deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-29117
Published: 2022-08-12
Description: A use-after-free vulnerability when parsing a specially crafted file in Esri ArcReader 10.8.1 (and earlier) allows an unauthenticated attacker to achieve arbitrary code execution in the context of the current user.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://www.esri.com/arcgis-blog/products/arcgis-desktop/administration/arcreader-general-data-frame-security-update/; https://www.esri.com/arcgis-blog/products/arcgis-desktop/administration/arcreader-general-data-frame-security-update/
CVE: CVE-2021-29118
Published: 2022-08-12
Description: An out-of-bounds read vulnerability exists when parsing a specially crafted file in Esri ArcReader 10.8.1 (and earlier) which allow an unauthenticated attacker to induce an information disclosure issue in the context of the current user.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://www.esri.com/arcgis-blog/products/arcgis-desktop/administration/arcreader-general-data-frame-security-update/; https://www.esri.com/arcgis-blog/products/arcgis-desktop/administration/arcreader-general-data-frame-security-update/
CVE: CVE-2022-2797
Published: 2022-08-12
Description: A vulnerability classified as critical was found in SourceCodester Student Information System. Affected by this vulnerability is an unknown functionality of the file /admin/students/view_student.php. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The identifier VDB-206245 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://vuldb.com/?id.206245; https://vuldb.com/?id.206245
CVE: CVE-2022-2587
Published: 2022-08-12
Description: Out of bounds write in Chrome OS Audio Server in Google Chrome on Chrome OS prior to 102.0.5005.125 allowed a remote attacker to potentially exploit heap corruption via crafted audio metadata.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://chromereleases.googleblog.com/2022/06/stable-channel-update-for-chromeos.html; https://crbug.com/1320917; https://chromereleases.googleblog.com/2022/06/stable-channel-update-for-chromeos.html
CVE: CVE-2022-2603
Published: 2022-08-12
Description: Use after free in Omnibox in Google Chrome prior to 104.0.5112.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop.html; https://crbug.com/1325699; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4NMJURTG5RO3TGD7ZMIQ6Z4ZZ3SAVYE/
CVE: CVE-2022-2604
Published: 2022-08-12
Description: Use after free in Safe Browsing in Google Chrome prior to 104.0.5112.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop.html; https://crbug.com/1335316; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4NMJURTG5RO3TGD7ZMIQ6Z4ZZ3SAVYE/
CVE: CVE-2022-2605
Published: 2022-08-12
Description: Out of bounds read in Dawn in Google Chrome prior to 104.0.5112.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop.html; https://crbug.com/1338470; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4NMJURTG5RO3TGD7ZMIQ6Z4ZZ3SAVYE/
CVE: CVE-2022-2606
Published: 2022-08-12
Description: Use after free in Managed devices API in Google Chrome prior to 104.0.5112.79 allowed a remote attacker who convinced a user to enable a specific Enterprise policy to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop.html; https://crbug.com/1330489; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4NMJURTG5RO3TGD7ZMIQ6Z4ZZ3SAVYE/
CVE: CVE-2022-2607
Published: 2022-08-12
Description: Use after free in Tab Strip in Google Chrome on Chrome OS prior to 104.0.5112.79 allowed a remote attacker who convinced a user to engage in specific user interactions to potentially exploit heap corruption via specific UI interactions.
CVSS Score: 8.8 (HIGH)
CWE: CWE-362
References: https://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop.html; https://crbug.com/1286203; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4NMJURTG5RO3TGD7ZMIQ6Z4ZZ3SAVYE/
CVE: CVE-2022-2608
Published: 2022-08-12
Description: Use after free in Overview Mode in Google Chrome on Chrome OS prior to 104.0.5112.79 allowed a remote attacker who convinced a user to engage in specific user interactions to potentially exploit heap corruption via specific UI interactions.
CVSS Score: 8.8 (HIGH)
CWE: CWE-362
References: https://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop.html; https://crbug.com/1330775; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4NMJURTG5RO3TGD7ZMIQ6Z4ZZ3SAVYE/
CVE: CVE-2022-2609
Published: 2022-08-12
Description: Use after free in Nearby Share in Google Chrome on Chrome OS prior to 104.0.5112.79 allowed a remote attacker who convinced a user to engage in specific user interactions to potentially exploit heap corruption via specific UI interactions.
CVSS Score: 8.8 (HIGH)
CWE: CWE-362
References: https://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop.html; https://crbug.com/1338560; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4NMJURTG5RO3TGD7ZMIQ6Z4ZZ3SAVYE/
CVE: CVE-2022-2610
Published: 2022-08-12
Description: Insufficient policy enforcement in Background Fetch in Google Chrome prior to 104.0.5112.79 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-668
References: https://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop.html; https://crbug.com/1278255; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4NMJURTG5RO3TGD7ZMIQ6Z4ZZ3SAVYE/
CVE: CVE-2022-2611
Published: 2022-08-12
Description: Inappropriate implementation in Fullscreen API in Google Chrome on Android prior to 104.0.5112.79 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.
