deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-29453
Published: 2022-06-15
Description: Cross-Site Request Forgery (CSRF) vulnerability in API KEY for Google Maps plugin <= 1.2.1 at WordPress leading to Google Maps API key update.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/api-key-for-google-maps/wordpress-api-key-for-google-maps-plugin-1-2-1-csrf-vulnerability-leading-to-google-maps-api-key-update; https://wordpress.org/plugins/api-key-for-google-maps/#developers; https://patchstack.com/database/vulnerability/api-key-for-google-maps/wordpress-api-key-for-google-maps-plugin-1-2-1-csrf-vulnerability-leading-to-google-maps-api-key-update
CVE: CVE-2021-39820
Published: 2022-06-15
Description: Adobe InDesign versions 16.3 (and earlier), and 16.3.1 (and earlier) is affected by an Out-of-bounds Write vulnerability due to insecure handling of a malicious TIFF file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required to exploit this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://helpx.adobe.com/security/products/indesign/apsb21-73.html; https://helpx.adobe.com/security/products/indesign/apsb21-73.html
CVE: CVE-2021-40727
Published: 2022-06-15
Description: Access of Memory Location After End of Buffer (CWE-788
CVSS Score: 7.8 (HIGH)
CWE: CWE-788
References: https://helpx.adobe.com/security/products/indesign/apsb21-73.html; https://helpx.adobe.com/security/products/indesign/apsb21-73.html
CVE: CVE-2021-40940
Published: 2022-06-15
Description: Monstra 3.0.4 does not filter the case of php, which leads to an unrestricted file upload vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://github.com/monstra-cms/monstra/issues/471; https://github.com/monstra-cms/monstra/issues/471
CVE: CVE-2021-42732
Published: 2022-06-15
Description: Access of Memory Location After End of Buffer (CWE-788)
CVSS Score: 7.8 (HIGH)
CWE: CWE-788
References: https://helpx.adobe.com/security/products/indesign/apsb21-73.html; https://helpx.adobe.com/security/products/indesign/apsb21-73.html
CVE: CVE-2022-1342
Published: 2022-06-15
Description: A lack of password masking in Devolutions Remote Desktop Manager allows physically proximate attackers to observe sensitive data. A caching issue can cause sensitive fields to sometimes stay revealed when closing and reopening a panel, which could lead to involuntarily disclosing sensitive information. This issue affects: Devolutions Remote Desktop Manager 2022.1.24 version and prior versions.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-549, CWE-522
References: https://devolutions.net/security/advisories/DEVO-2022-0003; https://devolutions.net/security/advisories/DEVO-2022-0003
CVE: CVE-2022-32101
Published: 2022-06-15
Description: kkcms v1.3.7 was discovered to contain a SQL injection vulnerability via the cid parameter at /template/wapian/vlist.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.yuque.com/docs/share/e6e66d95-9d58-4dc0-a0ce-f337a16b482f; https://www.yuque.com/docs/share/e6e66d95-9d58-4dc0-a0ce-f337a16b482f
CVE: CVE-2022-32151
Published: 2022-06-15
Description: The httplib and urllib Python libraries that Splunk shipped with Splunk Enterprise did not validate certificates using the certificate authority (CA) certificate stores by default in Splunk Enterprise versions before 9.0 and Splunk Cloud Platform versions before 8.2.2203. Python 3 client libraries now verify server certificates by default and use the appropriate CA certificate stores for each library. Apps and add-ons that include their own HTTP libraries are not affected. For Splunk Enterprise, update to Splunk Enterprise version 9.0 and Configure TLS host name validation for Splunk-to-Splunk communications (https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation) to enable the remediation.
CVSS Score: 7.4 (HIGH)
CWE: CWE-295, CWE-295
References: https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation; https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/Updates; https://research.splunk.com/application/splunk_protocol_impersonation_weak_encryption_simplerequest/
CVE: CVE-2022-32152
Published: 2022-06-15
Description: Splunk Enterprise peers in Splunk Enterprise versions before 9.0 and Splunk Cloud Platform versions before 8.2.2203 did not validate the TLS certificates during Splunk-to-Splunk communications by default. Splunk peer communications configured properly with valid certificates were not vulnerable. However, an attacker with administrator credentials could add a peer without a valid certificate and connections from misconfigured nodes without valid certificates did not fail by default. For Splunk Enterprise, update to Splunk Enterprise version 9.0 and Configure TLS host name validation for Splunk-to-Splunk communications (https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation) to enable the remediation.
