deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-33973
Published: 2022-11-11
Description: Improper access control in the Intel(R) WAPI Security software for Windows 10/11 before version 22.2150.0.1 may allow an authenticated user to potentially enable information disclosure via local access.
CVSS Score: 3.3 (LOW)
CWE: CWE-922
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00720.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00720.html
CVE: CVE-2022-34152
Published: 2022-11-11
Description: Improper input validation in BIOS firmware for some Intel(R) NUC Boards, Intel(R) NUC Kits before version TY0070 may allow a privileged user to potentially enable escalation of privilege via local access.
CVSS Score: 7.7 (HIGH)
CWE: CWE-20, CWE-20
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00752.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00752.html
CVE: CVE-2022-35276
Published: 2022-11-11
Description: Improper access control in BIOS firmware for some Intel(R) NUC 8 Compute Elements before version CBWHL357.0096 may allow a privileged user to potentially enable escalation of privilege via local access.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00752.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00752.html
CVE: CVE-2022-36349
Published: 2022-11-11
Description: Insecure default variable initialization in BIOS firmware for some Intel(R) NUC Boards and Intel(R) NUC Kits before version MYi30060 may allow an authenticated user to potentially enable denial of service via local access.
CVSS Score: 5.2 (MEDIUM)
CWE: CWE-1188
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00752.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00752.html
CVE: CVE-2022-36367
Published: 2022-11-11
Description: Incorrect default permissions in the Intel(R) Support Android application before version v22.02.28 may allow a privileged user to potentially enable information disclosure via local access.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-276, CWE-276
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00740.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00740.html
CVE: CVE-2022-36370
Published: 2022-11-11
Description: Improper authentication in BIOS firmware for some Intel(R) NUC Boards and Intel(R) NUC Kits before version MYi30060 may allow a privileged user to potentially enable escalation of privilege via local access.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287, CWE-287
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00752.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00752.html
CVE: CVE-2022-36377
Published: 2022-11-11
Description: Insecure inherited permissions in some Intel(R) Wireless Adapter Driver installation software for Intel(R) NUC Kits & Mini PCs before version 22.190.0.3 for Windows may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-277, CWE-276
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00908.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00908.html
CVE: CVE-2022-36380
Published: 2022-11-11
Description: Uncontrolled search path in the installer software for some Intel(r) NUC Kit Wireless Adapter drivers for Windows 10 before version 22.40 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-427, CWE-427
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00747.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00747.html
CVE: CVE-2022-36384
Published: 2022-11-11
Description: Unquoted search path in the installer software for some Intel(r) NUC Kit Wireless Adapter drivers for Windows 10 before version 22.40 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-428, CWE-428
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00747.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00747.html
CVE: CVE-2022-36400
Published: 2022-11-11
Description: Path traversal in the installer software for some Intel(r) NUC Kit Wireless Adapter drivers for Windows 10 before version 22.40 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00747.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00747.html
CVE: CVE-2022-36789
Published: 2022-11-11
Description: Improper access control in BIOS firmware for some Intel(R) NUC 10 Performance Kits and Intel(R) NUC 10 Performance Mini PCs before version FNCML357.0053 may allow a privileged user to potentially enable escalation of privilege via local access.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00752.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00752.html
CVE: CVE-2022-37334
Published: 2022-11-11
Description: Improper initialization in BIOS firmware for some Intel(R) NUC 11 Pro Kits and Intel(R) NUC 11 Pro Boards before version TNTGL357.0064 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS Score: 7.8 (HIGH)
CWE: CWE-665, CWE-665
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00752.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00752.html
CVE: CVE-2022-37345
Published: 2022-11-11
Description: Improper authentication in BIOS firmware[A1] for some Intel(R) NUC Kits before version RY0386 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS Score: 7.8 (HIGH)
CWE: CWE-287, CWE-287
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00752.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00752.html
CVE: CVE-2022-38099
Published: 2022-11-11
Description: Improper input validation in BIOS firmware for some Intel(R) NUC 11 Compute Elements before version EBTGL357.0065 may allow a privileged user to potentially enable escalation of privilege via local access.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00752.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00752.html
CVE: CVE-2022-3955
Published: 2022-11-11
Description: A vulnerability was found in tholum crm42. It has been rated as critical. This issue affects some unknown processing of the file crm42\class\class.user.php of the component Login. The manipulation of the argument user_name leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-213461 was assigned to this vulnerability.
