deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-0308
Published: 2022-02-12
Description: Use after free in Data Transfer in Google Chrome on Chrome OS prior to 97.0.4692.99 allowed a remote attacker who convinced a user to engage in specific user interaction to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2022/01/stable-channel-update-for-desktop_19.html; https://crbug.com/1282480; https://chromereleases.googleblog.com/2022/01/stable-channel-update-for-desktop_19.html
CVE: CVE-2022-0309
Published: 2022-02-12
Description: Inappropriate implementation in Autofill in Google Chrome prior to 97.0.4692.99 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-863
References: https://chromereleases.googleblog.com/2022/01/stable-channel-update-for-desktop_19.html; https://crbug.com/1240472; https://chromereleases.googleblog.com/2022/01/stable-channel-update-for-desktop_19.html
CVE: CVE-2022-0310
Published: 2022-02-12
Description: Heap buffer overflow in Task Manager in Google Chrome prior to 97.0.4692.99 allowed a remote attacker to potentially exploit heap corruption via specific user interactions.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://chromereleases.googleblog.com/2022/01/stable-channel-update-for-desktop_19.html; https://crbug.com/1283805; https://chromereleases.googleblog.com/2022/01/stable-channel-update-for-desktop_19.html
CVE: CVE-2022-0311
Published: 2022-02-12
Description: Heap buffer overflow in Task Manager in Google Chrome prior to 97.0.4692.99 allowed a remote attacker who convinced a user to engage in specific user interaction to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://chromereleases.googleblog.com/2022/01/stable-channel-update-for-desktop_19.html; https://crbug.com/1283807; https://chromereleases.googleblog.com/2022/01/stable-channel-update-for-desktop_19.html
CVE: CVE-2022-22765
Published: 2022-02-12
Description: BD Viper LT system, versions 2.0 and later, contains hardcoded credentials. If exploited, threat actors may be able to access, modify or delete sensitive information, including electronic protected health information (ePHI), protected health information (PHI) and personally identifiable information (PII). BD Viper LT system versions 4.0 and later utilize Microsoft Windows 10 and have additional Operating System hardening configurations which increase the attack complexity required to exploit this vulnerability.
CVSS Score: 8.0 (HIGH)
CWE: CWE-798, CWE-798
References: https://cybersecurity.bd.com/bulletins-and-patches/bd-viper-lt-system-%E2%80%93-hardcoded-credentials; https://www.cisa.gov/uscert/ics/advisories/icsma-22-062-02; https://cybersecurity.bd.com/bulletins-and-patches/bd-viper-lt-system-%E2%80%93-hardcoded-credentials
CVE: CVE-2021-24446
Published: 2022-02-14
Description: The Remove Footer Credit WordPress plugin before 1.0.6 does not have CSRF check in place when saving its settings, which could allow attacker to make logged in admins change them and lead to Stored XSS issue as well due to the lack of sanitisation
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/be55131b-d9f2-4ac1-b667-c544c066887f; https://wpscan.com/vulnerability/be55131b-d9f2-4ac1-b667-c544c066887f
CVE: CVE-2021-24874
Published: 2022-02-14
Description: The Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue WordPress plugin before 3.1.31 does not escape the lang and pid parameter before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/28d34cc1-2294-4409-a60f-c8c441eb3f2d; https://wpscan.com/vulnerability/28d34cc1-2294-4409-a60f-c8c441eb3f2d
CVE: CVE-2021-24904
Published: 2022-02-14
Description: The Mortgage Calculators WP WordPress plugin before 1.56 does not implement any sanitisation on the color setting of the background of a calculator, which could allow high privilege users to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/7b80f89b-e724-41c5-aa03-21d1eef50f21; https://wpscan.com/vulnerability/7b80f89b-e724-41c5-aa03-21d1eef50f21
CVE: CVE-2021-25014
Published: 2022-02-14
Description: The Ibtana WordPress plugin before 1.1.4.9 does not have authorisation and CSRF checks in the ive_save_general_settings AJAX action, allowing any authenticated users, such as subscriber to call it and change the plugin's settings which could lead to Stored Cross-Site Scripting issue.
