deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-1677
Published: 2022-09-01
Description: In OpenShift Container Platform, a user with permissions to create or modify Routes can craft a payload that inserts a malformed entry into one of the cluster router's HAProxy configuration files. This malformed entry can match any arbitrary hostname, or all hostnames in the cluster, and direct traffic to an arbitrary application within the cluster, including one under attacker control.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-400
References: https://access.redhat.com/security/cve/CVE-2022-1677; https://bugzilla.redhat.com/show_bug.cgi?id=2076211; https://access.redhat.com/security/cve/CVE-2022-1677
CVE: CVE-2022-1729
Published: 2022-09-01
Description: A race condition was found the Linux kernel in perf_event_open() which can be exploited by an unprivileged user to gain root privileges. The bug allows to build several exploit primitives such as kernel address information leak, arbitrary execution, etc.
CVSS Score: 7.0 (HIGH)
CWE: CWE-366, CWE-362
References: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=3ac6487e584a1eb54071dbe1212e05b884136704; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.openwall.com/lists/oss-security/2022/05/20/2
CVE: CVE-2022-1902
Published: 2022-09-01
Description: A flaw was found in the Red Hat Advanced Cluster Security for Kubernetes. Notifier secrets were not properly sanitized in the GraphQL API. This flaw allows authenticated ACS users to retrieve Notifiers from the GraphQL API, revealing secrets that can escalate their privileges.
CVSS Score: 8.8 (HIGH)
CWE: CWE-497, CWE-668
References: https://access.redhat.com/security/cve/CVE-2022-1902; https://bugzilla.redhat.com/show_bug.cgi?id=2090957; https://github.com/stackrox/stackrox/pull/1803
CVE: CVE-2022-23452
Published: 2022-09-01
Description: An authorization flaw was found in openstack-barbican, where anyone with an admin role could add secrets to a different project container. This flaw allows an attacker on the network to consume protected resources and cause a denial of service.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-863, CWE-863
References: https://access.redhat.com/security/cve/CVE-2022-23452; https://bugzilla.redhat.com/show_bug.cgi?id=2022908; https://bugzilla.redhat.com/show_bug.cgi?id=2025090
CVE: CVE-2022-2238
Published: 2022-09-01
Description: A vulnerability was found in the search-api container in Red Hat Advanced Cluster Management for Kubernetes when a query in the search filter gets parsed by the backend. This flaw allows an attacker to craft specific strings containing special characters that lead to crashing the pod and affects system availability while restarting.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://access.redhat.com/security/cve/CVE-2022-2238; https://bugzilla.redhat.com/show_bug.cgi?id=2101669; https://access.redhat.com/security/cve/CVE-2022-2238
CVE: CVE-2022-2256
Published: 2022-09-01
Description: A Stored Cross-site scripting (XSS) vulnerability was found in keycloak as shipped in Red Hat Single Sign-On 7. This flaw allows a privileged attacker to execute malicious scripts in the admin console, abusing the default roles functionality.
CVSS Score: 3.8 (LOW)
CWE: CWE-79, CWE-79
References: https://bugzilla.redhat.com/show_bug.cgi?id=2101942; https://github.com/keycloak/keycloak/security/advisories/GHSA-w9mf-83w3-fv49; https://bugzilla.redhat.com/show_bug.cgi?id=2101942
CVE: CVE-2022-2308
Published: 2022-09-01
Description: A flaw was found in vDPA with VDUSE backend. There are currently no checks in VDUSE kernel driver to ensure the size of the device config space is in line with the features advertised by the VDUSE userspace application. In case of a mismatch, Virtio drivers config read helpers do not initialize the memory indirectly passed to vduse_vdpa_get_config() returning uninitialized memory from the stack. This could cause undefined behavior or data leaks in Virtio drivers.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-457, CWE-908
References: https://bugzilla.redhat.com/show_bug.cgi?id=2103900; https://bugzilla.redhat.com/show_bug.cgi?id=2103900
CVE: CVE-2022-2319
Published: 2022-09-01
Description: A flaw was found in the Xorg-x11-server. An out-of-bounds access issue can occur in the ProcXkbSetGeometry function due to improper validation of the request length.
