deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-3909
Published: 2022-12-05
Description: The Add Comments WordPress plugin through 1.0.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.8 (MEDIUM)
References: https://wpscan.com/vulnerability/8d57a534-7630-491a-a0fd-90430f85ae78; https://wpscan.com/vulnerability/8d57a534-7630-491a-a0fd-90430f85ae78
CVE: CVE-2022-3926
Published: 2022-12-05
Description: The WP OAuth Server (OAuth Authentication) WordPress plugin before 3.4.2 does not have CSRF check when regenerating secrets, which could allow attackers to make logged in admins regenerate the secret of an arbitrary client given they know the client ID
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/e1fcde2a-91a5-40cb-876b-884f01c80336; https://wpscan.com/vulnerability/e1fcde2a-91a5-40cb-876b-884f01c80336
CVE: CVE-2022-43515
Published: 2022-12-05
Description: Zabbix Frontend provides a feature that allows admins to maintain the installation and ensure that only certain IP addresses can access it. In this way, any user will not be able to access the Zabbix Frontend while it is being maintained and possible sensitive data will be prevented from being disclosed. An attacker can bypass this protection and access the instance using IP address not listed in the defined range.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20, CWE-863
References: https://lists.debian.org/debian-lts-announce/2023/08/msg00027.html; https://support.zabbix.com/browse/ZBX-22050; https://lists.debian.org/debian-lts-announce/2023/08/msg00027.html
CVE: CVE-2022-4292
Published: 2022-12-05
Description: Use After Free in GitHub repository vim/vim prior to 9.0.0882.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://github.com/vim/vim/commit/c3d27ada14acd02db357f2d16347acc22cb17e93; https://huntr.dev/bounties/da3d4c47-e57a-451e-993d-9df0ed31f57b; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WYC22GGZ6QA66HLNLHCTAJU265TT3O33/
CVE: CVE-2022-4293
Published: 2022-12-05
Description: Floating Point Comparison with Incorrect Operator in GitHub repository vim/vim prior to 9.0.0804.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-1077, CWE-697
References: https://github.com/vim/vim/commit/cdef1cefa2a440911c727558562f83ed9b00e16b; https://huntr.dev/bounties/385a835f-6e33-4d00-acce-ac99f3939143; https://security.gentoo.org/glsa/202305-16
CVE: CVE-2022-23467
Published: 2022-12-05
Description: OpenRazer is an open source driver and user-space daemon to control Razer device lighting and other features on GNU/Linux. Using a modified USB device an attacker can leak stack addresses of the `razer_attr_read_dpi_stages`, potentially bypassing KASLR. To exploit this vulnerability an attacker would need to access to a users keyboard or mouse or would need to convince a user to use a modified device. The issue has been patched in v3.5.1. Users are advised to upgrade and should be reminded not to plug in unknown USB devices.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-125
References: https://github.com/openrazer/openrazer/commit/33aa7f07d54ae066f201c6d298cb4a2181cb90e6; https://github.com/openrazer/openrazer/security/advisories/GHSA-39hg-jvc9-fg7h; https://github.com/openrazer/openrazer/commit/33aa7f07d54ae066f201c6d298cb4a2181cb90e6
CVE: CVE-2022-43097
Published: 2022-12-05
Description: Phpgurukul User Registration & User Management System v3.0 was discovered to contain multiple stored cross-site scripting (XSS) vulnerabilities via the firstname and lastname parameters of the registration form & login pages.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/nibin-m/CVE-2022-43097; https://github.com/nibin-m/CVE-2022-43097
CVE: CVE-2022-43516
Published: 2022-12-05
Description: A Firewall Rule which allows all incoming TCP connections to all programs from any source and to all ports is created in Windows Firewall after Zabbix agent installation (MSI)
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-16
References: https://support.zabbix.com/browse/ZBX-22002; https://support.zabbix.com/browse/ZBX-22002
CVE: CVE-2022-45771
Published: 2022-12-05
Description: An issue in the /api/audits component of Pwndoc v0.5.3 allows attackers to escalate privileges and execute arbitrary code via uploading a crafted audit file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://github.com/pwndoc/pwndoc; https://github.com/pwndoc/pwndoc/issues/401; https://github.com/pwndoc/pwndoc
CVE: CVE-2021-34181
Published: 2022-12-05
Description: Cross Site Scripting (XSS) vulnerability in TomExam 3.0 via p_name parameter to list.thtml.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.cnblogs.com/mrhonest/p/16949304.html; https://www.cnblogs.com/mrhonest/p/16949304.html
CVE: CVE-2022-37325
Published: 2022-12-05
Description: In Sangoma Asterisk through 16.28.0, 17.x and 18.x through 18.14.0, and 19.x through 19.6.0, an incoming Setup message to addons/ooh323c/src/ooq931.c with a malformed Calling or Called Party IE can cause a crash.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-787
References: https://downloads.asterisk.org/pub/security/AST-2022-007.html; https://lists.debian.org/debian-lts-announce/2023/02/msg00029.html; https://www.debian.org/security/2023/dsa-5358
CVE: CVE-2022-37783
Published: 2022-12-05
Description: All Craft CMS versions between 3.0.0 and 3.7.32 disclose password hashes of users who authenticate using their E-Mail address or username in Anti-CSRF-Tokens. Craft CMS uses a cookie called CRAFT_CSRF_TOKEN and a HTML hidden field called CRAFT_CSRF_TOKEN to avoid Cross Site Request Forgery attacks. The CRAFT_CSRF_TOKEN cookie discloses the password hash in without encoding it whereas the corresponding HTML hidden field discloses the users' password hash in a masked manner, which can be decoded by using public functions of the YII framework.