CVSS Score: 7.3 (HIGH)
CWE: CWE-707, CWE-89
References: https://github.com/tholum/crm42/issues/1; https://vuldb.com/?id.213461; https://github.com/tholum/crm42/issues/1
CVE: CVE-2022-3956
Published: 2022-11-11
Description: A vulnerability classified as critical has been found in tsruban HHIMS 2.1. Affected is an unknown function of the component Patient Portrait Handler. The manipulation of the argument PID leads to sql injection. It is possible to launch the attack remotely. It is recommended to apply a patch to fix this issue. VDB-213462 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-707, CWE-89
References: https://github.com/tsruban/HHIMS/issues/1; https://vuldb.com/?id.213462; https://github.com/tsruban/HHIMS/issues/1
CVE: CVE-2022-3957
Published: 2022-11-11
Description: A vulnerability classified as problematic was found in GPAC. Affected by this vulnerability is the function svg_parse_preserveaspectratio of the file scenegraph/svg_attributes.c of the component SVG Parser. The manipulation leads to memory leak. The attack can be launched remotely. The name of the patch is 2191e66aa7df750e8ef01781b1930bea87b713bb. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-213463.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-404, CWE-401
References: https://github.com/gpac/gpac/commit/2191e66aa7df750e8ef01781b1930bea87b713bb; https://vuldb.com/?id.213463; https://www.debian.org/security/2023/dsa-5411
CVE: CVE-2022-3959
Published: 2022-11-11
Description: A vulnerability, which was classified as problematic, has been found in drogon up to 1.8.1. Affected by this issue is some unknown functionality of the component Session Hash Handler. The manipulation leads to small space of random values. The attack may be launched remotely. Upgrading to version 1.8.2 is able to address this issue. The name of the patch is c0d48da99f66aaada17bcd28b07741cac8697647. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-213464.
CVSS Score: 3.1 (LOW)
CWE: CWE-330, CWE-330
References: https://github.com/drogonframework/drogon/commit/c0d48da99f66aaada17bcd28b07741cac8697647; https://github.com/drogonframework/drogon/pull/1433; https://github.com/drogonframework/drogon/releases/tag/v1.8.2
CVE: CVE-2022-34331
Published: 2022-11-11
Description: After performing a sequence of Power  FW950, FW1010 maintenance operations a SRIOV network adapter can be improperly configured leading to desired VEPA configuration being disabled.  IBM X-Force ID:  229695.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-287, CWE-287
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/229695; https://www.ibm.com/support/pages/node/6833632; https://exchange.xforce.ibmcloud.com/vulnerabilities/229695
CVE: CVE-2022-31772
Published: 2022-11-11
Description: 
IBM MQ 8.0, 9.0 LTS, 9.1 CD, 9.1 LTS, 9.2 CD, and 9.2 LTS could allow an authenticated and authorized user to cause a denial of service to the MQTT channels. IBM X-Force ID: 228335.


CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20, CWE-20
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/228335; https://www.ibm.com/support/pages/node/6833806; https://exchange.xforce.ibmcloud.com/vulnerabilities/228335
CVE: CVE-2022-36776
Published: 2022-11-11
Description: IBM Cloud Pak for Security (CP4S) 1.10.0.0 79and 1.10.2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.  IBM X-Force ID:  233663.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/233663; https://www.ibm.com/support/pages/node/6833574; https://exchange.xforce.ibmcloud.com/vulnerabilities/233663
CVE: CVE-2022-38387
Published: 2022-11-11
Description: IBM Cloud Pak for Security (CP4S) 1.10.0.0 through 1.10.2.0 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request.  IBM X-Force ID:  233786.
