deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-29813
Published: 2022-04-28
Description: In JetBrains IntelliJ IDEA before 2022.1 local code execution via custom Pandoc path was possible
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-94, CWE-94
References: https://www.jetbrains.com/privacy-security/issues-fixed/; https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2022-29814
Published: 2022-04-28
Description: In JetBrains IntelliJ IDEA before 2022.1 local code execution via HTML descriptions in custom JSON schemas was possible
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-94, CWE-94
References: https://www.jetbrains.com/privacy-security/issues-fixed/; https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2022-29815
Published: 2022-04-28
Description: In JetBrains IntelliJ IDEA before 2022.1 local code execution via workspace settings was possible
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-94, CWE-94
References: https://www.jetbrains.com/privacy-security/issues-fixed/; https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2022-29816
Published: 2022-04-28
Description: In JetBrains IntelliJ IDEA before 2022.1 HTML injection into IDE messages was possible
CVSS Score: 2.8 (LOW)
CWE: CWE-74, CWE-79
References: https://www.jetbrains.com/privacy-security/issues-fixed/; https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2022-29817
Published: 2022-04-28
Description: In JetBrains IntelliJ IDEA before 2022.1 reflected XSS via error messages in internal web server was possible
CVSS Score: 3.9 (LOW)
CWE: CWE-79, CWE-79
References: https://www.jetbrains.com/privacy-security/issues-fixed/; https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2022-29818
Published: 2022-04-28
Description: In JetBrains IntelliJ IDEA before 2022.1 origin checks in the internal web server were flawed
CVSS Score: 3.9 (LOW)
CWE: CWE-346, CWE-346
References: https://www.jetbrains.com/privacy-security/issues-fixed/; https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2022-29819
Published: 2022-04-28
Description: In JetBrains IntelliJ IDEA before 2022.1 local code execution via links in Quick Documentation was possible
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-94, CWE-94
References: https://www.jetbrains.com/privacy-security/issues-fixed/; https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2022-29820
Published: 2022-04-28
Description: In JetBrains PyCharm before 2022.1 exposure of the debugger port to the internal network was possible
CVSS Score: 3.0 (LOW)
CWE: CWE-1327, CWE-668
References: https://www.jetbrains.com/privacy-security/issues-fixed/; https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2022-29821
Published: 2022-04-28
Description: In JetBrains Rider before 2022.1 local code execution via links in ReSharper Quick Documentation was possible
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-94, CWE-94
References: https://www.jetbrains.com/privacy-security/issues-fixed/; https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2021-33436
Published: 2022-04-28
Description: NoMachine for Windows prior to version 6.15.1 and 7.5.2 suffer from local privilege escalation due to the lack of safe DLL loading. This vulnerability allows local non-privileged users to perform DLL Hijacking via any writable directory listed under the system path and ultimately execute code as NT AUTHORITY\SYSTEM.
CVSS Score: 7.3 (HIGH)
References: https://github.com/active-labs/Advisories/blob/master/2021/ACTIVE-2021-001.md; https://knowledgebase.nomachine.com/SU05S00223; https://knowledgebase.nomachine.com/SU05S00224
CVE: CVE-2021-41921
Published: 2022-04-28
Description: novel-plus V3.6.1 allows unrestricted file uploads. Unrestricted file suffixes and contents can lead to server attacks and arbitrary code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://github.com/201206030/novel-plus/issues/62; https://github.com/201206030/novel-plus/issues/62
CVE: CVE-2022-24935
Published: 2022-04-28
Description: Lexmark products through 2022-02-10 have Incorrect Access Control.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306
References: https://lexmark.com; https://publications.lexmark.com/publications/security-alerts/CVE-2022-24935.pdf; https://lexmark.com
CVE: CVE-2022-29152
Published: 2022-04-28
Description: The Ericom PowerTerm WebConnect 6.0 login portal can unsafely write an XSS payload from the AppPortal cookie into the page.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/the-emmons/CVE-Disclosures/blob/main/CVE-2022-29152/CVE-2022-29152.md; https://www.ericom.com/powerterm/webconnect-hostview/; https://github.com/the-emmons/CVE-Disclosures/blob/main/CVE-2022-29152/CVE-2022-29152.md
CVE: CVE-2021-41945
Published: 2022-04-28
