deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-3964
Published: 2022-11-13
Description: A vulnerability classified as problematic has been found in ffmpeg. This affects an unknown part of the file libavcodec/rpzaenc.c of the component QuickTime RPZA Video Encoder. The manipulation of the argument y_size leads to out-of-bounds read. It is possible to initiate the attack remotely. The name of the patch is 92f9b28ed84a[PII_REDACTED]5beba16c146bdaf984. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-213543.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119
References: https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/92f9b28ed84a[PII_REDACTED]5beba16c146bdaf984; https://security.gentoo.org/glsa/202312-14; https://vuldb.com/?id.213543
CVE: CVE-2022-3965
Published: 2022-11-13
Description: A vulnerability classified as problematic was found in ffmpeg. This vulnerability affects the function smc_encode_stream of the file libavcodec/smcenc.c of the component QuickTime Graphics Video Encoder. The manipulation of the argument y_size leads to out-of-bounds read. The attack can be initiated remotely. The name of the patch is 13c[PII_REDACTED]b7f7182480d075e13b36ed8edd. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-213544.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119
References: https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/13c[PII_REDACTED]b7f7182480d075e13b36ed8edd; https://security.gentoo.org/glsa/202312-14; https://vuldb.com/?id.213544
CVE: CVE-2022-3966
Published: 2022-11-13
Description: A vulnerability, which was classified as critical, has been found in Ultimate Member Plugin up to 2.5.0. This issue affects the function load_template of the file includes/core/class-shortcodes.php of the component Template Handler. The manipulation of the argument tpl leads to pathname traversal. The attack may be initiated remotely. Upgrading to version 2.5.1 is able to address this issue. The name of the patch is e1bc94c1100f02a129721ba4be5fbc44c3d78ec4. It is recommended to upgrade the affected component. The identifier VDB-213545 was assigned to this vulnerability.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: https://github.com/ultimatemember/ultimatemember/commit/e1bc94c1100f02a129721ba4be5fbc44c3d78ec4; https://github.com/ultimatemember/ultimatemember/releases/tag/2.5.1; https://vuldb.com/?id.213545
CVE: CVE-2022-3967
Published: 2022-11-13
Description: A vulnerability, which was classified as critical, was found in Vesta Control Panel. Affected is an unknown function of the file func/main.sh of the component sed Handler. The manipulation leads to argument injection. An attack has to be approached locally. The name of the patch is 39561c32c12cabe563de48cc96eccb9e2c655e25. It is recommended to apply a patch to fix this issue. VDB-213546 is the identifier assigned to this vulnerability.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-707
References: https://github.com/serghey-rodin/vesta/commit/39561c32c12cabe563de48cc96eccb9e2c655e25; https://vuldb.com/?id.213546; https://github.com/serghey-rodin/vesta/commit/39561c32c12cabe563de48cc96eccb9e2c655e25
CVE: CVE-2022-3968
Published: 2022-11-13
Description: A vulnerability has been found in emlog and classified as problematic. Affected by this vulnerability is an unknown functionality of the file admin/article_save.php. The manipulation of the argument tag leads to cross site scripting. The attack can be launched remotely. The name of the patch is 5bf7a79826e0ea09bcc8a21f69a0c74107761a02. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-213547.
CVSS Score: 3.5 (LOW)
CWE: CWE-707, CWE-79
References: https://github.com/emlog/emlog/commit/5bf7a79826e0ea09bcc8a21f69a0c74107761a02; https://vuldb.com/?id.213547; https://github.com/emlog/emlog/commit/5bf7a79826e0ea09bcc8a21f69a0c74107761a02
CVE: CVE-2022-3969
Published: 2022-11-13
Description: A vulnerability was found in OpenKM up to 6.3.11 and classified as problematic. Affected by this issue is the function getFileExtension of the file src/main/java/com/openkm/util/FileUtils.java. The manipulation leads to insecure temporary file. Upgrading to version 6.3.12 is able to address this issue. The name of the patch is c069e4d73ab8864345c25119d8459495f45453e1. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-213548.
