deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-39395
Published: 2022-11-10
Description: Vela is a Pipeline Automation (CI/CD) framework built on Linux container technology written in Golang. In Vela Server and Vela Worker prior to version 0.16.0 and Vela UI prior to version 0.17.0, some default configurations for Vela allow exploitation and container breakouts. Users should upgrade to Server 0.16.0, Worker 0.16.0, and UI 0.17.0 to fix the issue. After upgrading, Vela administrators will need to explicitly change the default settings to configure Vela as desired. Some of the fixes will interrupt existing workflows and will require Vela administrators to modify default settings. However, not applying the patch (or workarounds) will continue existing risk exposure. Some workarounds are available. Vela administrators can adjust the worker's `VELA_RUNTIME_PRIVILEGED_IMAGES` setting to be explicitly empty, leverage the `VELA_REPO_ALLOWLIST` setting on the server component to restrict access to a list of repositories that are allowed to be enabled, and/or audit enabled repositories and disable pull_requests if they are not needed.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-269, CWE-269
References: https://docs.docker.com/engine/security/#docker-daemon-attack-surface; https://github.com/go-vela/server/commit/05558ee99d70f7d6f83bed7c8f78ac0b35fa26f4; https://github.com/go-vela/server/releases/tag/v0.16.0
CVE: CVE-2022-39388
Published: 2022-11-10
Description: Istio is an open platform to connect, manage, and secure microservices. In versions on the 1.15.x branch prior to 1.15.3, a user can impersonate any workload identity within the service mesh if they have localhost access to the Istiod control plane. Version 1.15.3 contains a patch for this issue. There are no known workarounds.
CVSS Score: 7.6 (HIGH)
CWE: CWE-863, CWE-863
References: https://github.com/istio/istio/commit/346260e5115e9fbc65ba8a559bc686e6ca046a32; https://github.com/istio/istio/commit/9a643e270421560afb2630e00f76d46a55499df9; https://github.com/istio/istio/security/advisories/GHSA-6c6p-h79f-g6p4
CVE: CVE-2022-39392
Published: 2022-11-10
Description: Wasmtime is a standalone runtime for WebAssembly. Prior to version 2.0.2, there is a bug in Wasmtime's implementation of its pooling instance allocator when the allocator is configured to give WebAssembly instances a maximum of zero pages of memory. In this configuration, the virtual memory mapping for WebAssembly memories did not meet the compiler-required configuration requirements for safely executing WebAssembly modules. Wasmtime's default settings require virtual memory page faults to indicate that wasm reads/writes are out-of-bounds, but the pooling allocator's configuration would not create an appropriate virtual memory mapping for this meaning out of bounds reads/writes can successfully read/write memory unrelated to the wasm sandbox within range of the base address of the memory mapping created by the pooling allocator. This bug is not applicable with the default settings of the `wasmtime` crate. This bug can only be triggered by setting `InstanceLimits::memory_pages` to zero. This is expected to be a very rare configuration since this means that wasm modules cannot allocate any pages of linear memory. All wasm modules produced by all current toolchains are highly likely to use linear memory, so it's expected to be unlikely that this configuration is set to zero by any production embedding of Wasmtime. This bug has been patched and users should upgrade to Wasmtime 2.0.2. This bug can be worked around by increasing the `memory_pages` allotment when configuring the pooling allocator to a value greater than zero. If an embedding wishes to still prevent memory from actually being used then the `Store::limiter` method can be used to dynamically disallow growth of memory beyond 0 bytes large. Note that the default `memory_pages` value is greater than zero.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-119, CWE-125, CWE-787, CWE-125, CWE-787
References: https://github.com/bytecodealliance/wasmtime/commit/e60c3742904ccbb3e26da201c9221c38a4981d72; https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-44mr-8vmm-wjhg; https://github.com/bytecodealliance/wasmtime/commit/e60c3742904ccbb3e26da201c9221c38a4981d72
CVE: CVE-2022-39393
Published: 2022-11-10
Description: Wasmtime is a standalone runtime for WebAssembly. Prior to versions 2.0.2 and 1.0.2, there is a bug in Wasmtime's implementation of its pooling instance allocator where when a linear memory is reused for another instance the initial heap snapshot of the prior instance can be visible, erroneously to the next instance. This bug has been patched and users should upgrade to Wasmtime 2.0.2 and 1.0.2. Other mitigations include disabling the pooling allocator and disabling the `memory-init-cow`.
