deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-29513
Published: 2022-07-04
Description: Cross-site scripting vulnerability in Scheduler of Cybozu Garoon 4.10.0 to 5.5.1 allows a remote authenticated attacker with an administrative privilege to execute an arbitrary script.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://cs.cybozu.co.jp/2022/007429.html; https://jvn.jp/en/jp/JVN73897863/index.html; https://cs.cybozu.co.jp/2022/007429.html
CVE: CVE-2022-29892
Published: 2022-07-04
Description: Improper input validation vulnerability in Space of Cybozu Garoon 4.0.0 to 5.5.1 allows a remote authenticated attacker to repeatedly display errors in certain functions and cause a denial-of-service (DoS).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://cs.cybozu.co.jp/2022/007429.html; https://jvn.jp/en/jp/JVN73897863/index.html; https://cs.cybozu.co.jp/2022/007429.html
CVE: CVE-2022-2300
Published: 2022-07-04
Description: Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.2.19.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/microweber/microweber/commit/70b46e231e7b2c113666745a0ab6de9a8b7ef08e; https://huntr.dev/bounties/882d6cf9-64f5-4614-a873-a3030473c817; https://github.com/microweber/microweber/commit/70b46e231e7b2c113666745a0ab6de9a8b7ef08e
CVE: CVE-2022-2301
Published: 2022-07-04
Description: Buffer Over-read in GitHub repository hpjansson/chafa prior to 1.10.3.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-126, CWE-125
References: https://github.com/hpjansson/chafa/commit/56fabfa18a6880b4cb66047fa[PII_REDACTED]048d9; https://huntr.dev/bounties/f6b9114b-671d-4948-b946-ffe5c9aeb816; https://github.com/hpjansson/chafa/commit/56fabfa18a6880b4cb66047fa[PII_REDACTED]048d9
CVE: CVE-2021-25056
Published: 2022-07-04
Description: The Ninja Forms Contact Form WordPress plugin before 3.6.10 does not sanitise and escape field labels, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://wpscan.com/vulnerability/795acab2-f621-4662-834b-ebb6205ef7de; https://wpscan.com/vulnerability/795acab2-f621-4662-834b-ebb6205ef7de
CVE: CVE-2021-25066
Published: 2022-07-04
Description: The Ninja Forms Contact Form WordPress plugin before 3.6.10 does not sanitize and escape some imported data, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/323d5fd0-abe8-44ef-9127-eea6fd4f3f3d; https://wpscan.com/vulnerability/323d5fd0-abe8-44ef-9127-eea6fd4f3f3d
CVE: CVE-2022-0250
Published: 2022-07-04
Description: The Redirection for Contact Form 7 WordPress plugin before 2.5.0 does not escape a link generated before outputting it in an attribute, leading to a Reflected Cross-Site Scripting
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/[PII_REDACTED]-89eb-814ceff74867; https://wpscan.com/vulnerability/[PII_REDACTED]-89eb-814ceff74867
CVE: CVE-2022-1301
Published: 2022-07-04
Description: The WP Contact Slider WordPress plugin before 2.4.7 does not sanitize and escape the Text to Display settings of sliders, which could allow high privileged users such as editor and above to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/69b75983-1010-453e-bf67-27b4a2a327a8; https://wpscan.com/vulnerability/69b75983-1010-453e-bf67-27b4a2a327a8
CVE: CVE-2022-1946
Published: 2022-07-04
Description: The Gallery WordPress plugin before 2.0.0 does not sanitise and escape a parameter before outputting it back in the response of an AJAX action (available to both unauthenticated and authenticated users), leading to a Reflected Cross-Site Scripting issue
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/0903920c-be2e-4515-901f-87253eb30940; https://wpscan.com/vulnerability/0903920c-be2e-4515-901f-87253eb30940
CVE: CVE-2022-1967
Published: 2022-07-04
Description: The WP Championship WordPress plugin before 9.3 is lacking CSRF checks in various places, allowing attackers to make a logged in admin perform unwanted actions, such as create and delete arbitrary teams as well as update the plugin's settings. Due to the lack of sanitisation and escaping, it could also lead to Stored Cross-Site Scripting issues
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/02d25736-c796-49bd-b774-66e0e3fcf4c9; https://wpscan.com/vulnerability/02d25736-c796-49bd-b774-66e0e3fcf4c9
CVE: CVE-2022-2268
Published: 2022-07-04
Description: The Import any XML or CSV File to WordPress plugin before 3.6.8 accepts all zip files and automatically extracts the zip file without validating the extracted file type. Allowing high privilege users such as admin to upload an arbitrary file like PHP, leading to RCE
CVSS Score: 7.2 (HIGH)
CWE: CWE-434, CWE-434
References: https://wpscan.com/vulnerability/578093db-a025-4148-8c4b-ec2df31743f7; https://wpscan.com/vulnerability/578093db-a025-4148-8c4b-ec2df31743f7