CVSS Score: 2.6 (LOW)
CWE: CWE-377
References: https://github.com/openkm/document-management-system/commit/c069e4d73ab8864345c25119d8459495f45453e1; https://github.com/openkm/document-management-system/pull/332; https://github.com/openkm/document-management-system/releases/tag/v6.3.12
CVE: CVE-2022-3970
Published: 2022-11-13
Description: A vulnerability was found in LibTIFF. It has been classified as critical. This affects the function TIFFReadRGBATileExt of the file libtiff/tif_getimage.c. The manipulation leads to integer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 227500897dfb07fb7d27f7aa570050e62617e3be. It is recommended to apply a patch to fix this issue. The identifier VDB-213549 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-189
References: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=53137; https://gitlab.com/libtiff/libtiff/-/commit/227500897dfb07fb7d27f7aa570050e62617e3be; https://lists.debian.org/debian-lts-announce/2023/01/msg00018.html
CVE: CVE-2022-3971
Published: 2022-11-13
Description: A vulnerability was found in matrix-appservice-irc up to 0.35.1. It has been declared as critical. This vulnerability affects unknown code of the file src/datastore/postgres/PgDataStore.ts. The manipulation of the argument roomIds leads to sql injection. Upgrading to version 0.36.0 is able to address this issue. The name of the patch is 179313a37f06b298150edba3e2b0e5a73c1415e7. It is recommended to upgrade the affected component. VDB-213550 is the identifier assigned to this vulnerability.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-707
References: https://github.com/matrix-org/matrix-appservice-irc/commit/179313a37f06b298150edba3e2b0e5a73c1415e7; https://github.com/matrix-org/matrix-appservice-irc/pull/1619; https://github.com/matrix-org/matrix-appservice-irc/releases/tag/0.36.0
CVE: CVE-2022-3972
Published: 2022-11-13
Description: A vulnerability was found in Pingkon HMS-PHP. It has been rated as critical. This issue affects some unknown processing of the file admin/adminlogin.php. The manipulation of the argument uname/pass leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-213551.
CVSS Score: 7.3 (HIGH)
CWE: CWE-707
References: https://github.com/Pingkon/HMS-PHP/issues/1; https://vuldb.com/?id.213551; https://github.com/Pingkon/HMS-PHP/issues/1
CVE: CVE-2022-3973
Published: 2022-11-13
Description: A vulnerability classified as critical has been found in Pingkon HMS-PHP. Affected is an unknown function of the file /admin/admin.php of the component Data Pump Metadata. The manipulation of the argument uname/pass leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-213552.
CVSS Score: 7.3 (HIGH)
CWE: CWE-707
References: https://github.com/Pingkon/HMS-PHP/issues/1; https://vuldb.com/?id.213552; https://github.com/Pingkon/HMS-PHP/issues/1
CVE: CVE-2022-3974
Published: 2022-11-13
Description: A vulnerability classified as critical was found in Axiomatic Bento4. Affected by this vulnerability is the function AP4_StdcFileByteStream::ReadPartial of the file Ap4StdCFileByteStream.cpp of the component mp4info. The manipulation leads to heap-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-213553 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-119, CWE-787
References: https://github.com/axiomatic-systems/Bento4/files/9987970/mp4info_overflow_ReadPartial341.zip; https://github.com/axiomatic-systems/Bento4/issues/812; https://vuldb.com/?id.213553
CVE: CVE-2022-3975
Published: 2022-11-13
Description: A vulnerability, which was classified as problematic, has been found in NukeViet CMS. Affected by this issue is the function filterAttr of the file vendor/vinades/nukeviet/Core/Request.php of the component Data URL Handler. The manipulation of the argument attrSubSet leads to cross site scripting. The attack may be launched remotely. Upgrading to version 4.5 is able to address this issue. The name of the patch is 0b3197fad950bb3383e83039a8ee4c9509b3ce02. It is recommended to upgrade the affected component. VDB-213554 is the identifier assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-707
References: https://github.com/nukeviet/nukeviet; https://github.com/nukeviet/nukeviet/commit/0b3197fad950bb3383e83039a8ee4c9509b3ce02; https://vuldb.com/?id.213554
CVE: CVE-2022-3976
Published: 2022-11-13
Description: A vulnerability has been found in MZ Automation libiec61850 up to 1.4 and classified as critical. This vulnerability affects unknown code of the file src/mms/iso_mms/client/mms_client_files.c of the component MMS File Services. The manipulation of the argument filename leads to path traversal. Upgrading to version 1.5 is able to address this issue. The name of the patch is 10622ba36bb3910c151348f1569f039ecdd8786f. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-213556.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-22
