deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-44390
Published: 2022-01-28
Description: A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. Format param is not object. An attacker can send an HTTP request to trigger this vulnerability.
CVSS Score: 7.7 (HIGH)
CWE: CWE-20, CWE-20
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421
CVE: CVE-2021-44391
Published: 2022-01-28
Description: A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. GetEnc param is not object. An attacker can send an HTTP request to trigger this vulnerability.
CVSS Score: 7.7 (HIGH)
CWE: CWE-20, CWE-20
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421
CVE: CVE-2021-44392
Published: 2022-01-28
Description: A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. GetImage param is not object. An attacker can send an HTTP request to trigger this vulnerability.
CVSS Score: 7.7 (HIGH)
CWE: CWE-20, CWE-20
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421
CVE: CVE-2021-44393
Published: 2022-01-28
Description: A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. GetIsp param is not object. An attacker can send an HTTP request to trigger this vulnerability.
CVSS Score: 7.7 (HIGH)
CWE: CWE-20, CWE-20
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421
CVE: CVE-2021-44395
Published: 2022-01-28
Description: A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. GetMask param is not object. An attacker can send an HTTP request to trigger this vulnerability.
CVSS Score: 7.7 (HIGH)
CWE: CWE-20, CWE-20
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421
CVE: CVE-2021-44396
Published: 2022-01-28
Description: A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. Preview param is not object. An attacker can send an HTTP request to trigger this vulnerability.
CVSS Score: 7.7 (HIGH)
CWE: CWE-20, CWE-20
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421
CVE: CVE-2021-44397
Published: 2022-01-28
Description: A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. rtmp=start param is not object. An attacker can send an HTTP request to trigger this vulnerability.
CVSS Score: 7.7 (HIGH)
CWE: CWE-20, CWE-20
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421
CVE: CVE-2021-44398
Published: 2022-01-28
Description: A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. rtmp=stop param is not object. An attacker can send an HTTP request to trigger this vulnerability.
CVSS Score: 7.7 (HIGH)
CWE: CWE-20, CWE-20
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421
CVE: CVE-2021-44399
Published: 2022-01-28
Description: A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. GetPtzPreset param is not object. An attacker can send an HTTP request to trigger this vulnerability.
CVSS Score: 7.7 (HIGH)
CWE: CWE-20, CWE-20
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421
CVE: CVE-2021-44400
Published: 2022-01-28
Description: A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. GetPtzPatrol param is not object. An attacker can send an HTTP request to trigger this vulnerability.
CVSS Score: 7.7 (HIGH)
CWE: CWE-20, CWE-20
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421
CVE: CVE-2021-44401
Published: 2022-01-28
Description: A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. PtzCtrl param is not object. An attacker can send an HTTP request to trigger this vulnerability.
CVSS Score: 7.7 (HIGH)
CWE: CWE-20, CWE-20
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421
CVE: CVE-2021-44402
Published: 2022-01-28
Description: A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. GetPtzSerial param is not object. An attacker can send an HTTP request to trigger this vulnerability.
CVSS Score: 7.7 (HIGH)
CWE: CWE-20, CWE-20
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421
CVE: CVE-2021-44403
Published: 2022-01-28
Description: A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. GetPtzTattern param is not object. An attacker can send an HTTP request to trigger this vulnerability.
CVSS Score: 7.7 (HIGH)
CWE: CWE-20, CWE-20
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421
CVE: CVE-2021-44404
Published: 2022-01-28
Description: A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. GetZoomFocus param is not object. An attacker can send an HTTP request to trigger this vulnerability.
CVSS Score: 7.7 (HIGH)
CWE: CWE-20, CWE-20
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421
CVE: CVE-2021-44405
Published: 2022-01-28
Description: A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. StartZoomFocus param is not object. An attacker can send an HTTP request to trigger this vulnerability.
CVSS Score: 7.7 (HIGH)
CWE: CWE-20, CWE-20
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421
CVE: CVE-2021-44406
Published: 2022-01-28
Description: A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. GetAutoFocus param is not object. An attacker can send an HTTP request to trigger this vulnerability.
CVSS Score: 7.7 (HIGH)
CWE: CWE-20, CWE-20
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421
CVE: CVE-2021-44407
Published: 2022-01-28
Description: A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. TestEmail param is not object. An attacker can send an HTTP request to trigger this vulnerability.
CVSS Score: 7.7 (HIGH)
CWE: CWE-20, CWE-20
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421
CVE: CVE-2021-44408
Published: 2022-01-28
Description: A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. TestFtp param is not object. An attacker can send an HTTP request to trigger this vulnerability.
CVSS Score: 7.7 (HIGH)
CWE: CWE-20, CWE-20
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421
CVE: CVE-2021-44409
Published: 2022-01-28
Description: A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. TestWifi param is not object. An attacker can send an HTTP request to trigger this vulnerability.
CVSS Score: 7.7 (HIGH)
CWE: CWE-20, CWE-20
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421
CVE: CVE-2021-44410
Published: 2022-01-28
Description: A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. UpgradePrepare param is not object. An attacker can send an HTTP request to trigger this vulnerability.