CVSS Score: 8.6 (HIGH)
CWE: CWE-226, CWE-212
References: https://github.com/bytecodealliance/wasmtime/commit/2614f2e9d2d36805ead8a8da0fa0c6e0d9e428a0; https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-wh6w-3828-g9qf; https://github.com/bytecodealliance/wasmtime/commit/2614f2e9d2d36805ead8a8da0fa0c6e0d9e428a0
CVE: CVE-2022-39394
Published: 2022-11-10
Description: Wasmtime is a standalone runtime for WebAssembly. Prior to version 2.0.2, there is a bug in Wasmtime's C API implementation where the definition of the `wasmtime_trap_code` does not match its declared signature in the `wasmtime/trap.h` header file. This discrepancy causes the function implementation to perform a 4-byte write into a 1-byte buffer provided by the caller. This can lead to three zero bytes being written beyond the 1-byte location provided by the caller. This bug has been patched and users should upgrade to Wasmtime 2.0.2. This bug can be worked around by providing a 4-byte buffer casted to a 1-byte buffer when calling `wasmtime_trap_code`. Users of the `wasmtime` crate are not affected by this issue, only users of the C API function `wasmtime_trap_code` are affected.
CVSS Score: 3.8 (LOW)
CWE: CWE-787, CWE-787
References: https://github.com/bytecodealliance/wasmtime/commit/087d9d7becf7422b3f872a3bcd5d97bb7ce7ff36; https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-h84q-m8rr-3v9q; https://github.com/bytecodealliance/wasmtime/commit/087d9d7becf7422b3f872a3bcd5d97bb7ce7ff36
CVE: CVE-2022-41719
Published: 2022-11-10
Description: Unmarshal can panic on some inputs, possibly allowing for denial of service attacks.
CVSS Score: 7.5 (HIGH)
References: https://github.com/shamaton/msgpack/issues/31; https://github.com/shamaton/msgpack/pull/32; https://pkg.go.dev/vuln/GO-2022-0972
CVE: CVE-2022-43074
Published: 2022-11-10
Description: AyaCMS v3.1.2 was discovered to contain an arbitrary file upload vulnerability via the component /admin/fst_upload.inc.php. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434, CWE-434
References: https://github.com/loadream/AyaCMS/issues/3; https://github.com/loadream/AyaCMS/issues/3
CVE: CVE-2022-26088
Published: 2022-11-10
Description: An issue was discovered in BMC Remedy before 22.1. Email-based Incident Forwarding allows remote authenticated users to inject HTML (such as an SSRF payload) into the Activity Log by placing it in the To: field. This affects rendering that occurs upon a click in the "number of recipients" field. NOTE: the vendor's position is that "no real impact is demonstrated."
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://packetstormsecurity.com/files/169863/BMC-Remedy-ITSM-Suite-9.1.10-20.02-HTML-Injection.html; http://seclists.org/fulldisclosure/2022/Nov/10; https://sec-consult.com/vulnerability-lab/advisory/html-injection-in-bmc-remedy-itsm-suite/
CVE: CVE-2022-35740
Published: 2022-11-10
Description: dotCMS before 22.06 allows remote attackers to bypass intended access control and obtain sensitive information by using a semicolon in a URL to introduce a matrix parameter. (This is also fixed in 5.3.8.12, 21.06.9, and 22.03.2 for LTS users.) Some Java application frameworks, including those used by Spring or Tomcat, allow the use of matrix parameters: these are URI parameters separated by semicolons. Through precise semicolon placement in a URI, it is possible to exploit this feature to avoid dotCMS's path-based XSS prevention (such as "require login" filters), and consequently access restricted resources. For example, an attacker could place a semicolon immediately before a / character that separates elements of a filesystem path. This could reveal file content that is ordinarily only visible to signed-in users. This issue can be chained with other exploit code to achieve XSS attacks against dotCMS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/dotCMS/patches-hotfixes/tree/master/com.dotcms.security.matrixparams; https://www.dotcms.com/security/SI-63; https://github.com/dotCMS/patches-hotfixes/tree/master/com.dotcms.security.matrixparams
CVE: CVE-2022-41874
Published: 2022-11-10
Description: Tauri is a framework for building binaries for all major desktop platforms. In versions prior to 1.0.7 and 1.1.2, Tauri is vulnerable to an Incorrectly-Resolved Name. Due to incorrect escaping of special characters in paths selected via the file dialog and drag and drop functionality, it is possible to partially bypass the `fs` scope definition. It is not possible to traverse into arbitrary paths, as the issue is limited to neighboring files and sub folders of already allowed paths. The impact differs on Windows, MacOS and Linux due to different specifications of valid path characters. This bypass depends on the file picker dialog or dragged files, as user selected paths are automatically added to the allow list at runtime. A successful bypass requires the user to select a pre-existing malicious file or directory during the file picker dialog and an adversary controlled logic to access these files. The issue has been patched in versions 1.0.7, 1.1.2 and 1.2.0. As a workaround, disable the dialog and fileDropEnabled component inside the tauri.conf.json.
