deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-42125
Published: 2022-11-15
Description: Zip slip vulnerability in FileUtil.unzip in Liferay Portal 7.4.3.5 through 7.4.3.35 and Liferay DXP 7.4 update 1 through update 34 allows attackers to create or overwrite existing files on the filesystem via the deployment of a malicious plugin/module.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: http://liferay.com; https://issues.liferay.com/browse/LPE-17517; https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42125
CVE: CVE-2022-42126
Published: 2022-11-15
Description: The Asset Libraries module in Liferay Portal 7.3.5 through 7.4.3.28, and Liferay DXP 7.3 before update 8, and DXP 7.4 before update 29 does not properly check permissions of asset libraries, which allows remote authenticated users to view asset libraries via the UI.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284
References: http://liferay.com; https://issues.liferay.com/browse/LPE-17593; https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42126
CVE: CVE-2022-42127
Published: 2022-11-15
Description: The Friendly Url module in Liferay Portal 7.4.3.5 through 7.4.3.36, and Liferay DXP 7.4 update 1 though 36 does not properly check user permissions, which allows remote attackers to obtain the history of all friendly URLs that was assigned to a page.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-276, CWE-276
References: http://liferay.com; https://issues.liferay.com/browse/LPE-17607; https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42127
CVE: CVE-2022-42128
Published: 2022-11-15
Description: The Hypermedia REST APIs module in Liferay Portal 7.4.1 through 7.4.3.4, and Liferay DXP 7.4 GA does not properly check permissions, which allows remote attackers to obtain a WikiNode object via the WikiNodeResource.getSiteWikiNodeByExternalReferenceCode API.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-276, CWE-276
References: http://liferay.com; https://issues.liferay.com/browse/LPE-17595; https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42128
CVE: CVE-2022-42977
Published: 2022-11-15
Description: The Netic User Export add-on before 1.3.5 for Atlassian Confluence has the functionality to generate a list of users in the application, and export it. During export, the HTTP request has a fileName parameter that accepts any file on the system (e.g., an SSH private key) to be downloaded.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://gist.github.com/CveCt0r/34251664a511f1045ce6a5492e94eec1; https://gist.github.com/CveCt0r/34251664a511f1045ce6a5492e94eec1
CVE: CVE-2022-42978
Published: 2022-11-15
Description: In the Netic User Export add-on before 1.3.5 for Atlassian Confluence, authorization is mishandled. An unauthenticated attacker could access files on the remote system.
CVSS Score: 7.5 (HIGH)
CWE: CWE-863, CWE-863
References: https://gist.github.com/CveCt0r/34251664a511f1045ce6a5492e94eec1; https://gist.github.com/CveCt0r/34251664a511f1045ce6a5492e94eec1
CVE: CVE-2022-40843
Published: 2022-11-15
Description: The Tenda AC1200 V-W15Ev2 V15.11.0.10(1576) router is vulnerable to improper authorization / improper session management that allows the router login page to be bypassed. This leads to authenticated attackers having the ability to read the routers syslog.log file which contains the MD5 password of the Administrator's user account.
CVSS Score: 4.9 (MEDIUM)
References: https://boschko.ca/tenda_ac1200_router/; https://boschko.ca/tenda_ac1200_router/
CVE: CVE-2022-40845
Published: 2022-11-15
Description: The Tenda AC1200 Router model W15Ev2 V15.11.0.10(1576) is affected by a password exposure vulnerability. When combined with the improper authorization/improper session management vulnerability, an attacker with access to the router may be able to expose sensitive information which they're not explicitly authorized to have.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-425, CWE-425
References: https://boschko.ca/tenda_ac1200_router/; https://boschko.ca/tenda_ac1200_router/
CVE: CVE-2022-40847
Published: 2022-11-15
Description: In Tenda AC1200 Router model W15Ev2 V15.11.0.10(1576), there exists a command injection vulnerability in the function formSetFixTools. This vulnerability allows attackers to run arbitrary commands on the server via the hostname parameter.