CVSS Score: 7.8 (HIGH)
CWE: CWE-1320
References: https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/938; https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/939; https://lists.freedesktop.org/archives/xorg-announce/2022-July/003192.html
CVE: CVE-2022-2320
Published: 2022-09-01
Description: A flaw was found in the Xorg-x11-server. The specific flaw exists within the handling of ProcXkbSetDeviceInfo requests. The issue results from the lack of proper validation of user-supplied data, which can result in a memory access past the end of an allocated buffer. This flaw allows an attacker to escalate privileges and execute arbitrary code in the context of root.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://github.com/freedesktop/xorg-xserver/commit/dd8caf39e9e15d8f302e54045dd08d8ebf1025dc; https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/938; https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/939
CVE: CVE-2022-2403
Published: 2022-09-01
Description: A credentials leak was found in the OpenShift Container Platform. The private key for the external cluster certificate was stored incorrectly in the oauth-serving-cert ConfigMaps, and accessible to any authenticated OpenShift user or service-account. A malicious user could exploit this flaw by reading the oauth-serving-cert ConfigMap in the openshift-config-managed namespace, compromising any web traffic secured using that certificate.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-497, CWE-668
References: https://access.redhat.com/security/cve/CVE-2022-2403; https://bugzilla.redhat.com/show_bug.cgi?id=2101959; https://access.redhat.com/security/cve/CVE-2022-2403
CVE: CVE-2022-2447
Published: 2022-09-01
Description: A flaw was found in Keystone. There is a time lag (up to one hour in a default configuration) between when security policy says a token should be revoked from when it is actually revoked. This could allow a remote administrator to secretly maintain access for longer than expected.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-324, CWE-672
References: https://access.redhat.com/security/cve/CVE-2022-2447; https://bugzilla.redhat.com/show_bug.cgi?id=2105419; https://access.redhat.com/security/cve/CVE-2022-2447
CVE: CVE-2022-2639
Published: 2022-09-01
Description: An integer coercion error was found in the openvswitch kernel module. Given a sufficiently large number of actions, while copying and reserving memory for a new action of a new flow, the reserve_sfa_size() function does not return -EMSGSIZE as expected, potentially leading to an out-of-bounds write access. This flaw allows a local user to crash or potentially escalate their privileges on the system.
CVSS Score: 7.8 (HIGH)
CWE: CWE-192, CWE-681
References: https://bugzilla.redhat.com/show_bug.cgi?id=2084479; https://github.com/torvalds/linux/commit/cefa91b2332d7009bc0be5d951d6cbbf349f90f8; https://bugzilla.redhat.com/show_bug.cgi?id=2084479
CVE: CVE-2022-2663
Published: 2022-09-01
Description: An issue was found in the Linux kernel in nf_conntrack_irc where the message handling can be confused and incorrectly matches the message. A firewall may be able to be bypassed when users are using unencrypted IRC with nf_conntrack_irc configured.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-923
References: https://dgl.cx/2022/08/nat-again-irc-cve-2022-2663; https://lists.debian.org/debian-lts-announce/2022/10/msg00000.html; https://lists.debian.org/debian-lts-announce/2022/11/msg00001.html
CVE: CVE-2022-2738
Published: 2022-09-01
Description: The version of podman as released for Red Hat Enterprise Linux 7 Extras via RHSA-2022:2190 advisory included an incorrect version of podman missing the fix for CVE-2020-8945, which was previously fixed via RHSA-2020:2117. This issue could possibly be used to crash or cause potential code execution in Go applications that use the Go GPGME wrapper library, under certain conditions, during GPG signature verification.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416, CWE-416
References: https://access.redhat.com/security/cve/CVE-2022-2738; https://bugzilla.redhat.com/show_bug.cgi?id=2116923; https://access.redhat.com/security/cve/CVE-2022-2738
CVE: CVE-2022-2739
Published: 2022-09-01
Description: The version of podman as released for Red Hat Enterprise Linux 7 Extras via RHSA-2022:2190 advisory included an incorrect version of podman missing the fix for CVE-2020-14370, which was previously fixed via RHSA-2020:5056. This issue could possibly allow an attacker to gain access to sensitive information stored in environment variables.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200, CWE-312
References: https://access.redhat.com/security/cve/CVE-2022-2739; https://bugzilla.redhat.com/show_bug.cgi?id=2116927; https://access.redhat.com/security/cve/CVE-2022-2739
CVE: CVE-2022-2764
Published: 2022-09-01
Description: A flaw was found in Undertow. Denial of service can be achieved as Undertow server waits for the LAST_CHUNK forever for EJB invocations.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-400
References: https://bugzilla.redhat.com/show_bug.cgi?id=2117506; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://bugzilla.redhat.com/show_bug.cgi?id=2117506
CVE: CVE-2022-2806
Published: 2022-09-01
Description: It was found that the ovirt-log-collector/sosreport collects the RHV admin password unfiltered. Fixed in: sos-4.2-20.el8_6, ovirt-log-collector-4.4.7-2.el8ev
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://github.com/sosreport/sos/pull/2947; https://github.com/sosreport/sos/pull/2947
CVE: CVE-2022-32743
Published: 2022-09-01
Description: Samba does not validate the Validated-DNS-Host-Name right for the dNSHostName attribute which could permit unprivileged users to write it.