CVSS Score: 3.5 (LOW)
CWE: CWE-862
References: https://wpscan.com/vulnerability/63c58d7f-8e0b-4aa5-b3c8-8726b4f19bf1; https://wpscan.com/vulnerability/63c58d7f-8e0b-4aa5-b3c8-8726b4f19bf1
CVE: CVE-2021-25018
Published: 2022-02-14
Description: The PPOM for WooCommerce WordPress plugin before 24.0 does not have authorisation and CSRF checks in the ppom_settings_panel_action AJAX action, allowing any authenticated to call it and set arbitrary settings. Furthermore, due to the lack of sanitisation and escaping, it could lead to Stored XSS issues
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://wpscan.com/vulnerability/9e092aad-0b36-45a9-8987-8d904b34fbb2; https://wpscan.com/vulnerability/9e092aad-0b36-45a9-8987-8d904b34fbb2
CVE: CVE-2021-25033
Published: 2022-02-14
Description: The WordPress Newsletter Plugin WordPress plugin before 1.6.5 does not validate the to parameter before redirecting the user to its given value, leading to an open redirect issue
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://plugins.trac.wordpress.org/changeset/2639592; https://wpscan.com/vulnerability/c2d2384c-41b9-4aaf-b918-c1cfda58af5c; https://plugins.trac.wordpress.org/changeset/2639592
CVE: CVE-2021-25050
Published: 2022-02-14
Description: The Remove Footer Credit WordPress plugin before 1.0.11 does properly sanitise its settings, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/2655918; https://wpscan.com/vulnerability/25a28adb-794f-4bdb-89e8-060296b45b38; https://plugins.trac.wordpress.org/changeset/2655918
CVE: CVE-2021-25107
Published: 2022-02-14
Description: The Form Store to DB WordPress plugin before 1.1.1 does not sanitise and escape parameter keys before outputting it back in the created entry, allowing unauthenticated attacker to perform Cross-Site Scripting attacks against admin
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/2657583; https://wpscan.com/vulnerability/3999a1b9-df85-43b1-b412-dc8a6f71cc5d; https://plugins.trac.wordpress.org/changeset/2657583
CVE: CVE-2021-25109
Published: 2022-02-14
Description: The Futurio Extra WordPress plugin before 1.6.3 is affected by a SQL Injection vulnerability that could be used by high privilege users to extract data from the database as well as used to perform Cross-Site Scripting (XSS) against logged in admins by making send open a malicious link.
CVSS Score: 2.7 (LOW)
CWE: CWE-89, CWE-89
References: https://wpscan.com/vulnerability/36261af9-3b34-4563-af3c-c9e54ae2d581; https://wpscan.com/vulnerability/36261af9-3b34-4563-af3c-c9e54ae2d581
CVE: CVE-2021-25110
Published: 2022-02-14
Description: The Futurio Extra WordPress plugin before 1.6.3 allows any logged in user, such as subscriber, to extract any other user's email address.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://wpscan.com/vulnerability/b655fc21-47a1-4786-8911-d78ab823c153; https://wpscan.com/vulnerability/b655fc21-47a1-4786-8911-d78ab823c153
CVE: CVE-2021-25115
Published: 2022-02-14
Description: The WP Photo Album Plus WordPress plugin before 8.0.10 was vulnerable to Stored Cross-Site Scripting (XSS). Error log content was handled improperly, therefore any user, even unauthenticated, could cause arbitrary javascript to be executed in the admin panel.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/2655859/wp-photo-album-plus; https://wpscan.com/vulnerability/dbc18c2c-7547-44fc-8a41-c819757e47a7; https://plugins.trac.wordpress.org/changeset/2655859/wp-photo-album-plus
CVE: CVE-2021-44879
Published: 2022-02-14
Description: In gc_data_segment in fs/f2fs/gc.c in the Linux kernel before 5.16.3, special files are not considered, leading to a move_data_page NULL pointer dereference.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://bugzilla.kernel.org/show_bug.cgi?id=215231; https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.16.3; https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=9056d6489f5a41cfbb67f719d2c0ce61ead72d9f
CVE: CVE-2021-45444
Published: 2022-02-14
Description: In zsh before 5.8.1, an attacker can achieve code execution if they control a command output inside the prompt, as demonstrated by a %F argument. This occurs because of recursive PROMPT_SUBST expansion.