CVSS Score: 7.7 (HIGH)
CWE: CWE-20, CWE-20
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421
CVE: CVE-2021-44411
Published: 2022-01-28
Description: A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. Search param is not object. An attacker can send an HTTP request to trigger this vulnerability.
CVSS Score: 7.7 (HIGH)
CWE: CWE-20, CWE-20
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421
CVE: CVE-2021-44412
Published: 2022-01-28
Description: A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. GetRec param is not object. An attacker can send an HTTP request to trigger this vulnerability.
CVSS Score: 7.7 (HIGH)
CWE: CWE-20, CWE-20
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421
CVE: CVE-2021-44413
Published: 2022-01-28
Description: A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. AddUser param is not object. An attacker can send an HTTP request to trigger this vulnerability.
CVSS Score: 7.7 (HIGH)
CWE: CWE-20, CWE-20
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421
CVE: CVE-2021-44414
Published: 2022-01-28
Description: A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. DelUser param is not object. An attacker can send an HTTP request to trigger this vulnerability.
CVSS Score: 7.7 (HIGH)
CWE: CWE-20, CWE-20
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421
CVE: CVE-2021-44415
Published: 2022-01-28
Description: A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. ModifyUser param is not object. An attacker can send an HTTP request to trigger this vulnerability.
CVSS Score: 7.7 (HIGH)
CWE: CWE-20, CWE-20
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421
CVE: CVE-2021-44416
Published: 2022-01-28
Description: A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. Disconnect param is not object. An attacker can send an HTTP request to trigger this vulnerability.
CVSS Score: 7.7 (HIGH)
CWE: CWE-20, CWE-20
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421
CVE: CVE-2021-44417
Published: 2022-01-28
Description: A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. GetAlarm param is not object. An attacker can send an HTTP request to trigger this vulnerability.
CVSS Score: 7.7 (HIGH)
CWE: CWE-20, CWE-20
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421
CVE: CVE-2021-44418
Published: 2022-01-28
Description: A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. GetMdState param is not object. An attacker can send an HTTP request to trigger this vulnerability.
CVSS Score: 7.7 (HIGH)
CWE: CWE-20, CWE-20
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421
CVE: CVE-2021-44419
Published: 2022-01-28
Description: A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. GetMdAlarm param is not object. An attacker can send an HTTP request to trigger this vulnerability.
CVSS Score: 7.7 (HIGH)
CWE: CWE-20, CWE-20
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421
CVE: CVE-2021-46444
Published: 2022-01-28
Description: H.H.G Multistore v5.1.0 and below was discovered to contain a SQL injection vulnerability via /admin/admin.php?module=admin_group_edit&agID.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/blockomat2100/PoCs/blob/main/hhg_multistore/exploit_hhg_multistore.md; https://www.hhg-multistore.com/; https://github.com/blockomat2100/PoCs/blob/main/hhg_multistore/exploit_hhg_multistore.md
CVE: CVE-2021-46445
Published: 2022-01-28
Description: H.H.G Multistore v5.1.0 and below was discovered to contain a SQL injection vulnerability via /admin/categories.php?box_group_id.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/blockomat2100/PoCs/blob/main/hhg_multistore/exploit_hhg_multistore.md; https://www.hhg-multistore.com/; https://github.com/blockomat2100/PoCs/blob/main/hhg_multistore/exploit_hhg_multistore.md
CVE: CVE-2021-46446
Published: 2022-01-28
Description: H.H.G Multistore v5.1.0 and below was discovered to contain a SQL injection vulnerability via /admin/admin.php?module=admin_access_group_edit&aagID.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/blockomat2100/PoCs/blob/main/hhg_multistore/exploit_hhg_multistore.md; https://www.hhg-multistore.com/; https://github.com/blockomat2100/PoCs/blob/main/hhg_multistore/exploit_hhg_multistore.md
CVE: CVE-2021-46447
Published: 2022-01-28
Description: A cross-site scripting (XSS) vulnerability in H.H.G Multistore v5.1.0 and below allows attackers to execute arbitrary web scripts or HTML via a crafted payload inserted into the State parameter under the Address Book module.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/blockomat2100/PoCs/blob/main/hhg_multistore/exploit_hhg_multistore.md; https://www.hhg-multistore.com/; https://github.com/blockomat2100/PoCs/blob/main/hhg_multistore/exploit_hhg_multistore.md
CVE: CVE-2021-46448
Published: 2022-01-28
Description: H.H.G Multistore v5.1.0 and below was discovered to contain a SQL injection vulnerability via /admin/customers.php?page=1&cID.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/blockomat2100/PoCs/blob/main/hhg_multistore/exploit_hhg_multistore.md; https://www.hhg-multistore.com/; https://github.com/blockomat2100/PoCs/blob/main/hhg_multistore/exploit_hhg_multistore.md
CVE: CVE-2021-4160
Published: 2022-01-28
Description: There is a carry propagation bug in the MIPS32 and MIPS64 squaring procedure. Many EC algorithms are affected, including some of the TLS 1.3 default curves. Impact was not analyzed in detail, because the pre-requisites for attack are considered unlikely and include reusing private keys. Analysis suggests that attacks against RSA and DSA as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH are considered just feasible (although very difficult) because most of the work necessary to deduce information about a private key may be performed offline. The amount of resources required for such an attack would be significant. However, for an attack on TLS to be meaningful, the server would have to share the DH private key among multiple clients, which is no longer an option since CVE-2016-0701. This issue affects OpenSSL versions 1.0.2, 1.1.1 and 3.0.0. It was addressed in the releases of 1.1.1m and 3.0.1 on the 15th of December 2021. For the 1.0.2 release it is addressed in git commit 6fc1aaaf3 that is available to premium support customers only. It will be made available in 1.0.2zc when it is released. The issue only affects OpenSSL on MIPS platforms. Fixed in OpenSSL 3.0.1 (Affected 3.0.0). Fixed in OpenSSL 1.1.1m (Affected 1.1.1-1.1.1l). Fixed in OpenSSL 1.0.2zc-dev (Affected 1.0.2-1.0.2zb).