CVSS Score: 2.6 (LOW)
CWE: CWE-668, CWE-706, CWE-706
References: https://github.com/tauri-apps/tauri/security/advisories/GHSA-q9wv-22m9-vhqh; https://github.com/tauri-apps/tauri/security/advisories/GHSA-q9wv-22m9-vhqh
CVE: CVE-2022-41876
Published: 2022-11-10
Description: ezplatform-graphql is a GraphQL server implementation for Ibexa DXP and Ibexa Open Source. Versions prior to 2.3.12 and 1.0.13 are subject to Insecure Storage of Sensitive Information. Unauthenticated GraphQL queries for user accounts can expose password hashes of users that have created or modified content, typically administrators and editors. This issue has been patched in versions 2.3.12, and 1.0.13 on the 1.X branch. Users unable to upgrade can remove the "passwordHash" entry from "src/bundle/Resources/config/graphql/User.types.yaml" in the GraphQL package, and other properties like hash type, email, login if you prefer.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200, CWE-922, CWE-922
References: https://github.com/ezsystems/ezplatform-graphql/security/advisories/GHSA-c7pc-pgf6-mfh5; https://github.com/ezsystems/ezplatform-graphql/security/advisories/GHSA-c7pc-pgf6-mfh5
CVE: CVE-2022-41879
Published: 2022-11-10
Description: Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In versions prior to 5.3.3 or 4.10.20, a compromised Parse Server Cloud Code Webhook target endpoint allows an attacker to use prototype pollution to bypass the Parse Server `requestKeywordDenylist` option. This issue has been patched in versions 5.3.3 and 4.10.20. There are no known workarounds.
CVSS Score: 7.2 (HIGH)
CWE: CWE-1321, CWE-1321
References: https://github.com/parse-community/parse-server/security/advisories/GHSA-93vw-8fm5-p2jf; https://github.com/parse-community/parse-server/security/advisories/GHSA-93vw-8fm5-p2jf
CVE: CVE-2022-43679
Published: 2022-11-10
Description: The Docker image of ownCloud Server through 10.11 contains a misconfiguration that renders the trusted_domains config useless. This could be abused to spoof the URL in password-reset e-mail messages.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-284
References: https://owncloud.com; https://owncloud.com
CVE: CVE-2022-28748
Published: 2022-11-10
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2022-2964. Reason: This candidate is a reservation duplicate of CVE-2022-2964. Notes: All CVE users should reference CVE-2022-2964 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2022-3703
Published: 2022-11-10
Description: All versions of ETIC Telecom Remote Access Server (RAS) 4.5.0 and prior’s web portal is vulnerable to accepting malicious firmware packages that could provide a backdoor to an attacker and provide privilege escalation to the device.