References: https://github.com/mz-automation/libiec61850; https://github.com/mz-automation/libiec61850/commit/10622ba36bb3910c151348f1569f039ecdd8786f; https://vuldb.com/?id.213556
CVE: CVE-2022-3978
Published: 2022-11-13
Description: A vulnerability, which was classified as problematic, was found in NodeBB up to 2.5.7. This affects an unknown part of the file /register/abort. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. Upgrading to version 2.5.8 is able to address this issue. The name of the patch is 2f9d8c350e54543f608d3d4c8e1a49bbb6cdea38. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-213555.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863, CWE-352
References: https://github.com/NodeBB/NodeBB/commit/2f9d8c350e54543f608d3d4c8e1a49bbb6cdea38; https://github.com/NodeBB/NodeBB/issues/11017; https://github.com/NodeBB/NodeBB/releases/tag/v2.5.8
CVE: CVE-2022-3979
Published: 2022-11-13
Description: A vulnerability was found in NagVis up to 1.9.33 and classified as problematic. This issue affects the function checkAuthCookie of the file share/server/core/classes/CoreLogonMultisite.php. The manipulation of the argument hash leads to incorrect type conversion. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. Upgrading to version 1.9.34 is able to address this issue. The identifier of the patch is 7574fd8a2903282c2e0d1feef5c4876763db21d5. It is recommended to upgrade the affected component. The identifier VDB-213557 was assigned to this vulnerability.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-704, CWE-704
References: https://github.com/NagVis/nagvis/commit/7574fd8a2903282c2e0d1feef5c4876763db21d5; https://github.com/NagVis/nagvis/releases/tag/nagvis-1.9.34; https://vuldb.com/?ctiid.213557
CVE: CVE-2021-38827
Published: 2022-11-14
Description: Xiongmai Camera XM-JPR2-LX V4.02.R12.A6[PII_REDACTED]2[PII_REDACTED]0 is vulnerable to account takeover.
CVSS Score: 7.5 (HIGH)
CWE: CWE-294, CWE-294
References: https://github.com/ChandlerChin/XiongmaiCamera/blob/main/Account%20takeover%20with%20traffic%20monitoring%20exploitation%20in%20XM-JPR2-LX%20device.pdf; https://github.com/ChandlerChin/XiongmaiCamera/blob/main/Account%20takeover%20with%20traffic%20monitoring%20exploitation%20in%20XM-JPR2-LX%20device.pdf
CVE: CVE-2021-38828
Published: 2022-11-14
Description: Xiongmai Camera XM-JPR2-LX V4.02.R12.A6[PII_REDACTED]2[PII_REDACTED]0 is vulnerable to plain-text traffic sniffing.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-319, CWE-319
References: https://github.com/ChandlerChin/XiongmaiCamera/blob/main/Sniffing%20the%20plain-text%20traffic%20in%20Xiongmai%20Camera.pdf; https://github.com/ChandlerChin/XiongmaiCamera/blob/main/Sniffing%20the%20plain-text%20traffic%20in%20Xiongmai%20Camera.pdf
CVE: CVE-2022-31630
Published: 2022-11-14
Description: In PHP versions prior to 7.4.33, 8.0.25 and 8.1.12, when using imageloadfont() function in gd extension, it is possible to supply a specially crafted font file, such as if the loaded font is used with imagechar() function, the read outside allocated buffer will be used. This can lead to crashes or disclosure of confidential information. 
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-131, CWE-190, CWE-125
References: https://bugs.php.net/bug.php?id=81739; https://bugs.php.net/bug.php?id=81739
CVE: CVE-2022-45198
Published: 2022-11-14
Description: Pillow before 9.2.0 performs Improper Handling of Highly Compressed GIF Data (Data Amplification).
CVSS Score: 7.5 (HIGH)
References: https://bugs.gentoo.org/855683; https://cwe.mitre.org/data/definitions/409.html; https://github.com/python-pillow/Pillow/commit/11918eac0628ec8ac0812670d9838361ead2d6a4
CVE: CVE-2022-45199
Published: 2022-11-14
Description: Pillow before 9.3.0 allows denial of service via SAMPLESPERPIXEL.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://bugs.gentoo.org/878769; https://github.com/python-pillow/Pillow/commit/2444cddab2f83f28687c7c20871574acbb6dbcf3; https://github.com/python-pillow/Pillow/pull/6700
CVE: CVE-2022-37290
Published: 2022-11-14
Description: GNOME Nautilus 42.2 allows a NULL pointer dereference and get_basename application crash via a pasted ZIP archive.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://gitlab.gnome.org/GNOME/nautilus/-/issues/2376; https://gitlab.gnome.org/GNOME/nautilus/-/merge_requests/1001; https://gitlab.gnome.org/GNOME/nautilus/-/tree/master
CVE: CVE-2022-45183
Published: 2022-11-14
Description: Escalation of privileges in the Web Server in Ironman Software PowerShell Universal 2.x and 3.x allows an attacker with a valid app token to retrieve other app tokens by ID via an HTTP web request. Patched Versions are 3.5.3, 3.4.7, and 2.12.6.
