deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-22221
Published: 2022-07-20
Description: An Improper Neutralization of Special Elements vulnerability in the download manager of Juniper Networks Junos OS on SRX Series and EX Series allows a locally authenticated attacker with low privileges to take full control over the device. One aspect of this vulnerability is that the attacker needs to be able to execute any of the "request ..." or "show system download ..." commands. This issue affects Juniper Networks Junos OS on SRX Series and EX Series: All versions prior to 19.2R1-S9, 19.2R3-S5; 19.3 versions prior to 19.3R3-S6; 19.4 versions prior to 19.4R3-S8; 20.1 versions prior to 20.1R3-S4; 20.2 versions prior to 20.2R3-S4; 20.3 versions prior to 20.3R3-S3; 20.4 versions prior to 20.4R3-S2, 20.4R3-S3; 21.1 versions prior to 21.1R3-S1; 21.2 versions prior to 21.2R2-S2, 21.2R3; 21.3 versions prior to 21.3R2, 21.3R3; 21.4 versions prior to 21.4R1-S1, 21.4R2.
CVSS Score: 7.8 (HIGH)
References: https://kb.juniper.net/JSA69725; https://kb.juniper.net/JSA69725
CVE: CVE-2022-1264
Published: 2022-07-20
Description: The affected product may allow an attacker with access to the Ignition web configuration to run arbitrary code.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-102-03; https://www.cisa.gov/uscert/ics/advisories/icsa-22-102-03
CVE: CVE-2022-1766
Published: 2022-07-20
Description: Anchore Enterprise anchorectl version 0.1.4 improperly stored credentials when generating a Software Bill of Materials. anchorectl will add the credentials used to access Anchore Enterprise API in the Software Bill of Materials (SBOM) generated by anchorectl. Users of anchorectl version 0.1.4 should upgrade to anchorectl version 0.1.5 to resolve this issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-522, CWE-522
References: https://docs.anchore.com/current/docs/releasenotes/401/; https://docs.anchore.com/current/docs/releasenotes/401/
CVE: CVE-2022-2107
Published: 2022-07-20
Description: The MiCODUS MV720 GPS tracker API server has an authentication mechanism that allows devices to use a hard-coded master password. This may allow an attacker to send SMS commands directly to the GPS tracker as if they were coming from the GPS owner’s mobile number.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-200-01; https://www.cisa.gov/uscert/ics/advisories/icsa-22-200-01
CVE: CVE-2022-2141
Published: 2022-07-20
Description: SMS-based GPS commands can be executed by MiCODUS MV720 GPS tracker without authentication.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287, CWE-306
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-200-01; https://www.cisa.gov/uscert/ics/advisories/icsa-22-200-01
CVE: CVE-2022-2179
Published: 2022-07-20
Description: The X-Frame-Options header in Rockwell Automation MicroLogix 1100/1400 Versions 21.007 and prior is not configured in the HTTP response, which could allow clickjacking attacks.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-1021, CWE-1021
References: https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1135994; https://www.cisa.gov/uscert/ics/advisories/icsa-22-188-01; https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1135994
CVE: CVE-2022-2199
Published: 2022-07-20
Description: The main MiCODUS MV720 GPS tracker web server has a reflected cross-site scripting vulnerability that could allow an attacker to gain control by tricking a user into making a request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-79
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-200-01; https://www.cisa.gov/uscert/ics/advisories/icsa-22-200-01
CVE: CVE-2022-33944
Published: 2022-07-20
Description: The main MiCODUS MV720 GPS tracker web server has an authenticated insecure direct object references vulnerability on endpoint and POST parameter “Device ID,” which accepts arbitrary device IDs.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-639
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-200-01; https://www.cisa.gov/uscert/ics/advisories/icsa-22-200-01
CVE: CVE-2022-34150
Published: 2022-07-20
Description: The main MiCODUS MV720 GPS tracker web server has an authenticated insecure direct object reference vulnerability on endpoint and parameter device IDs, which accept arbitrary device IDs without further verification.
