deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-46053
Published: 2022-01-10
Description: A Denial of Service vulnerability exists in Binaryen 103. The program terminates with signal SIGKILL.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119
References: https://github.com/WebAssembly/binaryen/issues/4392; https://github.com/WebAssembly/binaryen/issues/4392
CVE: CVE-2021-46054
Published: 2022-01-10
Description: A Denial of Service vulnerability exists in Binaryen 104 due to an assertion abort in wasm::WasmBinaryBuilder::visitRethrow(wasm::Rethrow*).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-617
References: https://github.com/WebAssembly/binaryen/issues/4410; https://github.com/WebAssembly/binaryen/issues/4410
CVE: CVE-2021-46055
Published: 2022-01-10
Description: A Denial of Service vulnerability exists in Binaryen 104 due to an assertion abort in wasm::WasmBinaryBuilder::visitRethrow(wasm::Rethrow*).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-617
References: https://github.com/WebAssembly/binaryen/issues/4413; https://github.com/WebAssembly/binaryen/issues/4413
CVE: CVE-2021-46058
Published: 2022-01-10
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2021-46059
Published: 2022-01-10
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2021-46060
Published: 2022-01-10
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2021-46146
Published: 2022-01-10
Description: An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. The WikibaseMediaInfo component is vulnerable to XSS via the caption fields for a given media file.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://gerrit.wikimedia.org/r/q/I58d37fb59f998f5bec4a018bf9da96a777f8ff78; https://phabricator.wikimedia.org/T293556; https://gerrit.wikimedia.org/r/q/I58d37fb59f998f5bec4a018bf9da96a777f8ff78
CVE: CVE-2021-46147
Published: 2022-01-10
Description: An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. MassEditRegex allows CSRF.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://gerrit.wikimedia.org/r/q/I5980de35b0a01b5242b68b7b0bdc08adf5d968d8; https://phabricator.wikimedia.org/T293341; https://gerrit.wikimedia.org/r/q/I5980de35b0a01b5242b68b7b0bdc08adf5d968d8
CVE: CVE-2021-46148
Published: 2022-01-10
Description: An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. Some unprivileged users can view confidential information (e.g., IP addresses and User-Agent headers for election traffic) on a testwiki SecurePoll instance.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://gerrit.wikimedia.org/r/q/Ib2715adb281f8892b586dcb1895e87ac0eb548b0; https://phabricator.wikimedia.org/T290808; https://phabricator.wikimedia.org/T290856
CVE: CVE-2021-46149
Published: 2022-01-10
Description: An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. A denial of service (resource consumption) can be accomplished by searching for a very long key in a Language Name Search.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://gerrit.wikimedia.org/r/q/Ide32704cca578b9aecbce34bdcc0ac25c2a09a4d; https://phabricator.wikimedia.org/T293749; https://gerrit.wikimedia.org/r/q/Ide32704cca578b9aecbce34bdcc0ac25c2a09a4d
CVE: CVE-2021-46150
Published: 2022-01-10
Description: An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. Special:CheckUserLog allows CheckUser XSS because of date mishandling, as demonstrated by an XSS payload in MediaWiki:October.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://gerrit.wikimedia.org/r/plugins/gitiles/mediawiki/extensions/CheckUser/+/79c2c49a18f96b159258958feca90fce964c350a; https://phabricator.wikimedia.org/T292795; https://gerrit.wikimedia.org/r/plugins/gitiles/mediawiki/extensions/CheckUser/+/79c2c49a18f96b159258958feca90fce964c350a
CVE: CVE-2021-46163
Published: 2022-01-10
Description: Kentico Xperience 13.0.44 allows XSS via an XML document to the Media Libraries subsystem.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/boatpavaris/649e731b[PII_REDACTED]fbe423dcfd8485; https://gist.github.com/boatpavaris/649e731b[PII_REDACTED]fbe423dcfd8485
CVE: CVE-2021-46164
Published: 2022-01-10
Description: Zoho ManageEngine Desktop Central before 10.0.662 allows remote code execution by an authenticated user who has complete access to the Reports module.