CVSS Score: 8.8 (HIGH)
CWE: CWE-269
References: https://blog.ironmansoftware.com/psu-2022-11-cve/; https://docs.powershelluniversal.com/changelog; https://ironmansoftware.com
CVE: CVE-2022-45184
Published: 2022-11-14
Description: The Web Server in Ironman Software PowerShell Universal v3.x and v2.x allows for directory traversal outside of the configuration directory, which allows a remote attacker with administrator privilege to create, delete, update, and display files outside of the configuration directory via a crafted HTTP request to particular endpoints in the web server. Patched Versions are 3.5.3 and 3.4.7.
CVSS Score: 7.2 (HIGH)
CWE: CWE-22
References: https://blog.ironmansoftware.com/psu-2022-11-cve/; https://docs.powershelluniversal.com/changelog; https://ironmansoftware.com
CVE: CVE-2022-27949
Published: 2022-11-14
Description: A vulnerability in UI of Apache Airflow allows an attacker to view unmasked secrets in rendered template values for tasks which were not executed (for example when they were depending on past and previous instances of the task failed). This issue affects Apache Airflow prior to 2.3.1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://www.openwall.com/lists/oss-security/2022/11/14/3; https://github.com/apache/airflow/pull/22754; https://lists.apache.org/thread/n38oc5obb48600fsvnbopxcs0jpbp65p
CVE: CVE-2022-40127
Published: 2022-11-14
Description: A vulnerability in Example Dags of Apache Airflow allows an attacker with UI access who can trigger DAGs, to execute arbitrary commands via manually provided run_id parameter. This issue affects Apache Airflow Apache Airflow versions prior to 2.4.0.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94, CWE-94
References: http://www.openwall.com/lists/oss-security/2022/11/14/2; https://github.com/apache/airflow/pull/25960; https://lists.apache.org/thread/cf132hgm6jvzvsbpsozl3plf1r4cwysy
CVE: CVE-2022-3988
Published: 2022-11-14
Description: A vulnerability was found in Frappe. It has been rated as problematic. Affected by this issue is some unknown functionality of the file frappe/templates/includes/navbar/navbar_search.html of the component Search. The manipulation of the argument q leads to cross site scripting. The attack may be launched remotely. The name of the patch is bfab[PII_REDACTED]c6cb77fe267063877c31b616ce. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-213560.
CVSS Score: 3.5 (LOW)
CWE: CWE-707, CWE-79
References: https://github.com/frappe/frappe/commit/bfab[PII_REDACTED]c6cb77fe267063877c31b616ce; https://github.com/frappe/frappe/pull/18847; https://vuldb.com/?id.213560
CVE: CVE-2022-45378
Published: 2022-11-14
Description: In the default configuration of Apache SOAP, an RPCRouterServlet is available without authentication. This gives an attacker the possibility to invoke methods on the classpath that meet certain criteria. Depending on what classes are available on the classpath this might even lead to arbitrary remote code execution. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306, CWE-306
References: http://www.openwall.com/lists/oss-security/2022/11/14/4; https://lists.apache.org/thread/g4l64s283njhnph2otx7q4gs2j952d31; http://www.openwall.com/lists/oss-security/2022/11/14/4
CVE: CVE-2022-2449
Published: 2022-11-14
Description: The reSmush.it : the only free Image Optimizer & compress plugin WordPress plugin before 0.4.4 does not perform CSRF checks for any of its AJAX actions, allowing an attackers to trick logged in users to perform various actions on their behalf on the site.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://wpscan.com/vulnerability/6e42f26b-3403-4d55-99ad-2c8e2d76e537; https://wpscan.com/vulnerability/6e42f26b-3403-4d55-99ad-2c8e2d76e537
CVE: CVE-2022-2450
Published: 2022-11-14
Description: The reSmush.it : the only free Image Optimizer & compress plugin WordPress plugin before 0.4.4 lacks authorization in various AJAX actions, allowing any logged-in users, such as subscribers to call them.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://wpscan.com/vulnerability/1b3ff124-f973-4584-a7d7-26cc404bfe2b; https://wpscan.com/vulnerability/1b3ff124-f973-4584-a7d7-26cc404bfe2b
CVE: CVE-2022-3415
Published: 2022-11-14
Description: The Chat Bubble WordPress plugin before 2.3 does not sanitise and escape some contact parameters, which could allow unauthenticated attackers to set Stored Cross-Site Scripting payloads in them, which will trigger when an admin view the related contact message