CVSS Score: 7.1 (HIGH)
CWE: CWE-639, CWE-639
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-200-01; https://www.cisa.gov/uscert/ics/advisories/icsa-22-200-01
CVE: CVE-2022-29834
Published: 2022-07-20
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Mitsubishi Electric GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric ICONICS Suite versions 10.97 to 10.97.1, and Mitsubishi Electric Iconics Digital Solutions ICONICS Suite versions 10.97 to 10.97.1 allows a remote unauthenticated attacker to access to arbitrary files in the GENESIS64 server or ICONICS suite server and disclose information stored in the files by embedding a malicious URL parameter in the URL of the monitoring screen delivered to the GENESIS64 or ICONICS Suite mobile monitoring application and accessing the monitoring screen.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://jvn.jp/vu/JVNVU96480474/index.html; https://www.cisa.gov/news-events/ics-advisories/icsa-22-202-04; https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-008_en.pdf
CVE: CVE-2022-33315
Published: 2022-07-20
Description: Deserialization of Untrusted Data vulnerability in Mitsubishi Electric GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric ICONICS Suite versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions ICONICS Suite versions 10.97 to 10.97.1, and Mitsubishi Electric MC Works64 versions 4.04E and prior allows an unauthenticated attacker to execute an arbitrary malicious code by leading a user to load a monitoring screen file including malicious XAML codes.
CVSS Score: 7.8 (HIGH)
CWE: CWE-502, CWE-502
References: https://jvn.jp/vu/JVNVU96480474/index.html; https://www.cisa.gov/news-events/ics-advisories/icsa-22-202-04; https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-008_en.pdf
CVE: CVE-2022-33316
Published: 2022-07-20
Description: Deserialization of Untrusted Data vulnerability in Mitsubishi Electric GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric ICONICS Suite versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions ICONICS Suite versions 10.97 to 10.97.1, and Mitsubishi Electric MC Works64 versions 4.04E and prior allows an unauthenticated attacker to execute an arbitrary malicious code by leading a user to load a monitoring screen file including malicious XAML codes.
CVSS Score: 7.8 (HIGH)
CWE: CWE-502, CWE-502
References: https://jvn.jp/vu/JVNVU96480474/index.html; https://www.cisa.gov/news-events/ics-advisories/icsa-22-202-04; https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-008_en.pdf
CVE: CVE-2022-33317
Published: 2022-07-20
Description: Inclusion of Functionality from Untrusted Control Sphere vulnerability in Mitsubishi Electric GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric ICONICS Suite versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions ICONICS Suite versions 10.97 to 10.97.1, and Mitsubishi Electric MC Works64 versions 4.04E and prior allows an unauthenticated attacker to execute an arbitrary malicious code by leading a user to load a monitoring screen file including malicious script codes.
CVSS Score: 7.8 (HIGH)
CWE: CWE-829, CWE-829
References: https://jvn.jp/vu/JVNVU96480474/index.html; https://www.cisa.gov/news-events/ics-advisories/icsa-22-202-04; https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-008_en.pdf
CVE: CVE-2022-33318
Published: 2022-07-20
Description: Deserialization of Untrusted Data vulnerability in Mitsubishi Electric GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric ICONICS Suite versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions ICONICS Suite versions 10.97 to 10.97.1, Mitsubishi Electric GENESIS32 versions 9.7 and prior, Mitsubishi Electric Iconics Digital Solutions GENESIS32 versions 9.7 and prior, and Mitsubishi Electric MC Works64 versions 4.04E and prior allows a remote unauthenticated attacker to execute an arbitrary malicious code by sending specially crafted packets to the GENESIS64, ICONICS Suite, GENESIS32, or MC Works64 server.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502, CWE-502
References: https://jvn.jp/vu/JVNVU96480474/index.html; https://www.cisa.gov/news-events/ics-advisories/icsa-22-202-04; https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-008_en.pdf
CVE: CVE-2022-33319
Published: 2022-07-20
Description: Out-of-bounds Read vulnerability in Mitsubishi Electric GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric ICONICS Suite versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions ICONICS Suite versions 10.97 to 10.97.1, Mitsubishi Electric GENESIS32 versions 9.7 and prior, Mitsubishi Electric Iconics Digital Solutions GENESIS32 versions 9.7 and prior, and Mitsubishi Electric MC Works64 versions 4.04E and prior allows a remote unauthenticated attacker to disclose information on memory or cause a Denial of Service (DoS) condition by sending specially crafted packets to the GENESIS64, ICONICS Suite, GENESIS32, or MC Works64 server.
CVSS Score: 8.2 (HIGH)
CWE: CWE-125, CWE-125
References: https://jvn.jp/vu/JVNVU96480474/index.html; https://www.cisa.gov/news-events/ics-advisories/icsa-22-202-04; https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-008_en.pdf
CVE: CVE-2022-33320
Published: 2022-07-20
Description: Deserialization of Untrusted Data vulnerability in Mitsubishi Electric GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric ICONICS Suite versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions ICONICS Suite versions 10.97 to 10.97.1, and Mitsubishi Electric MC Works64 versions 4.04E and prior allows an unauthenticated attacker to execute an arbitrary malicious code by leading a user to load a project configuration file including malicious XML codes.