CVSS Score: 7.5 (HIGH)
CWE: CWE-522
References: http://www.openwall.com/lists/oss-security/2024/06/06/1; https://at-trustit.tuv.at/tuev-trust-it-cves/cve-disclosure-of-password-hashes/; https://cves.at/posts/cve-2022-37783/writeup/
CVE: CVE-2022-42705
Published: 2022-12-05
Description: A use-after-free in res_pjsip_pubsub.c in Sangoma Asterisk 16.28, 18.14, 19.6, and certified/18.9-cert2 may allow a remote authenticated attacker to crash Asterisk (denial of service) by performing activity on a subscription via a reliable transport at the same time that Asterisk is also performing activity on that subscription.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-416, CWE-416
References: https://downloads.asterisk.org/pub/security/AST-2022-008.html; https://lists.debian.org/debian-lts-announce/2023/02/msg00029.html; https://www.debian.org/security/2023/dsa-5358
CVE: CVE-2022-42706
Published: 2022-12-05
Description: An issue was discovered in Sangoma Asterisk through 16.28, 17 and 18 through 18.14, 19 through 19.6, and certified through 18.9-cert1. GetConfig, via Asterisk Manager Interface, allows a connected application to access files outside of the asterisk configuration directory, aka Directory Traversal.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://downloads.asterisk.org/pub/security/AST-2022-009.html; https://lists.debian.org/debian-lts-announce/2023/02/msg00029.html; https://www.debian.org/security/2023/dsa-5358
CVE: CVE-2022-44039
Published: 2022-12-05
Description: Franklin Fueling System FFS Colibri 1.9.22.8925 is affected by: File system overwrite. The impact is: File system rewrite (remote). ¶¶ An attacker can overwrite system files like [system.conf] and [passwd], this occurs because the insecure usage of "fopen" system function with the mode "wb" which allows overwriting file if exists. Overwriting files such as passwd, allows an attacker to escalate his privileges by planting backdoor user with root privilege or change root password.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-863, CWE-863
References: https://pastebin.com/raw/64stbsWu; https://pastebin.com/raw/64stbsWu
CVE: CVE-2022-45479
Published: 2022-12-05
Description: PC Keyboard allows remote unauthenticated users to send instructions to the server to execute arbitrary code without any previous authorization or authentication. CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306, CWE-306
References: https://www.synopsys.com/blogs/software-security/cyrc-advisory-remote-code-execution-vulnerabilities-mouse-keyboard-apps/; https://www.synopsys.com/blogs/software-security/cyrc-advisory-remote-code-execution-vulnerabilities-mouse-keyboard-apps/
CVE: CVE-2022-45481
Published: 2022-12-05
Description: The default configuration of Lazy Mouse does not require a password, allowing remote unauthenticated users to execute arbitrary code with no prior authorization or authentication. CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306, CWE-306, CWE-306
References: https://www.synopsys.com/blogs/software-security/cyrc-advisory-remote-code-execution-vulnerabilities-mouse-keyboard-apps/; https://www.synopsys.com/blogs/software-security/cyrc-advisory-remote-code-execution-vulnerabilities-mouse-keyboard-apps/
CVE: CVE-2022-46164
Published: 2022-12-05
Description: NodeBB is an open source Node.js based forum software. Due to a plain object with a prototype being used in socket.io message handling a specially crafted payload can be used to impersonate other users and takeover accounts. This vulnerability has been patched in version 2.6.1. Users are advised to upgrade. Users unable to upgrade may cherry-pick commit `48d[PII_REDACTED]4da45926cca6370a92ed0c46b8` into their codebase to patch the exploit.

