deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-30055
Published: 2022-05-16
Description: Prime95 30.7 build 9 suffers from a Buffer Overflow vulnerability that could lead to Remote Code Execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://mrvar0x.com/2022/04/25/prime95-buffer-overflow-rce/; https://packetstormsecurity.com/files/166840/Prime95-30.7-Build-9-Buffer-Overflow.html; https://mrvar0x.com/2022/04/25/prime95-buffer-overflow-rce/
CVE: CVE-2022-30126
Published: 2022-05-16
Description: In Apache Tika, a regular expression in our StandardsText class, used by the StandardsExtractingContentHandler could lead to a denial of service caused by backtracking on a specially crafted file. This only affects users who are running the StandardsExtractingContentHandler, which is a non-standard handler. This is fixed in 1.28.2 and 2.4.0
CVSS Score: 5.5 (MEDIUM)
References: http://www.openwall.com/lists/oss-security/2022/05/16/3; http://www.openwall.com/lists/oss-security/2022/05/31/2; http://www.openwall.com/lists/oss-security/2022/06/27/5
CVE: CVE-2021-27442
Published: 2022-05-16
Description: The Weintek cMT product line is vulnerable to a cross-site scripting vulnerability, which could allow an unauthenticated remote attacker to inject malicious JavaScript code.
CVSS Score: 9.4 (CRITICAL)
CWE: CWE-79
References: https://dl.weintek.com/public/Document/TEC/TEC21001E_cMT_EasyWeb_V1_Security_Issues.pdf; https://www.cisa.gov/uscert/ics/advisories/icsa-21-082-01; https://dl.weintek.com/public/Document/TEC/TEC21001E_cMT_EasyWeb_V1_Security_Issues.pdf
CVE: CVE-2021-27444
Published: 2022-05-16
Description: The Weintek cMT product line is vulnerable to various improper access controls, which may allow an unauthenticated attacker to remotely access and download sensitive information and perform administrative actions on behalf of a legitimate administrator.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: https://dl.weintek.com/public/Document/TEC/TEC21001E_cMT_EasyWeb_V1_Security_Issues.pdf; https://www.cisa.gov/uscert/ics/advisories/icsa-21-082-01; https://dl.weintek.com/public/Document/TEC/TEC21001E_cMT_EasyWeb_V1_Security_Issues.pdf
CVE: CVE-2021-27446
Published: 2022-05-16
Description: The Weintek cMT product line is vulnerable to code injection, which may allow an unauthenticated remote attacker to execute commands with root privileges on the operation system.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-94, CWE-94
References: https://dl.weintek.com/public/Document/TEC/TEC21001E_cMT_EasyWeb_V1_Security_Issues.pdf; https://www.cisa.gov/uscert/ics/advisories/icsa-21-082-01; https://dl.weintek.com/public/Document/TEC/TEC21001E_cMT_EasyWeb_V1_Security_Issues.pdf
CVE: CVE-2021-33001
Published: 2022-05-16
Description: xArrow SCADA versions 7.2 and prior is vulnerable to cross-site scripting due to parameter ‘bdate’ of the resource xhisvalue.htm, which may allow an unauthorized attacker to execute arbitrary code.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.cisa.gov/uscert/ics/advisories/icsa-21-229-03; https://www.cisa.gov/uscert/ics/advisories/icsa-21-229-03
CVE: CVE-2021-33021
Published: 2022-05-16
Description: xArrow SCADA versions 7.2 and prior is vulnerable to cross-site scripting due to parameter ‘edate’ of the resource xhisalarm.htm, which may allow an unauthorized attacker to execute arbitrary code.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.cisa.gov/uscert/ics/advisories/icsa-21-229-03; https://www.cisa.gov/uscert/ics/advisories/icsa-21-229-03
CVE: CVE-2021-33025
Published: 2022-05-16
Description: xArrow SCADA versions 7.2 and prior permits unvalidated registry keys to be run with application-level privileges.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-79, CWE-20