CVSS Score: 7.5 (HIGH)
CWE: CWE-276, CWE-276
References: https://bugzilla.samba.org/show_bug.cgi?id=14833; https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/5c578b15-d619-408d-ba17-380714b89fd1; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZTTOLTHUHOV4SHCHCB5TAA4FQVJAWN4P/
CVE: CVE-2022-36601
Published: 2022-09-01
Description: The Eclipse TCF debug interface in JasMiner-X4-Server-20[PII_REDACTED]07 and below is open on port 1534. This issue allows unauthenticated attackers to gain root privileges on the affected device and access sensitive data or execute arbitrary commands.
CVSS Score: 9.8 (CRITICAL)
References: https://jamesachambers.com/cryptocurrency-asic-miners-security-and-hacking-audit/; https://jamesachambers.com/cryptocurrency-asic-miners-security-and-hacking-audit/
CVE: CVE-2022-36602
Published: 2022-09-01
Description: InnoSilicon A10 a10_20200924_120556 was discovered to contain a remote code execution (RCE) vulnerability in the setPlatformAPI function.
CVSS Score: 8.8 (HIGH)
References: https://jamesachambers.com/cryptocurrency-asic-miners-security-and-hacking-audit/; https://jamesachambers.com/cryptocurrency-asic-miners-security-and-hacking-audit/
CVE: CVE-2022-36603
Published: 2022-09-01
Description: InnoSilicon T3T+ t2t+_soc_20190911_151433.swu was discovered to contain a remote code execution (RCE) vulnerability in the checkUrl function.
CVSS Score: 8.8 (HIGH)
References: https://jamesachambers.com/cryptocurrency-asic-miners-security-and-hacking-audit/; https://jamesachambers.com/cryptocurrency-asic-miners-security-and-hacking-audit/
CVE: CVE-2022-36604
Published: 2022-09-01
Description: An access control issue in Canaan Avalon ASIC Miner 2020.3.30 and below allows unauthenticated attackers to arbitrarily change user passwords via a crafted POST request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306
References: https://jamesachambers.com/cryptocurrency-asic-miners-security-and-hacking-audit/; https://jamesachambers.com/cryptocurrency-asic-miners-security-and-hacking-audit/
CVE: CVE-2022-36621
Published: 2022-09-01
Description: Samsung Electronics mTower v0.3.0 and earlier was discovered to contain a NULL pointer dereference via the function TEE_AllocateTransientObject.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://github.com/Samsung/mTower; https://github.com/Samsung/mTower/blob/18f4b592a8a973ce5972f4e2658ea0f6e3686284/tee/lib/libutee/tee_api_objects.c#L223; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2022-36622
Published: 2022-09-01
Description: Samsung Electronics mTower v0.3.0 and earlier was discovered to contain a NULL pointer dereference via the function TEE_GetObjectInfo1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://github.com/Samsung/mTower; https://github.com/Samsung/mTower/blob/18f4b592a8a973ce5972f4e2658ea0f6e3686284/tee/lib/libutee/tee_api_objects.c#L84; https://github.com/Samsung/mTower/blob/18f4b592a8a973ce5972f4e2658ea0f6e3686284/tee/tee/tee_svc.c#L965
CVE: CVE-2022-38126
Published: 2022-09-01
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2022-38127
Published: 2022-09-01
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2022-38128
Published: 2022-09-01
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2022-3078
Published: 2022-09-01
Description: An issue was discovered in the Linux kernel through 5.16-rc6. There is a lack of check after calling vzalloc() and lack of free after allocation in drivers/media/test-drivers/vidtv/vidtv_s302m.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?h=v5.19-rc2&id=e6a21a14106d9718aa4f8e115b1e474888eeba44; https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?h=v5.19-rc2&id=e6a21a14106d9718aa4f8e115b1e474888eeba44
CVE: CVE-2021-25657
Published: 2022-09-02
Description: A privilege escalation vulnerability was discovered in Avaya IP Office Admin Lite and USB Creator that may potentially allow a local user to escalate privileges. This issue affects Admin Lite and USB Creator 11.1 Feature Pack 2 Service Pack 1 and earlier versions.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2022/MNDT-2022-0037/MNDT-2022-0037.md; https://support.avaya.com/css/P8/documents/101083319; https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2022/MNDT-2022-0037/MNDT-2022-0037.md
CVE: CVE-2022-36759
Published: 2022-09-02
Description: Online Food Ordering System v1.0 was discovered to contain a SQL injection vulnerability via the component /dishes.php?res_id=.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://hackmd.io/%40hieuleuxuan/OFOS_Sql_Injection; https://hackmd.io/%40hieuleuxuan/OFOS_Sql_Injection
CVE: CVE-2022-39170
Published: 2022-09-02
Description: libdwarf 0.4.1 has a double free in _dwarf_exec_frame_instr in dwarf_frame.c.
