deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-43860
Published: 2022-12-24
Description: IBM Navigator for i 7.3, 7.4, and 7.5 could allow an authenticated user to obtain sensitive information they are authorized to but not while using this interface.  By performing an SQL injection an attacker could see user profile attributes through this interface.  IBM X-Force ID:  239305.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/239305; https://www.ibm.com/support/pages/node/6850801; https://exchange.xforce.ibmcloud.com/vulnerabilities/239305
CVE: CVE-2022-45798
Published: 2022-12-24
Description: A link following vulnerability in the Damage Cleanup Engine component of Trend Micro Apex One and Trend Micro Apex One as a Service could allow a local attacker to escalate privileges by creating a symbolic link and abusing the service to delete a file.

Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-59
References: https://success.trendmicro.com/solution/000291830; https://www.zerodayinitiative.com/advisories/ZDI-22-1665/; https://success.trendmicro.com/solution/000291830
CVE: CVE-2022-46175
Published: 2022-12-24
Description: JSON5 is an extension to the popular JSON file format that aims to be easier to write and maintain by hand (e.g. for config files). The `parse` method of the JSON5 library before and including versions 1.0.1 and 2.2.1 does not restrict parsing of keys named `__proto__`, allowing specially crafted strings to pollute the prototype of the resulting object. This vulnerability pollutes the prototype of the object returned by `JSON5.parse` and not the global Object prototype, which is the commonly understood definition of Prototype Pollution. However, polluting the prototype of a single object can have significant security impact for an application if the object is later used in trusted operations. This vulnerability could allow an attacker to set arbitrary and unexpected keys on the object returned from `JSON5.parse`. The actual impact will depend on how applications utilize the returned object and how they filter unwanted keys, but could include denial of service, cross-site scripting, elevation of privilege, and in extreme cases, remote code execution. `JSON5.parse` should restrict parsing of `__proto__` keys when parsing JSON strings to objects. As a point of reference, the `JSON.parse` method included in JavaScript ignores `__proto__` keys. Simply changing `JSON5.parse` to `JSON.parse` in the examples above mitigates this vulnerability. This vulnerability is patched in json5 versions 1.0.2, 2.2.2, and later.
CVSS Score: 7.1 (HIGH)
CWE: CWE-1321
References: https://github.com/json5/json5/issues/199; https://github.com/json5/json5/issues/295; https://github.com/json5/json5/pull/298
CVE: CVE-2022-47932
Published: 2022-12-24
Description: Brave Browser before 1.43.34 allowed a remote attacker to cause a denial of service via a crafted HTML file that mentions an ipfs:// or ipns:// URL. This vulnerability is caused by an incomplete fix for CVE-2022-47933.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400
References: https://github.com/brave/brave-browser/issues/24093; https://github.com/brave/brave-core/commit/e[PII_REDACTED]8c17e48a67e302d3ab02a38d3ef50; https://github.com/brave/brave-core/pull/14211
CVE: CVE-2022-47933
Published: 2022-12-24
Description: Brave Browser before 1.42.51 allowed a remote attacker to cause a denial of service via a crafted HTML file that references the IPFS scheme. This vulnerability is caused by an uncaught exception in the function ipfs::OnBeforeURLRequest_IPFSRedirectWork() in ipfs_redirect_network_delegate_helper.cc.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-755, CWE-755
References: https://github.com/brave/brave-browser/issues/23646; https://github.com/brave/brave-browser/issues/24378; https://github.com/brave/brave-core/commit/7ef8cb2f232abdf59ec9c3c99a086a14b972bc56
CVE: CVE-2022-47934
Published: 2022-12-24
