deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-22065
Published: 2022-06-14
Description: Out of bound read in WLAN HOST due to improper length check can lead to DOS in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://www.qualcomm.com/company/product-security/bulletins/may-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/may-2022-bulletin
CVE: CVE-2022-22068
Published: 2022-06-14
Description: kernel event may contain unexpected content which is not generated by NPU software in asynchronous execution mode in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
CVSS Score: 8.4 (HIGH)
CWE: CWE-416
References: https://www.qualcomm.com/company/product-security/bulletins/may-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/may-2022-bulletin
CVE: CVE-2022-22071
Published: 2022-06-14
Description: Possible use after free when process shell memory is freed using IOCTL munmap call and process initialization is in progress in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music
CVSS Score: 8.4 (HIGH)
CWE: CWE-416, CWE-416
References: https://www.qualcomm.com/company/product-security/bulletins/may-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/may-2022-bulletin; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-22071
CVE: CVE-2022-22072
Published: 2022-06-14
Description: Buffer overflow can occur due to improper validation of NDP application information length in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music
CVSS Score: 7.8 (HIGH)
CWE: CWE-1284
References: https://www.qualcomm.com/company/product-security/bulletins/may-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/may-2022-bulletin
CVE: CVE-2022-22082
Published: 2022-06-14
Description: Memory corruption due to possible buffer overflow while parsing DSF header with corrupted channel count in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
CVSS Score: 8.4 (HIGH)
CWE: CWE-120
References: https://www.qualcomm.com/company/product-security/bulletins/june-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/june-2022-bulletin
CVE: CVE-2022-22083
Published: 2022-06-14
Description: Denial of service due to memory corruption while extracting ape header from clips in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://www.qualcomm.com/company/product-security/bulletins/june-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/june-2022-bulletin
CVE: CVE-2022-22084
Published: 2022-06-14
Description: Memory corruption when extracting qcp audio file due to lack of check on data length in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
CVSS Score: 8.4 (HIGH)
CWE: CWE-787
References: https://www.qualcomm.com/company/product-security/bulletins/june-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/june-2022-bulletin
CVE: CVE-2022-22085
Published: 2022-06-14
Description: Memory corruption in video due to buffer overflow while reading the dts file in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
CVSS Score: 8.4 (HIGH)
CWE: CWE-787
References: https://www.qualcomm.com/company/product-security/bulletins/june-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/june-2022-bulletin
CVE: CVE-2022-22086
Published: 2022-06-14
Description: Memory corruption in video due to double free while parsing 3gp clip with invalid meta data atoms in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
CVSS Score: 7.3 (HIGH)
CWE: CWE-415
References: https://www.qualcomm.com/company/product-security/bulletins/june-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/june-2022-bulletin
CVE: CVE-2022-22087
Published: 2022-06-14
Description: memory corruption in video due to buffer overflow while parsing mkv clip with no codechecker in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
CVSS Score: 7.3 (HIGH)
CWE: CWE-120
References: https://www.qualcomm.com/company/product-security/bulletins/june-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/june-2022-bulletin
CVE: CVE-2022-22090
Published: 2022-06-14
Description: Memory corruption in audio due to use after free while managing buffers from internal cache in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Mobile
CVSS Score: 8.4 (HIGH)
CWE: CWE-416
References: https://www.qualcomm.com/company/product-security/bulletins/june-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/june-2022-bulletin
CVE: CVE-2022-22103
Published: 2022-06-14
Description: Memory corruption in multimedia driver due to double free while processing data from user in Snapdragon Auto
CVSS Score: 7.8 (HIGH)
CWE: CWE-415
References: https://www.qualcomm.com/company/product-security/bulletins/june-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/june-2022-bulletin
CVE: CVE-2022-25651
Published: 2022-06-14
Description: Memory corruption in bluetooth host due to integer overflow while processing BT HFP-UNIT profile in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190
References: https://www.qualcomm.com/company/product-security/bulletins/june-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/june-2022-bulletin
CVE: CVE-2022-26476
Published: 2022-06-14
Description: A vulnerability has been identified in Spectrum Power 4 (All versions using Shared HIS), Spectrum Power 7 (All versions using Shared HIS), Spectrum Power MGMS (All versions using Shared HIS). An unauthenticated attacker could log into the component Shared HIS used in Spectrum Power systems by using an account with default credentials. A successful exploitation could allow the attacker to access the component Shared HIS with administrative privileges.