CVE: CVE-2022-33171
Published: 2022-07-04
Description: The findOne function in TypeORM before 0.3.0 can either be supplied with a string or a FindOneOptions object. When input to the function is a user-controlled parsed JSON object, supplying a crafted FindOneOptions instead of an id string leads to SQL injection. NOTE: the vendor's position is that the user's application is responsible for input validation
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://packetstormsecurity.com/files/168096/TypeORM-0.3.7-Information-Disclosure.html; http://seclists.org/fulldisclosure/2022/Aug/7; https://github.com/typeorm/typeorm/compare/0.2.45...0.3.0
CVE: CVE-2022-34265
Published: 2022-07-04
Description: An issue was discovered in Django 3.2 before 3.2.14 and 4.0 before 4.0.6. The Trunc() and Extract() database functions are subject to SQL injection if untrusted data is used as a kind/lookup_name value. Applications that constrain the lookup name and kind choice to a known safe list are unaffected.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://docs.djangoproject.com/en/4.0/releases/security/; https://groups.google.com/forum/#%21forum/django-announce; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HWY6DQWRVBALV73BPUVBXC3QIYUM24IK/
CVE: CVE-2022-31599
Published: 2022-07-04
Description: NVIDIA DGX A100 contains a vulnerability in SBIOS in the Ofbd, where a local user with elevated privileges can cause access to an uninitialized pointer, which may lead to code execution, escalation of privileges, denial of service, and information disclosure. The scope of impact can extend to other components.
CVSS Score: 8.2 (HIGH)
CWE: CWE-824, CWE-824
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5367; https://nvidia.custhelp.com/app/answers/detail/a_id/5367
CVE: CVE-2022-31600
Published: 2022-07-04
Description: NVIDIA DGX A100 contains a vulnerability in SBIOS in the SmmCore, where a user with high privileges can chain another vulnerability to this vulnerability, causing an integer overflow, possibly leading to code execution, escalation of privileges, denial of service, compromised integrity, and information disclosure. The scope of impact can extend to other components.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190, CWE-190
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5367; https://nvidia.custhelp.com/app/answers/detail/a_id/5367
CVE: CVE-2022-31601
Published: 2022-07-04
Description: NVIDIA DGX A100 contains a vulnerability in SBIOS in the SmbiosPei, which may allow a highly privileged local attacker to cause an out-of-bounds write, which may lead to code execution, denial of service, compromised integrity, and information disclosure.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5367; https://nvidia.custhelp.com/app/answers/detail/a_id/5367
CVE: CVE-2022-31602
Published: 2022-07-04
Description: NVIDIA DGX A100 contains a vulnerability in SBIOS in the IpSecDxe, where a user with elevated privileges and a preconditioned heap can exploit an out-of-bounds write vulnerability, which may lead to code execution, denial of service, data integrity impact, and information disclosure.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5367; https://nvidia.custhelp.com/app/answers/detail/a_id/5367
CVE: CVE-2022-31603
Published: 2022-07-04
Description: NVIDIA DGX A100 contains a vulnerability in SBIOS in the IpSecDxe, where a user with high privileges and preconditioned IpSecDxe global data can exploit improper validation of an array index to cause code execution, which may lead to denial of service, data integrity impact, and information disclosure.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-129, CWE-129
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5367; https://nvidia.custhelp.com/app/answers/detail/a_id/5367
CVE: CVE-2022-34829
Published: 2022-07-04
Description: Zoho ManageEngine ADSelfService Plus before 6203 allows a denial of service (application restart) via a crafted payload to the Mobile App Deployment API.
CVSS Score: 7.5 (HIGH)
References: https://www.manageengine.com/products/self-service-password/advisory/CVE-2022-34829.html; https://www.manageengine.com/products/self-service-password/advisory/CVE-2022-34829.html
CVE: CVE-2022-34918
Published: 2022-07-04
Description: An issue was discovered in the Linux kernel through 5.18.9. A type confusion bug in nft_set_elem_init (leading to a buffer overflow) could be used by a local attacker to escalate privileges, a different vulnerability than CVE-2022-32250. (The attacker can obtain root access, but must start with an unprivileged user namespace to obtain CAP_NET_ADMIN access.) This can be fixed in nft_setelem_parse_data in net/netfilter/nf_tables_api.c.
