deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-28144
Published: 2022-03-29
Description: Jenkins Proxmox Plugin 0.7.0 and earlier does not perform a permission check in several HTTP endpoints, allowing attackers with Overall/Read permission to connect to an attacker-specified host using attacker-specified username and password (perform a connection test), disable SSL/TLS validation for the entire Jenkins controller JVM as part of the connection test (see CVE-2022-28142), and test a rollback with attacker-specified parameters.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: http://www.openwall.com/lists/oss-security/2022/03/29/1; https://www.jenkins.io/security/advisory/2022-03-29/#SECURITY-2082; http://www.openwall.com/lists/oss-security/2022/03/29/1
CVE: CVE-2022-28145
Published: 2022-03-29
Description: Jenkins Continuous Integration with Toad Edge Plugin 2.3 and earlier does not apply Content-Security-Policy headers to report files it serves, resulting in a stored cross-site scripting (XSS) exploitable by attackers with Item/Configure permission or otherwise able to control report contents.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2022/03/29/1; https://www.jenkins.io/security/advisory/2022-03-29/#SECURITY-1892; http://www.openwall.com/lists/oss-security/2022/03/29/1
CVE: CVE-2022-28146
Published: 2022-03-29
Description: Jenkins Continuous Integration with Toad Edge Plugin 2.3 and earlier allows attackers with Item/Configure permission to read arbitrary files on the Jenkins controller by specifying an input folder on the Jenkins controller as a parameter to its build steps.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: http://www.openwall.com/lists/oss-security/2022/03/29/1; https://www.jenkins.io/security/advisory/2022-03-29/#SECURITY-2633; http://www.openwall.com/lists/oss-security/2022/03/29/1
CVE: CVE-2022-28147
Published: 2022-03-29
Description: A missing permission check in Jenkins Continuous Integration with Toad Edge Plugin 2.3 and earlier allows attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: http://www.openwall.com/lists/oss-security/2022/03/29/1; https://www.jenkins.io/security/advisory/2022-03-29/#SECURITY-2635; http://www.openwall.com/lists/oss-security/2022/03/29/1
CVE: CVE-2022-28148
Published: 2022-03-29
Description: The file browser in Jenkins Continuous Integration with Toad Edge Plugin 2.3 and earlier may interpret some paths to files as absolute on Windows, resulting in a path traversal vulnerability allowing attackers with Item/Read permission to obtain the contents of arbitrary files on Windows controllers.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: http://www.openwall.com/lists/oss-security/2022/03/29/1; https://www.jenkins.io/security/advisory/2022-03-29/#SECURITY-2654; http://www.openwall.com/lists/oss-security/2022/03/29/1
CVE: CVE-2022-28149
Published: 2022-03-29
Description: Jenkins Job and Node ownership Plugin 0.13.0 and earlier does not escape the names of the secondary owners, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2022/03/29/1; https://www.jenkins.io/security/advisory/2022-03-29/#SECURITY-2285; http://www.openwall.com/lists/oss-security/2022/03/29/1
CVE: CVE-2022-28150
Published: 2022-03-29
Description: A cross-site request forgery (CSRF) vulnerability in Jenkins Job and Node ownership Plugin 0.13.0 and earlier allows attackers to change the owners and item-specific permissions of a job.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://www.openwall.com/lists/oss-security/2022/03/29/1; https://www.jenkins.io/security/advisory/2022-03-29/#SECURITY-2062%20%281%29; http://www.openwall.com/lists/oss-security/2022/03/29/1
CVE: CVE-2022-28151
Published: 2022-03-29
Description: A missing permission check in Jenkins Job and Node ownership Plugin 0.13.0 and earlier allows attackers with Item/Read permission to change the owners and item-specific permissions of a job.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: http://www.openwall.com/lists/oss-security/2022/03/29/1; https://www.jenkins.io/security/advisory/2022-03-29/#SECURITY-2062%20%281%29; http://www.openwall.com/lists/oss-security/2022/03/29/1
CVE: CVE-2022-28152
Published: 2022-03-29
Description: A cross-site request forgery (CSRF) vulnerability in Jenkins Job and Node ownership Plugin 0.13.0 and earlier allows attackers to restore the default ownership of a job.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: http://www.openwall.com/lists/oss-security/2022/03/29/1; https://www.jenkins.io/security/advisory/2022-03-29/#SECURITY-2062%20%282%29; http://www.openwall.com/lists/oss-security/2022/03/29/1