CVSS Score: 8.8 (HIGH)
CWE: CWE-798, CWE-798
References: https://cert-portal.siemens.com/productcert/pdf/ssa-388239.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-388239.pdf
CVE: CVE-2022-27219
Published: 2022-06-14
Description: A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.0 SP2). Affected application is missing general HTTP security headers in the web server configured on port 443. This could aid attackers by making the servers more prone to clickjacking, channel downgrade attacks and other similar client-based attack vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-358, CWE-1021
References: https://cert-portal.siemens.com/productcert/pdf/ssa-911567.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-911567.pdf
CVE: CVE-2022-27220
Published: 2022-06-14
Description: A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.0 SP2). Affected application is missing general HTTP security headers in the web server configured on port 6220. This could aid attackers by making the servers more prone to clickjacking, channel downgrade attacks and other similar client-based attack vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-358, CWE-1021
References: https://cert-portal.siemens.com/productcert/pdf/ssa-911567.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-911567.pdf
CVE: CVE-2022-27221
Published: 2022-06-14
Description: A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). An attacker in machine-in-the-middle could obtain plaintext secret values by observing length differences during a series of guesses in which a string in an HTTP request URL potentially matches an unknown string in an HTTP response body, aka a "BREACH" attack.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-203, CWE-203
References: https://cert-portal.siemens.com/productcert/html/ssa-484086.html; https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf; https://cert-portal.siemens.com/productcert/html/ssa-484086.html
CVE: CVE-2022-29034
Published: 2022-06-14
Description: A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). An error message pop up window in the web interface of the affected application does not prevent injection of JavaScript code.

This could allow attackers to perform reflected cross-site scripting (XSS) attacks.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://packetstormsecurity.com/files/167554/SIEMENS-SINEMA-Remote-Connect-3.0.1.0-01.01.00.02-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2022/Jun/35; https://cert-portal.siemens.com/productcert/html/ssa-484086.html
CVE: CVE-2022-30228
Published: 2022-06-14
Description: A vulnerability has been identified in SICAM GridEdge (Classic) (All versions < V2.6.6). The affected software does not apply cross-origin resource sharing (CORS) restrictions for critical operations. In case an attacker tricks a legitimate user into accessing a special resource a malicious request could be executed.
CVSS Score: 8.8 (HIGH)
CWE: CWE-346, CWE-346
References: https://cert-portal.siemens.com/productcert/html/ssa-631336.html; https://cert-portal.siemens.com/productcert/pdf/ssa-631336.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-631336.pdf
CVE: CVE-2022-30229
Published: 2022-06-14
Description: A vulnerability has been identified in SICAM GridEdge (Classic) (All versions < V2.6.6). The affected application does not require authenticated access for privileged functions. This could allow an unauthenticated attacker to change data of a user, such as credentials, in case that user's id is known.
CVSS Score: 7.2 (HIGH)
CWE: CWE-306, CWE-287
References: https://cert-portal.siemens.com/productcert/html/ssa-631336.html; https://cert-portal.siemens.com/productcert/pdf/ssa-631336.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-631336.pdf
CVE: CVE-2022-30230
Published: 2022-06-14
Description: A vulnerability has been identified in SICAM GridEdge (Classic) (All versions < V2.6.6). The affected application does not require authenticated access for privileged functions. This could allow an unauthenticated attacker to create a new user with administrative permissions.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306, CWE-306
References: https://cert-portal.siemens.com/productcert/html/ssa-631336.html; https://cert-portal.siemens.com/productcert/pdf/ssa-631336.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-631336.pdf
CVE: CVE-2022-30231
Published: 2022-06-14
Description: A vulnerability has been identified in SICAM GridEdge (Classic) (All versions < V2.6.6). The affected application discloses password hashes of other users upon request. This could allow an authenticated user to retrieve another user's password hash.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-402, CWE-522
References: https://cert-portal.siemens.com/productcert/html/ssa-631336.html; https://cert-portal.siemens.com/productcert/pdf/ssa-631336.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-631336.pdf
CVE: CVE-2022-30937
Published: 2022-06-14
Description: A vulnerability has been identified in EN100 Ethernet module DNP3 IP variant (All versions), EN100 Ethernet module IEC 104 variant (All versions), EN100 Ethernet module IEC 61850 variant (All versions < V4.37), EN100 Ethernet module Modbus TCP variant (All versions), EN100 Ethernet module PROFINET IO variant (All versions). Affected applications contains a memory corruption vulnerability while parsing specially crafted HTTP packets to /txtrace endpoint. This could allow an attacker to crash the affected application leading to a denial of service condition.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119, CWE-787