CVSS Score: 4.3 (MEDIUM)
References: https://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop.html; https://crbug.com/1320538; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4NMJURTG5RO3TGD7ZMIQ6Z4ZZ3SAVYE/
CVE: CVE-2022-2612
Published: 2022-08-12
Description: Side-channel information leakage in Keyboard input in Google Chrome prior to 104.0.5112.79 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-203
References: https://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop.html; https://crbug.com/1321350; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4NMJURTG5RO3TGD7ZMIQ6Z4ZZ3SAVYE/
CVE: CVE-2022-2613
Published: 2022-08-12
Description: Use after free in Input in Google Chrome on Chrome OS prior to 104.0.5112.79 allowed a remote attacker who convinced a user to enage in specific user interactions to potentially exploit heap corruption via specific UI interactions.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop.html; https://crbug.com/1325256; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4NMJURTG5RO3TGD7ZMIQ6Z4ZZ3SAVYE/
CVE: CVE-2022-2614
Published: 2022-08-12
Description: Use after free in Sign-In Flow in Google Chrome prior to 104.0.5112.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop.html; https://crbug.com/1341907; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4NMJURTG5RO3TGD7ZMIQ6Z4ZZ3SAVYE/
CVE: CVE-2022-2615
Published: 2022-08-12
Description: Insufficient policy enforcement in Cookies in Google Chrome prior to 104.0.5112.79 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-565
References: https://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop.html; https://crbug.com/1268580; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4NMJURTG5RO3TGD7ZMIQ6Z4ZZ3SAVYE/
CVE: CVE-2022-2616
Published: 2022-08-12
Description: Inappropriate implementation in Extensions API in Google Chrome prior to 104.0.5112.79 allowed an attacker who convinced a user to install a malicious extension to spoof the contents of the Omnibox (URL bar) via a crafted Chrome Extension.
CVSS Score: 6.5 (MEDIUM)
References: https://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop.html; https://crbug.com/1302159; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4NMJURTG5RO3TGD7ZMIQ6Z4ZZ3SAVYE/
CVE: CVE-2022-2617
Published: 2022-08-12
Description: Use after free in Extensions API in Google Chrome prior to 104.0.5112.79 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via specific UI interactions.
CVSS Score: 8.8 (HIGH)
CWE: CWE-362
References: https://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop.html; https://crbug.com/1292451; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4NMJURTG5RO3TGD7ZMIQ6Z4ZZ3SAVYE/
CVE: CVE-2022-2618
Published: 2022-08-12
Description: Insufficient validation of untrusted input in Internals in Google Chrome prior to 104.0.5112.79 allowed a remote attacker to bypass download restrictions via a malicious file .
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop.html; https://crbug.com/1308422; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4NMJURTG5RO3TGD7ZMIQ6Z4ZZ3SAVYE/
CVE: CVE-2022-2619
Published: 2022-08-12
Description: Insufficient validation of untrusted input in Settings in Google Chrome prior to 104.0.5112.79 allowed an attacker who convinced a user to install a malicious extension to inject scripts or HTML into a privileged page via a crafted HTML page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-116
References: https://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop.html; https://crbug.com/1332881; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4NMJURTG5RO3TGD7ZMIQ6Z4ZZ3SAVYE/
CVE: CVE-2022-2620
Published: 2022-08-12
Description: Use after free in WebUI in Google Chrome on Chrome OS prior to 104.0.5112.79 allowed a remote attacker who convinced a user to engage in specific user interactions to potentially exploit heap corruption via specific UI interactions.
CVSS Score: 8.8 (HIGH)
CWE: CWE-665
References: https://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop.html; https://crbug.com/1337304; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4NMJURTG5RO3TGD7ZMIQ6Z4ZZ3SAVYE/
CVE: CVE-2022-2621
Published: 2022-08-12
Description: Use after free in Extensions in Google Chrome prior to 104.0.5112.79 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via specific UI interactions.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop.html; https://crbug.com/1323449; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4NMJURTG5RO3TGD7ZMIQ6Z4ZZ3SAVYE/
CVE: CVE-2022-2622
Published: 2022-08-12
Description: Insufficient validation of untrusted input in Safe Browsing in Google Chrome on Windows prior to 104.0.5112.79 allowed a remote attacker to bypass download restrictions via a crafted file.
CVSS Score: 6.5 (MEDIUM)
References: https://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop.html; https://crbug.com/1332392; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4NMJURTG5RO3TGD7ZMIQ6Z4ZZ3SAVYE/
CVE: CVE-2022-2623
Published: 2022-08-12
Description: Use after free in Offline in Google Chrome on Android prior to 104.0.5112.79 allowed a remote attacker who convinced a user to engage in specific user interactions to potentially exploit heap corruption via specific UI interactions.