CVE: CVE-2022-28153
Published: 2022-03-29
Description: Jenkins SiteMonitor Plugin 0.6 and earlier does not escape URLs of sites to monitor in tooltips, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2022/03/29/1; https://www.jenkins.io/security/advisory/2022-03-29/#SECURITY-1932; http://www.openwall.com/lists/oss-security/2022/03/29/1
CVE: CVE-2022-28154
Published: 2022-03-29
Description: Jenkins Coverage/Complexity Scatter Plot Plugin 1.1.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVSS Score: 8.1 (HIGH)
CWE: CWE-611
References: http://www.openwall.com/lists/oss-security/2022/03/29/1; https://www.jenkins.io/security/advisory/2022-03-29/#SECURITY-1899; http://www.openwall.com/lists/oss-security/2022/03/29/1
CVE: CVE-2022-28155
Published: 2022-03-29
Description: Jenkins Pipeline: Phoenix AutoTest Plugin 1.3 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVSS Score: 8.1 (HIGH)
CWE: CWE-611
References: http://www.openwall.com/lists/oss-security/2022/03/29/1; https://www.jenkins.io/security/advisory/2022-03-29/#SECURITY-1897; http://www.openwall.com/lists/oss-security/2022/03/29/1
CVE: CVE-2022-28156
Published: 2022-03-29
Description: Jenkins Pipeline: Phoenix AutoTest Plugin 1.3 and earlier allows attackers with Item/Configure permission to copy arbitrary files and directories from the Jenkins controller to the agent workspace.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: http://www.openwall.com/lists/oss-security/2022/03/29/1; https://www.jenkins.io/security/advisory/2022-03-29/#SECURITY-2683; http://www.openwall.com/lists/oss-security/2022/03/29/1
CVE: CVE-2022-28157
Published: 2022-03-29
Description: Jenkins Pipeline: Phoenix AutoTest Plugin 1.3 and earlier allows attackers with Item/Configure permission to upload arbitrary files from the Jenkins controller via FTP to an attacker-specified FTP server.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: http://www.openwall.com/lists/oss-security/2022/03/29/1; https://www.jenkins.io/security/advisory/2022-03-29/#SECURITY-2684; http://www.openwall.com/lists/oss-security/2022/03/29/1
CVE: CVE-2022-28158
Published: 2022-03-29
Description: A missing permission check in Jenkins Pipeline: Phoenix AutoTest Plugin 1.3 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: http://www.openwall.com/lists/oss-security/2022/03/29/1; https://www.jenkins.io/security/advisory/2022-03-29/#SECURITY-2685; http://www.openwall.com/lists/oss-security/2022/03/29/1
CVE: CVE-2022-28159
Published: 2022-03-29
Description: Jenkins Tests Selector Plugin 1.3.3 and earlier does not escape the Properties File Path option for Choosing Tests parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2022/03/29/1; https://www.jenkins.io/security/advisory/2022-03-29/#SECURITY-2262; http://www.openwall.com/lists/oss-security/2022/03/29/1
CVE: CVE-2022-28160
Published: 2022-03-29
Description: Jenkins Tests Selector Plugin 1.3.3 and earlier allows users with Item/Configure permission to read arbitrary files on the Jenkins controller.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-668
References: http://www.openwall.com/lists/oss-security/2022/03/29/1; https://www.jenkins.io/security/advisory/2022-03-29/#SECURITY-2338; http://www.openwall.com/lists/oss-security/2022/03/29/1
CVE: CVE-2021-22572
Published: 2022-03-29
Description: On unix-like systems, the system temporary directory is shared between all users on that system. The root cause is File.createTempFile creates files in the the system temporary directory with world readable permissions. Any sensitive information written to theses files is visible to all other local users on unix-like systems. We recommend upgrading past commit https://github.com/google/data-transfer-project/pull/969
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-377, CWE-668
References: https://github.com/JLLeitschuh/security-research/security/advisories/GHSA-22c6-wcjm-qfjg; https://github.com/google/data-transfer-project/pull/969; https://github.com/JLLeitschuh/security-research/security/advisories/GHSA-22c6-wcjm-qfjg
CVE: CVE-2022-1055
Published: 2022-03-29
Description: A use-after-free exists in the Linux Kernel in tc_new_tfilter that could allow a local attacker to gain privilege escalation. The exploit requires unprivileged user namespaces. We recommend upgrading past commit 04c2a47ffb13c29778e2a14e414ad4cb5a5db4b5