CVSS Score: 8.1 (HIGH)
CWE: CWE-295, CWE-295
References: https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation; https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/Updates; https://research.splunk.com/application/splunk_digital_certificates_infrastructure_version/
CVE: CVE-2022-32153
Published: 2022-06-15
Description: Splunk Enterprise peers in Splunk Enterprise versions before 9.0 and Splunk Cloud Platform versions before 8.2.2203 did not validate the TLS certificates during Splunk-to-Splunk communications by default. Splunk peer communications configured properly with valid certificates were not vulnerable. However, an attacker with administrator credentials could add a peer without a valid certificate and connections from misconfigured nodes without valid certificates did not fail by default. For Splunk Enterprise, update to Splunk Enterprise version 9.0 and Configure TLS host name validation for Splunk-to-Splunk communications (https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation) to enable the remediation.
CVSS Score: 8.1 (HIGH)
CWE: CWE-297, CWE-295
References: https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation; https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/Updates; https://research.splunk.com/application/splunk_digital_certificates_infrastructure_version/
CVE: CVE-2022-32154
Published: 2022-06-15
Description: Dashboards in Splunk Enterprise versions before 9.0 might let an attacker inject risky search commands into a form token when the token is used in a query in a cross-origin request. The result bypasses SPL safeguards for risky commands. See New capabilities can limit access to some custom and potentially risky commands (https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/SPLsafeguards#New_capabilities_can_limit_access_to_some_custom_and_potentially_risky_commands) for more information. Note that the attack is browser-based and an attacker cannot exploit it at will.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20, CWE-77
References: https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/SPLsafeguards#New_capabilities_can_limit_access_to_some_custom_and_potentially_risky_commands; https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/Updates; https://research.splunk.com/application/splunk_command_and_scripting_interpreter_delete_usage/
CVE: CVE-2022-32155
Published: 2022-06-15
Description: In universal forwarder versions before 9.0, management services are available remotely by default. When not required, it introduces a potential exposure, but it is not a vulnerability. If exposed, we recommend each customer assess the potential severity specific to your environment. In 9.0, the universal forwarder now binds the management port to localhost preventing remote logins by default. If management services are not required in versions before 9.0, set disableDefaultPort = true in server.conf OR allowRemoteLogin = never in server.conf OR mgmtHostPort = localhost in web.conf. See Configure universal forwarder management security (https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation#Configure_universal_forwarder_management_security) for more information on disabling the remote management services.
CVSS Score: 7.5 (HIGH)
CWE: CWE-732
References: https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation#Configure_universal_forwarder_management_security; https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/Updates; https://www.splunk.com/en_us/product-security/announcements/svd-2022-0605.html
CVE: CVE-2022-32156
Published: 2022-06-15
Description: In Splunk Enterprise and Universal Forwarder versions before 9.0, the Splunk command-line interface (CLI) did not validate TLS certificates while connecting to a remote Splunk platform instance by default. After updating to version 9.0, see  Configure TLS host name validation for the Splunk CLI https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation#Configure_TLS_host_name_validation_for_the_Splunk_CLI  to enable the remediation. The vulnerability does not affect the Splunk Cloud Platform. At the time of publishing, we have no evidence of exploitation of this vulnerability by external parties.

The issue requires conditions beyond the control of a potential bad actor such as a machine-in-the-middle attack. Hence, Splunk rates the complexity of the attack as High.
CVSS Score: 8.1 (HIGH)
CWE: CWE-295, CWE-295
References: https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation#Configure_TLS_host_name_validation_for_the_Splunk_CLI; https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/Updates; https://www.splunk.com/en_us/product-security/announcements/svd-2022-0606.html
CVE: CVE-2022-32157
Published: 2022-06-15
Description: Splunk Enterprise deployment servers in versions before 9.0 allow unauthenticated downloading of forwarder bundles. Remediation requires you to update the deployment server to version 9.0 and Configure authentication for deployment servers and clients (https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/ConfigDSDCAuthEnhancements#Configure_authentication_for_deployment_servers_and_clients). Once enabled, deployment servers can manage only Universal Forwarder versions 9.0 and higher. Though the vulnerability does not directly affect Universal Forwarders, remediation requires updating all Universal Forwarders that the deployment server manages to version 9.0 or higher prior to enabling the remediation.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306, CWE-306
