deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-46179
Published: 2022-12-28
Description: LiuOS is a small Python project meant to imitate the functions of a regular operating system. Version 0.1.0 and prior of LiuOS allow an attacker to set the GITHUB_ACTIONS environment variable to anything other than null or true and skip authentication checks. This issue is patched in the latest commit (c658b4f3e57258acf5f6207a90c2f2169698ae22) by requiring the var to be set to true, causing a test script to run instead of being able to login. A potential workaround is to check for the GITHUB_ACTIONS environment variable and set it to "" (no quotes) to null the variable and force credential checks.
CVSS Score: 9.2 (CRITICAL)
CWE: CWE-639
References: https://github.com/LiuWoodsCode/LiuOS/commit/c658b4f3e57258acf5f6207a90c2f2169698ae22; https://github.com/LiuWoodsCode/LiuOS/security/advisories/GHSA-f9x3-mj2r-cqmf; https://github.com/LiuWoodsCode/LiuOS/commit/c658b4f3e57258acf5f6207a90c2f2169698ae22
CVE: CVE-2019-25092
Published: 2022-12-28
Description: A vulnerability classified as problematic was found in Nakiami Mellivora up to 2.1.x. Affected by this vulnerability is the function print_user_ip_log of the file include/layout/user.inc.php of the component Admin Panel. The manipulation of the argument $entry['ip'] leads to cross site scripting. The attack can be launched remotely. Upgrading to version 2.2.0 is able to address this issue. The name of the patch is e0b6965f8dde608a3d2621617c05695eb406cbb9. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-216955.
CVSS Score: 2.4 (LOW)
CWE: CWE-79
References: https://github.com/Nakiami/mellivora/commit/e0b6965f8dde608a3d2621617c05695eb406cbb9; https://github.com/Nakiami/mellivora/releases/tag/v2.2.0; https://vuldb.com/?ctiid.216955
CVE: CVE-2021-4293
Published: 2022-12-28
Description: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as problematic has been found in gnuboard youngcart5 up to 5.4.5.1. Affected is an unknown function of the file adm/menu_list_update.php. The manipulation of the argument me_link leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 5.4.5.2 is able to address this issue. The name of the patch is 70daa537adfa47b87af12d85f1e698fff01785ff. It is recommended to upgrade the affected component. VDB-216954 is the identifier assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/gnuboard/youngcart5/commit/70daa537adfa47b87af12d85f1e698fff01785ff; https://github.com/gnuboard/youngcart5/releases/tag/5.4.5.2; https://vuldb.com/?ctiid.216954
CVE: CVE-2018-25050
Published: 2022-12-28
Description: A vulnerability, which was classified as problematic, has been found in Harvest Chosen up to 1.8.6. Affected by this issue is the function AbstractChosen of the file coffee/lib/abstract-chosen.coffee. The manipulation of the argument group_label leads to cross site scripting. The attack may be launched remotely. Upgrading to version 1.8.7 is able to address this issue. The name of the patch is 77fd031d541e77510268d1041ed37798fdd1017e. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-216956.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-79
References: https://github.com/harvesthq/chosen/commit/77fd031d541e77510268d1041ed37798fdd1017e; https://github.com/harvesthq/chosen/pull/2997; https://github.com/harvesthq/chosen/releases/tag/v1.8.7
CVE: CVE-2022-3922
Published: 2022-12-28
Description: The Broken Link Checker WordPress plugin before 1.11.20 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/78054bd7-cdc2-4b14-9b5c-30f10e802d6b; https://wpscan.com/vulnerability/78054bd7-cdc2-4b14-9b5c-30f10e802d6b
CVE: CVE-2018-25051
Published: 2022-12-28
Description: A vulnerability, which was classified as problematic, was found in JmPotato Pomash. This affects an unknown part of the file Pomash/theme/clean/templates/editor.html. The manipulation of the argument article.title/content.title/article.tag leads to cross site scripting. It is possible to initiate the attack remotely. The name of the patch is be1914ef0a6808e00f51618b2de92496a3604415. It is recommended to apply a patch to fix this issue. The identifier VDB-216957 was assigned to this vulnerability.