CVSS Score: 7.8 (HIGH)
CWE: CWE-843
References: http://packetstormsecurity.com/files/168191/Kernel-Live-Patch-Security-Notice-LSN-0089-1.html; http://packetstormsecurity.com/files/168543/Netfilter-nft_set_elem_init-Heap-Overflow-Privilege-Escalation.html; http://www.openwall.com/lists/oss-security/2022/07/05/1
CVE: CVE-2022-2306
Published: 2022-07-05
Description: Old session tokens can be used to authenticate to the application and send authenticated requests.
CVSS Score: 7.5 (HIGH)
CWE: CWE-613
References: https://github.com/heroiclabs/nakama/commit/ce8d3921e2acd44ef8b5e6edfe595b6df067b166; https://huntr.dev/bounties/35acf263-6db4-4310-ab27-4c3c3a53f796; https://github.com/heroiclabs/nakama/commit/ce8d3921e2acd44ef8b5e6edfe595b6df067b166
CVE: CVE-2022-2309
Published: 2022-07-05
Description: NULL Pointer Dereference allows attackers to cause a denial of service (or application crash). This only applies when lxml is used together with libxml2 2.9.10 through 2.9.14. libxml2 2.9.9 and earlier are not affected. It allows triggering crashes through forged input data, given a vulnerable code sequence in the application. The vulnerability is caused by the iterwalk function (also used by the canonicalize function). Such code shouldn't be in wide-spread use, given that parsing + iterwalk would usually be replaced with the more efficient iterparse function. However, an XML converter that serialises to C14N would also be vulnerable, for example, and there are legitimate use cases for this code sequence. If untrusted input is received (also remotely) and processed via iterwalk function, a crash can be triggered.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://github.com/lxml/lxml/commit/86368e9cf70a0ad23cccd5ee32de847149af0c6f; https://huntr.dev/bounties/8264e74f-edda-4c40-9956-49de635105ba; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HGYC6L7ENH5VEGN3YWFBYMGKX6WNS7HZ/
CVE: CVE-2022-2097
Published: 2022-07-05
Description: AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimised implementation will not encrypt the entirety of the data under some circumstances. This could reveal sixteen bytes of data that was preexisting in the memory that wasn't written. In the special case of "in place" encryption, sixteen bytes of the plaintext would be revealed. Since OpenSSL does not support OCB based cipher suites for TLS and DTLS, they are both unaffected. Fixed in OpenSSL 3.0.5 (Affected 3.0.0-3.0.4). Fixed in OpenSSL 1.1.1q (Affected 1.1.1-1.1.1p).
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-327
References: https://cert-portal.siemens.com/productcert/pdf/ssa-332410.pdf; https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=919925673d6c9cfed3c1085497f5dfbbed5fc431; https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=a98f339ddd7e8f487d6e0088d4a9a42324885a93
CVE: CVE-2021-43702
Published: 2022-07-05
Description: ASUS RT-A88U 3.0.0.4.386_45898 is vulnerable to Cross Site Scripting (XSS). The ASUS router admin panel does not sanitize the WiFI logs correctly, if an attacker was able to change the SSID of the router with a custom payload, they could achieve stored XSS on the device.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-79
References: https://www.asus.com/uk/Networking-IoT-Servers/WiFi-Routers/ASUS-WiFi-Routers/RT-AC88U/; https://www.kroll.com/en/insights/publications/cyber/cve-2021-43702-from-discovery-to-patch; https://www.asus.com/uk/Networking-IoT-Servers/WiFi-Routers/ASUS-WiFi-Routers/RT-AC88U/
CVE: CVE-2022-30289
Published: 2022-07-05
Description: A stored Cross-site Scripting (XSS) vulnerability was identified in the Data Import functionality of OpenCTI through 5.2.4. An attacker can abuse the vulnerability to upload a malicious file that will then be executed by a victim when they open the file location.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/OpenCTI-Platform/opencti/releases; https://www.enisa.europa.eu/topics/threat-risk-management/vulnerability-disclosure; https://github.com/OpenCTI-Platform/opencti/releases
CVE: CVE-2022-26365
Published: 2022-07-05
Description: Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Linux Block and Network PV device frontends don't zero memory regions before sharing them with the backend (CVE-2022-26365, CVE-2022-33740). Additionally the granularity of the grant table doesn't allow sharing less than a 4K page, leading to unrelated data residing in the same 4K page as data shared with a backend being accessible by such backend (CVE-2022-33741, CVE-2022-33742).