References: https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/ConfigDSDCAuthEnhancements#Configure_authentication_for_deployment_servers_and_clients; https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/Updates; https://research.splunk.com/application/splunk_process_injection_forwarder_bundle_downloads/
CVE: CVE-2022-32158
Published: 2022-06-15
Description: Splunk Enterprise deployment servers in versions before 8.1.10.1, 8.2.6.1, and 9.0 let clients deploy forwarder bundles to other deployment clients through the deployment server. An attacker that compromised a Universal Forwarder endpoint could use the vulnerability to execute arbitrary code on all other Universal Forwarder endpoints subscribed to the deployment server.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-284
References: https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/Updates; https://www.splunk.com/en_us/product-security/announcements/svd-2022-0608.html; https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/Updates
CVE: CVE-2022-32299
Published: 2022-06-15
Description: YoudianCMS v9.5.0 was discovered to contain a SQL injection vulnerability via the id parameter at /App/Lib/Action/Admin/SiteAction.class.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://www.yuque.com/docs/share/a296c6fe-8af7-4e01-bc14-3ad13d6335ed; https://www.yuque.com/docs/share/a296c6fe-8af7-4e01-bc14-3ad13d6335ed
CVE: CVE-2022-32300
Published: 2022-06-15
Description: YoudianCMS v9.5.0 was discovered to contain a SQL injection vulnerability via the MailSendID parameter at /App/Lib/Action/Admin/MailAction.class.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://www.yuque.com/docs/share/bf37643b-9782-4320-9ca9-cf38a331b686; https://www.yuque.com/docs/share/bf37643b-9782-4320-9ca9-cf38a331b686
CVE: CVE-2022-32301
Published: 2022-06-15
Description: YoudianCMS v9.5.0 was discovered to contain a SQL injection vulnerability via the IdList parameter at /App/Lib/Action/Home/ApiAction.class.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.yuque.com/docs/share/8864c0c7-ad8e-407f-98d3-104d2f2dd13e; https://www.yuque.com/docs/share/8864c0c7-ad8e-407f-98d3-104d2f2dd13e
CVE: CVE-2022-32302
Published: 2022-06-15
Description: Theme Park Ticketing System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at edit_ticket.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://www.yuque.com/docs/share/0255145d-8a60-4045-a5d2-fd82232e0faa; https://www.yuque.com/docs/share/0255145d-8a60-4045-a5d2-fd82232e0faa
CVE: CVE-2022-32991
Published: 2022-06-15
Description: Web Based Quiz System v1.0 was discovered to contain a SQL injection vulnerability via the eid parameter at welcome.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://www.yuque.com/docs/share/fd95cc4d-2a38-4e5a-9fac-bfa3534f8056; https://www.yuque.com/docs/share/fd95cc4d-2a38-4e5a-9fac-bfa3534f8056
CVE: CVE-2022-32992
Published: 2022-06-15
Description: Online Tours And Travels Management System v1.0 was discovered to contain a SQL injection vulnerability via the tname parameter at /admin/operations/tax.php.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://www.yuque.com/docs/share/d1593cea-f278-4a5e-a6ee-f7a63b641f1d; https://www.yuque.com/docs/share/d1593cea-f278-4a5e-a6ee-f7a63b641f1d
CVE: CVE-2017-20046
Published: 2022-06-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This CVE has been rejected since it is out of scope in accordance to the Vulnerability Policy of Axis: https://www.axis.com/dam/public/76/fe/26/axis-vulnerability-management-policy-en-US-375421.pdf. Notes: none
CVE: CVE-2017-20047
Published: 2022-06-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This CVE has been rejected as out of scope in accordance to the Vulnerability Policy of Axis: https://www.axis.com/dam/public/76/fe/26/axis-vulnerability-management-policy-en-US-375421.pdf. Notes: none
CVE: CVE-2017-20048
Published: 2022-06-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This CVE has been rejected since it is out of scope in accordance to the Vulnerability Policy of Axis: https://www.axis.com/dam/public/76/fe/26/axis-vulnerability-management-policy-en-US-375421.pdf. Notes: none
CVE: CVE-2017-20049
Published: 2022-06-15
Description: A vulnerability, was found in legacy Axis devices such as P3225 and M3005. This affects an unknown part of the component CGI Script. The manipulation leads to improper privilege management. It is possible to initiate the attack remotely.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-269
References: https://www.axis.com/dam/public/df/f3/dd/cve-2017-20049-en-US-376956.pdf; https://www.axis.com/dam/public/df/f3/dd/cve-2017-20049-en-US-376956.pdf
CVE: CVE-2017-20050
Published: 2022-06-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This CVE has been rejected due to lack of sufficient information on how to reproduce the vulnerability. Notes: none
CVE: CVE-2022-20664
Published: 2022-06-15
Description: A vulnerability in the web management interface of Cisco Secure Email and Web Manager, formerly Cisco Security Management Appliance (SMA), and Cisco Email Security Appliance (ESA) could allow an authenticated, remote attacker to retrieve sensitive information from a Lightweight Directory Access Protocol (LDAP) external authentication server connected to an affected device. This vulnerability is due to a lack of proper input sanitization while querying the external authentication server. An attacker could exploit this vulnerability by sending a crafted query through an external authentication web page. A successful exploit could allow the attacker to gain access to sensitive information, including user credentials from the external authentication server. To exploit this vulnerability, an attacker would need valid operator-level (or higher) credentials.