CVSS Score: 2.4 (LOW)
CWE: CWE-79
References: https://github.com/JmPotato/Pomash/commit/be1914ef0a6808e00f51618b2de92496a3604415; https://vuldb.com/?ctiid.216957; https://vuldb.com/?id.216957
CVE: CVE-2018-25052
Published: 2022-12-28
Description: A vulnerability has been found in Catalyst-Plugin-Session up to 0.40 and classified as problematic. This vulnerability affects the function _load_sessionid of the file lib/Catalyst/Plugin/Session.pm of the component Session ID Handler. The manipulation of the argument sid leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 0.41 is able to address this issue. The name of the patch is 88d1b599e1163761c9bd53bec53ba078f13e09d4. It is recommended to upgrade the affected component. VDB-216958 is the identifier assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/perl-catalyst/Catalyst-Plugin-Session/commit/88d1b599e1163761c9bd53bec53ba078f13e09d4; https://github.com/perl-catalyst/Catalyst-Plugin-Session/releases/tag/0.41; https://vuldb.com/?ctiid.216958
CVE: CVE-2018-25053
Published: 2022-12-28
Description: A vulnerability was found in moappi Json2html up to 1.1.x and classified as problematic. This issue affects some unknown processing of the file json2html.js. The manipulation leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 1.2.0 is able to address this issue. The name of the patch is 2d3d24d971b19a8ed1fb823596300b9835d55801. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-216959.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://github.com/moappi/json2html/commit/2d3d24d971b19a8ed1fb823596300b9835d55801; https://github.com/moappi/json2html/releases/tag/1.2.0; https://vuldb.com/?ctiid.216959
CVE: CVE-2018-25054
Published: 2022-12-28
Description: A vulnerability was found in shred cilla. It has been classified as problematic. Affected is an unknown function of the file cilla-xample/src/main/webapp/WEB-INF/jsp/view/search.jsp of the component Search Handler. The manipulation of the argument details leads to cross site scripting. It is possible to launch the attack remotely. The name of the patch is d345e6bc7798bd717a583ec7f545ca387819d5c7. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-216960.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/shred/cilla/commit/d345e6bc7798bd717a583ec7f545ca387819d5c7; https://vuldb.com/?ctiid.216960; https://vuldb.com/?id.216960
CVE: CVE-2018-25055
Published: 2022-12-28
Description: A vulnerability was found in FarCry Solr Pro Plugin up to 1.5.x. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file packages/forms/solrProSearch.cfc of the component Search Handler. The manipulation of the argument suggestion leads to cross site scripting. The attack can be launched remotely. Upgrading to version 1.6.0 is able to address this issue. The name of the patch is b8f3d61511c9b02b781ec442bfb803cbff8e08d5. It is recommended to upgrade the affected component. The identifier VDB-216961 was assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/jeffcoughlin/farcrysolrpro/commit/b8f3d61511c9b02b781ec442bfb803cbff8e08d5; https://github.com/jeffcoughlin/farcrysolrpro/issues/78; https://github.com/jeffcoughlin/farcrysolrpro/releases/tag/1.6.0
CVE: CVE-2018-25056
Published: 2022-12-28
Description: A vulnerability, which was classified as problematic, was found in yolapi. Affected is the function render_description of the file yolapi/pypi/metadata.py. The manipulation of the argument text leads to cross site scripting. It is possible to launch the attack remotely. The name of the patch is a0fe129055a99f429133a5c40cb13b44611ff796. It is recommended to apply a patch to fix this issue. VDB-216966 is the identifier assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/yola/yolapi/commit/a0fe129055a99f429133a5c40cb13b44611ff796; https://vuldb.com/?ctiid.216966; https://vuldb.com/?id.216966
CVE: CVE-2022-4796
Published: 2022-12-28
Description: Incorrect Use of Privileged APIs in GitHub repository usememos/memos prior to 0.9.1.