Description: Encode OSS httpx < 0.23.0 is affected by improper input validation in `httpx.URL`, `httpx.Client` and some functions using `httpx.URL.copy_with`.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-20
References: http://encode.com; https://gist.github.com/lebr0nli/4edb76bbd3b5ff993cf44f2fbce5e571; https://github.com/encode/httpx
CVE: CVE-2022-24873
Published: 2022-04-28
Description: Shopware is an open source e-commerce software platform. Prior to version 5.7.9, Shopware is vulnerable to non-stored cross-site scripting in the storefront. This issue is fixed in version 5.7.9. Users of older versions may attempt to mitigate the vulnerability by using the Shopware security plugin.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-04-2022; https://github.com/shopware/shopware/security/advisories/GHSA-4g29-fccr-p59w; https://www.shopware.com/en/changelog-sw5/#5-7-9
CVE: CVE-2022-28101
Published: 2022-04-28
Description: Turtlapp Turtle Note v0.7.2.6 does not filter the <meta> tag during markdown parsing, allowing attackers to execute HTML injection.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-79
References: https://github.com/turtl/tracker/issues/404; https://www.cybercitadel.com/html-injection-turtl/; https://github.com/turtl/tracker/issues/404
CVE: CVE-2022-28102
Published: 2022-04-28
Description: A cross-site scripting (XSS) vulnerability in PHP MySQL Admin Panel Generator v1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected at /edit-db.php.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://php-mysql-admin-panel-generator.com; https://github.com/housamz/php-mysql-admin-panel-generator/issues/19; http://php-mysql-admin-panel-generator.com
CVE: CVE-2021-43930
Published: 2022-04-28
Description: Elcomplus SmartPTT is vulnerable as the backup and restore system does not adequately validate download requests, enabling malicious users to perform path traversal attacks and potentially download arbitrary files from the system.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-22
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-109-04; https://www.cisa.gov/uscert/ics/advisories/icsa-22-109-04
CVE: CVE-2021-43932
Published: 2022-04-28
Description: Elcomplus SmartPTT is vulnerable when an attacker injects JavaScript code into a specific parameter that can executed upon accessing the dashboard or the main page.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-79, CWE-79
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-109-04; https://www.cisa.gov/uscert/ics/advisories/icsa-22-109-04
CVE: CVE-2021-43934
Published: 2022-04-28
Description: Elcomplus SmartPTT is vulnerable as the backup and restore system does not adequately validate upload requests, enabling a malicious user to potentially upload arbitrary files.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-109-04; https://www.cisa.gov/uscert/ics/advisories/icsa-22-109-04
CVE: CVE-2021-43939
Published: 2022-04-28
Description: Elcomplus SmartPTT is vulnerable when a low-authenticated user can access higher level administration authorization by issuing requests directly to the desired endpoints.
CVSS Score: 8.8 (HIGH)
CWE: CWE-285
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-109-04; https://www.cisa.gov/uscert/ics/advisories/icsa-22-109-04
CVE: CVE-2022-1511
Published: 2022-04-28
Description: Missing Authorization in GitHub repository snipe/snipe-it prior to 5.4.4.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://github.com/snipe/snipe-it/commit/2e9cf8fa87a025c0eac9f79f4864b3fdd33a950c; https://huntr.dev/bounties/4a1723e9-5bc4-4c4b-bceb-1c45964cc71d; https://github.com/snipe/snipe-it/commit/2e9cf8fa87a025c0eac9f79f4864b3fdd33a950c
CVE: CVE-2022-22781
Published: 2022-04-28
Description: The Zoom Client for Meetings for MacOS (Standard and for IT Admin) prior to version 5.9.6 failed to properly check the package version during the update process. This could lead to a malicious actor updating an unsuspecting user’s currently installed version to a less secure version.
CVSS Score: 7.5 (HIGH)
CWE: CWE-354
References: https://explore.zoom.us/en/trust/security/security-bulletin/; https://explore.zoom.us/en/trust/security/security-bulletin/
CVE: CVE-2022-22782
Published: 2022-04-28
Description: The Zoom Client for Meetings for Windows prior to version 5.9.7, Zoom Rooms for Conference Room for Windows prior to version 5.10.0, Zoom Plugins for Microsoft Outlook for Windows prior to version 5.10.3, and Zoom VDI Windows Meeting Clients prior to version 5.9.6; was susceptible to a local privilege escalation issue during the installer repair operation. A malicious actor could utilize this to potentially delete system level files or folders, causing integrity or availability issues on the user’s host machine.