CVSS Score: 8.8 (HIGH)
References: https://www.manageengine.com/products/desktop-central/vulnerabilities-in-reports-module.html; https://www.manageengine.com/products/desktop-central/vulnerabilities-in-reports-module.html
CVE: CVE-2021-46165
Published: 2022-01-10
Description: Zoho ManageEngine Desktop Central before 10.0.662, during startup, launches an executable file from the batch files, but this file's path might not be properly defined.
CVSS Score: 7.8 (HIGH)
References: https://www.manageengine.com/products/desktop-central/vulnerabilities-in-reports-module.html; https://www.manageengine.com/products/desktop-central/vulnerabilities-in-reports-module.html
CVE: CVE-2021-46166
Published: 2022-01-10
Description: Zoho ManageEngine Desktop Central before 10.0.662 allows authenticated users to obtain sensitive information from the database by visiting the Reports page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://www.manageengine.com/products/desktop-central/vulnerabilities-in-reports-module.html; https://www.manageengine.com/products/desktop-central/vulnerabilities-in-reports-module.html
CVE: CVE-2022-0132
Published: 2022-01-10
Description: peertube is vulnerable to Server-Side Request Forgery (SSRF)
CVSS Score: 7.5 (HIGH)
CWE: CWE-918, CWE-918
References: https://github.com/chocobozzz/peertube/commit/7b54a81cccf6b4c12269e9d6897d608b1a99537a; https://huntr.dev/bounties/77ec5308-5561-4664-af21-d780df2d1e4b; https://github.com/chocobozzz/peertube/commit/7b54a81cccf6b4c12269e9d6897d608b1a99537a
CVE: CVE-2022-0133
Published: 2022-01-10
Description: peertube is vulnerable to Improper Access Control
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://github.com/chocobozzz/peertube/commit/795212f7acc690c88c86d0fab8772f6564d59cb8; https://huntr.dev/bounties/80aabdc1-89fe-47b8-87ca-9d68107fc0b4; https://github.com/chocobozzz/peertube/commit/795212f7acc690c88c86d0fab8772f6564d59cb8
CVE: CVE-2022-21667
Published: 2022-01-10
Description: soketi is an open-source WebSockets server. There is an unhandled case when reading POST requests which results in the server crashing if it could not read the body of a request. In the event that a POST request is sent to any endpoint of the server with an empty body, even unauthenticated with the Pusher Protocol, it will crash the server. All users that run the server are affected by this vulnerability and it's highly recommended to upgrade to the latest patch. There are no workarounds for this issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-755, CWE-755
References: https://github.com/soketi/soketi/commit/4b12efef9c31117c36a0a0f1c3aa32114e86364b; https://github.com/soketi/soketi/releases/tag/0.24.1; https://github.com/soketi/soketi/security/advisories/GHSA-86ch-6w7v-v6xf
CVE: CVE-2022-21823
Published: 2022-01-10
Description: A insecure storage of sensitive information vulnerability exists in Ivanti Workspace Control <2021.2 (10.7.30.0) that could allow an attacker with locally authenticated low privileges to obtain key information due to an unspecified attack vector.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-922, CWE-922
References: https://forums.ivanti.com/s/article/A-locally-authenticated-user-with-low-privileges-can-obtain-key-information-due-to-an-unspecified-attack-vector?language=en_US; https://forums.ivanti.com/s/article/A-locally-authenticated-user-with-low-privileges-can-obtain-key-information-due-to-an-unspecified-attack-vector?language=en_US
CVE: CVE-2022-22263
Published: 2022-01-10
Description: Unprotected dynamic receiver in SecSettings prior to SMR Jan-2022 Release 1 allows untrusted applications to launch arbitrary activity.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-269, CWE-269
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=1; https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=1
CVE: CVE-2022-22264
Published: 2022-01-10
Description: Improper sanitization of incoming intent in Dressroom prior to SMR Jan-2022 Release 1 allows local attackers to read and write arbitrary files without permission.