CVSS Score: 8.1 (HIGH)
CWE: CWE-648
References: https://github.com/usememos/memos/commit/3556ae4e651d9443dc3bb8a170dd3cc726517a53; https://huntr.dev/bounties/efe8001b-1d6a-41af-a64c-736705cc66a6; https://github.com/usememos/memos/commit/3556ae4e651d9443dc3bb8a170dd3cc726517a53
CVE: CVE-2022-4797
Published: 2022-12-28
Description: Improper Restriction of Excessive Authentication Attempts in GitHub repository usememos/memos prior to 0.9.1.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-307
References: https://github.com/usememos/memos/commit/3556ae4e651d9443dc3bb8a170dd3cc726517a53; https://huntr.dev/bounties/5233f76f-016b-4c65-b019-2c5d27802a1b; https://github.com/usememos/memos/commit/3556ae4e651d9443dc3bb8a170dd3cc726517a53
CVE: CVE-2022-4798
Published: 2022-12-28
Description: Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.1.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-639, CWE-639
References: https://github.com/usememos/memos/commit/3556ae4e651d9443dc3bb8a170dd3cc726517a53; https://huntr.dev/bounties/e12eed25-1a8e-4ee1-b846-2d4df1db2fae; https://github.com/usememos/memos/commit/3556ae4e651d9443dc3bb8a170dd3cc726517a53
CVE: CVE-2022-4799
Published: 2022-12-28
Description: Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-639, CWE-639
References: https://github.com/usememos/memos/commit/3556ae4e651d9443dc3bb8a170dd3cc726517a53; https://huntr.dev/bounties/c5d70f9d-b7a7-4418-9368-4566a8143e79; https://github.com/usememos/memos/commit/3556ae4e651d9443dc3bb8a170dd3cc726517a53
CVE: CVE-2022-4800
Published: 2022-12-28
Description: Improper Verification of Source of a Communication Channel in GitHub repository usememos/memos prior to 0.9.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-940
References: https://github.com/usememos/memos/commit/3556ae4e651d9443dc3bb8a170dd3cc726517a53; https://huntr.dev/bounties/aa45a6eb-cc38-45e5-a301-221ef43c0ef8; https://github.com/usememos/memos/commit/3556ae4e651d9443dc3bb8a170dd3cc726517a53
CVE: CVE-2022-4801
Published: 2022-12-28
Description: Insufficient Granularity of Access Control in GitHub repository usememos/memos prior to 0.9.1.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-1220
References: https://github.com/usememos/memos/commit/3556ae4e651d9443dc3bb8a170dd3cc726517a53; https://huntr.dev/bounties/b0795261-0f97-4f0b-be44-9dc079e01593; https://github.com/usememos/memos/commit/3556ae4e651d9443dc3bb8a170dd3cc726517a53
CVE: CVE-2022-4802
Published: 2022-12-28
Description: Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.1.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-639, CWE-639
References: https://github.com/usememos/memos/commit/3556ae4e651d9443dc3bb8a170dd3cc726517a53; https://huntr.dev/bounties/d47d4a94-92e3-4400-b012-a8577cbd7956; https://github.com/usememos/memos/commit/3556ae4e651d9443dc3bb8a170dd3cc726517a53
CVE: CVE-2022-4803
Published: 2022-12-28
Description: Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.1.