CVSS Score: 7.8 (HIGH)
References: http://seclists.org/fulldisclosure/2022/May/33; http://seclists.org/fulldisclosure/2022/May/35; http://seclists.org/fulldisclosure/2022/May/38
CVE: CVE-2022-0176
Published: 2022-02-14
Description: The PowerPack Lite for Beaver Builder WordPress plugin before 1.2.9.3 does not sanitise and escape the tab parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/2655379; https://wpscan.com/vulnerability/564a66d5-7fab-4de0-868a-e19466a507af; https://plugins.trac.wordpress.org/changeset/2655379
CVE: CVE-2022-0188
Published: 2022-02-14
Description: The CMP WordPress plugin before 4.0.19 allows any user, even not logged in, to arbitrarily change the coming soon page layout.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-306
References: https://plugins.trac.wordpress.org/changeset/2657597/cmp-coming-soon-maintenance; https://wpscan.com/vulnerability/50b6f770-6f53-41ef-b2f3-2a58e9afd332; https://plugins.trac.wordpress.org/changeset/2657597/cmp-coming-soon-maintenance
CVE: CVE-2022-0190
Published: 2022-02-14
Description: The Ad Invalid Click Protector (AICP) WordPress plugin before 1.2.6 is affected by a SQL Injection in the id parameter of the delete action.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://wpscan.com/vulnerability/ae322f11-d8b4-4b69-9efa-0fb87475fa44; https://wpscan.com/vulnerability/ae322f11-d8b4-4b69-9efa-0fb87475fa44
CVE: CVE-2022-0193
Published: 2022-02-14
Description: The Complianz WordPress plugin before 6.0.0 does not escape the s parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/2654225; https://wpscan.com/vulnerability/30d1d328-9f19-4c4c-b90a-04937d617864; https://plugins.trac.wordpress.org/changeset/2654225
CVE: CVE-2022-0200
Published: 2022-02-14
Description: Themify Portfolio Post WordPress plugin before 1.1.7 does not sanitise and escape the num_of_pages parameter before outputting it back the response of the themify_create_popup_page_pagination AJAX action (available to any authenticated user), leading to a Reflected Cross-Site Scripting
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/bbc0b812-7b30-4ab4-bac8-27c706b3f146; https://wpscan.com/vulnerability/bbc0b812-7b30-4ab4-bac8-27c706b3f146
CVE: CVE-2022-0201
Published: 2022-02-14
Description: The Permalink Manager Lite WordPress plugin before 2.2.15 and Permalink Manager Pro WordPress plugin before 2.2.15 do not sanitise and escape query parameters before outputting them back in the debug page, leading to a Reflected Cross-Site Scripting issue
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/2656512; https://wpscan.com/vulnerability/f274b0d8-74bf-43de-9051-29ce36d78ad4; https://plugins.trac.wordpress.org/changeset/2656512
CVE: CVE-2022-0206
Published: 2022-02-14
Description: The NewStatPress WordPress plugin before 1.3.6 does not properly escape the whatX parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/ce12437a-d440-4c4a-9247-95a8f39d00b9; https://wpscan.com/vulnerability/ce12437a-d440-4c4a-9247-95a8f39d00b9
CVE: CVE-2022-0208
Published: 2022-02-14
Description: The MapPress Maps for WordPress plugin before 2.73.4 does not sanitise and escape the mapid parameter before outputting it back in the "Bad mapid" error message, leading to a Reflected Cross-Site Scripting
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/59a2abd0-4aee-47aa-ad3a-865f624fa0fc; https://wpscan.com/vulnerability/59a2abd0-4aee-47aa-ad3a-865f624fa0fc
CVE: CVE-2022-0212
Published: 2022-02-14