CVSS Score: 7.6 (HIGH)
CWE: CWE-345
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-307-01; https://www.cisa.gov/uscert/ics/advisories/icsa-22-307-01
CVE: CVE-2022-40225
Published: 2022-11-10
Description: A vulnerability has been identified in SIPLUS TIM 1531 IRC (6AG1543-1MX00-7XE0) (All versions < V2.4.8), TIM 1531 IRC (6GK7543-1MX00-0XE0) (All versions < V2.4.8). Casting an internal value could lead to floating point exception under certain circumstances. This could allow an attacker to cause a denial of service condition on affected devices.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-681
References: https://cert-portal.siemens.com/productcert/html/ssa-337522.html; https://cert-portal.siemens.com/productcert/html/ssa-337522.html
CVE: CVE-2022-40981
Published: 2022-11-10
Description: All versions of ETIC Telecom Remote Access Server (RAS) 4.5.0 and prior is vulnerable to malicious file upload. An attacker could take advantage of this to store malicious files on the server, which could override sensitive and useful existing files on the filesystem, fill the hard disk to full capacity, or compromise the affected device or computers with administrator level privileges connected to the affected device.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-434, CWE-434
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-307-01; https://www.cisa.gov/uscert/ics/advisories/icsa-22-307-01
CVE: CVE-2022-41607
Published: 2022-11-10
Description: All versions of ETIC Telecom Remote Access Server (RAS) 4.5.0 and prior’s application programmable interface (API) is vulnerable to directory traversal through several different methods. This could allow an attacker to read sensitive files from the server, including SSH private keys, passwords, scripts, python objects, database files, and more.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-22
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-307-01; https://www.cisa.gov/uscert/ics/advisories/icsa-22-307-01
CVE: CVE-2022-42460
Published: 2022-11-10
Description: Broken Access Control vulnerability leading to Stored Cross-Site Scripting (XSS) in Traffic Manager plugin <= 1.4.5 on WordPress.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79, CWE-264
References: https://patchstack.com/database/vulnerability/traffic-manager/wordpress-traffic-manager-plugin-1-4-5-broken-access-control-vulnerability-leading-to-stored-cross-site-scripting-xss?_s_id=cve; https://wordpress.org/plugins/traffic-manager/; https://patchstack.com/database/vulnerability/traffic-manager/wordpress-traffic-manager-plugin-1-4-5-broken-access-control-vulnerability-leading-to-stored-cross-site-scripting-xss?_s_id=cve
CVE: CVE-2021-0185
Published: 2022-11-10
Description: Improper input validation in the firmware for some Intel(R) Server Board M10JNP Family before version 7.216 may allow a privileged user to potentially enable an escalation of privilege via local access.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-20
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00708.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00708.html
CVE: CVE-2022-41878
Published: 2022-11-10
Description: Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In versions prior to 5.3.2 or 4.10.19, keywords that are specified in the Parse Server option `requestKeywordDenylist` can be injected via Cloud Code Webhooks or Triggers. This will result in the keyword being saved to the database, bypassing the `requestKeywordDenylist` option. This issue is fixed in versions 4.10.19, and 5.3.2. If upgrade is not possible, the following Workarounds may be applied: Configure your firewall to only allow trusted servers to make request to the Parse Server Cloud Code Webhooks API, or block the API completely if you are not using the feature.
CVSS Score: 7.2 (HIGH)
CWE: CWE-74, CWE-1321, CWE-1321
References: https://github.com/parse-community/parse-server/security/advisories/GHSA-xprv-wvh7-qqqx; https://github.com/parse-community/parse-server/security/advisories/GHSA-xprv-wvh7-qqqx
CVE: CVE-2022-36938
Published: 2022-11-11
Description: DexLoader function get_stringidx_fromdex() in Redex prior to commit 3b44c64 can load an out of bound address when loading the string index table, potentially allowing remote code execution during processing of a 3rd party Android APK file.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125, CWE-1284
References: https://github.com/facebook/redex/commit/3b44c640346b77bfb7ef36e2413688dd460288d2; https://github.com/facebook/redex/commit/3b44c640346b77bfb7ef36e2413688dd460288d2
CVE: CVE-2022-41873
Published: 2022-11-11
Description: Contiki-NG is an open-source, cross-platform operating system for Next-Generation IoT devices. Versions prior to 4.9 are vulnerable to an Out-of-bounds read. While processing the L2CAP protocol, the Bluetooth Low Energy stack of Contiki-NG needs to map an incoming channel ID to its metadata structure. While looking up the corresponding channel structure in get_channel_for_cid (in os/net/mac/ble/ble-l2cap.c), a bounds check is performed on the incoming channel ID, which is meant to ensure that the channel ID does not exceed the maximum number of supported channels.However, an integer truncation issue leads to only the lowest byte of the channel ID to be checked, which leads to an incomplete out-of-bounds check. A crafted channel ID leads to out-of-bounds memory to be read and written with attacker-controlled data. The vulnerability has been patched in the "develop" branch of Contiki-NG, and will be included in release 4.9. As a workaround, Users can apply the patch in Contiki-NG pull request 2081 on GitHub.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-125, CWE-787, CWE-125
References: https://github.com/contiki-ng/contiki-ng/pull/2081; https://github.com/contiki-ng/contiki-ng/security/advisories/GHSA-m5cj-fw8m-ffgf; https://github.com/contiki-ng/contiki-ng/pull/2081
CVE: CVE-2022-41892
Published: 2022-11-11
Description: Arches is a web platform for creating, managing, & visualizing geospatial data. Versions prior to 6.1.2, 6.2.1, and 7.1.2 are vulnerable to SQL Injection. With a carefully crafted web request, it's possible to execute certain unwanted sql statements against the database. This issue is fixed in version 7.12, 6.2.1, and 6.1.2. Users are recommended to upgrade as soon as possible. There are no workarounds.