References: https://www.cisa.gov/uscert/ics/advisories/icsa-21-229-03; https://www.cisa.gov/uscert/ics/advisories/icsa-21-229-03
CVE: CVE-2022-1679
Published: 2022-05-16
Description: A use-after-free flaw was found in the Linux kernel’s Atheros wireless adapter driver in the way a user forces the ath9k_htc_wait_for_target function to fail with some input messages. This flaw allows a local user to crash or potentially escalate their privileges on the system.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://lists.debian.org/debian-lts-announce/2022/10/msg00000.html; https://lists.debian.org/debian-lts-announce/2022/11/msg00001.html; https://lore.kernel.org/lkml/87ilqc7jv9.fsf%40kernel.org/t/
CVE: CVE-2022-30695
Published: 2022-05-16
Description: Local privilege escalation due to excessive permissions assigned to child processes. The following products are affected: Acronis Snap Deploy (Windows) before build 3640
CVSS Score: 7.8 (HIGH)
CWE: CWE-250, CWE-269
References: https://security-advisory.acronis.com/advisories/SEC-3080; https://security-advisory.acronis.com/advisories/SEC-3080
CVE: CVE-2022-30696
Published: 2022-05-16
Description: Local privilege escalation due to a DLL hijacking vulnerability. The following products are affected: Acronis Snap Deploy (Windows) before build 3640
CVSS Score: 7.8 (HIGH)
CWE: CWE-427, CWE-427
References: https://security-advisory.acronis.com/advisories/SEC-3081; https://security-advisory.acronis.com/advisories/SEC-3081
CVE: CVE-2022-30697
Published: 2022-05-16
Description: Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Snap Deploy (Windows) before build 3640
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://security-advisory.acronis.com/advisories/SEC-3082; https://security-advisory.acronis.com/advisories/SEC-3082
CVE: CVE-2022-1731
Published: 2022-05-16
Description: Metasonic Doc WebClient 7.0.14.0 / 7.0.12.0 / 7.0.3.0 is vulnerable to a SQL injection attack in the username field. SSO or System authentication are required to be enabled for vulnerable conditions to exist.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.tenable.com/security/research/tra-2022-17; https://www.tenable.com/security/research/tra-2022-17
CVE: CVE-2022-23657
Published: 2022-05-16
Description: A remote authentication bypass vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, 6.8.9-HF2 and below, 6.7.x and below. Aruba has released updates to ClearPass Policy Manager that address this security vulnerability.
CVSS Score: 10.0 (CRITICAL)
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-007.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-007.txt
CVE: CVE-2022-23658
Published: 2022-05-16
Description: A remote authentication bypass vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, 6.8.9-HF2 and below, 6.7.x and below. Aruba has released updates to ClearPass Policy Manager that address this security vulnerability.
CVSS Score: 10.0 (CRITICAL)
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-007.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-007.txt
CVE: CVE-2022-23659
Published: 2022-05-16
Description: A remote reflected cross site scripting (xss) vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, 6.8.9-HF2 and below, 6.7.x and below. Aruba has released updates to ClearPass Policy Manager that address this security vulnerability.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-007.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-007.txt
CVE: CVE-2022-23660
Published: 2022-05-16
Description: A remote authentication bypass vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, 6.8.9-HF2 and below, 6.7.x and below. Aruba has released updates to ClearPass Policy Manager that address this security vulnerability.