CVSS Score: 7.7 (HIGH)
CWE: CWE-20, CWE-20
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=1; https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=1
CVE: CVE-2022-22265
Published: 2022-01-10
Description: An improper check or handling of exceptional conditions in NPU driver prior to SMR Jan-2022 Release 1 allows arbitrary memory write and code execution.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-703
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=1; https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=1; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-22265
CVE: CVE-2022-22266
Published: 2022-01-10
Description: (Applicable to China models only) Unprotected WifiEvaluationService in TencentWifiSecurity application prior to SMR Jan-2022 Release 1 allows untrusted applications to get WiFi information without proper permission.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-269, CWE-269
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=1; https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=1
CVE: CVE-2022-22267
Published: 2022-01-10
Description: Implicit Intent hijacking vulnerability in ActivityMetricsLogger prior to SMR Jan-2022 Release 1 allows attackers to get running application information.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-285, CWE-552
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=1; https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=1
CVE: CVE-2022-22268
Published: 2022-01-10
Description: Incorrect implementation of Knox Guard prior to SMR Jan-2022 Release 1 allows physically proximate attackers to temporary unlock the Knox Guard via Samsung DeX mode.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-285, CWE-552
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=1; https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=1
CVE: CVE-2022-22269
Published: 2022-01-10
Description: Keeping sensitive data in unprotected BluetoothSettingsProvider prior to SMR Jan-2022 Release 1 allows untrusted applications to get a local Bluetooth MAC address.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-285, CWE-552
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=1; https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=1
CVE: CVE-2022-22270
Published: 2022-01-10
Description: An implicit Intent hijacking vulnerability in Dialer prior to SMR Jan-2022 Release 1 allows unprivileged applications to access contact information.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-94, CWE-552
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=1; https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=1
CVE: CVE-2022-22271
Published: 2022-01-10
Description: A missing input validation before memory copy in TIMA trustlet prior to SMR Jan-2022 Release 1 allows attackers to copy data from arbitrary memory.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=1; https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=1
CVE: CVE-2022-22272
Published: 2022-01-10
Description: Improper authorization in TelephonyManager prior to SMR Jan-2022 Release 1 allows attackers to get IMSI without READ_PRIVILEGED_PHONE_STATE permission
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-285
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=1; https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=1
CVE: CVE-2022-22283
Published: 2022-01-10
Description: Improper session management vulnerability in Samsung Health prior to 6.20.1.005 prevents logging out from Samsung Health App.
CVSS Score: 2.8 (LOW)
CWE: CWE-287, CWE-613
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=1; https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=1
CVE: CVE-2022-22284
Published: 2022-01-10
Description: Improper authentication vulnerability in Samsung Internet prior to 16.0.2.19 allows attackers to bypass secret mode password authentication
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-287, CWE-287
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=1; https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=1
CVE: CVE-2022-22285
Published: 2022-01-10
Description: A vulnerability using PendingIntent in Reminder prior to version 12.2.05.0 in Android R(11.0) and 12.3.02.1000 in Android S(12.0) allows attackers to execute privileged action by hijacking and modifying the intent.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-94, CWE-94
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=1; https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=1
CVE: CVE-2022-22286
Published: 2022-01-10
Description: A vulnerability using PendingIntent in Bixby Routines prior to version 3.1.21.8 in Android R(11.0) and 2.6.30.5 in Android Q(10.0) allows attackers to execute privileged action by hijacking and modifying the intent.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-94, CWE-94
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=1; https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=1
CVE: CVE-2022-22287
Published: 2022-01-10
Description: Abitrary file access vulnerability in Samsung Email prior to 6.1.60.16 allows attacker to read isolated data in sandbox.
CVSS Score: 3.9 (LOW)
CWE: CWE-20, CWE-200
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=1; https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=1
CVE: CVE-2022-22288
Published: 2022-01-10
Description: Improper authorization vulnerability in Galaxy Store prior to 4.5.36.5 allows remote app installation of the allowlist.