CVSS Score: 8.8 (HIGH)
CWE: CWE-639, CWE-639
References: https://github.com/usememos/memos/commit/3556ae4e651d9443dc3bb8a170dd3cc726517a53; https://huntr.dev/bounties/0fba72b9-db10-4d9f-a707-2acf2004a286; https://github.com/usememos/memos/commit/3556ae4e651d9443dc3bb8a170dd3cc726517a53
CVE: CVE-2022-4804
Published: 2022-12-28
Description: Improper Authorization in GitHub repository usememos/memos prior to 0.9.1.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-285
References: https://github.com/usememos/memos/commit/3556ae4e651d9443dc3bb8a170dd3cc726517a53; https://huntr.dev/bounties/4ee48a1e-6332-4d95-a360-9c392643c533; https://github.com/usememos/memos/commit/3556ae4e651d9443dc3bb8a170dd3cc726517a53
CVE: CVE-2022-4805
Published: 2022-12-28
Description: Incorrect Use of Privileged APIs in GitHub repository usememos/memos prior to 0.9.1.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-648
References: https://github.com/usememos/memos/commit/3556ae4e651d9443dc3bb8a170dd3cc726517a53; https://huntr.dev/bounties/b03f6a9b-e49b-42d6-a318-1d7afd985873; https://github.com/usememos/memos/commit/3556ae4e651d9443dc3bb8a170dd3cc726517a53
CVE: CVE-2022-4806
Published: 2022-12-28
Description: Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.1.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-639, CWE-639
References: https://github.com/usememos/memos/commit/3556ae4e651d9443dc3bb8a170dd3cc726517a53; https://huntr.dev/bounties/2c7101bc-e6d8-4cd0-9003-bc8d86f4e4be; https://github.com/usememos/memos/commit/3556ae4e651d9443dc3bb8a170dd3cc726517a53
CVE: CVE-2022-4807
Published: 2022-12-28
Description: Improper Access Control in GitHub repository usememos/memos prior to 0.9.1.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284
References: https://github.com/usememos/memos/commit/3556ae4e651d9443dc3bb8a170dd3cc726517a53; https://huntr.dev/bounties/704c9ed7-2120-47ea-aaf0-5fdcbd492954; https://github.com/usememos/memos/commit/3556ae4e651d9443dc3bb8a170dd3cc726517a53
CVE: CVE-2022-4808
Published: 2022-12-28
Description: Improper Privilege Management in GitHub repository usememos/memos prior to 0.9.1.
CVSS Score: 8.8 (HIGH)
CWE: CWE-269
References: https://github.com/usememos/memos/commit/3556ae4e651d9443dc3bb8a170dd3cc726517a53; https://huntr.dev/bounties/11877cbf-fcaf-42ef-813e-502c7293f2b5; https://github.com/usememos/memos/commit/3556ae4e651d9443dc3bb8a170dd3cc726517a53
CVE: CVE-2022-4809
Published: 2022-12-28
Description: Improper Access Control in GitHub repository usememos/memos prior to 0.9.1.
CVSS Score: 8.8 (HIGH)
CWE: CWE-284
References: https://github.com/usememos/memos/commit/3556ae4e651d9443dc3bb8a170dd3cc726517a53; https://huntr.dev/bounties/e46c5380-a590-40de-a8e5-79872ee0bb29; https://github.com/usememos/memos/commit/3556ae4e651d9443dc3bb8a170dd3cc726517a53
CVE: CVE-2022-4810
Published: 2022-12-28
Description: Improper Access Control in GitHub repository usememos/memos prior to 0.9.1.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284
References: https://github.com/usememos/memos/commit/3556ae4e651d9443dc3bb8a170dd3cc726517a53; https://huntr.dev/bounties/f0c8d778-db86-4ed3-85bb-5315ab56915e; https://github.com/usememos/memos/commit/3556ae4e651d9443dc3bb8a170dd3cc726517a53
CVE: CVE-2022-4811
Published: 2022-12-28
Description: Authorization Bypass Through User-Controlled Key vulnerability in usememos usememos/memos.This issue affects usememos/memos before 0.9.1.