CVSS Score: 7.8 (HIGH)
CWE: CWE-502, CWE-502
References: https://jvn.jp/vu/JVNVU96480474/index.html; https://www.cisa.gov/news-events/ics-advisories/icsa-22-202-04; https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-008_en.pdf
CVE: CVE-2022-34042
Published: 2022-07-20
Description: Barangay Management System v1.0 was discovered to contain a SQL injection vulnerability via the hidden_id parameter at /pages/household/household.php.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/tianqi5432/bug_report/blob/main/vendors/itsourcecode.com/barangay-management-system/SQLi-1.md; https://github.com/tianqi5432/bug_report/blob/main/vendors/itsourcecode.com/barangay-management-system/SQLi-1.md
CVE: CVE-2022-34045
Published: 2022-07-20
Description: Wavlink WN530HG4 M30HG4.V5030.191116 was discovered to contain a hardcoded encryption/decryption key for its configuration files at /etc_ro/lighttpd/www/cgi-bin/ExportAllSettings.sh.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://drive.google.com/file/d/1s5uZGC_iSzfCJt9BJ8h-P24vmsrmttrf/view?usp=sharing; https://drive.google.com/file/d/1s5uZGC_iSzfCJt9BJ8h-P24vmsrmttrf/view?usp=sharing
CVE: CVE-2022-34046
Published: 2022-07-20
Description: An access control issue in Wavlink WN533A8 M33A8.V5030.190716 allows attackers to obtain usernames and passwords via view-source:http://IP_ADDRESS/sysinit.shtml?r=52300 and searching for [logincheck(user);].
CVSS Score: 7.5 (HIGH)
CWE: CWE-863
References: http://packetstormsecurity.com/files/167890/Wavlink-WN533A8-Password-Disclosure.html; https://drive.google.com/file/d/18ECQEqZ296LDzZ0wErgqnNfen1jCn0mG/view?usp=sharing; http://packetstormsecurity.com/files/167890/Wavlink-WN533A8-Password-Disclosure.html
CVE: CVE-2022-34047
Published: 2022-07-20
Description: An access control issue in Wavlink WN530HG4 M30HG4.V5030.191116 allows attackers to obtain usernames and passwords via view-source:http://IP_ADDRESS/set_safety.shtml?r=52300 and searching for [var syspasswd].
CVSS Score: 7.5 (HIGH)
CWE: CWE-668
References: http://packetstormsecurity.com/files/167891/Wavlink-WN530HG4-Password-Disclosure.html; https://drive.google.com/file/d/1sTQdUc12aZvJRFeb5wp8AfPdUEkkU9Sy/view?usp=sharing; http://packetstormsecurity.com/files/167891/Wavlink-WN530HG4-Password-Disclosure.html
CVE: CVE-2022-34048
Published: 2022-07-20
Description: Wavlink WN533A8 M33A8.V5030.190716 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the login_page parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://drive.google.com/file/d/1NI3-k3AGIsSe2zjeigl1GVyU1VpG1SV3/view?usp=sharing; https://drive.google.com/file/d/1xznFhH3w3TDN2RCdX62_ebylR4yaKmzf/view?usp=sharing; https://drive.google.com/file/d/1NI3-k3AGIsSe2zjeigl1GVyU1VpG1SV3/view?usp=sharing
CVE: CVE-2022-34049
Published: 2022-07-20
Description: An access control issue in Wavlink WN530HG4 M30HG4.V5030.191116 allows unauthenticated attackers to download log files and configuration data.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-552
References: https://drive.google.com/file/d/1-eNgq6IS609bq2vB93c_N8jnZrJ2dgNF/view?usp=sharing; https://drive.google.com/file/d/1ZeSwqu04OghLQXeG7emU-w-Amgadafqx/view?usp=sharing; https://drive.google.com/file/d/1-eNgq6IS609bq2vB93c_N8jnZrJ2dgNF/view?usp=sharing
CVE: CVE-2021-29755
Published: 2022-07-20
Description: IBM QRadar SIEM 7.3, 7.4, and 7.5 does not preform proper certificate validation for some inter-host communications. IBM X-Force ID: 202015.
CVSS Score: 7.5 (HIGH)
CWE: CWE-295
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/202015; https://www.ibm.com/support/pages/node/6605431; https://exchange.xforce.ibmcloud.com/vulnerabilities/202015
CVE: CVE-2021-38936
Published: 2022-07-20
Description: IBM QRadar SIEM 7.3, 7.4, and 7.5 could disclose highly sensitive information to a privileged user. IBM X-Force ID: 210893.