CVSS Score: 7.5 (HIGH)
CWE: CWE-285
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=1; https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=1
CVE: CVE-2022-22289
Published: 2022-01-10
Description: Improper access control vulnerability in S Assistant prior to version 7.5 allows attacker to remotely get senstive information.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-287, CWE-287
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=1; https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=1
CVE: CVE-2022-22701
Published: 2022-01-10
Description: PartKeepr versions up to v1.4.0, loads attachments using a URL while creating a part and allows the use of the 'file://' URI scheme, allowing an authenticated user to read local files.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://fluidattacks.com/advisories/hendrix/; https://github.com/partkeepr/PartKeepr/issues/1229; https://fluidattacks.com/advisories/hendrix/
CVE: CVE-2022-22702
Published: 2022-01-10
Description: PartKeepr versions up to v1.4.0, in the functionality to upload attachments using a URL when creating a part does not validate that requests can be made to local ports, allowing an authenticated user to carry out SSRF attacks and port enumeration.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-918
References: https://fluidattacks.com/advisories/joplin/; https://github.com/partkeepr/PartKeepr/issues/1230; https://fluidattacks.com/advisories/joplin/
CVE: CVE-2022-22815
Published: 2022-01-10
Description: path_getbbox in path.c in Pillow before 9.0.0 improperly initializes ImagePath.Path.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-665
References: https://github.com/python-pillow/Pillow/blob/c5d9223a8b5e9295d15b5a9b1ef1dae44c8499f3/src/path.c#L331; https://lists.debian.org/debian-lts-announce/2022/01/msg00018.html; https://pillow.readthedocs.io/en/stable/releasenotes/9.0.0.html#fixed-imagepath-path-array-handling
CVE: CVE-2022-22816
Published: 2022-01-10
Description: path_getbbox in path.c in Pillow before 9.0.0 has a buffer over-read during initialization of ImagePath.Path.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://github.com/python-pillow/Pillow/blob/c5d9223a8b5e9295d15b5a9b1ef1dae44c8499f3/src/path.c#L331; https://lists.debian.org/debian-lts-announce/2022/01/msg00018.html; https://pillow.readthedocs.io/en/stable/releasenotes/9.0.0.html#fixed-imagepath-path-array-handling
CVE: CVE-2022-22817
Published: 2022-01-10
Description: PIL.ImageMath.eval in Pillow before 9.0.0 allows evaluation of arbitrary expressions, such as ones that use the Python exec method. A lambda expression could also be used.
CVSS Score: 9.8 (CRITICAL)
References: https://lists.debian.org/debian-lts-announce/2022/01/msg00018.html; https://lists.debian.org/debian-lts-announce/2024/03/msg00021.html; https://pillow.readthedocs.io/en/stable/releasenotes/9.0.0.html#restrict-builtins-available-to-imagemath-eval
CVE: CVE-2022-22821
Published: 2022-01-10
Description: NVIDIA NeMo before 1.6.0 contains a vulnerability in ASR WebApp, in which ../ Path Traversal may lead to deletion of any directory when admin privileges are available.
CVSS Score: 2.0 (LOW)
CWE: CWE-22
References: https://github.com/NVIDIA/NeMo/security/advisories/GHSA-rpx7-33j2-xx9x; https://github.com/NVIDIA/NeMo/security/advisories/GHSA-rpx7-33j2-xx9x
CVE: CVE-2022-22822
Published: 2022-01-10
Description: addBinding in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190, CWE-190
References: http://www.openwall.com/lists/oss-security/2022/01/17/3; https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf; https://github.com/libexpat/libexpat/pull/539
CVE: CVE-2022-22823
Published: 2022-01-10
Description: build_model in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190, CWE-190
References: http://www.openwall.com/lists/oss-security/2022/01/17/3; https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf; https://github.com/libexpat/libexpat/pull/539
CVE: CVE-2022-22824
Published: 2022-01-10
Description: defineAttribute in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190, CWE-190
References: http://www.openwall.com/lists/oss-security/2022/01/17/3; https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf; https://github.com/libexpat/libexpat/pull/539
CVE: CVE-2022-22825
Published: 2022-01-10
Description: lookup in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
CVSS Score: 8.8 (HIGH)
CWE: CWE-190, CWE-190
References: http://www.openwall.com/lists/oss-security/2022/01/17/3; https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf; https://github.com/libexpat/libexpat/pull/539