CVSS Score: 8.8 (HIGH)
CWE: CWE-415
References: https://github.com/davea42/libdwarf-code/commit/60303eb80ecc7747bf29776d545e2a5c5a76f6f8; https://github.com/davea42/libdwarf-code/issues/132; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IKUE4XT62AEZ3H5D6GMREYOSCMMRFXBH/
CVE: CVE-2022-36593
Published: 2022-09-02
Description: kkFileView v4.0.0 was discovered to contain an arbitrary file deletion vulnerability via the fileName parameter at /controller/FileController.java.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://github.com/kekingcn/kkFileView/issues/370; https://github.com/kekingcn/kkFileView/issues/370
CVE: CVE-2022-36594
Published: 2022-09-02
Description: Mapper v4.0.0 to v4.2.0 was discovered to contain a SQL injection vulnerability via the ids parameter at the selectByIds function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/abel533/Mapper/issues/862; https://github.com/abel533/Mapper/issues/862
CVE: CVE-2022-39176
Published: 2022-09-02
Description: BlueZ before 5.59 allows physically proximate attackers to obtain sensitive information because profiles/audio/avrcp.c does not validate params_len.
CVSS Score: 8.8 (HIGH)
References: https://bugs.launchpad.net/ubuntu/+source/bluez/+bug/1977968; https://lists.debian.org/debian-lts-announce/2022/10/msg00026.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2022-39177
Published: 2022-09-02
Description: BlueZ before 5.59 allows physically proximate attackers to cause a denial of service because malformed and invalid capabilities can be processed in profiles/audio/avdtp.c.
CVSS Score: 8.8 (HIGH)
References: https://bugs.launchpad.net/ubuntu/+source/bluez/+bug/1977968; https://lists.debian.org/debian-lts-announce/2022/10/msg00026.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2022-36600
Published: 2022-09-02
Description: BlogEngine v3.3.8.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /blogengine/api/posts. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Description field.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/BlogEngine/BlogEngine.NET/issues/254; https://github.com/BlogEngine/BlogEngine.NET/issues/254
CVE: CVE-2022-36609
Published: 2022-09-02
Description: Clinic's Patient Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /pms/update_patient.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/Lendme1996/bug_report/blob/main/vendors/oretnom23/clinics-patient-management-system/SQLi-1.md; https://github.com/Lendme1996/bug_report/blob/main/vendors/oretnom23/clinics-patient-management-system/SQLi-1.md
CVE: CVE-2022-36636
Published: 2022-09-02
Description: Garage Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /print.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://senzee.net/index.php/2022/07/21/vulnerability-of-garage-management-system-1-0/; https://www.sourcecodester.com/php/15485/garage-management-system-using-phpmysql-source-code.htm; https://senzee.net/index.php/2022/07/21/vulnerability-of-garage-management-system-1-0/
CVE: CVE-2022-36637
Published: 2022-09-02
Description: Garage Management System v1.0 was discovered to contain a persistent cross-site scripting (XSS) vulnerability via the brand_name parameter at /brand.php.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://senzee.net/index.php/2022/07/21/vulnerability-of-garage-management-system-1-0/; https://www.sourcecodester.com/php/15485/garage-management-system-using-phpmysql-source-code.htm; https://senzee.net/index.php/2022/07/21/vulnerability-of-garage-management-system-1-0/
CVE: CVE-2022-37679
Published: 2022-09-02
Description: Miniblog.Core v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /blog/edit. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Excerpt field.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/madskristensen/Miniblog.Core/issues/178; https://github.com/madskristensen/Miniblog.Core/issues/178
CVE: CVE-2022-39188
Published: 2022-09-02
Description: An issue was discovered in include/asm-generic/tlb.h in the Linux kernel before 5.19. Because of a race condition (unmap_mapping_range versus munmap), a device driver can free a page while it still has stale TLB entries. This only occurs in situations with VM_PFNMAP VMAs.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-362
References: https://bugs.chromium.org/p/project-zero/issues/detail?id=2329; https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.19; https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=b67fbebd4cf980aecbcc750e1462128bffe8ae15
CVE: CVE-2022-39189
Published: 2022-09-02
Description: An issue was discovered the x86 KVM subsystem in the Linux kernel before 5.18.17. Unprivileged guest users can compromise the guest kernel because TLB flush operations are mishandled in certain KVM_VCPU_PREEMPTED situations.
