deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-14589
Published: 2023-02-28
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2019. Notes: none.
CVE: CVE-2019-14592
Published: 2023-02-28
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2019. Notes: none.
CVE: CVE-2019-14593
Published: 2023-02-28
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2019. Notes: none.
CVE: CVE-2019-14594
Published: 2023-02-28
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2019. Notes: none.
CVE: CVE-2019-14595
Published: 2023-02-28
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2019. Notes: none.
CVE: CVE-2019-14597
Published: 2023-02-28
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2019. Notes: none.
CVE: CVE-2019-14606
Published: 2023-02-28
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2019. Notes: none.
CVE: CVE-2019-14614
Published: 2023-02-28
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2019. Notes: none.
CVE: CVE-2019-14616
Published: 2023-02-28
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2019. Notes: none.
CVE: CVE-2019-14617
Published: 2023-02-28
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2019. Notes: none.
CVE: CVE-2019-14618
Published: 2023-02-28
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2019. Notes: none.
CVE: CVE-2019-14619
Published: 2023-02-28
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2019. Notes: none.
CVE: CVE-2019-14621
Published: 2023-02-28
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2019. Notes: none.
CVE: CVE-2019-14622
Published: 2023-02-28
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2019. Notes: none.
CVE: CVE-2019-14623
Published: 2023-02-28
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2019. Notes: none.
CVE: CVE-2019-14624
Published: 2023-02-28
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2019. Notes: none.
CVE: CVE-2019-14627
Published: 2023-02-28
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2019. Notes: none.
CVE: CVE-2019-14628
Published: 2023-02-28
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2019. Notes: none.
CVE: CVE-2019-14631
Published: 2023-02-28
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2019. Notes: none.
CVE: CVE-2019-14632
Published: 2023-02-28
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2019. Notes: none.
CVE: CVE-2019-14633
Published: 2023-02-28
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2019. Notes: none.
CVE: CVE-2019-14634
Published: 2023-02-28
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2019. Notes: none.
CVE: CVE-2019-14635
Published: 2023-02-28
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2019. Notes: none.
CVE: CVE-2019-14636
Published: 2023-02-28
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2019. Notes: none.
CVE: CVE-2019-14637
Published: 2023-02-28
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2019. Notes: none.
CVE: CVE-2019-14638
Published: 2023-02-28
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2019. Notes: none.
CVE: CVE-2019-14639
Published: 2023-02-28
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2019. Notes: none.
CVE: CVE-2019-14640
Published: 2023-02-28
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2019. Notes: none.
CVE: CVE-2019-14641
Published: 2023-02-28
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2019. Notes: none.
CVE: CVE-2019-14642
Published: 2023-02-28
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2019. Notes: none.
CVE: CVE-2019-14643
Published: 2023-02-28
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2019. Notes: none.
CVE: CVE-2019-14644
Published: 2023-02-28
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2019. Notes: none.
CVE: CVE-2019-14645
Published: 2023-02-28
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2019. Notes: none.
CVE: CVE-2019-14646
Published: 2023-02-28
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2019. Notes: none.
CVE: CVE-2019-14647
Published: 2023-02-28
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2019. Notes: none.
CVE: CVE-2019-14648
Published: 2023-02-28
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2019. Notes: none.
CVE: CVE-2019-14649
Published: 2023-02-28
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2019. Notes: none.
CVE: CVE-2019-14650
Published: 2023-02-28
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2019. Notes: none.
CVE: CVE-2019-14651
Published: 2023-02-28
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2019. Notes: none.