CVE: CVE-2022-22826
Published: 2022-01-10
Description: nextScaffoldPart in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
CVSS Score: 8.8 (HIGH)
CWE: CWE-190, CWE-190
References: http://www.openwall.com/lists/oss-security/2022/01/17/3; https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf; https://github.com/libexpat/libexpat/pull/539
CVE: CVE-2022-22827
Published: 2022-01-10
Description: storeAtts in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
CVSS Score: 8.8 (HIGH)
CWE: CWE-190, CWE-190
References: http://www.openwall.com/lists/oss-security/2022/01/17/3; https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf; https://github.com/libexpat/libexpat/pull/539
CVE: CVE-2022-22836
Published: 2022-01-10
Description: CoreFTP Server before 727 allows directory traversal (for file creation) by an authenticated attacker via ../ in an HTTP PUT request.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: http://www.coreftp.com/forums/viewtopic.php?f=15&t=4022509; https://yoursecuritybores.me/coreftp-vulnerabilities/; http://www.coreftp.com/forums/viewtopic.php?f=15&t=4022509
CVE: CVE-2022-22844
Published: 2022-01-10
Description: LibTIFF 4.3.0 has an out-of-bounds read in _TIFFmemcpy in tif_unix.c in certain situations involving a custom tag and 0x0200 as the second word of the DE field.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://gitlab.com/libtiff/libtiff/-/issues/355; https://gitlab.com/libtiff/libtiff/-/merge_requests/287; https://lists.debian.org/debian-lts-announce/2022/03/msg00001.html
CVE: CVE-2022-22845
Published: 2022-01-10
Description: QXIP SIPCAPTURE homer-app before 1.4.28 for HOMER 7.x has the same 167f0db2-f83e-4baa-9736-d56064a5b415 JWT secret key across different customers' installations.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: http://sipcapture.org; https://github.com/sipcapture/homer; https://github.com/sipcapture/homer-app/commit/7f92f3afc8b0380c14af3d0fc1c365318a2d1591
CVE: CVE-2022-22846
Published: 2022-01-10
Description: The dnslib package through 0.9.16 for Python does not verify that the ID value in a DNS reply matches an ID value in a query.
CVSS Score: 7.5 (HIGH)
References: https://github.com/paulc/dnslib/issues/30; https://github.com/paulc/dnslib/issues/30
CVE: CVE-2022-22847
Published: 2022-01-10
Description: Formpipe Lasernet before 9.13.3 allows file inclusion in Client Web Services (either by an authenticated attacker, or in a configuration that does not require authentication).
CVSS Score: 9.8 (CRITICAL)
References: https://support.formpipe.com/news/posts/vulnerability-in-the-client-web-service-of-lasernet-9-and-older; https://support.formpipe.com/news/posts/vulnerability-in-the-client-web-service-of-lasernet-9-and-older
CVE: CVE-2021-44586
Published: 2022-01-10
Description: An issue was discovered in dst-admin v1.3.0. The product has an unauthorized arbitrary file download vulnerability that can expose sensitive information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://github.com/qinming99/dst-admin/issues/28; https://github.com/qinming99/dst-admin/issues/28
CVE: CVE-2021-23154
Published: 2022-01-10
Description: In Lens prior to 5.3.4, custom helm chart configuration creates helm commands from string concatenation of provided arguments which are then executed in the user's shell. Arguments can be provided which cause arbitrary shell commands to run on the system.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-94, CWE-78
References: https://github.com/Mirantis/security/blob/main/advisories/0003.md; https://github.com/Mirantis/security/blob/main/advisories/0003.md
CVE: CVE-2021-23218
Published: 2022-01-10
Description: When running with FIPS mode enabled, Mirantis Container Runtime 20.10.8 leaks memory during TLS Handshakes which could be abused to cause a denial of service.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-401, CWE-401
References: https://github.com/Mirantis/security/blob/main/advisories/0002.md; https://github.com/Mirantis/security/blob/main/advisories/0002.md
CVE: CVE-2021-24862
Published: 2022-01-10
Description: The RegistrationMagic WordPress plugin before 5.0.1.6 does not escape user input in its rm_chronos_ajax AJAX action before using it in a SQL statement when duplicating tasks in batches, which could lead to a SQL injection issue
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.com/files/165746/WordPress-RegistrationMagic-V-5.0.1.5-SQL-Injection.html; https://github.com/Hacker5preme/Exploits/tree/main/Wordpress/CVE-2021-24862; https://wpscan.com/vulnerability/7d3af3b5-5548-419d-aa32-1f7b51622615