CVSS Score: 10.0 (CRITICAL)
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-007.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-007.txt
CVE: CVE-2022-23661
Published: 2022-05-16
Description: A authenticated remote command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, 6.8.9-HF2 and below, 6.7.x and below. Aruba has released updates to ClearPass Policy Manager that address this security vulnerability.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-78
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-007.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-007.txt
CVE: CVE-2022-23662
Published: 2022-05-16
Description: A authenticated remote command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, 6.8.9-HF2 and below, 6.7.x and below. Aruba has released updates to ClearPass Policy Manager that address this security vulnerability.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-78
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-007.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-007.txt
CVE: CVE-2022-23663
Published: 2022-05-16
Description: A authenticated remote command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, 6.8.9-HF2 and below, 6.7.x and below. Aruba has released updates to ClearPass Policy Manager that address this security vulnerability.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-78
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-007.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-007.txt
CVE: CVE-2022-23664
Published: 2022-05-16
Description: A authenticated remote command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, 6.8.9-HF2 and below, 6.7.x and below. Aruba has released updates to ClearPass Policy Manager that address this security vulnerability.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-78
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-007.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-007.txt
CVE: CVE-2022-23665
Published: 2022-05-16
Description: A authenticated remote command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, 6.8.9-HF2 and below, 6.7.x and below. Aruba has released updates to ClearPass Policy Manager that address this security vulnerability.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-78
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-007.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-007.txt
CVE: CVE-2022-23666
Published: 2022-05-16
Description: A authenticated remote command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, 6.8.9-HF2 and below, 6.7.x and below. Aruba has released updates to ClearPass Policy Manager that address this security vulnerability.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-78
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-007.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-007.txt
CVE: CVE-2022-1586
Published: 2022-05-16
Description: An out-of-bounds read vulnerability was discovered in the PCRE2 library in the compile_xclass_matchingpath() function of the pcre2_jit_compile.c file. This involves a unicode property matching issue in JIT-compiled regular expressions. The issue occurs because the character was not fully read in case-less matching within JIT.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-125, CWE-125
References: https://bugzilla.redhat.com/show_bug.cgi?id=2077976%2C; https://github.com/PCRE2Project/pcre2/commit/50a51cb7e67268e6ad417eb07c9de9bfea5cc55a%2C; https://github.com/PCRE2Project/pcre2/commit/d4fa336fbcc388f89095b184ba6d99422cfc676c
CVE: CVE-2022-1587
Published: 2022-05-16
Description: An out-of-bounds read vulnerability was discovered in the PCRE2 library in the get_recurse_data_length() function of the pcre2_jit_compile.c file. This issue affects recursions in JIT-compiled regular expressions caused by duplicate data transfers.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-125, CWE-125
References: https://bugzilla.redhat.com/show_bug.cgi?id=2077983%2C; https://github.com/PCRE2Project/pcre2/commit/03654e751e7f[PII_REDACTED]b67dfcadda6b42c9d0; https://lists.debian.org/debian-lts-announce/2023/03/msg00014.html
CVE: CVE-2022-23667
Published: 2022-05-16
Description: A authenticated remote command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, 6.8.9-HF2 and below, 6.7.x and below. Aruba has released updates to ClearPass Policy Manager that address this security vulnerability.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-007.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-007.txt
CVE: CVE-2022-23668
Published: 2022-05-16
Description: A remote authenticated server-side request forgery (ssrf) vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, 6.8.9-HF2 and below, 6.7.x and below. Aruba has released updates to ClearPass Policy Manage that address this security vulnerability.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-918
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-007.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-007.txt
CVE: CVE-2022-23670
Published: 2022-05-16
Description: A remote authenticated information disclosure vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, 6.8.9-HF2 and below, 6.7.x and below. Aruba has released updates to ClearPass Policy Manager that address this security vulnerability.
CVSS Score: 6.5 (MEDIUM)
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-007.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-007.txt
CVE: CVE-2022-1753
Published: 2022-05-17
Description: A vulnerability, which was classified as critical, was found in WoWonder. Affected is the file /requests.php which is responsible to handle group messages. The manipulation of the argument group_id allows posting messages in other groups. It is possible to launch the attack remotely but it might require authentication. A video explaining the attack has been disclosed to the public.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-284, CWE-863
References: https://vuldb.com/?id.199974; https://www.youtube.com/watch?v=tIzOZtp2fxA; https://youtu.be/tIzOZtp2fxA
CVE: CVE-2013-10001
Published: 2022-05-17
Description: A vulnerability was found in HTC One/Sense 4.x. It has been rated as problematic. Affected by this issue is the certification validation of the mail client. An exploit has been disclosed to the public and may be used.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-295, CWE-295
References: http://www.modzero.ch/modlog/archives/2013/05/28/htcs_e-mail_client_fails_to_verify_server_certificates/; https://vuldb.com/?id.8900; http://www.modzero.ch/modlog/archives/2013/05/28/htcs_e-mail_client_fails_to_verify_server_certificates/
CVE: CVE-2022-26650
Published: 2022-05-17
Description: In Apache ShenYui, ShenYu-Bootstrap, RegexPredicateJudge.java uses Pattern.matches(conditionData.getParamValue(), realData) to make judgments, where both parameters are controllable by the user. This can cause an attacker pass in malicious regular expressions and characters causing a resource exhaustion. This issue affects Apache ShenYu (incubating) 2.4.0, 2.4.1 and 2.4.2 and is fixed in 2.4.3.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1333, CWE-1333
References: http://www.openwall.com/lists/oss-security/2022/05/17/3; https://lists.apache.org/thread/8rp33m3nm4bwtx3qx76mqynth3t3d673; http://www.openwall.com/lists/oss-security/2022/05/17/3
CVE: CVE-2022-1723
Published: 2022-05-17
Description: Server-Side Request Forgery (SSRF) in GitHub repository jgraph/drawio prior to 18.0.6.