CVSS Score: 9.4 (CRITICAL)
CWE: CWE-665
References: https://github.com/NodeBB/NodeBB/commit/48d[PII_REDACTED]4da45926cca6370a92ed0c46b8; https://github.com/NodeBB/NodeBB/security/advisories/GHSA-rf3g-v8p5-p675; https://github.com/NodeBB/NodeBB/commit/48d[PII_REDACTED]4da45926cca6370a92ed0c46b8
CVE: CVE-2022-23143
Published: 2022-12-05
Description: ZTE OTCP product is impacted by a permission and access control vulnerability. Due to improper permission settings, an attacker with high permissions could use this vulnerability to maliciously delete and modify files.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-732, CWE-732
References: https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1026164; https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1026164
CVE: CVE-2022-27773
Published: 2022-12-05
Description: A privilege escalation vulnerability is identified in Ivanti EPM (LANDesk Management Suite) that allows a user to execute commands with elevated privileges.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-276
References: https://forums.ivanti.com/s/article/Security-Advisory-for-Ivanti-Endpoint-Manager-Client-CVE-2022-27773?language=en_US; https://forums.ivanti.com/s/article/Security-Advisory-for-Ivanti-Endpoint-Manager-Client-CVE-2022-27773?language=en_US
CVE: CVE-2022-2827
Published: 2022-12-05
Description: AMI MegaRAC User Enumeration Vulnerability
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://9443417.fs1.hubspotusercontent-na1.net/hubfs/9443417/Security%20Advisories/AMI-SA-2023001.pdf; https://9443417.fs1.hubspotusercontent-na1.net/hubfs/9443417/Security%20Advisories/AMI-SA-2023001.pdf
CVE: CVE-2022-30122
Published: 2022-12-05
Description: A possible denial of service vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and <2.2.3.1 in the multipart parsing component of Rack.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-1333
References: https://discuss.rubyonrails.org/t/cve-2022-30122-denial-of-service-vulnerability-in-rack-multipart-parsing/80729; https://security.gentoo.org/glsa/202310-18; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2022-30123
Published: 2022-12-05
Description: A sequence injection vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and <2.2.3.1 which could allow is a possible shell escape in the Lint and CommonLogger components of Rack.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-150
References: https://discuss.rubyonrails.org/t/cve-2022-30123-possible-shell-escape-sequence-injection-vulnerability-in-rack/80728; https://security.gentoo.org/glsa/202310-18; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2022-32221
Published: 2022-12-05
Description: When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIELDS` option has been set, if the same handle previously was used to issue a `PUT` request which used that callback. This flaw may surprise the application and cause it to misbehave and either send off the wrong data or use memory after free or similar in the subsequent `POST` request. The problem exists in the logic for a reused handle when it is changed from a PUT to a POST.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-200, CWE-668
References: http://seclists.org/fulldisclosure/2023/Jan/19; http://seclists.org/fulldisclosure/2023/Jan/20; http://www.openwall.com/lists/oss-security/2023/05/17/4
CVE: CVE-2022-32224
Published: 2022-12-05
Description: A possible escalation to RCE vulnerability exists when using YAML serialized columns in Active Record < 7.0.3.1, <6.1.6.1, <6.0.5.1 and <5.2.8.1 which could allow an attacker, that can manipulate data in the database (via means like SQL injection), the ability to escalate to an RCE.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502, CWE-502
References: https://github.com/advisories/GHSA-3hhc-qp5v-9p2j; https://groups.google.com/g/rubyonrails-security/c/MmFO3LYQE8U; https://github.com/advisories/GHSA-3hhc-qp5v-9p2j
CVE: CVE-2022-35254
Published: 2022-12-05
Description: An unauthenticated attacker can cause a denial-of-service to the following products: Ivanti Connect Secure (ICS) in versions prior to 9.1R14.3, 9.1R15.2, 9.1R16.2, and 22.2R4, Ivanti Policy Secure (IPS) in versions prior to 9.1R17 and 22.3R1, and Ivanti Neurons for Zero-Trust Access in versions prior to 22.3R1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416, CWE-400