CVSS Score: 7.9 (HIGH)
References: https://explore.zoom.us/en/trust/security/security-bulletin/; https://explore.zoom.us/en/trust/security/security-bulletin/
CVE: CVE-2022-22783
Published: 2022-04-28
Description: A vulnerability in Zoom On-Premise Meeting Connector Controller version 4.8[PII_REDACTED]0 and On-Premise Meeting Connector MMR version 4.8[PII_REDACTED]0 exposes process memory fragments to connected clients, which could be observed by a passive attacker.
CVSS Score: 6.5 (MEDIUM)
References: https://explore.zoom.us/en/trust/security/security-bulletin/; https://explore.zoom.us/en/trust/security/security-bulletin/
CVE: CVE-2022-24879
Published: 2022-04-28
Description: Shopware is an open source e-commerce software platform. Versions prior to 5.7.9 are vulnerable to malfunction of cross-site request forgery (CSRF) token validation. Under certain circumstances, the CSRF tokens were not generated anew and not validated correctly. This issue is fixed in version 5.7.9. Users of older versions may attempt to mitigate the vulnerability by using the Shopware security plugin.
CVSS Score: 7.5 (HIGH)
CWE: CWE-352, CWE-352
References: https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-04-2022; https://github.com/shopware/shopware/security/advisories/GHSA-pf38-v6qj-j23h; https://www.shopware.com/en/changelog-sw5/#5-7-9
CVE: CVE-2022-24892
Published: 2022-04-28
Description: Shopware is an open source e-commerce software platform. Starting with version 5.0.4 and before version 5.7.9, multiple tokens for password reset can be requested. All tokens can be used to change the password. This makes it possible for an attacker to take over the victim's account if they somehow gain access to the victims email account and find an unused password reset token in the emails. This issue is fixed in version 5.7.9.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-640, CWE-640
References: https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-04-2022; https://github.com/shopware/shopware/security/advisories/GHSA-3qrq-r688-vvh4; https://www.shopware.com/en/changelog-sw5/#5-7-9
CVE: CVE-2022-28114
Published: 2022-04-28
Description: DSCMS v3.0 was discovered to contain an arbitrary file deletion vulnerability via /controller/Adv.php.
CVSS Score: 9.1 (CRITICAL)
References: https://gitee.com/csdeshang/DSCMS_open/issues/3; https://gitee.com/csdeshang/DSCMS_open/issues/3
CVE: CVE-2022-28117
Published: 2022-04-28
Description: A Server-Side Request Forgery (SSRF) in feed_parser class of Navigate CMS v2.9.4 allows remote attackers to force the application to make arbitrary requests via injection of arbitrary URLs into the feed parameter.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-918
References: http://packetstormsecurity.com/files/167063/Navigate-CMS-2.9.4-Server-Side-Request-Forgery.html; https://www.navigatecms.com/en/blog/development/navigate_cms_update_2_9_5; https://www.youtube.com/watch?v=4kHW95CMfD0
CVE: CVE-2021-38952
Published: 2022-04-28
Description: IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 211408.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/211408; https://www.ibm.com/support/pages/node/6575551; https://exchange.xforce.ibmcloud.com/vulnerabilities/211408
CVE: CVE-2022-1514
Published: 2022-04-28
Description: Stored XSS via upload plugin functionality in zip format in GitHub repository neorazorx/facturascripts prior to 2022.06. Cross-site scripting attacks can have devastating consequences. Code injected into a vulnerable application can exfiltrate data or install malware on the user's machine. Attackers can masquerade as authorized users via session cookies, allowing them to perform any action allowed by the user account.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/neorazorx/facturascripts/commit/aa9f28cb86467468f43486b77ddef7ff4d3c687e; https://huntr.dev/bounties/4ae2a917-843a-4ae4-8197-8425a596761c; https://github.com/neorazorx/facturascripts/commit/aa9f28cb86467468f43486b77ddef7ff4d3c687e
CVE: CVE-2022-22322
Published: 2022-04-28
Description: IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 218370.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/218370; https://www.ibm.com/support/pages/node/6575567; https://exchange.xforce.ibmcloud.com/vulnerabilities/218370
CVE: CVE-2022-22427
Published: 2022-04-28
Description: IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 223720.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/223720; https://www.ibm.com/support/pages/node/6575589; https://exchange.xforce.ibmcloud.com/vulnerabilities/223720
CVE: CVE-2022-22441
Published: 2022-04-28
Description: IBM InfoSphere Information Server 11.7 could allow an authenticated user to view information of higher privileged users and groups due to a privilege escalation vulnerability. IBM X-Force ID: 224426.