Description: Brave Browser before 1.43.88 allowed a remote attacker to cause a denial of service in private and guest windows via a crafted HTML file that mentions an ipfs:// or ipns:// URL. This is caused by an incomplete fix for CVE-2022-47932 and CVE-2022-47934.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400
References: https://github.com/brave/brave-browser/issues/24211; https://github.com/brave/brave-browser/issues/25106; https://github.com/brave/brave-core/commit/82d8e39043e691e[PII_REDACTED]437275511ee87e8
CVE: CVE-2022-47949
Published: 2022-12-24
Description: The Nintendo NetworkBuffer class, as used in Animal Crossing: New Horizons before 2.0.6 and other products, allows remote attackers to execute arbitrary code via a large UDP packet that causes a buffer overflow, aka ENLBufferPwn. The victim must join a game session with the attacker. Other affected products include Mario Kart 7 before 1.2, Mario Kart 8, Mario Kart 8 Deluxe before 2.1.0, ARMS before 5.4.1, Splatoon, Splatoon 2 before 5.5.1, Splatoon 3 before late 2022, Super Mario Maker 2 before 3.0.2, and Nintendo Switch Sports before late 2022.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120, CWE-120
References: https://github.com/PabloMK7/ENLBufferPwn; https://github.com/PabloMK7/ENLBufferPwn
CVE: CVE-2022-45889
Published: 2022-12-25
Description: Planet eStream before 6.72.10.07 allows a remote attacker (who is a publisher or admin) to obtain access to all records stored in the database, and achieve the ability to execute arbitrary SQL commands, via Search (the StatisticsResults.aspx flt parameter).
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://sec-consult.com/vulnerability-lab/advisory/multiple-critical-vulnerabilities-in-planet-enterprises-ltd-planet-estream/; https://sec-consult.com/vulnerability-lab/advisory/multiple-critical-vulnerabilities-in-planet-enterprises-ltd-planet-estream/
CVE: CVE-2022-45890
Published: 2022-12-25
Description: In Planet eStream before 6.72.10.07, a Reflected Cross-Site Scripting (XSS) vulnerability exists via any metadata filter field (e.g., search within Default.aspx with the r or fo parameter).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://sec-consult.com/vulnerability-lab/advisory/multiple-critical-vulnerabilities-in-planet-enterprises-ltd-planet-estream/; https://sec-consult.com/vulnerability-lab/advisory/multiple-critical-vulnerabilities-in-planet-enterprises-ltd-planet-estream/
CVE: CVE-2022-45891
Published: 2022-12-25
Description: Planet eStream before 6.72.10.07 allows attackers to call restricted functions, and perform unauthenticated uploads (Upload2.ashx) or access content uploaded by other users (View.aspx after Ajax.asmx/SaveGrantAccessList).
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-863, CWE-863
References: https://sec-consult.com/vulnerability-lab/advisory/multiple-critical-vulnerabilities-in-planet-enterprises-ltd-planet-estream/; https://sec-consult.com/vulnerability-lab/advisory/multiple-critical-vulnerabilities-in-planet-enterprises-ltd-planet-estream/
CVE: CVE-2022-45892
Published: 2022-12-25
Description: In Planet eStream before 6.72.10.07, multiple Stored Cross-Site Scripting (XSS) vulnerabilities exist: Disclaimer, Search Function, Comments, Batch editing tool, Content Creation, Related Media, Create new user, and Change Username.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://sec-consult.com/vulnerability-lab/advisory/multiple-critical-vulnerabilities-in-planet-enterprises-ltd-planet-estream/; https://sec-consult.com/vulnerability-lab/advisory/multiple-critical-vulnerabilities-in-planet-enterprises-ltd-planet-estream/
CVE: CVE-2022-42953
Published: 2022-12-25
Description: Certain ZKTeco products (ZEM500-510-560-760, ZEM600-800, ZEM720, ZMM) allow access to sensitive information via direct requests for the form/DataApp?style=1 and form/DataApp?style=0 URLs. The affected versions may be before 8.88 (ZEM500-510-560-760, ZEM600-800, ZEM720) and 15.00 (ZMM200-220-210). The fixed versions are firmware version 8.88 (ZEM500-510-560-760, ZEM600-800, ZEM720) and firmware version 15.00 (ZMM200-220-210).