CVSS Score: 7.1 (HIGH)
CWE: CWE-401
References: http://www.openwall.com/lists/oss-security/2022/07/05/6; http://xenbits.xen.org/xsa/advisory-403.html; https://lists.debian.org/debian-lts-announce/2022/10/msg00000.html
CVE: CVE-2022-2304
Published: 2022-07-05
Description: Stack-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://github.com/vim/vim/commit/54e5fed6d27b747ff152cdb6edfb72ff60e70939; https://huntr.dev/bounties/eb7402f3-025a-402f-97a7-c38700d9548a; https://lists.debian.org/debian-lts-announce/2022/11/msg00009.html
CVE: CVE-2022-30290
Published: 2022-07-05
Description: In OpenCTI through 5.2.4, a broken access control vulnerability has been identified in the profile endpoint. An attacker can abuse the identified vulnerability in order to arbitrarily change their registered e-mail address as well as their API key, even though such action is not possible through the interface, legitimately.
CVSS Score: 7.5 (HIGH)
References: https://github.com/OpenCTI-Platform/opencti/releases; https://www.enisa.europa.eu/topics/threat-risk-management/vulnerability-disclosure; https://github.com/OpenCTI-Platform/opencti/releases
CVE: CVE-2022-33740
Published: 2022-07-05
Description: Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Linux Block and Network PV device frontends don't zero memory regions before sharing them with the backend (CVE-2022-26365, CVE-2022-33740). Additionally the granularity of the grant table doesn't allow sharing less than a 4K page, leading to unrelated data residing in the same 4K page as data shared with a backend being accessible by such backend (CVE-2022-33741, CVE-2022-33742).
CVSS Score: 7.1 (HIGH)
CWE: CWE-212
References: http://www.openwall.com/lists/oss-security/2022/07/05/6; http://xenbits.xen.org/xsa/advisory-403.html; https://lists.debian.org/debian-lts-announce/2022/10/msg00000.html
CVE: CVE-2022-33741
Published: 2022-07-05
Description: Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Linux Block and Network PV device frontends don't zero memory regions before sharing them with the backend (CVE-2022-26365, CVE-2022-33740). Additionally the granularity of the grant table doesn't allow sharing less than a 4K page, leading to unrelated data residing in the same 4K page as data shared with a backend being accessible by such backend (CVE-2022-33741, CVE-2022-33742).
CVSS Score: 7.1 (HIGH)
CWE: CWE-200
References: http://www.openwall.com/lists/oss-security/2022/07/05/6; http://xenbits.xen.org/xsa/advisory-403.html; https://lists.debian.org/debian-lts-announce/2022/10/msg00000.html
CVE: CVE-2022-33742
Published: 2022-07-05
Description: Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Linux Block and Network PV device frontends don't zero memory regions before sharing them with the backend (CVE-2022-26365, CVE-2022-33740). Additionally the granularity of the grant table doesn't allow sharing less than a 4K page, leading to unrelated data residing in the same 4K page as data shared with a backend being accessible by such backend (CVE-2022-33741, CVE-2022-33742).
CVSS Score: 7.1 (HIGH)
CWE: CWE-200
References: http://www.openwall.com/lists/oss-security/2022/07/05/6; http://xenbits.xen.org/xsa/advisory-403.html; https://lists.debian.org/debian-lts-announce/2022/10/msg00000.html
CVE: CVE-2022-33743
Published: 2022-07-05
Description: network backend may cause Linux netfront to use freed SKBs While adding logic to support XDP (eXpress Data Path), a code label was moved in a way allowing for SKBs having references (pointers) retained for further processing to nevertheless be freed.
CVSS Score: 7.8 (HIGH)
References: http://www.openwall.com/lists/oss-security/2022/07/05/5; http://xenbits.xen.org/xsa/advisory-405.html; https://www.debian.org/security/2022/dsa-5191
CVE: CVE-2022-33744
Published: 2022-07-05
Description: Arm guests can cause Dom0 DoS via PV devices When mapping pages of guests on Arm, dom0 is using an rbtree to keep track of the foreign mappings. Updating of that rbtree is not always done completely with the related lock held, resulting in a small race window, which can be used by unprivileged guests via PV devices to cause inconsistencies of the rbtree. These inconsistencies can lead to Denial of Service (DoS) of dom0, e.g. by causing crashes or the inability to perform further mappings of other guests' memory pages.