CVSS Score: 7.7 (HIGH)
CWE: CWE-497, CWE-200
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esasma-info-dsc-Q9tLuOvM; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esasma-info-dsc-Q9tLuOvM
CVE: CVE-2022-20733
Published: 2022-06-15
Description: A vulnerability in the login page of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to log in without credentials and access all roles without any restrictions. This vulnerability is due to exposed sensitive Security Assertion Markup Language (SAML) metadata. An attacker could exploit this vulnerability by using the exposed SAML metadata to bypass authentication to the user portal. A successful exploit could allow the attacker to access all roles without any restrictions.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-287
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ISE-SAML-nuukMPf9; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ISE-SAML-nuukMPf9
CVE: CVE-2022-20736
Published: 2022-06-15
Description: A vulnerability in the web-based management interface of Cisco AppDynamics Controller Software could allow an unauthenticated, remote attacker to access a configuration file and the login page for an administrative console that they would not normally have authorization to access. This vulnerability is due to improper authorization checking for HTTP requests that are submitted to the affected web-based management interface. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected instance of AppDynamics Controller. A successful exploit could allow the attacker to access the login page for an administrative console. AppDynamics has released software updates that address this vulnerability.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-939, CWE-862
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-appd-contrl-athzn-bp-BLypgsbu; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-appd-contrl-athzn-bp-BLypgsbu
CVE: CVE-2022-20798
Published: 2022-06-15
Description: A vulnerability in the external authentication functionality of Cisco Secure Email and Web Manager, formerly known as Cisco Security Management Appliance (SMA), and Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to bypass authentication and log in to the web management interface of an affected device. This vulnerability is due to improper authentication checks when an affected device uses Lightweight Directory Access Protocol (LDAP) for external authentication. An attacker could exploit this vulnerability by entering a specific input on the login page of the affected device. A successful exploit could allow the attacker to gain unauthorized access to the web-based management interface of the affected device.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287, CWE-287
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sma-esa-auth-bypass-66kEcxQD; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sma-esa-auth-bypass-66kEcxQD
CVE: CVE-2022-20817
Published: 2022-06-15
Description: A vulnerability in Cisco Unified IP Phones could allow an unauthenticated, remote attacker to impersonate another user's phone if the Cisco Unified Communications Manager (CUCM) is in secure mode. This vulnerability is due to improper key generation during the manufacturing process that could result in duplicated manufactured keys installed on multiple devices. An attacker could exploit this vulnerability by performing a machine-in-the-middle attack on the secure communication between the phone and the CUCM. A successful exploit could allow the attacker to impersonate another user's phone. This vulnerability cannot be addressed with software updates. There is a workaround that addresses this vulnerability.
CVSS Score: 7.4 (HIGH)
CWE: CWE-338, CWE-338
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cp6901-dup-cert-82jdJGe4; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cp6901-dup-cert-82jdJGe4
CVE: CVE-2022-20819
Published: 2022-06-15
Description: A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to obtain sensitive information from an affected device. This vulnerability exists because administrative privilege levels for sensitive data are not properly enforced. An attacker with read-only privileges for the web-based management interface on an affected device could exploit this vulnerability by browsing to a page that contains sensitive data. A successful exploit could allow the attacker to collect sensitive information about the system configuration.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-266, CWE-269
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-info-disclosure-Os6fSd6N; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-info-disclosure-Os6fSd6N
CVE: CVE-2022-20825
Published: 2022-06-15
Description: A vulnerability in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an unauthenticated, remote attacker to execute arbitrary code or cause an affected device to restart unexpectedly, resulting in a denial of service (DoS) condition. This vulnerability is due to insufficient user input validation of incoming HTTP packets. An attacker could exploit this vulnerability by sending a crafted request to the web-based management interface. A successful exploit could allow the attacker to execute arbitrary commands on an affected device using root-level privileges. Cisco has not released software updates that address this vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-121, CWE-787
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sb-rv-overflow-s2r82P9v; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sb-rv-overflow-s2r82P9v
CVE: CVE-2021-40776
Published: 2022-06-15
Description: Adobe Lightroom Classic 10.3 (and earlier) are affected by a privilege escalation vulnerability in the Offline Lightroom Classic installer. An authenticated attacker could leverage this vulnerability to escalate privileges. User interaction is required before product installation to abuse this vulnerability.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-379
References: https://helpx.adobe.com/security/products/lightroom/apsb21-97.html; https://helpx.adobe.com/security/products/lightroom/apsb21-97.html
CVE: CVE-2021-43754
Published: 2022-06-15
Description: Adobe Prelude version 22.1.1 (and earlier) is affected by an Out-of-bounds Write vulnerability due to insecure handling of a malicious file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required to exploit this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://helpx.adobe.com/security/products/prelude/apsb21-114.html; https://helpx.adobe.com/security/products/prelude/apsb21-114.html