References: https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA45520/?kA23Z000000GH5OSAW; https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA45520/?kA23Z000000GH5OSAW
CVE: CVE-2022-35255
Published: 2022-12-05
Description: A weak randomness in WebCrypto keygen vulnerability exists in Node.js 18 due to a change with EntropySource() in SecretKeyGenTraits::DoKeyGen() in src/crypto/crypto_keygen.cc. There are two problems with this: 1) It does not check the return value, it assumes EntropySource() always succeeds, but it can (and sometimes will) fail. 2) The random data returned byEntropySource() may not be cryptographically strong and therefore not suitable as keying material.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-338, CWE-338
References: https://cert-portal.siemens.com/productcert/pdf/ssa-332410.pdf; https://hackerone.com/reports/1690000; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2022-35256
Published: 2022-12-05
Description: The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF. This may result in HTTP Request Smuggling.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-444, CWE-444
References: https://cert-portal.siemens.com/productcert/pdf/ssa-332410.pdf; https://hackerone.com/reports/1675191; https://www.debian.org/security/2023/dsa-5326
CVE: CVE-2022-35258
Published: 2022-12-05
Description: An unauthenticated attacker can cause a denial-of-service to the following products: Ivanti Connect Secure (ICS) in versions prior to 9.1R14.3, 9.1R15.2, 9.1R16.2, and 22.2R4, Ivanti Policy Secure (IPS) in versions prior to 9.1R17 and 22.3R1, and Ivanti Neurons for Zero-Trust Access in versions prior to 22.3R1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-128, CWE-682
References: https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA45520/?kA23Z000000GH5OSAW; https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA45520/?kA23Z000000GH5OSAW
CVE: CVE-2022-35259
Published: 2022-12-05
Description: XML Injection with Endpoint Manager 2022. 3 and below causing a download of a malicious file to run and possibly execute to gain unauthorized privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-91, CWE-91
References: https://forums.ivanti.com/s/article/Security-Advisory-for-Ivanti-Endpoint-Manager-Client-CVE-2022-35259?language=en_US; https://forums.ivanti.com/s/article/Security-Advisory-for-Ivanti-Endpoint-Manager-Client-CVE-2022-35259?language=en_US
CVE: CVE-2022-35260
Published: 2022-12-05
Description: curl can be told to parse a `.netrc` file for credentials. If that file endsin a line with 4095 consecutive non-white space letters and no newline, curlwould first read past the end of the stack-based buffer, and if the readworks, write a zero byte beyond its boundary.This will in most cases cause a segfault or similar, but circumstances might also cause different outcomes.If a malicious user can provide a custom netrc file to an application or otherwise affect its contents, this flaw could be used as denial-of-service.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125, CWE-787
References: http://seclists.org/fulldisclosure/2023/Jan/19; http://seclists.org/fulldisclosure/2023/Jan/20; https://hackerone.com/reports/1721098
CVE: CVE-2022-40242
Published: 2022-12-05
Description: MegaRAC Default Credentials Vulnerability
CVSS Score: 7.5 (HIGH)
CWE: CWE-798, CWE-287
References: https://9443417.fs1.hubspotusercontent-na1.net/hubfs/9443417/Security%20Advisories/AMI-SA-2023001.pdf; https://9443417.fs1.hubspotusercontent-na1.net/hubfs/9443417/Security%20Advisories/AMI-SA-2023001.pdf
CVE: CVE-2022-40259
Published: 2022-12-05
Description: MegaRAC Default Credentials Vulnerability
CVSS Score: 8.3 (HIGH)
CWE: CWE-798, CWE-287
References: https://9443417.fs1.hubspotusercontent-na1.net/hubfs/9443417/Security%20Advisories/AMI-SA-2023001.pdf; https://9443417.fs1.hubspotusercontent-na1.net/hubfs/9443417/Security%20Advisories/AMI-SA-2023001.pdf
CVE: CVE-2022-43548
Published: 2022-12-05
Description: A OS Command Injection vulnerability exists in Node.js versions <14.21.1, <16.18.1, <18.12.1, <19.0.1 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid before making DBS requests allowing rebinding attacks.The fix for this issue in https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32212 was incomplete and this new CVE is to complete the fix.