CVSS Score: 7.1 (HIGH)
CWE: CWE-78, CWE-78
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/233786; https://www.ibm.com/support/pages/node/6833584; https://exchange.xforce.ibmcloud.com/vulnerabilities/233786
CVE: CVE-2022-40750
Published: 2022-11-11
Description: IBM WebSphere Application Server 8.5, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.  IBM X-Force ID:  236588.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/236588; https://www.ibm.com/support/pages/node/6833552; https://exchange.xforce.ibmcloud.com/vulnerabilities/236588
CVE: CVE-2022-41882
Published: 2022-11-11
Description: The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server with your computer. In version 3.6.0, if a user received a malicious file share and has it synced locally or the virtual filesystem enabled and clicked a nc://open/ link it will open the default editor for the file type of the shared file, which on Windows can also sometimes mean that a file depending on the type, e.g. "vbs", is being executed. It is recommended that the Nextcloud Desktop client is upgraded to version 3.6.1. As a workaround, users can block the Nextcloud Desktop client 3.6.0 by setting the `minimum.supported.desktop.version` system config to `3.6.1` on the server, so new files designed to use this attack vector are not downloaded anymore. Already existing files can still be used. Another workaround would be to enforce shares to be accepted by setting the `sharing.force_share_accept` system config to `true` on the server, so new files designed to use this attack vector are not downloaded anymore. Already existing shares can still be abused.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-94, CWE-94
References: https://github.com/nextcloud/desktop/pull/5039; https://github.com/nextcloud/desktop/releases/tag/v3.6.1; https://github.com/nextcloud/security-advisories/security/advisories/GHSA-3w86-rm38-8w63
CVE: CVE-2022-41904
Published: 2022-11-11
Description: Element iOS is an iOS Matrix client provided by Element. It is based on MatrixSDK. Prior to version 1.9.7, events encrypted using Megolm for which trust could not be established did not get decorated accordingly (with warning shields). Therefore a malicious homeserver could inject messages into the room without the user being alerted that the messages were not sent by a verified group member, even if the user has previously verified all group members. This issue has been patched in Element iOS 1.9.7. There are currently no known workarounds.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-357
References: https://github.com/vector-im/element-ios/releases/tag/v1.9.7; https://github.com/vector-im/element-ios/security/advisories/GHSA-fm8m-99j7-323g; https://github.com/vector-im/element-ios/releases/tag/v1.9.7
CVE: CVE-2022-41906
Published: 2022-11-11
Description: OpenSearch Notifications is a notifications plugin for OpenSearch that enables other plugins to send notifications via Email, Slack, Amazon Chime, Custom web-hook etc channels. A potential SSRF issue in OpenSearch Notifications Plugin starting in 2.0.0 and prior to 2.2.1 could allow an existing privileged user to enumerate listening services or interact with configured resources via HTTP requests exceeding the Notification plugin's intended scope. OpenSearch 2.2.1+ contains the fix for this issue. There are currently no recommended workarounds. 

CVSS Score: 8.7 (HIGH)
CWE: CWE-918, CWE-918
References: https://github.com/opensearch-project/notifications/pull/496; https://github.com/opensearch-project/notifications/pull/507; https://github.com/opensearch-project/notifications/security/advisories/GHSA-pfc4-3436-jgrw
CVE: CVE-2022-45182
Published: 2022-11-11
Description: Pi-Star_DV_Dash (for Pi-Star DV) before 5aa194d mishandles the module parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-233
References: https://github.com/AndyTaylorTweet/Pi-Star_DV_Dash/commit/0ad7d00210fc2c0eb7073e5ed429ac265ccfebbd; https://github.com/AndyTaylorTweet/Pi-Star_DV_Dash/commit/1e46533f4051648bc40478d99201f19241bbaa41; https://github.com/AndyTaylorTweet/Pi-Star_DV_Dash/commit/5aa194df3dfc92cc21f6604bbda32268f4a624ce
CVE: CVE-2022-41905
Published: 2022-11-11
Description: WsgiDAV is a generic and extendable WebDAV server based on WSGI. Implementations using this library with directory browsing enabled may be susceptible to Cross Site Scripting (XSS) attacks. This issue has been patched, users can upgrade to version 4.1.0. As a workaround, set `dir_browser.enable = False` in the configuration.