CVSS Score: 7.5 (HIGH)
CWE: CWE-918, CWE-918
References: https://github.com/jgraph/drawio/commit/7a68ebe22a64fe722704e9c[PII_REDACTED]fee2034; https://huntr.dev/bounties/619851a4-2a08-4196-80e9-ab41953491d8; https://github.com/jgraph/drawio/commit/7a68ebe22a64fe722704e9c[PII_REDACTED]fee2034
CVE: CVE-2021-42943
Published: 2022-05-17
Description: Stored cross-site scripting (XSS) in admin/usermanager.php over IPPlan v4.92b allows remote attackers to inject arbitrary web script or HTML via the userid parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://devbrain.com.br/index.php/2022/05/16/cve-2021-42943/; https://devbrain.com.br/index.php/2022/05/16/cve-2021-42943/
CVE: CVE-2021-42643
Published: 2022-05-17
Description: cmseasy V7.7.5_20211012 is affected by an arbitrary file write vulnerability. Through this vulnerability, a PHP script file is written to the website server, and accessing this file can lead to a code execution vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22
References: https://jdr2021.github.io/2021/10/14/CmsEasy_7.7.5_20211012%E5%AD%98%E5%9C%A8%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E5%86%99%E5%85%A5%E5%92%8C%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96%E6%BC%8F%E6%B4%9E/; https://jdr2021.github.io/2021/10/14/CmsEasy_7.7.5_20211012%E5%AD%98%E5%9C%A8%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E5%86%99%E5%85%A5%E5%92%8C%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96%E6%BC%8F%E6%B4%9E/
CVE: CVE-2021-42644
Published: 2022-05-17
Description: cmseasy V7.7.5_20211012 is affected by an arbitrary file read vulnerability. After login, the configuration file information of the website such as the database configuration file (config / config_database) can be read through this vulnerability.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-552
References: https://jdr2021.github.io/2021/10/14/CmsEasy_7.7.5_20211012%E5%AD%98%E5%9C%A8%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E5%86%99%E5%85%A5%E5%92%8C%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96%E6%BC%8F%E6%B4%9E/; https://jdr2021.github.io/2021/10/14/CmsEasy_7.7.5_20211012%E5%AD%98%E5%9C%A8%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E5%86%99%E5%85%A5%E5%92%8C%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96%E6%BC%8F%E6%B4%9E/
CVE: CVE-2022-1711
Published: 2022-05-17
Description: Server-Side Request Forgery (SSRF) in GitHub repository jgraph/drawio prior to 18.0.5.
CVSS Score: 7.5 (HIGH)
CWE: CWE-918, CWE-918
References: https://github.com/jgraph/drawio/commit/cf5c78aa0f3127fb10053db55b39f3017a0654ae; https://huntr.dev/bounties/c32afff5-6ad5-4d4d-beea-f55ab4925797; https://github.com/jgraph/drawio/commit/cf5c78aa0f3127fb10053db55b39f3017a0654ae
CVE: CVE-2022-29332
Published: 2022-05-17
Description: D-LINK DIR-825 AC1200 R2 is vulnerable to Directory Traversal. An attacker could use the "../../../../" setting of the FTP server folder to set the router's root folder for FTP access. This allows you to access the entire router file system via the FTP server.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://github.com/Quadron-Research-Lab/Hardware-IoT/blob/main/d-link_dir-825_R2.pdf; https://github.com/Quadron-Research-Lab/Hardware-IoT/blob/main/d-link_dir-825_R2.pdf
CVE: CVE-2022-30110
Published: 2022-05-17
Description: The file preview functionality in Jirafeau < 4.4.0, which is enabled by default, could be exploited for cross site scripting. An attacker could upload image/svg+xml files containing JavaScript. When someone visits the File Preview URL for this file, the JavaScript inside of this image/svg+xml file will be executed in the users' browser.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gitlab.com/mojo42/Jirafeau/-/merge_requests/103; https://gitlab.com/mojo42/Jirafeau/-/merge_requests/103
CVE: CVE-2022-30945
Published: 2022-05-17
Description: Jenkins Pipeline: Groovy Plugin 2689.v434009a_31b_f1 and earlier allows loading any Groovy source files on the classpath of Jenkins and Jenkins plugins in sandboxed pipelines.