Description: The SpiderCalendar WordPress plugin through 1.5.65 does not sanitise and escape the callback parameter before outputting it back in the page via the window AJAX action (available to both unauthenticated and authenticated users), leading to a Reflected Cross-Site Scripting issue.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/15be2d2b-baa3-4845-82cf-3c351c695b47; https://wpscan.com/vulnerability/15be2d2b-baa3-4845-82cf-3c351c695b47
CVE: CVE-2022-0214
Published: 2022-02-14
Description: The Custom Popup Builder WordPress plugin before 1.3.1 autoload data from its popup on every pages, as such data can be sent by unauthenticated user, and is not validated in length, this could cause a denial of service on the blog
CVSS Score: 7.5 (HIGH)
CWE: CWE-1284
References: https://wpscan.com/vulnerability/ca2e8feb-15d6-4965-ad9c-8da1bc01e0f4; https://wpscan.com/vulnerability/ca2e8feb-15d6-4965-ad9c-8da1bc01e0f4
CVE: CVE-2022-0565
Published: 2022-02-14
Description: Cross-site Scripting in Packagist pimcore/pimcore prior to 10.3.1.
CVSS Score: 7.6 (HIGH)
CWE: CWE-79, CWE-79
References: https://github.com/pimcore/pimcore/commit/7697f709a[PII_REDACTED]52696e583a2533a6e1245; https://huntr.dev/bounties/b0b29656-4bbe-41cf-92f6-8579df0b6de5; https://github.com/pimcore/pimcore/commit/7697f709a[PII_REDACTED]52696e583a2533a6e1245
CVE: CVE-2022-0569
Published: 2022-02-14
Description: Observable Discrepancy in Packagist snipe/snipe-it prior to v5.3.9.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-203, CWE-203
References: https://github.com/snipe/snipe-it/commit/05c0819776b07425b2831cd31a8a0f4e7ac30c09; https://huntr.dev/bounties/b41d5e63-bcd8-4864-8a2e-8ec74eec520b; https://github.com/snipe/snipe-it/commit/05c0819776b07425b2831cd31a8a0f4e7ac30c09
CVE: CVE-2022-0570
Published: 2022-02-14
Description: Heap-based Buffer Overflow in Homebrew mruby prior to 3.2.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-122
References: https://github.com/mruby/mruby/commit/38b164ace7d6ae1c367883a3d67d7f559783faad; https://huntr.dev/bounties/65a7632e-f95b-4836-b1a7-9cb95e5124f1; https://github.com/mruby/mruby/commit/38b164ace7d6ae1c367883a3d67d7f559783faad
CVE: CVE-2022-0571
Published: 2022-02-14
Description: Cross-site Scripting (XSS) - Reflected in GitHub repository phoronix-test-suite/phoronix-test-suite prior to 10.8.2.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/phoronix-test-suite/phoronix-test-suite/commit/1eac9260c8313f0cfc77837ec676f4e6d68bd833; https://huntr.dev/bounties/a5039485-6e48-4313-98ad-915506c19ae8; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KSQH5OWXAMWSM7H6VSBRDGTOE7UIOZHZ/
CVE: CVE-2022-0572
Published: 2022-02-14
Description: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: http://seclists.org/fulldisclosure/2022/Oct/28; http://seclists.org/fulldisclosure/2022/Oct/41; https://github.com/vim/vim/commit/6e28703a8e41f775f64e442c5d11ce1ff599aa3f
CVE: CVE-2022-0575
Published: 2022-02-14
Description: Cross-site Scripting (XSS) - Stored in Packagist librenms/librenms prior to 22.2.0.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/librenms/librenms/commit/4f[PII_REDACTED]3e2fcd1e34b3fc1181ec2ad78e54; https://huntr.dev/bounties/13951f51-deed-4a3d-8275-52306cc5a87d; https://notes.netbytesec.com/2022/02/multiple-vulnerabilities-in-librenms.html
CVE: CVE-2022-0576
Published: 2022-02-14
Description: Cross-site Scripting (XSS) - Generic in Packagist librenms/librenms prior to 22.1.0.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/librenms/librenms/commit/135717a9a05c5bf8921f1389cbb469dcbf300bfd; https://huntr.dev/bounties/114ba055-a2f0-4db9-aafb-95df944ba177; https://notes.netbytesec.com/2022/02/multiple-vulnerabilities-in-librenms.html