CVSS Score: 8.2 (HIGH)
CWE: CWE-79, CWE-79
References: https://github.com/mar10/wsgidav/commit/e9606ab0f42f4c1a6611bc3c52de299b0aba7726; https://github.com/mar10/wsgidav/security/advisories/GHSA-xx6g-jj35-pxjv; https://github.com/mar10/wsgidav/commit/e9606ab0f42f4c1a6611bc3c52de299b0aba7726
CVE: CVE-2022-45193
Published: 2022-11-12
Description: CBRN-Analysis before 22 has weak file permissions under Public Profile, leading to disclosure of file contents or privilege escalation.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-732, CWE-732
References: https://zigrin.com/advisories/cbrn-analysis-unprotected-storage-of-application-files/; https://zigrin.com/advisories/cbrn-analysis-unprotected-storage-of-application-files/
CVE: CVE-2022-45194
Published: 2022-11-12
Description: CBRN-Analysis before 22 allows XXE attacks via am mws XML document, leading to NTLMv2-SSP hash disclosure.
CVSS Score: 3.8 (LOW)
CWE: CWE-611, CWE-611
References: https://zigrin.com/advisories/cbrn-analysis-external-xml-entity-injection/; https://zigrin.com/advisories/cbrn-analysis-external-xml-entity-injection/
CVE: CVE-2022-40773
Published: 2022-11-12
Description: Zoho ManageEngine ServiceDesk Plus MSP before 10609 and SupportCenter Plus before 11025 are vulnerable to privilege escalation. This allows users to obtain sensitive data during an exportMickeyList export of requests from the list view.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20, CWE-20
References: https://www.manageengine.com/products/service-desk-msp/cve-2022-40773.html; https://www.zerodayinitiative.com/advisories/ZDI-22-1490/; https://www.manageengine.com/products/service-desk-msp/cve-2022-40773.html
CVE: CVE-2022-41339
Published: 2022-11-12
Description: In Zoho ManageEngine Mobile Device Manager Plus before 10.1.2207.5, the User Administration module allows privilege escalation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://www.manageengine.com/mobile-device-management/kb/CVE-2022-41339.html; https://www.manageengine.com/mobile-device-management/kb/CVE-2022-41339.html
CVE: CVE-2022-43671
Published: 2022-11-12
Description: Zoho ManageEngine Password Manager Pro before 12122, PAM360 before 5711, and Access Manager Plus before 4306 allow SQL Injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://www.manageengine.com/products/passwordmanagerpro/advisory/cve-2022-43671.html; https://www.manageengine.com/products/passwordmanagerpro/advisory/cve-2022-43671.html
CVE: CVE-2022-43672
Published: 2022-11-12
Description: Zoho ManageEngine Password Manager Pro before 12122, PAM360 before 5711, and Access Manager Plus before 4306 allow SQL Injection (in a different software component relative to CVE-2022-43671.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://www.manageengine.com/products/passwordmanagerpro/advisory/cve-2022-43672.html; https://www.manageengine.com/products/passwordmanagerpro/advisory/cve-2022-43672.html
CVE: CVE-2022-38650
Published: 2022-11-12
Description: A remote unauthenticated insecure deserialization vulnerability exists in VMware Hyperic Server 5.8.6. Exploitation of this vulnerability enables a malicious party to run arbitrary code or malware within Hyperic Server and the host operating system with the privileges of the Hyperic server process. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-502
References: https://www.cyber.gov.au/acsc/view-all-content/alerts/multiple-vulnerabilities-vmware-vrealize-hyperic-monitoring-and-performance-management-product; https://www.cyber.gov.au/acsc/view-all-content/alerts/multiple-vulnerabilities-vmware-vrealize-hyperic-monitoring-and-performance-management-product
CVE: CVE-2022-38651
Published: 2022-11-12
Description: A security filter misconfiguration exists in VMware Hyperic Server 5.8.6. Exploitation of this vulnerability enables a malicious party to bypass some authentication requirements when issuing requests to Hyperic Server. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-862