CVSS Score: 7.5 (HIGH)
CWE: CWE-425, CWE-425
References: https://seclists.org/fulldisclosure/2022/Oct/23; https://www.redteam-pentesting.de/en/advisories/-advisories-publicised-vulnerability-analyses; https://seclists.org/fulldisclosure/2022/Oct/23
CVE: CVE-2022-44012
Published: 2022-12-25
Description: An issue was discovered in /DS/LM_API/api/SelectionService/InsertQueryWithActiveRelationsReturnId in Simmeth Lieferantenmanager before 5.6. An attacker can execute JavaScript code in the browser of the victim if a site is loaded. The victim's encrypted password can be stolen and most likely be decrypted.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://sec-consult.com/vulnerability-lab/advisory/multiple-critical-vulnerabilities-in-simmeth-system-gmbh-lieferantenmanager/; https://sec-consult.com/vulnerability-lab/advisory/multiple-critical-vulnerabilities-in-simmeth-system-gmbh-lieferantenmanager/
CVE: CVE-2022-44013
Published: 2022-12-25
Description: An issue was discovered in Simmeth Lieferantenmanager before 5.6. An attacker can make various API calls without authentication because the password in a Credential Object is not checked.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-306, CWE-306
References: https://sec-consult.com/vulnerability-lab/advisory/multiple-critical-vulnerabilities-in-simmeth-system-gmbh-lieferantenmanager/; https://sec-consult.com/vulnerability-lab/advisory/multiple-critical-vulnerabilities-in-simmeth-system-gmbh-lieferantenmanager/
CVE: CVE-2022-44014
Published: 2022-12-25
Description: An issue was discovered in Simmeth Lieferantenmanager before 5.6. In the design of the API, a user is inherently able to fetch arbitrary SQL tables. This leaks all user passwords and MSSQL hashes via /DS/LM_API/api/SelectionService/GetPaggedTab.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: https://sec-consult.com/vulnerability-lab/advisory/multiple-critical-vulnerabilities-in-simmeth-system-gmbh-lieferantenmanager/; https://sec-consult.com/vulnerability-lab/advisory/multiple-critical-vulnerabilities-in-simmeth-system-gmbh-lieferantenmanager/
CVE: CVE-2022-44015
Published: 2022-12-25
Description: An issue was discovered in Simmeth Lieferantenmanager before 5.6. An attacker can inject raw SQL queries. By activating MSSQL features, the attacker is able to execute arbitrary commands on the MSSQL server via the xp_cmdshell extended procedure.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://sec-consult.com/vulnerability-lab/advisory/multiple-critical-vulnerabilities-in-simmeth-system-gmbh-lieferantenmanager/; https://sec-consult.com/vulnerability-lab/advisory/multiple-critical-vulnerabilities-in-simmeth-system-gmbh-lieferantenmanager/
CVE: CVE-2022-44016
Published: 2022-12-25
Description: An issue was discovered in Simmeth Lieferantenmanager before 5.6. An attacker can download arbitrary files from the web server by abusing an API call: /DS/LM_API/api/ConfigurationService/GetImages with an '"ImagesPath":"C:\\"' value.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://sec-consult.com/vulnerability-lab/advisory/multiple-critical-vulnerabilities-in-simmeth-system-gmbh-lieferantenmanager/; https://sec-consult.com/vulnerability-lab/advisory/multiple-critical-vulnerabilities-in-simmeth-system-gmbh-lieferantenmanager/
CVE: CVE-2022-44017
Published: 2022-12-25
Description: An issue was discovered in Simmeth Lieferantenmanager before 5.6. Due to errors in session management, an attacker can log back into a victim's account after the victim logged out - /LMS/LM/#main can be used for this. This is due to the credentials not being cleaned from the local storage after logout.