CVSS Score: 8.3 (HIGH)
CWE: CWE-639, CWE-639
References: https://github.com/usememos/memos/commit/3556ae4e651d9443dc3bb8a170dd3cc726517a53; https://huntr.dev/bounties/e907b754-4f33-46b6-9dd2-0d2223cb060c; https://github.com/usememos/memos/commit/3556ae4e651d9443dc3bb8a170dd3cc726517a53
CVE: CVE-2022-4812
Published: 2022-12-28
Description: Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-639, CWE-639
References: https://github.com/usememos/memos/commit/3556ae4e651d9443dc3bb8a170dd3cc726517a53; https://huntr.dev/bounties/33924891-5c36-4b46-b417-98eaab688c4c; https://github.com/usememos/memos/commit/3556ae4e651d9443dc3bb8a170dd3cc726517a53
CVE: CVE-2022-4813
Published: 2022-12-28
Description: Insufficient Granularity of Access Control in GitHub repository usememos/memos prior to 0.9.1.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-1220
References: https://github.com/usememos/memos/commit/3556ae4e651d9443dc3bb8a170dd3cc726517a53; https://huntr.dev/bounties/a24b45d8-554b-4131-8ce1-f33bf8cdbacc; https://github.com/usememos/memos/commit/3556ae4e651d9443dc3bb8a170dd3cc726517a53
CVE: CVE-2022-4814
Published: 2022-12-28
Description: Improper Access Control in GitHub repository usememos/memos prior to 0.9.1.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284
References: https://github.com/usememos/memos/commit/3556ae4e651d9443dc3bb8a170dd3cc726517a53; https://huntr.dev/bounties/e65b3458-c2e2-4c0b-9029-e3c9ee015ae4; https://github.com/usememos/memos/commit/3556ae4e651d9443dc3bb8a170dd3cc726517a53
CVE: CVE-2021-4294
Published: 2022-12-28
Description: A vulnerability was found in OpenShift OSIN. It has been classified as problematic. This affects the function ClientSecretMatches/CheckClientSecret. The manipulation of the argument secret leads to observable timing discrepancy. The name of the patch is 8612686d6dda34ae9ef6b5a974e4b7accb4fea29. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-216987.
CVSS Score: 2.6 (LOW)
CWE: CWE-208, CWE-203
References: https://github.com/openshift/osin/commit/8612686d6dda34ae9ef6b5a974e4b7accb4fea29; https://github.com/openshift/osin/pull/200; https://vuldb.com/?ctiid.216987
CVE: CVE-2022-38202
Published: 2022-12-28
Description: There is a path traversal vulnerability in Esri ArcGIS Server versions 10.9.1 and below. Successful exploitation may allow a remote, unauthenticated attacker traverse the file system to access files outside of the intended directory on ArcGIS Server. This could lead to the disclosure of sensitive site configuration information (not user datasets).
CVSS Score: 7.5 (HIGH)
CWE: CWE-23, CWE-22
References: https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/arcgis-server-security-2022-update-2-patch-is-now-available; https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/arcgis-server-security-2022-update-2-patch-is-now-available
CVE: CVE-2022-39012
Published: 2022-12-28
Description: Huawei Aslan Children's Watch has an improper input validation vulnerability. Successful exploitation may cause the watch's application service abnormal.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-20
References: https://www.huawei.com/en/psirt/security-advisories/2022/huawei-sa-iivviahcw-5fb2d55c-en; https://www.huawei.com/en/psirt/security-advisories/2022/huawei-sa-iivviahcw-5fb2d55c-en
CVE: CVE-2022-41579
Published: 2022-12-28
Description: There is an insufficient authentication vulnerability in some Huawei band products. Successful exploit could allow the attacker to spoof then connect to the band.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-287, CWE-287
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20221130-01-c7f72ffb-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20221130-01-c7f72ffb-en
CVE: CVE-2022-44564
Published: 2022-12-28
Description: Huawei Aslan Children's Watch has a path traversal vulnerability. Successful exploitation may allow attackers to access or modify protected system resources.