References: https://www.cyber.gov.au/acsc/view-all-content/alerts/multiple-vulnerabilities-vmware-vrealize-hyperic-monitoring-and-performance-management-product; https://www.cyber.gov.au/acsc/view-all-content/alerts/multiple-vulnerabilities-vmware-vrealize-hyperic-monitoring-and-performance-management-product
CVE: CVE-2022-38652
Published: 2022-11-12
Description: A remote insecure deserialization vulnerability exixsts in VMWare Hyperic Agent 5.8.6. Exploitation of this vulnerability enables a malicious authenticated user to run arbitrary code or malware within a Hyperic Agent instance and its host operating system with the privileges of the Hyperic Agent process (often SYSTEM on Windows platforms). NOTE: prior exploitation of CVE-2022-38650 results in the disclosure of the authentication material required to exploit this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-502
References: https://www.cyber.gov.au/acsc/view-all-content/alerts/multiple-vulnerabilities-vmware-vrealize-hyperic-monitoring-and-performance-management-product; https://www.cyber.gov.au/acsc/view-all-content/alerts/multiple-vulnerabilities-vmware-vrealize-hyperic-monitoring-and-performance-management-product
CVE: CVE-2022-45188
Published: 2022-11-12
Description: Netatalk through 3.1.13 has an afp_getappl heap-based buffer overflow resulting in code execution via a crafted .appl file. This provides remote root access on some platforms such as FreeBSD (used for TrueNAS).
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-122
References: https://lists.debian.org/debian-lts-announce/2023/05/msg00018.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EZYWSGVA6WXREMB6PV56HAHKU7R6KPOP/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GEAFLA5L2SHOUFBAGUXIF2TZLGBXGJKT/
CVE: CVE-2022-45195
Published: 2022-11-12
Description: SimpleXMQ before 3.4.0, as used in SimpleX Chat before 4.2, does not apply a key derivation function to intended data, which can interfere with forward secrecy and can have other impacts if there is a compromise of a single private key. This occurs in the X3DH key exchange for the double ratchet protocol.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-327, CWE-327
References: https://github.com/simplex-chat/simplexmq/compare/v3.3.0...v3.4.0; https://github.com/simplex-chat/simplexmq/pull/548; https://github.com/trailofbits/publications/blob/master/reviews/SimpleXChat.pdf
CVE: CVE-2022-45196
Published: 2022-11-12
Description: Hyperledger Fabric 2.3 allows attackers to cause a denial of service (orderer crash) by repeatedly sending a crafted channel tx with the same Channel name. NOTE: the official Fabric with Raft prevents exploitation via a locking mechanism and a check for names that already exist.
CVSS Score: 7.5 (HIGH)
CWE: CWE-670, CWE-670
References: https://github.com/SmartBFT-Go/fabric/issues/286; https://github.com/hyperledger/fabric/pull/2934; https://github.com/SmartBFT-Go/fabric/issues/286
CVE: CVE-2022-3963
Published: 2022-11-12
Description: A vulnerability was found in gnuboard5. It has been classified as problematic. Affected is an unknown function of the file bbs/faq.php of the component FAQ Key ID Handler. The manipulation of the argument fm_id leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 5.5.8.2.1 is able to address this issue. The name of the patch is ba062ca5b62809106d5a2f7df942ffcb44ecb5a9. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-213540.
CVSS Score: 3.5 (LOW)
CWE: CWE-707, CWE-79
References: https://github.com/gnuboard/gnuboard5/commit/ba062ca5b62809106d5a2f7df942ffcb44ecb5a9; https://vuldb.com/?id.213540; https://github.com/gnuboard/gnuboard5/commit/ba062ca5b62809106d5a2f7df942ffcb44ecb5a9