CVSS Score: 7.8 (HIGH)
References: https://bugs.chromium.org/p/project-zero/issues/detail?id=2309; https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.18.17; https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=6cd88243c7e03845a450795e134b488fc2afb736
CVE: CVE-2022-39190
Published: 2022-09-02
Description: An issue was discovered in net/netfilter/nf_tables_api.c in the Linux kernel before 5.19.6. A denial of service can occur upon binding to an already bound chain.
CVSS Score: 5.5 (MEDIUM)
References: https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.19.6; https://github.com/torvalds/linux/commit/e02f0d3970404bfea385b6edb86f2d936db0ea2b; https://lists.debian.org/debian-lts-announce/2022/11/msg00001.html
CVE: CVE-2022-39194
Published: 2022-09-02
Description: An issue was discovered in the MediaWiki through 1.38.2. The community configuration pages for the GrowthExperiments extension could cause a site to become unavailable due to insufficient validation when certain actions (including page moves) were performed.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-400
References: https://phabricator.wikimedia.org/T313205; https://phabricator.wikimedia.org/T313205
CVE: CVE-2022-25370
Published: 2022-09-02
Description: Apache OFBiz uses the Birt plugin (https://eclipse.github.io/birt-website/) to create data visualizations and reports. In Apache OFBiz release 18.12.05, and earlier versions, by leveraging a vulnerability in Birt (https://bugs.eclipse.org/bugs/show_bug.cgi?id=538142), an unauthenticated malicious user could perform a stored XSS attack in order to inject a malicious payload and execute it using the stored XSS.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://www.openwall.com/lists/oss-security/2022/09/02/8; http://www.openwall.com/lists/oss-security/2022/09/03/1; https://lists.apache.org/thread/vrvzokvxqtc4t6d7g8xgz89xpxcvjofh
CVE: CVE-2022-25371
Published: 2022-09-02
Description: Apache OFBiz uses the Birt project plugin (https://eclipse.github.io/birt-website/) to create data visualizations and reports. By leveraging a bug in Birt (https://bugs.eclipse.org/bugs/show_bug.cgi?id=538142) it is possible to perform a remote code execution (RCE) attack in Apache OFBiz, release 18.12.05 and earlier.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22, CWE-22
References: http://www.openwall.com/lists/oss-security/2022/09/02/7; http://www.openwall.com/lists/oss-security/2022/09/03/1; http://www.openwall.com/lists/oss-security/2022/09/08/2
CVE: CVE-2022-25813
Published: 2022-09-02
Description: In Apache OFBiz, versions 18.12.05 and earlier, an attacker acting as an anonymous user of the ecommerce plugin, can insert a malicious content in a message “Subject” field from the "Contact us" page. Then a party manager needs to list the communications in the party component to activate the SSTI. A RCE is then possible.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1336, CWE-94
References: http://www.openwall.com/lists/oss-security/2022/09/02/4; https://lists.apache.org/thread/vmj5s0qb59t0lvzf3vol3z1sc3sgyb2b; http://www.openwall.com/lists/oss-security/2022/09/02/4