CVSS Score: 7.8 (HIGH)
CWE: CWE-22, CWE-22
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20221102-01-d002dd8e-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20221102-01-d002dd8e-en
CVE: CVE-2022-45874
Published: 2022-12-28
Description: Huawei Aslan Children's Watch has an improper authorization vulnerability. Successful exploit could allow the attacker to access certain file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-285
References: https://www.huawei.com/en/psirt/security-advisories/2022/huawei-sa-iaviahcw-21a3acd8-en; https://www.huawei.com/en/psirt/security-advisories/2022/huawei-sa-iaviahcw-21a3acd8-en
CVE: CVE-2022-46740
Published: 2022-12-28
Description: There is a denial of service vulnerability in the Wi-Fi module of the HUAWEI WS7100-20 Smart WiFi Router.Successful exploit could cause a denial of service (DoS) condition.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400
References: https://www.huawei.com/en/psirt/security-advisories/2022/huawei-sa-dosvihswr-8f632df1-en; https://www.huawei.com/en/psirt/security-advisories/2022/huawei-sa-dosvihswr-8f632df1-en
CVE: CVE-2017-20150
Published: 2022-12-28
Description: A vulnerability was found in challenge website. It has been rated as critical. This issue affects some unknown processing. The manipulation leads to sql injection. The name of the patch is f1644b1d3502e5aa5284f31ea80d2623817f4d42. It is recommended to apply a patch to fix this issue. The identifier VDB-216989 was assigned to this vulnerability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://github.com/Challenge/website/commit/f1644b1d3502e5aa5284f31ea80d2623817f4d42; https://vuldb.com/?ctiid.216989; https://vuldb.com/?id.216989
CVE: CVE-2022-23553
Published: 2022-12-28
Description: Alpine is a scaffolding library in Java. Alpine prior to version 1.10.4 allows URL access filter bypass. This issue has been fixed in version 1.10.4. There are no known workarounds.
CVSS Score: 7.5 (HIGH)
CWE: CWE-863
References: https://github.com/stevespringett/Alpine/blob/alpine-parent-1.10.2/alpine/src/main/java/alpine/filters/BlacklistUrlFilter.java#L107-L121; https://github.com/stevespringett/Alpine/blob/alpine-parent-1.10.2/alpine/src/main/java/alpine/filters/WhitelistUrlFilter.java#L115-L127; https://securitylab.github.com/advisories/GHSL-2021-1009-Alpine/
CVE: CVE-2022-23554
Published: 2022-12-28
Description: Alpine is a scaffolding library in Java. Alpine prior to version 1.10.4 allows Authentication Filter bypass. The AuthenticationFilter relies on the request URI to evaluate if the user is accessing the swagger endpoint. By accessing a URL with a path such as /api/foo;%2fapi%2fswagger the contains condition will hold and will return from the authentication filter without aborting the request. Note that the principal object will not be assigned and therefore the issue wont allow user impersonation. This issue has been fixed in version 1.10.4. There are no known workarounds.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-287, CWE-697
References: https://github.com/stevespringett/Alpine/blob/f03dbda46229c26145a5f9f7f2660cc2c386be02/alpine/src/main/java/alpine/filters/AuthenticationFilter.java#L58-L60; https://github.com/stevespringett/Alpine/releases/tag/alpine-parent-1.10.4; https://securitylab.github.com/advisories/GHSL-2021-1010-Alpine/
CVE: CVE-2022-4817
Published: 2022-12-28
Description: A vulnerability was found in centic9 jgit-cookbook. It has been declared as problematic. This vulnerability affects unknown code. The manipulation leads to insecure temporary file. The attack can be initiated remotely. The name of the patch is b8cb29b43dc704708d598c60ac1881db7cf8e9c3. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-216988.
CVSS Score: 3.1 (LOW)
CWE: CWE-377, CWE-668
References: https://github.com/centic9/jgit-cookbook/commit/b8cb29b43dc704708d598c60ac1881db7cf8e9c3; https://github.com/centic9/jgit-cookbook/pull/86; https://vuldb.com/?ctiid.216988
CVE: CVE-2018-25057
Published: 2022-12-28
Description: A vulnerability was found in simple_php_link_shortener. It has been classified as critical. Affected is an unknown function of the file index.php. The manipulation of the argument $link["id"] leads to sql injection. The name of the patch is b26ac[PII_REDACTED]ed94ccb0222ba6b732de6e53f. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-216996.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/mikebharris/simple_php_link_shortener/commit/b26ac[PII_REDACTED]ed94ccb0222ba6b732de6e53f; https://vuldb.com/?ctiid.216996; https://vuldb.com/?id.216996