deleting popups, which could allow unauthenticated users to delete them
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-862
References: https://wpscan.com/vulnerability/60786bf8-c0d7-4d80-b189-866aba79bce2; https://wpscan.com/vulnerability/60786bf8-c0d7-4d80-b189-866aba79bce2
CVE: CVE-2022-4125
Published: 2022-12-19
Description: The Popup Manager WordPress plugin through 1.6.6 does not have authorisation and CSRF check when creating/updating popups, and is missing sanitisation as well as escaping, which could allow unauthenticated attackers to create arbitrary popups and add Stored XSS payloads as well
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/7862084a-2821-4ef1-8d01-c9c8b3f28b05; https://wpscan.com/vulnerability/7862084a-2821-4ef1-8d01-c9c8b3f28b05
CVE: CVE-2022-4610
Published: 2022-12-19
Description: A vulnerability, which was classified as problematic, has been found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome. Affected by this issue is some unknown functionality. The manipulation leads to risky cryptographic algorithm. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-216272.
CVSS Score: 1.9 (LOW)
CWE: CWE-310, CWE-327
References: https://modzero.com/modlog/archives/2022/12/19/better_make_sure_your_password_manager_is_secure/index.html; https://vuldb.com/?id.216272; https://www.modzero.com/static/MZ-22-03_Passwordstate_Security_Disclosure_Report-v1.0.pdf
CVE: CVE-2022-4611
Published: 2022-12-19
Description: A vulnerability, which was classified as problematic, was found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome. This affects an unknown part. The manipulation leads to hard-coded credentials. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component. The identifier VDB-216273 was assigned to this vulnerability.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-798, CWE-798
References: https://modzero.com/modlog/archives/2022/12/19/better_make_sure_your_password_manager_is_secure/index.html; https://vuldb.com/?ctiid.216273; https://vuldb.com/?id.216273
CVE: CVE-2022-4612
Published: 2022-12-19
Description: A vulnerability has been found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome and classified as problematic. This vulnerability affects unknown code. The manipulation leads to insufficiently protected credentials. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component. VDB-216274 is the identifier assigned to this vulnerability.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-522
References: https://modzero.com/modlog/archives/2022/12/19/better_make_sure_your_password_manager_is_secure/index.html; https://vuldb.com/?id.216274; https://www.modzero.com/static/MZ-22-03_Passwordstate_Security_Disclosure_Report-v1.0.pdf
CVE: CVE-2022-4613
Published: 2022-12-19
Description: A vulnerability was found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome and classified as critical. This issue affects some unknown processing of the component Browser Extension Provisioning. The manipulation leads to improper authorization. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-216275.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-266
References: https://modzero.com/modlog/archives/2022/12/19/better_make_sure_your_password_manager_is_secure/index.html; https://vuldb.com/?id.216275; https://www.modzero.com/static/MZ-22-03_Passwordstate_Security_Disclosure_Report-v1.0.pdf
CVE: CVE-2021-33640
Published: 2022-12-19
Description: After tar_close(), libtar.c releases the memory pointed to by pointer t. After tar_close() is called in the list() function, it continues to use pointer t: free_longlink_longname(t->th_buf) . As a result, the released memory is used (use-after-free).