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: http://packetstormsecurity.com/files/167386/Kernel-Live-Patch-Security-Notice-LSN-0086-1.html; https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=04c2a47ffb13c29778e2a14e414ad4cb5a5db4b5; https://kernel.dance/#04c2a47ffb13c29778e2a14e414ad4cb5a5db4b5
CVE: CVE-2021-43701
Published: 2022-03-29
Description: CSZ CMS 1.2.9 has a Time and Boolean-based Blind SQL Injection vulnerability in the endpoint /admin/export/getcsv/article_db, via the fieldS[] and orderby parameters.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://packetstormsecurity.com/files/166535/CSZ-CMS-1.2.9-SQL-Injection.html; https://github.com/cskaza/cszcms/issues/31; https://www.exploit-db.com/exploits/50846
CVE: CVE-2021-44081
Published: 2022-03-29
Description: A buffer overflow vulnerability exists in the AMF of open5gs 2.1.4. When the length of MSIN in Supi exceeds 24 characters, it leads to AMF denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://github.com/open5gs/open5gs/issues/1206; https://github.com/open5gs/open5gs/issues/1206
CVE: CVE-2022-0343
Published: 2022-03-29
Description: A local attacker, as a different local user, may be able to send a HTTP request to 127.0.0.1:10000 after the user (typically a developer) manually invoked the ./tools/run-dev-server script. It is recommended to upgrade to any version beyond 24.2
CVSS Score: 3.3 (LOW)
CWE: CWE-275
References: https://android-review.googlesource.com/c/platform/external/perfetto/+/1999296/; https://android-review.googlesource.com/c/platform/external/perfetto/+/1999296/
CVE: CVE-2022-0923
Published: 2022-03-29
Description: Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability that exists in HandlerDialog_KID.ashx. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database contents, and execute system commands.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-081-01; https://www.cisa.gov/uscert/ics/advisories/icsa-22-081-01
CVE: CVE-2022-1050
Published: 2022-03-29
Description: A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device. This flaw allows a crafted guest driver to execute HW commands when shared buffers are not yet allocated, potentially leading to a use-after-free condition.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://bugzilla.redhat.com/show_bug.cgi?id=2069625; https://lists.debian.org/debian-lts-announce/2023/03/msg00013.html; https://bugzilla.redhat.com/show_bug.cgi?id=2069625
CVE: CVE-2022-22934
Published: 2022-03-29
Description: An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. Salt Masters do not sign pillar data with the minion’s public key, which can result in attackers substituting arbitrary pillar data.
CVSS Score: 8.8 (HIGH)
References: https://github.com/saltstack/salt/releases%2C; https://repo.saltproject.io/; https://saltproject.io/security_announcements/salt-security-advisory-release/%2C
CVE: CVE-2022-22935
Published: 2022-03-29
Description: An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. A minion authentication denial of service can cause a MiTM attacker to force a minion process to stop by impersonating a master.
CVSS Score: 3.7 (LOW)
CWE: CWE-287, CWE-287
References: https://github.com/saltstack/salt/releases%2C; https://repo.saltproject.io/; https://saltproject.io/security_announcements/salt-security-advisory-release/%2C
CVE: CVE-2022-22936
Published: 2022-03-29
Description: An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. Job publishes and file server replies are susceptible to replay attacks, which can result in an attacker replaying job publishes causing minions to run old jobs. File server replies can also be re-played. A sufficient craft attacker could gain root access on minion under certain scenarios.
CVSS Score: 8.8 (HIGH)
CWE: CWE-294, CWE-294
References: https://github.com/saltstack/salt/releases%2C; https://repo.saltproject.io/; https://saltproject.io/security_announcements/salt-security-advisory-release/%2C
CVE: CVE-2022-22941
Published: 2022-03-29
Description: An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. When configured as a Master-of-Masters, with a publisher_acl, if a user configured in the publisher_acl targets any minion connected to the Syndic, the Salt Master incorrectly interpreted no valid targets as valid, allowing configured users to target any of the minions connected to the syndic with their configured commands. This requires a syndic master combined with publisher_acl configured on the Master-of-Masters, allowing users specified in the publisher_acl to bypass permissions, publishing authorized commands to any configured minion.