References: https://cert-portal.siemens.com/productcert/pdf/ssa-693555.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-693555.pdf
CVE: CVE-2022-31465
Published: 2022-06-14
Description: A vulnerability has been identified in Xpedition Designer VX.2.10 (All versions < VX.2.10 Update 13), Xpedition Designer VX.2.11 (All versions < VX.2.11 Update 11), Xpedition Designer VX.2.12 (All versions < VX.2.12 Update 5), Xpedition Designer VX.2.13 (All versions < VX.2.13 Update 1). The affected application assigns improper access rights to the service executable. This could allow an authenticated local attacker to inject arbitrary code and escalate privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732, CWE-732
References: https://cert-portal.siemens.com/productcert/pdf/ssa-988345.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-988345.pdf
CVE: CVE-2022-31619
Published: 2022-06-14
Description: A vulnerability has been identified in Teamcenter V12.4 (All versions < V12.4.0.13), Teamcenter V13.0 (All versions < V13.0.0.9), Teamcenter V13.1 (All versions < V13.1.0.9), Teamcenter V13.2 (All versions < V13.2.0.9), Teamcenter V13.3 (All versions < V13.3.0.3), Teamcenter V14.0 (All versions < V14.0.0.2). Java EE Server Manager HTML Adaptor in Teamcenter consists of default hardcoded credentials. Access to the application allows a user to perform a series of actions that could potentially lead to remote code execution with elevated permissions.
CVSS Score: 8.8 (HIGH)
CWE: CWE-798, CWE-798
References: https://cert-portal.siemens.com/productcert/pdf/ssa-220589.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-220589.pdf
CVE: CVE-2022-32145
Published: 2022-06-14
Description: A vulnerability has been identified in Teamcenter Active Workspace V5.2 (All versions < V5.2.9), Teamcenter Active Workspace V6.0 (All versions < V6.0.3). A reflected cross-site scripting (XSS) vulnerability exists in the web interface of the affected application that could allow an attacker to execute malicious code by tricking users into accessing a malicious link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://cert-portal.siemens.com/productcert/pdf/ssa-401167.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-401167.pdf
CVE: CVE-2022-32251
Published: 2022-06-14
Description: A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). There is a missing authentication verification for a resource used to change the roles and permissions of a user. This could allow an attacker to change the permissions of any user and gain the privileges of an administrative user.
CVSS Score: 8.8 (HIGH)
CWE: CWE-306, CWE-306
References: https://cert-portal.siemens.com/productcert/html/ssa-484086.html; https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf; https://cert-portal.siemens.com/productcert/html/ssa-484086.html
CVE: CVE-2022-32252
Published: 2022-06-14
Description: A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). The application does not perform the integrity check of the update packages. Without validation, an admin user might be tricked to install a malicious package, granting root privileges to an attacker.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-345, CWE-345
References: https://cert-portal.siemens.com/productcert/html/ssa-484086.html; https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf; https://cert-portal.siemens.com/productcert/html/ssa-484086.html
CVE: CVE-2022-32253
Published: 2022-06-14
Description: A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). Due to improper input validation, the OpenSSL certificate's password could be printed to a file reachable by an attacker.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-20, CWE-20
References: https://cert-portal.siemens.com/productcert/html/ssa-484086.html; https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf; https://cert-portal.siemens.com/productcert/html/ssa-484086.html
CVE: CVE-2022-32254
Published: 2022-06-14
Description: A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). A customized HTTP POST request could force the application to write the status of a given user to a log file, exposing sensitive user information that could provide valuable guidance to an attacker.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-532, CWE-532
References: https://cert-portal.siemens.com/productcert/html/ssa-484086.html; https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf; https://cert-portal.siemens.com/productcert/html/ssa-484086.html
CVE: CVE-2022-32255
Published: 2022-06-14
Description: A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). The affected application consists of a web service that lacks proper access control for some of the endpoints. This could lead to unauthorized access to limited information.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-284
References: https://cert-portal.siemens.com/productcert/html/ssa-484086.html; https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf; https://cert-portal.siemens.com/productcert/html/ssa-484086.html
CVE: CVE-2022-32256
Published: 2022-06-14
Description: A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). The affected application consists of a web service that lacks proper access control for some of the endpoints. This could lead to low privileged users accessing privileged information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284