CVSS Score: 4.7 (MEDIUM)
References: http://www.openwall.com/lists/oss-security/2022/07/05/4; http://xenbits.xen.org/xsa/advisory-406.html; https://lists.debian.org/debian-lts-announce/2022/10/msg00000.html
CVE: CVE-2021-43116
Published: 2022-07-05
Description: An Access Control vulnerability exists in Nacos 2.0.3 in the access prompt page; enter username and password, click on login to capture packets and then change the returned package, which lets a malicious user login.
CVSS Score: 8.8 (HIGH)
CWE: CWE-287
References: http://packetstormsecurity.com/files/171638/Nacos-2.0.3-Access-Control.html; https://github.com/alibaba/nacos/issues/7127; https://github.com/alibaba/nacos/issues/7182
CVE: CVE-2022-31836
Published: 2022-07-05
Description: The leafInfo.match() function in Beego v2.0.3 and below uses path.join() to deal with wildcardvalues which can lead to cross directory risk.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://github.com/advisories/GHSA-95f9-94vc-665h; https://github.com/beego/beego/issues/4961; https://github.com/advisories/GHSA-95f9-94vc-665h
CVE: CVE-2022-31770
Published: 2022-07-05
Description: IBM App Connect Enterprise Certified Container 4.2 could allow a user from the administration console to cause a denial of service by creating a specially crafted request. IBM X-Force ID: 228221.
CVSS Score: 4.9 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/228221; https://www.ibm.com/support/pages/node/6601125; https://exchange.xforce.ibmcloud.com/vulnerabilities/228221
CVE: CVE-2022-34876
Published: 2022-07-05
Description: SQL Injection vulnerability in admin interface (/vicidial/admin.php) of VICIdial via modify_email_accounts, access_recordings, and agentcall_email parameters allows attacker to spoof identity, tamper with existing data, allow the complete disclosure of all data on the system, destroy the data or make it otherwise unavailable, and become administrators of the database server. This issue affects: VICIdial 2.14b0.5 versions prior to 3555.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://github.com/rapid7/metasploit-framework/pull/16732; https://www.vicidial.org/VICIDIALforum/viewtopic.php?f=4&t=41300&sid=aacb27a29fefd85265b4d55fe51122af; https://github.com/rapid7/metasploit-framework/pull/16732
CVE: CVE-2022-34877
Published: 2022-07-05
Description: SQL Injection vulnerability in AST Agent Time Sheet interface ((/vicidial/AST_agent_time_sheet.php) of VICIdial via the agent parameter allows attacker to spoof identity, tamper with existing data, allow the complete disclosure of all data on the system, destroy the data or make it otherwise unavailable, and become administrators of the database server. This issue affects: VICIdial 2.14b0.5 versions prior to 3555.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://github.com/rapid7/metasploit-framework/pull/16732; https://www.vicidial.org/VICIDIALforum/viewtopic.php?f=4&t=41300&sid=aacb27a29fefd85265b4d55fe51122af; https://github.com/rapid7/metasploit-framework/pull/16732
CVE: CVE-2022-34878
Published: 2022-07-05
Description: SQL Injection vulnerability in User Stats interface (/vicidial/user_stats.php) of VICIdial via the file_download parameter allows attacker to spoof identity, tamper with existing data, allow the complete disclosure of all data on the system, destroy the data or make it otherwise unavailable, and become administrators of the database server.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://github.com/rapid7/metasploit-framework/pull/16732; https://www.vicidial.org/VICIDIALforum/viewtopic.php?f=4&t=41300&sid=aacb27a29fefd85265b4d55fe51122af; https://github.com/rapid7/metasploit-framework/pull/16732
CVE: CVE-2022-34879
Published: 2022-07-05
Description: Reflected Cross Site Scripting (XSS) vulnerabilities in AST Agent Time Sheet interface (/vicidial/AST_agent_time_sheet.php) of VICIdial via agent, and search_archived_data parameters. This issue affects: VICIdial 2.14b0.5 versions prior to 3555.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.vicidial.org/VICIDIALforum/viewtopic.php?f=4&t=41300&sid=aacb27a29fefd85265b4d55fe51122af; https://www.vicidial.org/VICIDIALforum/viewtopic.php?f=4&t=41300&sid=aacb27a29fefd85265b4d55fe51122af
CVE: CVE-2021-44915
Published: 2022-07-05
Description: Taocms 3.0.2 was discovered to contain a blind SQL injection vulnerability via the function Edit category.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/taogogo/taocms/issues/8; https://github.com/taogogo/taocms/issues/8