CVSS Score: 4.9 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/210893; https://www.ibm.com/support/pages/node/6605429; https://exchange.xforce.ibmcloud.com/vulnerabilities/210893
CVE: CVE-2022-22424
Published: 2022-07-20
Description: IBM QRadar SIEM 7.3, 7.4, and 7.5 could allow a local user to obtain sensitive information from the TLS key file due to incorrect file permissions. IBM X-Force ID: 223597.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-276
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/223597; https://www.ibm.com/support/pages/node/6605433; https://exchange.xforce.ibmcloud.com/vulnerabilities/223597
CVE: CVE-2022-26136
Published: 2022-07-20
Description: A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to bypass Servlet Filters used by first and third party apps. The impact depends on which filters are used by each app, and how the filters are used. This vulnerability can result in authentication bypass and cross-site scripting. Atlassian has released updates that fix the root cause of this vulnerability, but has not exhaustively enumerated all potential consequences of this vulnerability. Atlassian Bamboo versions are affected before 8.0.9, from 8.1.0 before 8.1.8, and from 8.2.0 before 8.2.4. Atlassian Bitbucket versions are affected before 7.6.16, from 7.7.0 before 7.17.8, from 7.18.0 before 7.19.5, from 7.20.0 before 7.20.2, from 7.21.0 before 7.21.2, and versions 8.0.0 and 8.1.0. Atlassian Confluence versions are affected before 7.4.17, from 7.5.0 before 7.13.7, from 7.14.0 before 7.14.3, from 7.15.0 before 7.15.2, from 7.16.0 before 7.16.4, from 7.17.0 before 7.17.4, and version 7.21.0. Atlassian Crowd versions are affected before 4.3.8, from 4.4.0 before 4.4.2, and version 5.0.0. Atlassian Fisheye and Crucible versions before 4.8.10 are affected. Atlassian Jira versions are affected before 8.13.22, from 8.14.0 before 8.20.10, and from 8.21.0 before 8.22.4. Atlassian Jira Service Management versions are affected before 4.13.22, from 4.14.0 before 4.20.10, and from 4.21.0 before 4.22.4.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-180, CWE-287
References: https://jira.atlassian.com/browse/BAM-21795; https://jira.atlassian.com/browse/BSERV-13370; https://jira.atlassian.com/browse/CONFSERVER-79476
CVE: CVE-2022-26137
Published: 2022-07-20
Description: A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to cause additional Servlet Filters to be invoked when the application processes requests or responses. Atlassian has confirmed and fixed the only known security issue associated with this vulnerability: Cross-origin resource sharing (CORS) bypass. Sending a specially crafted HTTP request can invoke the Servlet Filter used to respond to CORS requests, resulting in a CORS bypass. An attacker that can trick a user into requesting a malicious URL can access the vulnerable application with the victim’s permissions. Atlassian Bamboo versions are affected before 8.0.9, from 8.1.0 before 8.1.8, and from 8.2.0 before 8.2.4. Atlassian Bitbucket versions are affected before 7.6.16, from 7.7.0 before 7.17.8, from 7.18.0 before 7.19.5, from 7.20.0 before 7.20.2, from 7.21.0 before 7.21.2, and versions 8.0.0 and 8.1.0. Atlassian Confluence versions are affected before 7.4.17, from 7.5.0 before 7.13.7, from 7.14.0 before 7.14.3, from 7.15.0 before 7.15.2, from 7.16.0 before 7.16.4, from 7.17.0 before 7.17.4, and version 7.21.0. Atlassian Crowd versions are affected before 4.3.8, from 4.4.0 before 4.4.2, and version 5.0.0. Atlassian Fisheye and Crucible versions before 4.8.10 are affected. Atlassian Jira versions are affected before 8.13.22, from 8.14.0 before 8.20.10, and from 8.21.0 before 8.22.4. Atlassian Jira Service Management versions are affected before 4.13.22, from 4.14.0 before 4.20.10, and from 4.21.0 before 4.22.4.