CVE: CVE-2022-24110
Published: 2022-02-14
Description: Kiteworks MFT 7.5 may allow an unauthorized user to reset other users' passwords. This is fixed in version 7.6 and later.
CVSS Score: 6.5 (MEDIUM)
References: https://github.com/accellion/CVEs/blob/main/CVE-2022-24110.txt; https://www.kiteworks.com/platform/simple/managed-file-transfer/; https://github.com/accellion/CVEs/blob/main/CVE-2022-24110.txt
CVE: CVE-2022-24976
Published: 2022-02-14
Description: Atheme IRC Services before 7.2.12, when used in conjunction with InspIRCd, allows authentication bypass by ending an IRC handshake at a certain point during a challenge-response login sequence.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-287
References: https://github.com/atheme/atheme/commit/4e664c75d0b280a052eb8b5e81aa41944e593c52; https://github.com/atheme/atheme/compare/v7.2.11...v7.2.12; https://www.openwall.com/lists/oss-security/2022/01/30/4
CVE: CVE-2022-24977
Published: 2022-02-14
Description: ImpressCMS before 1.4.2 allows unauthenticated remote code execution via ...../// directory traversal in origName or imageName, leading to unsafe interaction with the CKEditor processImage.php script. The payload may be placed in PHP_SESSION_UPLOAD_PROGRESS when the PHP installation supports upload_progress.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://github.com/ImpressCMS/impresscms/commit/a66d7bb499faafab803e[PII_REDACTED]8fa0ba4261; https://github.com/ImpressCMS/impresscms/compare/1.4.1...v1.4.2; https://r0.haxors.org/posts?id=8
CVE: CVE-2021-45420
Published: 2022-02-14
Description: Emerson Dixell XWEB-500 products are affected by arbitrary file write vulnerability in /cgi-bin/logo_extra_upload.cgi, /cgi-bin/cal_save.cgi, and /cgi-bin/lo_utils.cgi. An attacker will be able to write any file on the target system without any kind of authentication mechanism, and this can lead to denial of service and potentially remote code execution. Note: the product has not been supported since 2018 and should be removed or replaced
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-200, CWE-306, CWE-668
References: http://dixell.com; http://emerson.com; https://www.swascan.com/emerson
CVE: CVE-2021-45421
Published: 2022-02-14
Description: Emerson Dixell XWEB-500 products are affected by information disclosure via directory listing. A potential attacker can use this misconfiguration to access all the files in the remote directories. Note: the product has not been supported since 2018 and should be removed or replaced
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://dixell.com; http://emerson.com; https://www.swascan.com/emerson
CVE: CVE-2022-24686
Published: 2022-02-14
Description: HashiCorp Nomad and Nomad Enterprise 0.3.0 through 1.0.17, 1.1.11, and 1.2.5 artifact download functionality has a race condition such that the Nomad client agent could download the wrong artifact into the wrong destination. Fixed in 1.0.18, 1.1.12, and 1.2.6
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-362
References: https://discuss.hashicorp.com; https://discuss.hashicorp.com/t/hcsec-2022-01-nomad-artifact-download-race-condition/35559; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2021-46371
Published: 2022-02-14
Description: antd-admin 5.5.0 is affected by an incorrect access control vulnerability. Unauthorized access to some interfaces in the foreground leads to leakage of sensitive information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306