References: https://cert-portal.siemens.com/productcert/html/ssa-484086.html; https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf; https://cert-portal.siemens.com/productcert/html/ssa-484086.html
CVE: CVE-2022-32258
Published: 2022-06-14
Description: A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). The affected application contains an older feature that allows to import device configurations via a specific endpoint. An attacker could use this vulnerability for information disclosure.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-448
References: https://cert-portal.siemens.com/productcert/html/ssa-484086.html; https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf; https://cert-portal.siemens.com/productcert/html/ssa-484086.html
CVE: CVE-2022-32259
Published: 2022-06-14
Description: A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). The system images for installation or update of the affected application contain unit test scripts with sensitive information. An attacker could gain information about testing architecture and also tamper with test configuration.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-1244
References: https://cert-portal.siemens.com/productcert/html/ssa-484086.html; https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf; https://cert-portal.siemens.com/productcert/html/ssa-484086.html
CVE: CVE-2022-32260
Published: 2022-06-14
Description: A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). The affected application creates temporary user credentials for UMC (User Management Component) users. An attacker could use these temporary credentials for authentication bypass in certain scenarios.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-286
References: https://cert-portal.siemens.com/productcert/html/ssa-381581.html; https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf; https://cert-portal.siemens.com/productcert/html/ssa-381581.html
CVE: CVE-2022-32261
Published: 2022-06-14
Description: A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). The affected application contains a misconfiguration in the APT update. This could allow an attacker to add insecure packages to the application.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-233
References: https://cert-portal.siemens.com/productcert/html/ssa-484086.html; https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf; https://cert-portal.siemens.com/productcert/html/ssa-484086.html
CVE: CVE-2022-32262
Published: 2022-06-14
Description: A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). The affected application contains a file upload server that is vulnerable to command injection. An attacker could use this to achieve arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77, CWE-77
References: https://cert-portal.siemens.com/productcert/html/ssa-484086.html; https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf; https://cert-portal.siemens.com/productcert/html/ssa-484086.html
CVE: CVE-2022-32285
Published: 2022-06-14
Description: A vulnerability has been identified in Mendix SAML Module (Mendix 7 compatible) (All versions < V1.16.6), Mendix SAML Module (Mendix 8 compatible) (All versions < V2.2.2), Mendix SAML Module (Mendix 9 compatible) (All versions < V3.2.3). The affected module is vulnerable to XML External Entity (XXE) attacks due to insufficient input sanitation. This may allow an attacker to disclose confidential data under certain circumstances.
CVSS Score: 7.5 (HIGH)
CWE: CWE-611, CWE-611
References: https://cert-portal.siemens.com/productcert/pdf/ssa-740594.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-740594.pdf
CVE: CVE-2022-32286
Published: 2022-06-14
Description: A vulnerability has been identified in Mendix SAML Module (Mendix 7 compatible) (All versions < V1.16.6), Mendix SAML Module (Mendix 8 compatible) (All versions < V2.2.2), Mendix SAML Module (Mendix 9 compatible) (All versions < V3.2.3). In certain configurations SAML module is vulnerable to Cross Site Scripting (XSS) attacks due to insufficient error message sanitation. This could allow an attacker to execute malicious code by tricking users into accessing a malicious link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://cert-portal.siemens.com/productcert/pdf/ssa-740594.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-740594.pdf
CVE: CVE-2021-40633
Published: 2022-06-14
Description: A memory leak (out-of-memory) in gif2rgb in util/gif2rgb.c in giflib 5.1.4 allows remote attackers trigger an out of memory exception or denial of service via a gif format file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-401
References: https://sourceforge.net/p/giflib/bugs/157/; https://sourceforge.net/p/giflib/bugs/157/
CVE: CVE-2021-40658
Published: 2022-06-14
Description: Textpattern 4.8.7 is affected by a HTML injection vulnerability through “Content>Write>Body”.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://tanmay26.medium.com/textpattern-4-8-7-is-affected-by-html-injection-in-the-body-parameter-1a7be2441b70; https://tanmay26.medium.com/textpattern-4-8-7-is-affected-by-html-injection-in-the-body-parameter-1a7be2441b70
CVE: CVE-2021-40678
Published: 2022-06-14
Description: In Piwigo 11.5.0, there exists a persistent cross-site scripting in the single mode function through /admin.php?page=batch_manager&mode=unit.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/Piwigo/Piwigo/issues/1476; https://github.com/Piwigo/Piwigo/issues/1476