CVSS Score: 8.8 (HIGH)
CWE: CWE-180, CWE-346
References: https://jira.atlassian.com/browse/BAM-21795; https://jira.atlassian.com/browse/BSERV-13370; https://jira.atlassian.com/browse/CONFSERVER-79476
CVE: CVE-2022-26138
Published: 2022-07-20
Description: The Atlassian Questions For Confluence app for Confluence Server and Data Center creates a Confluence user account in the confluence-users group with the username disabledsystemuser and a hardcoded password. A remote, unauthenticated attacker with knowledge of the hardcoded password could exploit this to log into Confluence and access all content accessible to users in the confluence-users group. This user account is created when installing versions 2.7.34, 2.7.35, and 3.0.2 of the app.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798, CWE-798
References: https://confluence.atlassian.com/doc/confluence-security-advisory-2022-07-20[PII_REDACTED].html; https://jira.atlassian.com/browse/CONFSERVER-79483; https://confluence.atlassian.com/doc/confluence-security-advisory-2022-07-20[PII_REDACTED].html
CVE: CVE-2022-35569
Published: 2022-07-20
Description: Blogifier v3.0 was discovered to contain an arbitrary file upload vulnerability at /api/storage/upload/PostImage. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted file.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/blogifierdotnet/Blogifier/issues/316; https://github.com/blogifierdotnet/Blogifier/issues/316
CVE: CVE-2020-21405
Published: 2022-07-20
Description: An issue was discovered in H96 Smart TV Box H96 Pro Plus allows attackers to corrupt files via calls to the saveDeepColorAttr service.unk
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://github.com/helloworldxp/TVBoxBugs/blob/master/H96_Pro_Plus_SmartTV_Vulnerability; https://github.com/helloworldxp/TVBoxBugs/blob/master/H96_Pro_Plus_SmartTV_Vulnerability
CVE: CVE-2020-21406
Published: 2022-07-20
Description: An issue was discovered in RK Smart TV Box MAX and V88 SmartTV box that allows attackers to cause a denial of service via the switchNextDisplayInterface service.
CVSS Score: 7.5 (HIGH)
References: https://github.com/helloworldxp/TVBoxBugs/blob/master/RK_MAX_V88_SmartTV_Vulnerability; https://github.com/helloworldxp/TVBoxBugs/blob/master/RK_MAX_V88_SmartTV_Vulnerability
CVE: CVE-2021-36849
Published: 2022-07-20
Description: Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in René Hermenau's Social Media Share Buttons plugin <= 3.8.1 at WordPress.
CVSS Score: 3.4 (LOW)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/mashsharer/wordpress-social-media-share-buttons-plugin-3-8-1-authenticated-stored-cross-site-scripting-xss-vulnerability; https://wordpress.org/plugins/mashsharer/#developers; https://patchstack.com/database/vulnerability/mashsharer/wordpress-social-media-share-buttons-plugin-3-8-1-authenticated-stored-cross-site-scripting-xss-vulnerability
CVE: CVE-2022-29454
Published: 2022-07-20
Description: Cross-Site Request Forgery (CSRF) vulnerability in WordPlus Better Messages plugin <= 1.9.9.148 at WordPress allows attackers to upload files. File attachment to messages must be activated.
CVSS Score: 3.1 (LOW)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/bp-better-messages/wordpress-better-messages-plugin-1-9-9-148-cross-site-request-forgery-csrf-vulnerability; https://wordpress.org/plugins/bp-better-messages/#developers; https://patchstack.com/database/vulnerability/bp-better-messages/wordpress-better-messages-plugin-1-9-9-148-cross-site-request-forgery-csrf-vulnerability
CVE: CVE-2022-29923
Published: 2022-07-20
Description: Cross-site Scripting (XSS) vulnerability in ThingsForRestaurants Quick Restaurant Reservations (WordPress plugin) allows Reflected XSS.This issue affects Quick Restaurant Reservations (WordPress plugin): from n/a through 1.4.1.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/quick-restaurant-reservations/wordpress-quick-restaurant-reservations-plugin-1-4-1-authenticated-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/quick-restaurant-reservations/wordpress-quick-restaurant-reservations-plugin-1-4-1-authenticated-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2022-31160
Published: 2022-07-20
Description: jQuery UI is a curated set of user interface interactions, effects, widgets, and themes built on top of jQuery. Versions prior to 1.13.2 are potentially vulnerable to cross-site scripting. Initializing a checkboxradio widget on an input enclosed within a label makes that parent label contents considered as the input label. Calling `.checkboxradio( "refresh" )` on such a widget and the initial HTML contained encoded HTML entities will make them erroneously get decoded. This can lead to potentially executing JavaScript code. The bug has been patched in jQuery UI 1.13.2. To remediate the issue, someone who can change the initial HTML can wrap all the non-input contents of the `label` in a `span`.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://blog.jqueryui.com/2022/07/jquery-ui-1-13-2-released/; https://github.com/jquery/jquery-ui/commit/8cc5bae1caa1fcf96bf5862c5646c787020ba3f9; https://github.com/jquery/jquery-ui/security/advisories/GHSA-h6gj-6jjq-h8g9