CVSS Score: 8.5 (HIGH)
References: http://www.openwall.com/lists/oss-security/2022/05/17/8; https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-359; http://www.openwall.com/lists/oss-security/2022/05/17/8
CVE: CVE-2022-30946
Published: 2022-05-17
Description: A cross-site request forgery (CSRF) vulnerability in Jenkins Script Security Plugin 1158.v7c1b_73a_69a_08 and earlier allows attackers to have Jenkins send an HTTP request to an attacker-specified webserver.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: http://www.openwall.com/lists/oss-security/2022/05/17/8; https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2116; http://www.openwall.com/lists/oss-security/2022/05/17/8
CVE: CVE-2022-30947
Published: 2022-05-17
Description: Jenkins Git Plugin 4.11.1 and earlier allows attackers able to configure pipelines to check out some SCM repositories stored on the Jenkins controller's file system using local paths as SCM URLs, obtaining limited information about other projects' SCM contents.
CVSS Score: 7.5 (HIGH)
References: http://www.openwall.com/lists/oss-security/2022/05/17/8; https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2478; http://www.openwall.com/lists/oss-security/2022/05/17/8
CVE: CVE-2022-30948
Published: 2022-05-17
Description: Jenkins Mercurial Plugin 2.16 and earlier allows attackers able to configure pipelines to check out some SCM repositories stored on the Jenkins controller's file system using local paths as SCM URLs, obtaining limited information about other projects' SCM contents.
CVSS Score: 7.5 (HIGH)
References: http://www.openwall.com/lists/oss-security/2022/05/17/8; https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2478; http://www.openwall.com/lists/oss-security/2022/05/17/8
CVE: CVE-2022-30949
Published: 2022-05-17
Description: Jenkins REPO Plugin 1.14.0 and earlier allows attackers able to configure pipelines to check out some SCM repositories stored on the Jenkins controller's file system using local paths as SCM URLs, obtaining limited information about other projects' SCM contents.
CVSS Score: 5.3 (MEDIUM)
References: http://www.openwall.com/lists/oss-security/2022/05/17/8; https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2478; http://www.openwall.com/lists/oss-security/2022/05/17/8
CVE: CVE-2022-30950
Published: 2022-05-17
Description: Jenkins WMI Windows Agents Plugin 1.8 and earlier includes the Windows Remote Command library which has a buffer overflow vulnerability that may allow users able to connect to a named pipe to execute commands on the Windows agent machine.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: http://www.openwall.com/lists/oss-security/2022/05/17/8; https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2604; http://www.openwall.com/lists/oss-security/2022/05/17/8
CVE: CVE-2022-30951
Published: 2022-05-17
Description: Jenkins WMI Windows Agents Plugin 1.8 and earlier includes the Windows Remote Command library does not implement access control, potentially allowing users to start processes even if they're not allowed to log in.
CVSS Score: 8.8 (HIGH)
CWE: CWE-862
References: http://www.openwall.com/lists/oss-security/2022/05/17/8; https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2604; http://www.openwall.com/lists/oss-security/2022/05/17/8
CVE: CVE-2022-30952
Published: 2022-05-17
Description: Jenkins Pipeline SCM API for Blue Ocean Plugin 1.25.3 and earlier allows attackers with Job/Configure permission to access credentials with attacker-specified IDs stored in the private per-user credentials stores of any attacker-specified user in Jenkins.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-522
References: http://www.openwall.com/lists/oss-security/2022/05/17/8; https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-714; http://www.openwall.com/lists/oss-security/2022/05/17/8
CVE: CVE-2022-30953
Published: 2022-05-17
Description: A cross-site request forgery (CSRF) vulnerability in Jenkins Blue Ocean Plugin 1.25.3 and earlier allows attackers to connect to an attacker-specified HTTP server.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: http://www.openwall.com/lists/oss-security/2022/05/17/8; https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2502; http://www.openwall.com/lists/oss-security/2022/05/17/8