CVSS Score: 8.8 (HIGH)
CWE: CWE-362
References: https://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop.html; https://crbug.com/1337798; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4NMJURTG5RO3TGD7ZMIQ6Z4ZZ3SAVYE/
CVE: CVE-2022-2624
Published: 2022-08-12
Description: Heap buffer overflow in PDF in Google Chrome prior to 104.0.5112.79 allowed a remote attacker who convinced a user to engage in specific user interactions to potentially exploit heap corruption via a crafted PDF file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop.html; https://crbug.com/1339745; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4NMJURTG5RO3TGD7ZMIQ6Z4ZZ3SAVYE/
CVE: CVE-2022-2800
Published: 2022-08-12
Description: A vulnerability, which was classified as problematic, has been found in SourceCodester Gym Management System. Affected by this issue is some unknown functionality. The manipulation leads to clickjacking. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-206246 is the identifier assigned to this vulnerability.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-451, CWE-1021
References: https://github.com/Blythe-LU/Record4/blob/main/Gym%20management%20system%20project%20-%20ClickJacking%20exists%20on%20multiple%20pages.md; https://vuldb.com/?id.206246; https://github.com/Blythe-LU/Record4/blob/main/Gym%20management%20system%20project%20-%20ClickJacking%20exists%20on%20multiple%20pages.md
CVE: CVE-2022-2801
Published: 2022-08-12
Description: A vulnerability, which was classified as critical, was found in SourceCodester Automated Beer Parlour Billing System. This affects an unknown part of the component Login. The manipulation of the argument username leads to sql injection. It is possible to initiate the attack remotely. The associated identifier of this vulnerability is VDB-206247.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://vuldb.com/?id.206247; https://vuldb.com/?id.206247
CVE: CVE-2022-2802
Published: 2022-08-12
Description: A vulnerability has been found in SourceCodester Gas Agency Management System and classified as critical. This vulnerability affects unknown code of the file gasmark/login.php. The manipulation of the argument username leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-206248.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://img-blog.csdnimg.cn/e1f59036a87b46529b2403445caf85c2.png; https://vuldb.com/?id.206248; https://img-blog.csdnimg.cn/e1f59036a87b46529b2403445caf85c2.png
CVE: CVE-2022-2803
Published: 2022-08-12
Description: A vulnerability was found in SourceCodester Zoo Management System and classified as critical. This issue affects some unknown processing of the file /pages/animals.php. The manipulation of the argument class_id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-206249 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://s1.ax1x.com/2022/08/12/vJ4zHH.png; https://vuldb.com/?id.206249; https://s1.ax1x.com/2022/08/12/vJ4zHH.png
CVE: CVE-2022-2804
Published: 2022-08-12
Description: A vulnerability was found in SourceCodester Zoo Management System. It has been classified as critical. Affected is an unknown function of the file /pages/apply_vacancy.php. The manipulation of the argument filename leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-206250 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-434
References: https://s1.ax1x.com/2022/08/12/vJ5pEd.png; https://vuldb.com/?id.206250; https://s1.ax1x.com/2022/08/12/vJ5pEd.png
CVE: CVE-2022-37397
Published: 2022-08-12
Description: An issue was discovered in the YugabyteDB 2.6.1 when using LDAP-based authentication in YCQL with Microsoft’s Active Directory. When anonymous or unauthenticated LDAP binding is enabled, it allows bypass of authentication with an empty password.
CVSS Score: 8.3 (HIGH)
CWE: CWE-16, CWE-287, CWE-287
References: https://www.yugabyte.com/; https://www.yugabyte.com/
CVE: CVE-2022-38183
Published: 2022-08-12
Description: In Gitea before 1.16.9, it was possible for users to add existing issues to projects. Due to improper access controls, an attacker could assign any issue to any project in Gitea (there was no permission check for fetching the issue). As a result, the attacker would get access to private issue titles.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://blog.gitea.io/2022/07/gitea-1.16.9-is-released/; https://herolab.usd.de/security-advisories/usd-2022-0015/; https://security.gentoo.org/glsa/202210-14
CVE: CVE-2022-35943
Published: 2022-08-12
Description: Shield is an authentication and authorization framework for CodeIgniter 4. This vulnerability may allow [SameSite Attackers](https://canitakeyoursubdomain.name/) to bypass the [CodeIgniter4 CSRF protection](https://codeigniter4.github.io/userguide/libraries/security.html) mechanism with CodeIgniter Shield. For this attack to succeed, the attacker must have direct (or indirect, e.g., XSS) control over a subdomain site (e.g., `https://a.example.com/`) of the target site (e.g., `http://example.com/`). Upgrade to **CodeIgniter v4.2.3 or later** and **Shield v1.0.0-beta.2 or later**. As a workaround: set `Config\Security::$csrfProtection` to `'session,'`remove old session data right after login (immediately after ID and password match) and regenerate CSRF token right after login (immediately after ID and password match)
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-352
References: https://codeigniter4.github.io/userguide/libraries/security.htm; https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite; https://github.com/codeigniter4/shield/security/advisories/GHSA-5hm8-vh6r-2cjq
CVE: CVE-2022-35953
Published: 2022-08-12
Description: BookWyrm is a social network for tracking your reading, talking about books, writing reviews, and discovering what to read next. Some links in BookWyrm may be vulnerable to tabnabbing, a form of phishing that gives attackers an opportunity to redirect a user to a malicious site. The issue was patched in version 0.4.5.