CVSS Score: 8.6 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/archesproject/arches/security/advisories/GHSA-gmpq-xrxj-xh8m; https://github.com/archesproject/arches/security/advisories/GHSA-gmpq-xrxj-xh8m
CVE: CVE-2022-3939
Published: 2022-11-11
Description: A vulnerability, which was classified as critical, has been found in lanyulei ferry. Affected by this issue is some unknown functionality of the file apis/public/file.go of the component API. The manipulation of the argument file leads to path traversal. The attack may be launched remotely. VDB-213446 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-22
References: https://vuldb.com/?id.213446; https://vuldb.com/?id.213446
CVE: CVE-2022-3940
Published: 2022-11-11
Description: A vulnerability, which was classified as problematic, was found in lanyulei ferry. This affects an unknown part of the file apis/process/task.go. The manipulation of the argument file_name leads to path traversal. The associated identifier of this vulnerability is VDB-213447.
CVSS Score: 3.5 (LOW)
CWE: CWE-22
References: https://vuldb.com/?id.213447; https://vuldb.com/?id.213447
CVE: CVE-2022-3941
Published: 2022-11-11
Description: A vulnerability has been found in Activity Log Plugin and classified as critical. This vulnerability affects unknown code of the component HTTP Header Handler. The manipulation of the argument X-Forwarded-For leads to improper output neutralization for logs. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-213448.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-707, CWE-116
References: https://drive.google.com/file/d/1YNOLomPC95rRvtk0topUhStVIa7Y8lcq/view; https://drive.google.com/file/d/1x-pgK3_-uS7NWfkEt_tk4Wc9FhXk-pYX/view; https://vuldb.com/?id.213448
CVE: CVE-2022-3942
Published: 2022-11-11
Description: A vulnerability was found in SourceCodester Sanitization Management System and classified as problematic. This issue affects some unknown processing of the file php-sms/?p=request_quote. The manipulation leads to cross site scripting. The attack may be initiated remotely. The identifier VDB-213449 was assigned to this vulnerability.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-707, CWE-79
References: https://vuldb.com/?id.213449; https://www.zerodayinitiative.com/advisories/ZDI-22-532/; https://vuldb.com/?id.213449
CVE: CVE-2022-3943
Published: 2022-11-11
Description: A vulnerability was found in ForU CMS. It has been classified as problematic. Affected is an unknown function of the file cms_chip.php. The manipulation of the argument name leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-213450 is the identifier assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-707, CWE-79
References: https://github.com/whiex/c2Rhc2Rhc2Q-/blob/main/MjU1NTI1ODU4ODU%3D.docx; https://vuldb.com/?id.213450; https://github.com/whiex/c2Rhc2Rhc2Q-/blob/main/MjU1NTI1ODU4ODU%3D.docx
CVE: CVE-2022-3944
Published: 2022-11-11
Description: A vulnerability was found in jerryhanjj ERP. It has been declared as critical. Affected by this vulnerability is the function uploadImages of the file application/controllers/basedata/inventory.php of the component Commodity Management. The manipulation leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-213451.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-266, CWE-434
References: https://github.com/jerryhanjj/ERP/issues/3; https://vuldb.com/?id.213451; https://github.com/jerryhanjj/ERP/issues/3
CVE: CVE-2022-3945
Published: 2022-11-11
Description: Improper Restriction of Excessive Authentication Attempts in GitHub repository kareadita/kavita prior to 0.6.0.3.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-307, CWE-307
References: https://github.com/kareadita/kavita/commit/f8db37d3f9aa42d47e7c4f4ca839e892d3f97afb; https://huntr.dev/bounties/55cd91b3-1d94-4d34-8d7f-86660b41fd65; https://github.com/kareadita/kavita/commit/f8db37d3f9aa42d47e7c4f4ca839e892d3f97afb
CVE: CVE-2022-3947
Published: 2022-11-11
Description: A vulnerability classified as critical has been found in eolinker goku_lite. This affects an unknown part of the file /balance/service/list. The manipulation of the argument route/keyword leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-213453 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-707, CWE-89
References: https://c2.im5i.com/2022/11/11/26Jg5.png; https://c2.im5i.com/2022/11/11/26c56.png; https://vuldb.com/?id.213453