CVSS Score: 8.1 (HIGH)
CWE: CWE-78, CWE-78
References: https://lists.debian.org/debian-lts-announce/2023/02/msg00038.html; https://nodejs.org/en/blog/vulnerability/november-2022-security-releases/; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2022-43549
Published: 2022-12-05
Description: Improper authentication in Veeam Backup for Google Cloud v1.0 and v3.0 allows attackers to bypass authentication mechanisms.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287, CWE-287
References: https://www.veeam.com/kb4374; https://www.veeam.com/kb4374
CVE: CVE-2022-43553
Published: 2022-12-05
Description: A remote code execution vulnerability in EdgeRouters (Version 2.0.9-hotfix.4 and earlier) allows a malicious actor with an operator account to run arbitrary administrator commands.This vulnerability is fixed in Version 2.0.9-hotfix.5 and later.
CVSS Score: 8.8 (HIGH)
CWE: CWE-250
References: https://community.ui.com/releases/Security-Advisory-Bulletin-026-026/07697c65-30b3-4c06-a158-35e06534480d; https://community.ui.com/releases/Security-Advisory-Bulletin-026-026/07697c65-30b3-4c06-a158-35e06534480d
CVE: CVE-2022-43556
Published: 2022-12-05
Description: Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to XSS in the text input field since the result dashboard page output is not sanitized. The Concrete CMS security team has ranked this 4.2 with CVSS v3.1 vector AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N Thanks @_akbar_jafarli_ for reporting. Remediate by updating to Concrete CMS 8.5.10 and Concrete CMS 9.1.3.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://documentation.concretecms.org/developers/introduction/version-history/8510-release-notes; https://documentation.concretecms.org/developers/introduction/version-history/913-release-notes; https://www.concretecms.org/about/project-news/security/concrete-cms-security-advisory-2022-10-31
CVE: CVE-2022-43557
Published: 2022-12-05
Description: The BD BodyGuard™ infusion pumps specified allow for access through the RS-232 (serial) port interface. If exploited, threat actors with physical access, specialized equipment and knowledge may be able to configure or disable the pump. No electronic protected health information (ePHI), protected health information (PHI) or personally identifiable information (PII) is stored in the pump.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-1299, CWE-287
References: https://www.bd.com/en-us/about-bd/cybersecurity/bulletin/bd-bodyguard-pumps-rs-232-interface-vulnerability; https://www.bd.com/en-us/about-bd/cybersecurity/bulletin/bd-bodyguard-pumps-rs-232-interface-vulnerability
CVE: CVE-2022-45912
Published: 2022-12-05
Description: An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0. Remote code execution can occur through ClientUploader by an authenticated admin user. An authenticated admin user can upload files through the ClientUploader utility, and traverse to any other directory for remote code execution.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434, CWE-434
References: https://gist.github.com/Threonic/e90c85e11e1ac925ff[PII_REDACTED]9e76; https://gist.github.com/Threonic/e90c85e11e1ac925ff[PII_REDACTED]9e76
CVE: CVE-2022-43706
Published: 2022-12-05
Description: Cross-site scripting (XSS) vulnerability in the Web UI of StackStorm versions prior to 3.8.0 allowed logged in users with write access to pack rules to inject arbitrary script or HTML that may be executed in Web UI for other logged in users.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://stackstorm.com/2022/12/v3-8-0-released/; https://stackstorm.com/2022/12/v3-8-0-released/
CVE: CVE-2022-45019
Published: 2022-12-05
Description: SLiMS 9 Bulian v9.5.0 was discovered to contain a SQL injection vulnerability via the keywords parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/slims.web.id/SLIMS-9.5.0; https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/slims.web.id/SLIMS-9.5.0
CVE: CVE-2022-45020
Published: 2022-12-05
Description: Rukovoditel v3.2.1 was discovered to contain a DOM-based cross-site scripting (XSS) vulnerability in the component /rukovoditel/index.php?module=users/login. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted GET request.
CVSS Score: 8.8 (HIGH)
CWE: CWE-79, CWE-79
References: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/rukovoditel.net/2022/rukovoditel-3.2.1; https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/rukovoditel.net/2022/rukovoditel-3.2.1
CVE: CVE-2022-45769
Published: 2022-12-05
Description: A cross-site scripting (XSS) vulnerability in ClicShopping_V3 v3.402 allows attackers to execute arbitrary web scripts or HTML via a crafted URL parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/clicshopping.org/2022/ClicShopping_V3; https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/clicshopping.org/2022/ClicShopping_V3
CVE: CVE-2022-45990
Published: 2022-12-05
Description: A cross-site scripting (XSS) vulnerability in the component /signup_script.php of Ecommerce-Website v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the eMail parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/winston-dsouza/ecommerce-website; https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/winston-dsouza/ecommerce-website