CVE: CVE-2023-1017
Published: 2023-02-28
Description: An out-of-bounds write vulnerability exists in TPM2.0's Module Library allowing writing of a 2-byte data past the end of TPM2.0 command in the CryptParameterDecryption routine. An attacker who can successfully exploit this vulnerability can lead to denial of service (crashing the TPM chip/process or rendering it unusable) and/or arbitrary code execution in the TPM context.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://kb.cert.org/vuls/id/782720; https://trustedcomputinggroup.org/about/security/; https://trustedcomputinggroup.org/wp-content/uploads/TCGVRT0007-Advisory-FINAL.pdf
CVE: CVE-2023-1065
Published: 2023-02-28
Description: This vulnerability in the Snyk Kubernetes Monitor can result in irrelevant data being posted to a Snyk Organization, which could in turn obfuscate other, relevant, security issues. It does not expose the user of the integration to any direct security risk and no user data can be leaked. To exploit the vulnerability the attacker does not need to be authenticated to Snyk but does need to know the target's Integration ID (which may or may not be the same as the Organization ID, although this is an unpredictable UUID in either case).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-287, CWE-287
References: https://github.com/snyk/kubernetes-monitor; https://github.com/snyk/kubernetes-monitor/commit/5b9a7821680bbfb6c4a900ab05d898ce2b2cc157; https://github.com/snyk/kubernetes-monitor/pull/1275
CVE: CVE-2023-27371
Published: 2023-02-28
Description: GNU libmicrohttpd before 0.9.76 allows remote DoS (Denial of Service) due to improper parsing of a multipart/form-data boundary in the postprocessor.c MHD_create_post_processor() method. This allows an attacker to remotely send a malicious HTTP POST packet that includes one or more '\0' bytes in a multipart/form-data boundary field, which - assuming a specific heap layout - will result in an out-of-bounds read and a crash in the find_boundary() function.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-125
References: https://git.gnunet.org/libmicrohttpd.git/commit/?id=6d6846e20bfdf4b3eb1b592c97520a532f724238; https://github.com/0xhebi/CVEs/tree/main/GNU%20Libmicrohttpd; https://lists.debian.org/debian-lts-announce/2023/03/msg00029.html
CVE: CVE-2023-27372
Published: 2023-02-28
Description: SPIP before 4.2.1 allows Remote Code Execution via form values in the public area because serialization is mishandled. The fixed versions are 3.2.18, 4.0.10, 4.1.8, and 4.2.1.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: http://packetstormsecurity.com/files/171921/SPIP-Remote-Command-Execution.html; http://packetstormsecurity.com/files/173044/SPIP-4.2.1-Remote-Code-Execution.html; https://blog.spip.net/Mise-a-jour-critique-de-securite-sortie-de-SPIP-4-2-1-SPIP-4-1-8-SPIP-4-0-10-et.html
CVE: CVE-2023-1099
Published: 2023-02-28
Description: A vulnerability was found in SourceCodester Online Student Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file eduauth/edit-class-detail.php. The manipulation of the argument editid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-222002 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/Online%20student%20management%20system%20pdf/Online%20student%20management%20system%20sql%20vlun%201.pdf; https://vuldb.com/?ctiid.222002; https://vuldb.com/?id.222002
CVE: CVE-2023-1100
Published: 2023-02-28
Description: A vulnerability classified as critical has been found in SourceCodester Online Catering Reservation System 1.0. This affects an unknown part of the file /reservation/add_message.php of the component POST Parameter Handler. The manipulation of the argument fullname leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-222003.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/jackswordsz/bug_report/blob/main/vendors/emoblazz/Online%20Catering%20Reservation%20System/SQLi-1.md; https://vuldb.com/?ctiid.222003; https://vuldb.com/?id.222003
CVE: CVE-2023-22996
Published: 2023-02-28
Description: In the Linux kernel before 5.17.2, drivers/soc/qcom/qcom_aoss.c does not release an of_find_device_by_node reference after use, e.g., with put_device.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-772, CWE-772
References: https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.17.2; https://github.com/torvalds/linux/commit/4b41a9d0fe3db5f91078a380f62f0572c3ecf2dd; https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.17.2
CVE: CVE-2023-22997
Published: 2023-02-28
Description: In the Linux kernel before 6.1.2, kernel/module/decompress.c misinterprets the module_get_next_page return value (expects it to be NULL in the error case, whereas it is actually an error pointer).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.2; https://github.com/torvalds/linux/commit/45af1d7aae7d5520d2858f8517a1342646f015db; https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.2
CVE: CVE-2023-22998
Published: 2023-02-28
Description: In the Linux kernel before 6.0.3, drivers/gpu/drm/virtio/virtgpu_object.c misinterprets the drm_gem_shmem_get_sg_table return value (expects it to be NULL in the error case, whereas it is actually an error pointer).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-436, CWE-436
References: https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.0.3; https://github.com/torvalds/linux/commit/c24968734abfed81c8f93dc5f44a7b7a9aecadfa; https://lists.debian.org/debian-lts-announce/2023/05/msg00005.html
CVE: CVE-2023-22999
Published: 2023-02-28
Description: In the Linux kernel before 5.16.3, drivers/usb/dwc3/dwc3-qcom.c misinterprets the dwc3_qcom_create_urs_usb_platdev return value (expects it to be NULL in the error case, whereas it is actually an error pointer).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.16.3; https://github.com/torvalds/linux/commit/b52fe2dbb3e655eb1483000adfab68a219549e13; https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.16.3
CVE: CVE-2022-23239
Published: 2023-02-28
Description: Active IQ Unified Manager for VMware vSphere, Linux, and Microsoft Windows versions prior to 9.11P1 are susceptible to a vulnerability which allows administrative users to perform a Stored Cross-Site Scripting (XSS) attack.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2022-23240
Published: 2023-02-28
Description: Active IQ Unified Manager for VMware vSphere, Linux, and Microsoft Windows versions prior to 9.11P1 are susceptible to a vulnerability which allows unauthorized users to update EMS Subscriptions via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2022-47075
Published: 2023-02-28
Description: An issue was discovered in Smart Office Web 20.28 and earlier allows attackers to download sensitive information via the action name parameter to ExportEmployeeDetails.aspx, and to ExportReportingManager.aspx.