CVSS Score: 7.1 (HIGH)
CWE: CWE-601
References: https://github.com/bookwyrm-social/bookwyrm/security/advisories/GHSA-xq42-mq5w-m24x; https://huntr.dev/bounties/67ca22bd-19c6-466b-955a-b1ee2da0c575/; https://github.com/bookwyrm-social/bookwyrm/security/advisories/GHSA-xq42-mq5w-m24x
CVE: CVE-2022-35956
Published: 2022-08-12
Description: This Rails gem adds two methods to the ActiveRecord::Base class that allow you to update many records on a single database hit, using a case sql statement for it. Before version 0.1.3 `update_by_case` gem used custom sql strings, and it was not sanitized, making it vulnerable to sql injection. Upgrade to version >= 0.1.3 that uses `Arel` instead to construct the resulting sql statement, with sanitized sql.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-89
References: https://github.com/camilova/activerecord-update-by-case/releases/tag/v0.1.3-stable; https://github.com/camilova/activerecord-update-by-case/security/advisories/GHSA-33wh-w4m7-c6r8; https://github.com/camilova/activerecord-update-by-case/releases/tag/v0.1.3-stable
CVE: CVE-2022-35942
Published: 2022-08-12
Description: Improper input validation on the `contains` LoopBack filter may allow for arbitrary SQL injection. When the extended filter property `contains` is permitted to be interpreted by the Postgres connector, it is possible to inject arbitrary SQL which may affect the confidentiality and integrity of data stored on the connected database. A patch was released in version 5.5.1. This affects users who does any of the following: - Connect to the database via the DataSource with `allowExtendedProperties: true` setting OR - Uses the connector's CRUD methods directly OR - Uses the connector's other methods to interpret the LoopBack filter. Users who are unable to upgrade should do the following if applicable: - Remove `allowExtendedProperties: true` DataSource setting - Add `allowExtendedProperties: false` DataSource setting - When passing directly to the connector functions, manually sanitize the user input for the `contains` LoopBack filter beforehand.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-89
References: https://github.com/loopbackio/loopback-connector-postgresql/commit/d57406c6737692a3a106b58a35406290cddb23e5; https://github.com/loopbackio/loopback-connector-postgresql/security/advisories/GHSA-j259-6c58-9m58; https://github.com/loopbackio/loopback-connector-postgresql/commit/d57406c6737692a3a106b58a35406290cddb23e5
CVE: CVE-2022-35949
Published: 2022-08-12
Description: undici is an HTTP/1.1 client, written from scratch for Node.js.`undici` is vulnerable to SSRF (Server-side Request Forgery) when an application takes in **user input** into the `path/pathname` option of `undici.request`. If a user specifies a URL such as `http://127.0.0.1` or `//127.0.0.1` ```js const undici = require("undici") undici.request({origin: "http://example.com", pathname: "//127.0.0.1"}) ``` Instead of processing the request as `http://example.org//127.0.0.1` (or `http://example.org/http://127.0.0.1` when `http://127.0.0.1 is used`), it actually processes the request as `http://127.0.0.1/` and sends it to `http://127.0.0.1`. If a developer passes in user input into `path` parameter of `undici.request`, it can result in an _SSRF_ as they will assume that the hostname cannot change, when in actual fact it can change because the specified path parameter is combined with the base URL. This issue was fixed in `undici@5.8.1`. The best workaround is to validate user input before passing it to the `undici.request` call.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-918
References: https://github.com/nodejs/undici/commit/124f7ebf705366b2e1844dff721928d270f87895; https://github.com/nodejs/undici/releases/tag/v5.8.2; https://github.com/nodejs/undici/security/advisories/GHSA-8qr4-xgw6-wmr3
CVE: CVE-2022-2116
Published: 2022-08-15
Description: The Contact Form DB WordPress plugin before 1.8.0 does not sanitise and escape some parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/01568da4-2ecf-4cf9-8030-31868ce0a87a; https://wpscan.com/vulnerability/01568da4-2ecf-4cf9-8030-31868ce0a87a