CVSS Score: 7.5 (HIGH)
CWE: CWE-384, CWE-384
References: https://sec-consult.com/vulnerability-lab/advisory/multiple-critical-vulnerabilities-in-simmeth-system-gmbh-lieferantenmanager/; https://sec-consult.com/vulnerability-lab/advisory/multiple-critical-vulnerabilities-in-simmeth-system-gmbh-lieferantenmanager/
CVE: CVE-2022-44380
Published: 2022-12-25
Description: Snipe-IT before 6.0.14 is vulnerable to Cross Site Scripting (XSS) for View Assigned Assets.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://census-labs.com/news/2022/12/23/multiple-vulnerabilities-in-snipe-it/; https://census-labs.com/news/2022/12/23/multiple-vulnerabilities-in-snipe-it/
CVE: CVE-2022-44381
Published: 2022-12-25
Description: Snipe-IT through 6.0.14 allows attackers to check whether a user account exists because of response variations in a /password/reset request.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-203, CWE-203
References: https://census-labs.com/news/2022/12/23/multiple-vulnerabilities-in-snipe-it/; https://census-labs.com/news/2022/12/23/multiple-vulnerabilities-in-snipe-it/
CVE: CVE-2022-44640
Published: 2022-12-25
Description: Heimdal before 7.7.1 allows remote attackers to execute arbitrary code because of an invalid free in the ASN.1 codec used by the Key Distribution Center (KDC).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-415
References: https://github.com/heimdal/heimdal/security/advisories/GHSA-88pm-hfmq-7vv4; https://security.gentoo.org/glsa/202310-06; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2022-45197
Published: 2022-12-25
Description: Slixmpp before 1.8.3 lacks SSL Certificate hostname validation in XMLStream, allowing an attacker to pose as any server in the eyes of Slixmpp.
CVSS Score: 7.5 (HIGH)
CWE: CWE-295, CWE-295
References: https://github.com/poezio/slixmpp/commits/master/slixmpp/xmlstream/xmlstream.py; https://github.com/poezio/slixmpp/tags; https://lab.louiz.org/poezio/slixmpp/-/commit/b60b1b985db928532f97c4f61d6fbc801f0aa7fa
CVE: CVE-2022-45893
Published: 2022-12-25
Description: Planet eStream before 6.72.10.07 allows a low-privileged user to gain access to administrative and high-privileged user accounts by changing the value of the ON cookie. A brute-force attack can calculate a value that provides permanent access.
CVSS Score: 8.8 (HIGH)
CWE: CWE-307, CWE-307
References: https://sec-consult.com/vulnerability-lab/advisory/multiple-critical-vulnerabilities-in-planet-enterprises-ltd-planet-estream/; https://sec-consult.com/vulnerability-lab/advisory/multiple-critical-vulnerabilities-in-planet-enterprises-ltd-planet-estream/
CVE: CVE-2022-45894
Published: 2022-12-25
Description: GetFile.aspx in Planet eStream before 6.72.10.07 allows ..\ directory traversal to read arbitrary local files.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://sec-consult.com/vulnerability-lab/advisory/multiple-critical-vulnerabilities-in-planet-enterprises-ltd-planet-estream/; https://sec-consult.com/vulnerability-lab/advisory/multiple-critical-vulnerabilities-in-planet-enterprises-ltd-planet-estream/
CVE: CVE-2022-45895
Published: 2022-12-25
Description: Planet eStream before 6.72.10.07 discloses sensitive information, related to the ON cookie (findable in HTML source code for Default.aspx in some situations) and the WhoAmI endpoint (e.g., path disclosure).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-668, CWE-668
References: https://sec-consult.com/vulnerability-lab/advisory/multiple-critical-vulnerabilities-in-planet-enterprises-ltd-planet-estream/; https://sec-consult.com/vulnerability-lab/advisory/multiple-critical-vulnerabilities-in-planet-enterprises-ltd-planet-estream/
CVE: CVE-2022-45896
Published: 2022-12-25
Description: Planet eStream before 6.72.10.07 allows unauthenticated upload of arbitrary files: Choose a Video / Related Media or Upload Document. Upload2.ashx can be used, or Ajax.asmx/ProcessUpload2. This leads to remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434, CWE-434
References: https://sec-consult.com/vulnerability-lab/advisory/multiple-critical-vulnerabilities-in-planet-enterprises-ltd-planet-estream/-; https://sec-consult.com/vulnerability-lab/advisory/multiple-critical-vulnerabilities-in-planet-enterprises-ltd-planet-estream/-
CVE: CVE-2022-42898
Published: 2022-12-25
Description: PAC parsing in MIT Kerberos 5 (aka krb5) before 1.19.4 and 1.20.x before 1.20.1 has integer overflows that may lead to remote code execution (in KDC, kadmind, or a GSS or Kerberos application server) on 32-bit platforms (which have a resultant heap-based buffer overflow), and cause a denial of service on other platforms. This occurs in krb5_pac_parse in lib/krb5/krb/pac.c. Heimdal before 7.7.1 has "a similar bug."