CVSS Score: 7.5 (HIGH)
References: http://packetstormsecurity.com/files/173093/Smart-Office-Web-20.28-Information-Disclosure-Insecure-Direct-Object-Reference.html; https://cvewalkthrough.com/smart-office-suite-cve-2022-47076-cve-2022-47075/; https://cvewalkthrough.com/smart-office-suite-unauthenticated-data-ex/
CVE: CVE-2022-47076
Published: 2023-02-28
Description: An issue was discovered in Smart Office Web 20.28 and earlier allows attackers to view sensitive information via DisplayParallelLogData.aspx.
CVSS Score: 7.5 (HIGH)
References: http://packetstormsecurity.com/files/173093/Smart-Office-Web-20.28-Information-Disclosure-Insecure-Direct-Object-Reference.html; https://cvewalkthrough.com/smart-office-suite-cve-2022-47076-cve-2022-47075/; https://cvewalkthrough.com/smart-office-suite-unauthenticated-data-ex/
CVE: CVE-2023-1095
Published: 2023-02-28
Description: In nf_tables_updtable, if nf_tables_table_enable returns an error, nft_trans_destroy is called to free the transaction object. nft_trans_destroy() calls list_del(), but the transaction was never placed on a list -- the list head is all zeroes, this results in a NULL pointer dereference.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://bugzilla.redhat.com/show_bug.cgi?id=2173973; https://github.com/torvalds/linux/commit/580077855a40741cf[PII_REDACTED]02d97ff02f4d9; https://bugzilla.redhat.com/show_bug.cgi?id=2173973
CVE: CVE-2023-25575
Published: 2023-02-28
Description: API Platform Core is the server component of API Platform: hypermedia and GraphQL APIs. Resource properties secured with the `security` option of the `ApiPlatform\Metadata\ApiProperty` attribute can be disclosed to unauthorized users. The problem affects most serialization formats, including raw JSON, which is enabled by default when installing API Platform. Custom serialization formats may also be impacted. Only collection endpoints are affected by the issue, item endpoints are not. The JSON-LD format is not affected by the issue. The result of the security rule is only executed for the first item of the collection. The result of the rule is then cached and reused for the next items. This bug can leak data to unauthorized users when the rule depends on the value of a property of the item. This bug can also hide properties that should be displayed to authorized users. This issue impacts the 2.7, 3.0 and 3.1 branches. Please upgrade to versions 2.7.10, 3.0.12 or 3.1.3. As a workaround, replace the `cache_key` of the context array of the Serializer inside a custom normalizer that works on objects if the security option of the `ApiPlatform\Metadata\ApiProperty` attribute is used.
CVSS Score: 7.7 (HIGH)
CWE: CWE-842, CWE-863
References: https://github.com/api-platform/core/commit/5723d68369722feefeb11e42528d9580db5dd0fb; https://github.com/api-platform/core/security/advisories/GHSA-vr2x-7687-h6qv; https://github.com/api-platform/core/commit/5723d68369722feefeb11e42528d9580db5dd0fb
CVE: CVE-2022-38220
Published: 2023-03-01
Description: An XSS vulnerability exists within Quest KACE Systems Management Appliance (SMA) through 12.1 that may allow remote injection of arbitrary web script or HTML.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://support.quest.com/kb/339613; https://support.quest.com/kb/4368602/quest-response-to-kace-sma-vulnerability-cve-2022-38220; https://support.quest.com/kb/339613
CVE: CVE-2023-0847
Published: 2023-03-01
Description: 
The Sub-IoT implementation of the DASH 7 Alliance protocol has a vulnerability that can lead to an out-of-bounds write prior to implementation version 0.5.0. If the protocol has been compiled using default settings, this will only grant the attacker access to allocated but unused memory. However, if it was configured using non-default settings, there is the possibility that exploiting this vulnerability could lead to system crashes and remote code execution. 