CVSS Score: 6.5 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/224426; https://www.ibm.com/support/pages/node/6575599; https://exchange.xforce.ibmcloud.com/vulnerabilities/224426
CVE: CVE-2022-22443
Published: 2022-04-28
Description: IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 224440.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/224440; https://www.ibm.com/support/pages/node/6575611; https://exchange.xforce.ibmcloud.com/vulnerabilities/224440
CVE: CVE-2022-27860
Published: 2022-04-28
Description: Cross-Site Request Forgery (CSRF) leading to Cross-Site Scripting (XSS) in Shea Bunge's Footer Text plugin <= 2.0.3 on WordPress.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-352
References: https://patchstack.com/database/vulnerability/footer-text/wordpress-footer-text-plugin-2-0-3-cross-site-request-forgery-csrf-leading-to-cross-site-scripting-xss-vulnerability; https://wordpress.org/plugins/footer-text/; https://patchstack.com/database/vulnerability/footer-text/wordpress-footer-text-plugin-2-0-3-cross-site-request-forgery-csrf-leading-to-cross-site-scripting-xss-vulnerability
CVE: CVE-2022-28892
Published: 2022-04-28
Description: Mahara before 20.10.5, 21.04.4, 21.10.2, and 22.04.0 is vulnerable to Cross Site Request Forgery (CSRF) because randomly generated tokens are too easily guessable.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://bugs.launchpad.net/mahara/+bug/1930171; https://mahara.org/interaction/forum/topic.php?id=9094; https://bugs.launchpad.net/mahara/+bug/1930171
CVE: CVE-2022-29415
Published: 2022-04-28
Description: Unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability in Mati Skiba @ Rav Messer's Ravpage plugin <= 2.16 at WordPress.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/ravpage/wordpress-ravpage-plugin-2-16-unauthenticated-reflected-cross-site-scripting-xss-vulnerability; https://wordpress.org/plugins/ravpage/; https://patchstack.com/database/vulnerability/ravpage/wordpress-ravpage-plugin-2-16-unauthenticated-reflected-cross-site-scripting-xss-vulnerability
CVE: CVE-2022-29584
Published: 2022-04-28
Description: Mahara before 20.10.5, 21.04.4, 21.10.2, and 22.04.0 allows stored XSS when a particular Cascading Style Sheets (CSS) class for embedly is used, and JavaScript code is constructed to perform an action.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://bugs.launchpad.net/mahara/+bug/1968920; https://mahara.org/interaction/forum/topic.php?id=9095; https://bugs.launchpad.net/mahara/+bug/1968920
CVE: CVE-2022-29585
Published: 2022-04-28
Description: In Mahara before 20.10.5, 21.04.4, 21.10.2, and 22.04.0, a site using Isolated Institutions is vulnerable if more than ten groups are used. They are all shown from page 2 of the group results list (rather than only being shown for the institution that the viewer is a member of).
CVSS Score: 7.5 (HIGH)
CWE: CWE-276
References: https://bugs.launchpad.net/mahara/+bug/1922226; https://mahara.org/interaction/forum/topic.php?id=9093; https://bugs.launchpad.net/mahara/+bug/1922226
CVE: CVE-2022-29410
Published: 2022-04-28
Description: Authenticated SQL Injection (SQLi) vulnerability in Mufeng's Hermit 音乐播放器 plugin <= 3.1.6 on WordPress allows attackers with Subscriber or higher user roles to execute SQLi attack via (&ids).
CVSS Score: 7.4 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/vulnerability/hermit/wordpress-hermit-plugin-3-1-6-authenticated-sql-injection-sqli-vulnerability; https://wordpress.org/plugins/hermit/; https://patchstack.com/database/vulnerability/hermit/wordpress-hermit-plugin-3-1-6-authenticated-sql-injection-sqli-vulnerability
CVE: CVE-2022-29411
Published: 2022-04-28
Description: SQL Injection (SQLi) vulnerability in Mufeng's Hermit 音乐播放器 plugin <= 3.1.6 on WordPress allows attackers to execute SQLi attack via (&id).