References: https://github.com/zuiidea/antd-admin/issues/1127; https://github.com/zuiidea/antd-admin/issues/1127
CVE: CVE-2022-0512
Published: 2022-02-14
Description: Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.6.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-639, CWE-639
References: https://github.com/unshiftio/url-parse/commit/9be7ee88afd2bb04e4d5a1a8da9a389ac13f8c40; https://huntr.dev/bounties/6d1bc51f-1876-4f5b-a2c2-734e09e8e05b; https://lists.debian.org/debian-lts-announce/2023/02/msg00030.html
CVE: CVE-2021-45392
Published: 2022-02-14
Description: A Buffer Overflow vulnerability exists in Tenda Router AX12 V22.03.01.21_CN in the sub_422CE4 function in page /goform/setIPv6Status via the prefixDelegate parameter, which causes a Denial of Service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: http://tendawifi.com/index.html; https://github.com/sec-bin/IoT-CVE/tree/main/Tenda/AX12/2; https://www.tenda.com.cn/
CVE: CVE-2021-39079
Published: 2022-02-14
Description: IBM Cognos Analytics Mobile for Android applications prior to version 1.1.14 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 215592.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/215592; https://www.ibm.com/support/pages/node/6555140; https://exchange.xforce.ibmcloud.com/vulnerabilities/215592
CVE: CVE-2021-39080
Published: 2022-02-14
Description: Due to weak obfuscation, IBM Cognos Analytics Mobile for Android application prior to version 1.1.14 , an attacker could be able to reverse engineer the codebase to gain knowledge about the programming technique, interface, class definitions, algorithms and functions used. IBM X-Force ID: 215593.
CVSS Score: 6.5 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/215593; https://www.ibm.com/support/pages/node/6555140; https://exchange.xforce.ibmcloud.com/vulnerabilities/215593
CVE: CVE-2022-22854
Published: 2022-02-14
Description: An access control issue in hprms/admin/?page=user/list of Hospital Patient Record Management System v1.0 allows attackers to escalate privileges via accessing and editing the user list.
CVSS Score: 8.8 (HIGH)
CWE: CWE-862
References: https://github.com/Dheeraj-Deshmukh/Hospital-s-patient-management-system; https://github.com/Dheeraj-Deshmukh/Hospital-s-patient-management-system
CVE: CVE-2022-23367
Published: 2022-02-14
Description: Fulusso v1.1 was discovered to contain a DOM-based cross-site scripting (XSS) vulnerability in /BindAccount/SuccessTips.js. This vulnerability allows attackers to inject malicious code into a victim user's device via open redirection.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/bincat99/311aff295c270371dc8ee89599b016f1; https://gist.github.com/bincat99/311aff295c270371dc8ee89599b016f1
CVE: CVE-2021-45346
Published: 2022-02-14
Description: A Memory Leak vulnerability exists in SQLite Project SQLite3 3.35.1 and 3.37.0 via maliciously crafted SQL Queries (made via editing the Database File), it is possible to query a record, and leak subsequent bytes of memory that extend beyond the record, which could let a malicious user obtain sensitive information. NOTE: The developer disputes this as a vulnerability stating that If you give SQLite a corrupted database file and submit a query against the database, it might read parts of the database that you did not intend or expect.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-401
References: https://github.com/guyinatuxedo/sqlite3_record_leaking; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://sqlite.org/forum/forumpost/056d557c2f8c452ed5