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-416, CWE-416
References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4S4PJRCJLEAWN2EKXGLSOBTL7O57V7NC/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7WX5YE66CT7Y5C2HTHXSFDKQWYWYWJ2T/; https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2021-33640&packageName=libtar
CVE: CVE-2022-28173
Published: 2022-12-19
Description: The web server of some Hikvision wireless bridge products have an access control vulnerability which can be used to obtain the admin permission. The attacker can exploit the vulnerability by sending crafted messages to the affected devices.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-284
References: https://www.hikvision.com/en/support/cybersecurity/security-advisory/access-control-vulnerability-in-some-hikvision-wireless-bridge-products/; https://www.hikvision.com/en/support/cybersecurity/security-advisory/access-control-vulnerability-in-some-hikvision-wireless-bridge-products/
CVE: CVE-2022-31683
Published: 2022-12-19
Description: Concourse (7.x.y prior to 7.8.3 and 6.x.y prior to 6.7.9) contains an authorization bypass issue. A Concourse user can send a request with body including :team_name=team2 to bypass team scope check to gain access to certain resources belong to any other team.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-639
References: https://github.com/concourse/concourse/security/advisories/GHSA-5jp2-vwrj-99rf; https://github.com/concourse/concourse/security/advisories/GHSA-5jp2-vwrj-99rf
CVE: CVE-2022-42945
Published: 2022-12-19
Description: DWG TrueViewTM 2023 version has a DLL Search Order Hijacking vulnerability. Successful exploitation by a malicious attacker could result in remote code execution on the target system.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427, CWE-427
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0024; https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0024
CVE: CVE-2022-42946
Published: 2022-12-19
Description: Parsing a maliciously crafted X_B and PRT file can force Autodesk Maya 2023 and 2022 to read beyond allocated buffer. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125, CWE-787
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0020; https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0020
CVE: CVE-2022-42947
Published: 2022-12-19
Description: A maliciously crafted X_B file when parsed through Autodesk Maya 2023 and 2022 can be used to write beyond the allocated buffer. This vulnerability can lead to arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0020; https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0020
CVE: CVE-2022-47512
Published: 2022-12-19
Description: Sensitive information was stored in plain text in a file that is accessible by a user with a local account in Hybrid Cloud Observability (HCO)/ SolarWinds Platform 2022.4. No other versions are affected
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-312, CWE-312
References: https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2022-4-1_release_notes.htm; https://www.solarwinds.com/trust-center/security-advisories/CVE-2022-47512; https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2022-4-1_release_notes.htm
CVE: CVE-2022-40435
Published: 2022-12-19
Description: Employee Performance Evaluation System v1.0 was discovered to contain a persistent cross-site scripting (XSS) vulnerability via adding new entries under the Departments and Designations module.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://employee.com; https://isaghojaria.medium.com/employee-performance-evaluation-system-v1-0-fdf7eb5eaf92; https://www.sourcecodester.com
CVE: CVE-2022-43289
Published: 2022-12-19
Description: Deark v.1.6.2 was discovered to contain a stack overflow via the do_prism_read_palette() function at /modules/atari-img.c.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://github.com/jsummers/deark; https://github.com/jsummers/deark/issues/52; https://github.com/jsummers/deark
CVE: CVE-2022-30679
Published: 2022-12-19
Description: Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb22-59.html; https://helpx.adobe.com/security/products/experience-manager/apsb22-59.html
CVE: CVE-2022-35693
Published: 2022-12-19
Description: Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb22-59.html; https://helpx.adobe.com/security/products/experience-manager/apsb22-59.html
CVE: CVE-2022-35695
Published: 2022-12-19
Description: Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb22-59.html; https://helpx.adobe.com/security/products/experience-manager/apsb22-59.html
CVE: CVE-2022-3775
Published: 2022-12-19
Description: When rendering certain unicode sequences, grub2's font code doesn't proper validate if the informed glyph's width and height is constrained within bitmap size. As consequence an attacker can craft an input which will lead to a out-of-bounds write into grub2's heap, leading to memory corruption and availability issues. Although complex, arbitrary code execution could not be discarded.
CVSS Score: 7.1 (HIGH)
CWE: CWE-787
References: https://access.redhat.com/security/cve/cve-2022-3775; https://security.gentoo.org/glsa/202311-14; https://access.redhat.com/security/cve/cve-2022-3775
CVE: CVE-2022-40607
Published: 2022-12-19
Description: 
IBM Spectrum Scale 5.1 could allow users with permissions to create pod, persistent volume and persistent volume claim to access files and directories outside of the volume, including on the host filesystem. IBM X-Force ID: 235740.


CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/235740; https://www.ibm.com/support/pages/node/6848231; https://exchange.xforce.ibmcloud.com/vulnerabilities/235740
CVE: CVE-2022-41418
Published: 2022-12-19
Description: An issue in the component BlogEngine/BlogEngine.NET/AppCode/Api/UploadController.cs of BlogEngine.NET v3.3.8.0 allows attackers to execute arbitrary code via uploading a crafted PNG file.
CVSS Score: 7.2 (HIGH)
CWE: CWE-22, CWE-22
References: https://gist.github.com/tree-chtsec/22a0a531ea188fd5b76fe11d32f41e95; https://gist.github.com/tree-chtsec/a02258bb6dea0d16e7e631898c066e05; https://github.com/BlogEngine/BlogEngine.NET/commit/7f927567db94462ffd37e128c0a53c11c1f81a8d