CVSS Score: 8.3 (HIGH)
CWE: CWE-89, CWE-89
References: https://patchstack.com/database/vulnerability/hermit/wordpress-hermit-plugin-3-1-6-unauthenticated-sql-injection-sqli-vulnerability; https://wordpress.org/plugins/hermit/; https://patchstack.com/database/vulnerability/hermit/wordpress-hermit-plugin-3-1-6-unauthenticated-sql-injection-sqli-vulnerability
CVE: CVE-2022-29412
Published: 2022-04-28
Description: Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Hermit 音乐播放器 plugin <= 3.1.6 on WordPress allow attackers to delete cache, delete a source, create source.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://patchstack.com/database/vulnerability/hermit/wordpress-hermit-plugin-3-1-6-multiple-cross-site-request-forgery-csrf-vulnerabilities; https://wordpress.org/plugins/hermit/; https://patchstack.com/database/vulnerability/hermit/wordpress-hermit-plugin-3-1-6-multiple-cross-site-request-forgery-csrf-vulnerabilities
CVE: CVE-2022-29413
Published: 2022-04-28
Description: Cross-Site Request Forgery (CSRF) leading to Stored Cross-Site Scripting (XSS) in Mufeng's Hermit 音乐播放器 plugin <= 3.1.6 on WordPress via &title parameter.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-79, CWE-352
References: https://patchstack.com/database/vulnerability/hermit/wordpress-hermit-plugin-3-1-6-cross-site-request-forgery-csrf-leading-to-stored-cross-site-scripting-xss-vulnerability; https://wordpress.org/plugins/hermit/; https://patchstack.com/database/vulnerability/hermit/wordpress-hermit-plugin-3-1-6-cross-site-request-forgery-csrf-leading-to-stored-cross-site-scripting-xss-vulnerability
CVE: CVE-2022-24898
Published: 2022-04-28
Description: org.xwiki.commons:xwiki-commons-xml is a common module used by other XWiki top level projects. Starting in version 2.7 and prior to versions 12.10.10, 13.4.4, and 13.8-rc-1, it is possible for a script to access any file accessing to the user running XWiki application server with XML External Entity Injection through the XML script service. The problem has been patched in versions 12.10.10, 13.4.4, and 13.8-rc-1. There is no easy workaround for fixing this vulnerability other than upgrading and being careful when giving Script rights.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-611, CWE-611
References: https://github.com/xwiki/xwiki-commons/commit/947e8921ebd95462d5a7928f397dd1b64f77c7d5; https://github.com/xwiki/xwiki-commons/security/advisories/GHSA-m2r5-4w96-qxg5; https://jira.xwiki.org/browse/XWIKI-18946
CVE: CVE-2022-28060
Published: 2022-04-28
Description: SQL Injection vulnerability in Victor CMS v1.0, via the user_name parameter to /includes/login.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://github.com/JiuBanSec/CVE/blob/main/VictorCMS%20SQL.md; https://github.com/JiuBanSec/CVE_LIST/blob/main/CVE-2022-28060/CVE-2022-28060.pdf; https://github.com/VictorAlagwu/CMSsite
CVE: CVE-2022-28454
Published: 2022-04-28
Description: Limbas 4.3.36.1319 is vulnerable to Cross Site Scripting (XSS).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.limbas.org/; https://github.com/YavuzSahbaz/Limbas-4.3.36.1319-is-vulnerable-to-Cross-Site-Scripting-XSS-; https://sourceforge.net/projects/limbas/
CVE: CVE-2022-28477
Published: 2022-04-28
Description: WBCE CMS 1.5.2 is vulnerable to Cross Site Scripting (XSS).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/APTX-4879/CVE; https://github.com/APTX-4879/CVE/blob/main/CVE-2022-28477..pdf; https://github.com/APTX-4879/CVE
CVE: CVE-2022-29081
Published: 2022-04-28
Description: Zoho ManageEngine Access Manager Plus before 4302, Password Manager Pro before 12007, and PAM360 before 5401 are vulnerable to access-control bypass on a few Rest API URLs (for SSOutAction. SSLAction. LicenseMgr. GetProductDetails. GetDashboard. FetchEvents. and Synchronize) via the ../RestAPI substring.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://www.manageengine.com/privileged-session-management/advisory/cve-2022-29081.html; https://www.tenable.com/security/research/tra-2022-14; https://www.manageengine.com/privileged-session-management/advisory/cve-2022-29081.html
CVE: CVE-2022-29555
Published: 2022-04-28
Description: The Deviceconnect microservice through 1.3.0 in Northern.tech Mender Enterprise before 3.2.2. allows Cross-Origin Websocket Hijacking.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://mender.io/blog/cve-2022-29555-and-cve-2022-29556-vulnerabilities-in-iot-manager-and-deviceconnect; https://northern.tech; https://mender.io/blog/cve-2022-29555-and-cve-2022-29556-vulnerabilities-in-iot-manager-and-deviceconnect