CVSS Score: 8.8 (HIGH)
CWE: CWE-190, CWE-190
References: https://bugzilla.samba.org/show_bug.cgi?id=15203; https://github.com/heimdal/heimdal/security/advisories/GHSA-64mq-fvfj-5x3c; https://github.com/krb5/krb5/commit/ea92d2f0fcceb54a70910fa32e9a0d7a5afc3583
CVE: CVE-2020-36627
Published: 2022-12-25
Description: A vulnerability was found in Macaron i18n. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file i18n.go. The manipulation leads to open redirect. The attack can be launched remotely. Upgrading to version 0.5.0 is able to address this issue. The name of the patch is 329b0c4844cc16a5a253c011b55180598e707735. It is recommended to upgrade the affected component. The identifier VDB-216745 was assigned to this vulnerability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-601
References: https://github.com/go-macaron/i18n/commit/329b0c4844cc16a5a253c011b55180598e707735; https://github.com/go-macaron/i18n/releases/tag/v0.5.0; https://vuldb.com/?id.216745
CVE: CVE-2020-36628
Published: 2022-12-25
Description: A vulnerability classified as critical has been found in Calsign APDE. This affects the function handleExtract of the file APDE/src/main/java/com/calsignlabs/apde/build/dag/CopyBuildTask.java of the component ZIP File Handler. The manipulation leads to path traversal. Upgrading to version 0.5.2-pre2-alpha is able to address this issue. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-216747.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-22
References: https://github.com/Calsign/APDE/commit/c6d64cbe465348c1bfd211122d89e3117afadecf; https://github.com/Calsign/APDE/releases/tag/v0.5.2-pre2-alpha; https://vuldb.com/?id.216747
CVE: CVE-2020-36629
Published: 2022-12-25
Description: A vulnerability classified as critical was found in SimbCo httpster. This vulnerability affects the function fs.realpathSync of the file src/server.coffee. The manipulation leads to path traversal. The exploit has been disclosed to the public and may be used. The name of the patch is d3055b3e30b40b65d30c5a06d6e053dffa7f35d0. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-216748.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-22
References: https://github.com/SimbCo/httpster/commit/d3055b3e30b40b65d30c5a06d6e053dffa7f35d0; https://github.com/SimbCo/httpster/pull/36; https://vuldb.com/?id.216748
CVE: CVE-2021-4276
Published: 2022-12-25
Description: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in dns-stats hedgehog. It has been rated as problematic. Affected by this issue is the function DSCIOManager::dsc_import_input_from_source of the file src/DSCIOManager.cpp. The manipulation leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The name of the patch is 58922c345d3d1fe89bb[PII_REDACTED]a3e07ca93ac. It is recommended to apply a patch to fix this issue. VDB-216746 is the identifier assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: We do assume that the Data Manager server can only be accessed by authorised users. Because of this, we don’t believe this specific attack is possible without such a compromise of the Data Manager server.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-89
References: https://github.com/dns-stats/hedgehog/commit/58922c345d3d1fe89bb[PII_REDACTED]a3e07ca93ac; https://github.com/dns-stats/hedgehog/pull/190; https://vuldb.com/?id.216746
CVE: CVE-2021-4277
Published: 2022-12-25
Description: A vulnerability, which was classified as problematic, has been found in fredsmith utils. This issue affects some unknown processing of the file screenshot_sync of the component Filename Handler. The manipulation leads to predictable from observable state. The name of the patch is dbab1b66955eeb3d76b34612b358307f5c4e3944. It is recommended to apply a patch to fix this issue. The identifier VDB-216749 was assigned to this vulnerability.