CVSS Score: 8.8 (HIGH)
CWE: CWE-732, CWE-732
References: https://github.com/saltstack/salt/releases%2C; https://repo.saltproject.io/; https://saltproject.io/security_announcements/salt-security-advisory-release/%2C
CVE: CVE-2022-25347
Published: 2022-03-29
Description: Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) is vulnerable to path traversal attacks, which may allow an attacker to write arbitrary files to locations on the file system.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-37, CWE-22
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-081-01; https://www.cisa.gov/uscert/ics/advisories/icsa-22-081-01
CVE: CVE-2022-25880
Published: 2022-03-29
Description: Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in HandlerTag_KID.ashx. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database contents, and execute system commands.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-081-01; https://www.cisa.gov/uscert/ics/advisories/icsa-22-081-01
CVE: CVE-2022-25980
Published: 2022-03-29
Description: Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability that exists in HandlerCommon.ashx. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database contents, and execute system commands.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-081-01; https://www.cisa.gov/uscert/ics/advisories/icsa-22-081-01
CVE: CVE-2022-26013
Published: 2022-03-29
Description: Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability that exists in DIAE_dmdsetHandler.ashx. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database contents, and execute system commands.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-081-01; https://www.cisa.gov/uscert/ics/advisories/icsa-22-081-01
CVE: CVE-2022-26059
Published: 2022-03-29
Description: Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability that exists in GetQueryData. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database contents, and execute system commands.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-081-01; https://www.cisa.gov/uscert/ics/advisories/icsa-22-081-01
CVE: CVE-2022-26065
Published: 2022-03-29
Description: Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in GetLatestDemandNode. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database contents, and execute system commands.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-081-01; https://www.cisa.gov/uscert/ics/advisories/icsa-22-081-01
CVE: CVE-2022-26069
Published: 2022-03-29
Description: Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability that exists in HandlerPage_KID.ashx. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database contents, and execute system commands.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-081-01; https://www.cisa.gov/uscert/ics/advisories/icsa-22-081-01
CVE: CVE-2022-26338
Published: 2022-03-29
Description: Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in HandlerPageP_KID.ashx. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database contents, and execute system commands.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-081-01; https://www.cisa.gov/uscert/ics/advisories/icsa-22-081-01
CVE: CVE-2022-26349
Published: 2022-03-29
Description: Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability that exists in DIAE_eccoefficientHandler.ashx. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database contents, and execute system commands.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-081-01; https://www.cisa.gov/uscert/ics/advisories/icsa-22-081-01
CVE: CVE-2022-26514
Published: 2022-03-29
Description: Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability that exists in DIAE_tagHandler.ashx. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database contents, and execute system commands.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-081-01; https://www.cisa.gov/uscert/ics/advisories/icsa-22-081-01
CVE: CVE-2022-26666
Published: 2022-03-29
Description: Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in HandlerECC.ashx. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database contents, and execute system commands.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-081-01; https://www.cisa.gov/uscert/ics/advisories/icsa-22-081-01
CVE: CVE-2022-26667
Published: 2022-03-29
Description: Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability that exists in GetDemandAnalysisData. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database contents, and execute system commands.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-081-01; https://www.cisa.gov/uscert/ics/advisories/icsa-22-081-01
CVE: CVE-2022-26836
Published: 2022-03-29
Description: Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability that exists in HandlerExport.ashx/Calendar. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database contents, and execute system commands.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-081-01; https://www.cisa.gov/uscert/ics/advisories/icsa-22-081-01
CVE: CVE-2022-26839
Published: 2022-03-29
Description: Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) is vulnerable to an incorrect default permission in the DIAEnergie application, which may allow an attacker to plant new files (such as DLLs) or replace existing executable files.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276, CWE-276
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-081-01; https://www.cisa.gov/uscert/ics/advisories/icsa-22-081-01
CVE: CVE-2022-26887
Published: 2022-03-29
Description: Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in DIAE_loopmapHandler.ashx. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database contents, and execute system commands.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-081-01; https://www.cisa.gov/uscert/ics/advisories/icsa-22-081-01
CVE: CVE-2022-27175
Published: 2022-03-29
Description: Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability that exists in GetCalcTagList. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database contents, and execute system commands.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-081-01; https://www.cisa.gov/uscert/ics/advisories/icsa-22-081-01
CVE: CVE-2021-42970
Published: 2022-03-29
Description: Cross Site Scripting (XSS) vulnerability exists in cxuucms v3 via the imgurl of /feedback/post/ content parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/cbkhwx/cxuucmsv3/issues/8; https://github.com/cbkhwx/cxuucmsv3/issues/8
CVE: CVE-2021-43109
Published: 2022-03-29
Description: An SQL Injection vulnerability exits in PuneethReddyHC online-shopping-system as of 11/01/2021 via the p parameter in product.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://github.com/PuneethReddyHC/online-shopping-system/issues/17; https://github.com/PuneethReddyHC/online-shopping-system/issues/17
CVE: CVE-2021-43110
Published: 2022-03-29
Description: An Access Conrol vulnerability exists in PuneethReddyHC online-shopping-system as of 11/01/2021 in add_products.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/PuneethReddyHC/online-shopping-system/issues/17; https://github.com/PuneethReddyHC/online-shopping-system/issues/17
CVE: CVE-2022-1122
Published: 2022-03-29
Description: A flaw was found in the opj2_decompress program in openjpeg2 2.4.0 in the way it handles an input directory with a large number of files. When it fails to allocate a buffer to store the filenames of the input directory, it calls free() on an uninitialized pointer, leading to a segmentation fault and a denial of service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-665, CWE-665, CWE-824
References: https://github.com/uclouvain/openjpeg/issues/1368; https://lists.debian.org/debian-lts-announce/2022/04/msg00006.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MIWSQFQWXDU4MT3XTVAO6HC7TVL3NHS7/