CVSS Score: 5.3 (MEDIUM)
CWE: CWE-787
References: https://github.com/Sub-IoT/Sub-IoT-Stack/security/advisories/GHSA-ggxh-88wc-c4fg; https://www.cisa.gov/news-events/ics-advisories/icsa-23-047-13; https://github.com/Sub-IoT/Sub-IoT-Stack/security/advisories/GHSA-ggxh-88wc-c4fg
CVE: CVE-2023-24045
Published: 2023-03-01
Description: In Dataiku DSS 11.2.1, an attacker can download other Dataiku files that were uploaded to the myfiles section by specifying the target username in a download request.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-434, CWE-434
References: https://dataiku.com; https://gist.github.com/alert3/04e2d0a[PII_REDACTED]04f846cfa00552b; https://dataiku.com
CVE: CVE-2023-26608
Published: 2023-03-01
Description: SOLDR (System of Orchestration, Lifecycle control, Detection and Response) 1.1.0 allows stored XSS via the module editor.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/vxcontrol/soldr/compare/v1.1.0...v1.2.0; https://github.com/vxcontrol/soldr/issues/89; https://github.com/vxcontrol/soldr/compare/v1.1.0...v1.2.0
CVE: CVE-2023-1103
Published: 2023-03-01
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was a duplicate of CVE-2022-4821. Notes: none.
CVE: CVE-2023-1104
Published: 2023-03-01
Description: Cross-site Scripting (XSS) - Stored in GitHub repository flatpressblog/flatpress prior to 1.3.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/flatpressblog/flatpress/commit/f6394eac7a0e001d2b1ac638d3313e531d19ea93; https://huntr.dev/bounties/a4909b4e-ab3c-41d6-b0d8-1c6e933bf758; https://github.com/flatpressblog/flatpress/commit/f6394eac7a0e001d2b1ac638d3313e531d19ea93
CVE: CVE-2023-1105
Published: 2023-03-01
Description: External Control of File Name or Path in GitHub repository flatpressblog/flatpress prior to 1.3.
CVSS Score: 8.1 (HIGH)
CWE: CWE-73
References: https://github.com/flatpressblog/flatpress/commit/5d5c7f6d8f072d14926fc2c3a97cdd763802f170; https://huntr.dev/bounties/4089a63f-cffd-42f3-b8d8-e80b6bd9c80f; https://github.com/flatpressblog/flatpress/commit/5d5c7f6d8f072d14926fc2c3a97cdd763802f170
CVE: CVE-2021-3855
Published: 2023-03-01
Description: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Liman Central Management System Liman MYS (HTTP/Controllers, CronMail, Jobs modules) allows Command Injection.This issue affects Liman Central Management System: from 1.7.0 before 1.8.3-462.


CVSS Score: 8.8 (HIGH)
CWE: CWE-77, CWE-77
References: https://docs.liman.dev/baslangic/guvenlik; https://www.usom.gov.tr/bildirim/tr-23-0109; https://docs.liman.dev/baslangic/guvenlik
CVE: CVE-2021-4326
Published: 2023-03-01
Description: A vulnerability in Imperative framework which allows already-privileged local actors to execute arbitrary shell commands via plugin install/update commands, or maliciously formed environment variables. Impacts Zowe CLI.
CVSS Score: 3.3 (LOW)
References: https://github.com/zowe/imperative/; https://github.com/zowe/imperative/
CVE: CVE-2022-20952
Published: 2023-03-01
Description: A vulnerability in the scanning engines of Cisco AsyncOS Software for Cisco Secure Web Appliance, formerly known as Cisco Web Security Appliance (WSA), could allow an unauthenticated, remote attacker to bypass a configured rule, thereby allowing traffic onto a network that should have been blocked.
 This vulnerability exists because malformed, encoded traffic is not properly detected. An attacker could exploit this vulnerability by connecting through an affected device to a malicious server and receiving malformed HTTP responses. A successful exploit could allow the attacker to bypass an explicit block rule and receive traffic that should have been rejected by the device.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wsa-bypass-bwBfugek; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wsa-bypass-bwBfugek