CVSS Score: 2.6 (LOW)
CWE: CWE-341, CWE-330
References: https://github.com/fredsmith/utils/commit/dbab1b66955eeb3d76b34612b358307f5c4e3944; https://vuldb.com/?id.216749; https://github.com/fredsmith/utils/commit/dbab1b66955eeb3d76b34612b358307f5c4e3944
CVE: CVE-2022-4731
Published: 2022-12-25
Description: A vulnerability, which was classified as problematic, was found in myapnea up to 29.0.x. Affected is an unknown function of the component Title Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 29.1.0 is able to address this issue. The name of the patch is[PII_REDACTED]0d761bd5d09809bfa6c14b598f8d18. It is recommended to upgrade the affected component. VDB-216750 is the identifier assigned to this vulnerability.
CVSS Score: 2.4 (LOW)
CWE: CWE-79
References: https://github.com/myapnea/myapnea.org/commit/[PII_REDACTED]0d761bd5d09809bfa6c14b598f8d18; https://github.com/myapnea/myapnea.org/releases/tag/v29.1.0; https://vuldb.com/?ctiid.216750
CVE: CVE-2021-4278
Published: 2022-12-25
Description: A vulnerability classified as problematic has been found in cronvel tree-kit up to 0.6.x. This affects an unknown part. The manipulation leads to improperly controlled modification of object prototype attributes ('prototype pollution'). Upgrading to version 0.7.0 is able to address this issue. The name of the patch is a63f559c50d70e8cb2eaae670dec25d1dbc4afcd. It is recommended to upgrade the affected component. The identifier VDB-216765 was assigned to this vulnerability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-1321
References: https://github.com/cronvel/tree-kit/commit/a63f559c50d70e8cb2eaae670dec25d1dbc4afcd; https://github.com/cronvel/tree-kit/releases/tag/v0.7.0; https://vuldb.com/?ctiid.216765
CVE: CVE-2022-4735
Published: 2022-12-25
Description: A vulnerability classified as problematic was found in asrashley dash-live. This vulnerability affects the function ready of the file static/js/media.js of the component DOM Node Handler. The manipulation leads to cross site scripting. The attack can be initiated remotely. The name of the patch is 24d01757a5319cc14c4aa1d8b53d1ab24d48e451. It is recommended to apply a patch to fix this issue. VDB-216766 is the identifier assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/asrashley/dash-live/commit/24d01757a5319cc14c4aa1d8b53d1ab24d48e451; https://github.com/asrashley/dash-live/pull/7; https://vuldb.com/?ctiid.216766
CVE: CVE-2019-25084
Published: 2022-12-25
Description: A vulnerability, which was classified as problematic, has been found in Hide Files on GitHub up to 2.x. This issue affects the function addEventListener of the file extension/options.js. The manipulation leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 3.0.0 is able to address this issue. The name of the patch is 9de0c57df81db1178e0e79431d462f6d9842742e. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-216767.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/sindresorhus/hide-files-on-github/commit/9de0c57df81db1178e0e79431d462f6d9842742e; https://github.com/sindresorhus/hide-files-on-github/pull/73; https://github.com/sindresorhus/hide-files-on-github/releases/tag/3.0.0