CVSS Score: 5.9 (MEDIUM)
References: https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf; https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=3bf7b73ea7123045b8f972badc67ed6878e6c37f; https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=6fc1aaaf303185aa5e483e06bdfae16daa9193a7
CVE: CVE-2022-0352
Published: 2022-01-28
Description: Cross-site Scripting (XSS) - Reflected in Pypi calibreweb prior to 0.6.16.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/janeczku/calibre-web/commit/6bf[PII_REDACTED]4513c3692c074ebc7ba4ce005e1; https://huntr.dev/bounties/a577ff17-2ded-4c41-84ae-6ac02440f717; https://github.com/janeczku/calibre-web/commit/6bf[PII_REDACTED]4513c3692c074ebc7ba4ce005e1
CVE: CVE-2022-0392
Published: 2022-01-28
Description: Heap-based Buffer Overflow in GitHub repository vim prior to 8.2.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: http://seclists.org/fulldisclosure/2022/Oct/28; http://seclists.org/fulldisclosure/2022/Oct/41; http://seclists.org/fulldisclosure/2022/Oct/43
CVE: CVE-2022-0393
Published: 2022-01-28
Description: Out-of-bounds Read in GitHub repository vim/vim prior to 8.2.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125, CWE-125
References: https://github.com/vim/vim/commit/a4bc2dd7cccf5a4a9f78b58b6f35a45d17164323; https://huntr.dev/bounties/ecc8f488-01a0-477f-848f-e30b8e524bba; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7ZLEHVP4LNAGER4ZDGUDS5V5YVQD6INF/
CVE: CVE-2022-0395
Published: 2022-01-28
Description: Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/livehelperchat/livehelperchat/commit/8fdb4f67ac1a095331aa0fb4630ef9dfe8e75dcb; https://huntr.dev/bounties/36abbd6e-239e-4739-8c77-ba212b946a4a; https://github.com/livehelperchat/livehelperchat/commit/8fdb4f67ac1a095331aa0fb4630ef9dfe8e75dcb
CVE: CVE-2022-21721
Published: 2022-01-28
Description: Next.js is a React framework. Starting with version 12.0.0 and prior to version 12.0.9, vulnerable code could allow a bad actor to trigger a denial of service attack for anyone using i18n functionality. In order to be affected by this CVE, one must use next start or a custom server and the built-in i18n support. Deployments on Vercel, along with similar environments where invalid requests are filtered before reaching Next.js, are not affected. A patch has been released, `next@12.0.9`, that mitigates this issue. As a workaround, one may ensure `/${locale}/_next/` is blocked from reaching the Next.js instance until it becomes feasible to upgrade.
CVSS Score: 5.9 (MEDIUM)
References: https://github.com/vercel/next.js/pull/33503; https://github.com/vercel/next.js/releases/tag/v12.0.9; https://github.com/vercel/next.js/security/advisories/GHSA-wr66-vrwm-5g5x
CVE: CVE-2022-23598
Published: 2022-01-28
Description: laminas-form is a package for validating and displaying simple and complex forms. When rendering validation error messages via the `formElementErrors()` view helper shipped with laminas-form, many messages will contain the submitted value. However, in laminas-form prior to version 3.1.1, the value was not being escaped for HTML contexts, which could potentially lead to a reflected cross-site scripting attack. Versions 3.1.1 and above contain a patch to mitigate the vulnerability. A workaround is available. One may manually place code at the top of a view script where one calls the `formElementErrors()` view helper. More information about this workaround is available on the GitHub Security Advisory.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://getlaminas.org/security/advisory/LP-2022-01; https://github.com/laminas/laminas-form/commit/43005a3ec4c2292d4f825273768d9b884acbca37; https://github.com/laminas/laminas-form/security/advisories/GHSA-jq4p-mq33-w375