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79, CWE-79
References: https://wpscan.com/vulnerability/012c5b64-ef76-4539-afd8-40f6c329ae88; https://wpscan.com/vulnerability/012c5b64-ef76-4539-afd8-40f6c329ae88
CVE: CVE-2022-3469
Published: 2022-11-14
Description: The WP Attachments WordPress plugin before 5.0.5 does not sanitize and escapes some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example, in multisite setup).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/017ca231-e019-4694-afa2-ab7f8481ae63; https://wpscan.com/vulnerability/017ca231-e019-4694-afa2-ab7f8481ae63
CVE: CVE-2022-3477
Published: 2022-11-14
Description: The tagDiv Composer WordPress plugin before 3.5, required by the Newspaper WordPress theme before 12.1 and Newsmag WordPress theme before 5.2.2, does not properly implement the Facebook login feature, allowing unauthenticated attackers to login as any user by just knowing their email address
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287, CWE-287
References: https://wpscan.com/vulnerability/993a95d2-6fce-48de-ae17-06ce2db829ef; https://wpscan.com/vulnerability/993a95d2-6fce-48de-ae17-06ce2db829ef
CVE: CVE-2022-3484
Published: 2022-11-14
Description: The WPB Show Core WordPress plugin does not sanitize and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/3afaed61-6187-4915-acf0-16e79d5c2464; https://wpscan.com/vulnerability/3afaed61-6187-4915-acf0-16e79d5c2464
CVE: CVE-2022-3538
Published: 2022-11-14
Description: The Webmaster Tools Verification WordPress plugin through 1.2 does not have authorisation and CSRF checks when disabling plugins, allowing unauthenticated users to disable arbitrary plugins
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352, CWE-862, CWE-352, CWE-862
References: https://wpscan.com/vulnerability/337ee7ed-9ade-4567-b976-88386cbcf036; https://wpscan.com/vulnerability/337ee7ed-9ade-4567-b976-88386cbcf036
CVE: CVE-2022-3539
Published: 2022-11-14
Description: The Testimonials WordPress plugin before 2.7, super-testimonial-pro WordPress plugin before 1.0.8 do not sanitize and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/ab3b0052-1a74-4ba3-b6d2-78cfe56029db; https://wpscan.com/vulnerability/ab3b0052-1a74-4ba3-b6d2-78cfe56029db
CVE: CVE-2022-3574
Published: 2022-11-14
Description: The WPForms Pro WordPress plugin before 1.7.7 does not validate its form data when generating the exported CSV, which could lead to CSV injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1236
References: https://wpscan.com/vulnerability/0eae5189-81af-4344-9e96-dd1f4e223d41; https://wpscan.com/vulnerability/0eae5189-81af-4344-9e96-dd1f4e223d41
CVE: CVE-2022-3578
Published: 2022-11-14
Description: The ProfileGrid WordPress plugin before 5.1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/17596b0e-ff45-4d0c-8e57-a31101e30345; https://wpscan.com/vulnerability/17596b0e-ff45-4d0c-8e57-a31101e30345
CVE: CVE-2022-3631
Published: 2022-11-14
Description: The OAuth Client by DigitialPixies WordPress plugin through 1.1.0 does not sanitize and escapes some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example, in multisite setup).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://wpscan.com/vulnerability/13966b61-7e65-4493-8bd8-828d6d4441d5; https://wpscan.com/vulnerability/13966b61-7e65-4493-8bd8-828d6d4441d5
CVE: CVE-2022-3632
Published: 2022-11-14
Description: The OAuth Client by DigitialPixies WordPress plugin through 1.1.0 does not have CSRF checks in some places, which could allow attackers to make logged-in users perform unwanted actions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://wpscan.com/vulnerability/4c1b0e5e-245a-4d1f-a561-e91af906e62d; https://wpscan.com/vulnerability/4c1b0e5e-245a-4d1f-a561-e91af906e62d
CVE: CVE-2022-43288
Published: 2022-11-14
Description: Rukovoditel v3.2.1 was discovered to contain a SQL injection vulnerability via the order_by parameter at /rukovoditel/index.php?module=logs/view&type=php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/Kubozz/rukovoditel-3.2.1/issues/2; https://github.com/Kubozz/rukovoditel-3.2.1/issues/2
CVE: CVE-2021-40272
Published: 2022-11-14
Description: OP5 Monitor 8.3.1, 8.3.2, and OP5 8.3.3 are vulnerable to Cross Site Scripting (XSS).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/hosakauk/exploits/blob/master/itrs_op5_monitor_xss.pdf; https://github.com/hosakauk/exploits/blob/master/itrs_op5_monitor_xss.pdf