CVSS Score: 7.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://boschko.ca/tenda_ac1200_router/; https://boschko.ca/tenda_ac1200_router/
CVE: CVE-2022-42129
Published: 2022-11-15
Description: An Insecure direct object reference (IDOR) vulnerability in the Dynamic Data Mapping module in Liferay Portal 7.3.2 through 7.4.3.4, and Liferay DXP 7.3 before update 4, and 7.4 GA allows remote authenticated users to view and access form entries via the `formInstanceRecordId` parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-639, CWE-639
References: http://liferay.com; https://issues.liferay.com/browse/LPE-17448; https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42129
CVE: CVE-2022-42130
Published: 2022-11-15
Description: The Dynamic Data Mapping module in Liferay Portal 7.1.0 through 7.4.3.4, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 19, 7.3 before update 4, and 7.4 GA does not properly check permission of form entries, which allows remote authenticated users to view and access all form entries.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-276, CWE-276
References: http://liferay.com; https://issues.liferay.com/browse/LPE-17447; https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42130
CVE: CVE-2022-42131
Published: 2022-11-15
Description: Certain Liferay products are affected by: Missing SSL Certificate Validation in the Dynamic Data Mapping module's REST data providers. This affects Liferay Portal 7.1.0 through 7.4.2 and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 17, and 7.3 before service pack 3.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-295, CWE-295
References: http://liferay.com; https://issues.liferay.com/browse/LPE-17377; https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42131
CVE: CVE-2022-42132
Published: 2022-11-15
Description: The Test LDAP Users functionality in Liferay Portal 7.0.0 through 7.4.3.4, and Liferay DXP 7.0 fix pack 102 and earlier, 7.1 before fix pack 27, 7.2 before fix pack 17, 7.3 before update 4, and DXP 7.4 GA includes the LDAP credential in the page URL when paginating through the list of users, which allows man-in-the-middle attackers or attackers with access to the request logs to see the LDAP credential.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-200, CWE-200
References: http://liferay.com; https://issues.liferay.com/browse/LPE-17438; https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42132
CVE: CVE-2022-40844
Published: 2022-11-15
Description: In Tenda (Shenzhen Tenda Technology Co., Ltd) AC1200 Router model W15Ev2 V15.11.0.10(1576), a Stored Cross Site Scripting (XSS) issue exists allowing an attacker to execute JavaScript code via the applications website filtering tab, specifically the URL body.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://boschko.ca/tenda_ac1200_router/; https://boschko.ca/tenda_ac1200_router/
CVE: CVE-2022-40846
Published: 2022-11-15
Description: In Tenda AC1200 Router model W15Ev2 V15.11.0.10(1576), a Stored Cross Site Scripting (XSS) vulnerability exists allowing an attacker to execute JavaScript code via the applications stored hostname.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://boschko.ca/tenda_ac1200_router/; https://boschko.ca/tenda_ac1200_router/
CVE: CVE-2022-41395
Published: 2022-11-15
Description: Tenda AC1200 Router Model W15Ev2 V15.11.0.10(1576) was discovered to contain a command injection vulnerability via the dmzHost parameter in the setDMZ function.
CVSS Score: 7.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://boschko.ca/tenda_ac1200_router; https://boschko.ca/tenda_ac1200_router/; https://boschko.ca/tenda_ac1200_router
CVE: CVE-2022-41396
Published: 2022-11-15
Description: Tenda AC1200 Router Model W15Ev2 V15.11.0.10(1576) was discovered to contain multiple command injection vulnerabilities in the function setIPsecTunnelList via the IPsecLocalNet and IPsecRemoteNet parameters.
CVSS Score: 7.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://boschko.ca/tenda_ac1200_router; https://boschko.ca/tenda_ac1200_router/; https://boschko.ca/tenda_ac1200_router
CVE: CVE-2022-42053
Published: 2022-11-15
Description: Tenda AC1200 Router Model W15Ev2 V15.11.0.10(1576) was discovered to contain a command injection vulnerability via the PortMappingServer parameter in the setPortMapping function.
CVSS Score: 7.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://boschko.ca/tenda_ac1200_router/; https://boschko.ca/tenda_ac1200_router/
CVE: CVE-2022-42058
Published: 2022-11-15
Description: Tenda AC1200 Router Model W15Ev2 V15.11.0.10(1576) was discovered to contain a stack overflow via the setRemoteWebManage function. This vulnerability allows attackers to cause a Denial of Service (DoS) via crafted overflow data.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://boschko.ca/tenda_ac1200_router; https://boschko.ca/tenda_ac1200_router/; https://boschko.ca/tenda_ac1200_router
CVE: CVE-2022-42060
Published: 2022-11-15
Description: Tenda AC1200 Router Model W15Ev2 V15.11.0.10(1576) was discovered to contain a stack overflow via the setWanPpoe function. This vulnerability allows attackers to cause a Denial of Service (DoS) via crafted overflow data.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-121
References: https://boschko.ca/tenda_ac1200_router; https://boschko.ca/tenda_ac1200_router/; https://boschko.ca/tenda_ac1200_router
CVE: CVE-2022-45402
Published: 2022-11-15
Description: In Apache Airflow versions prior to 2.4.3, there was an open redirect in the webserver's `/login` endpoint.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: http://www.openwall.com/lists/oss-security/2022/11/15/1; https://github.com/apache/airflow/pull/27576; https://lists.apache.org/thread/nf4xrkoo6c81g6fdn4vj8k9x2686o9nh
CVE: CVE-2022-25667
Published: 2022-11-15
Description: Information disclosure in kernel due to improper handling of ICMP requests in Snapdragon Wired Infrastructure and Networking
CVSS Score: 7.5 (HIGH)
CWE: CWE-287, CWE-287
References: https://www.qualcomm.com/company/product-security/bulletins/november-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/november-2022-bulletin
CVE: CVE-2022-25671
Published: 2022-11-15
Description: Denial of service in MODEM due to reachable assertion in Snapdragon Mobile
CVSS Score: 7.5 (HIGH)
CWE: CWE-617, CWE-617
References: https://www.qualcomm.com/company/product-security/bulletins/november-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/november-2022-bulletin
CVE: CVE-2022-25674
Published: 2022-11-15
Description: Cryptographic issues in WLAN during the group key handshake of the WPA/WPA2 protocol in Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Voice & Music
CVSS Score: 6.5 (MEDIUM)
References: https://www.qualcomm.com/company/product-security/bulletins/november-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/november-2022-bulletin
CVE: CVE-2022-25676
Published: 2022-11-15
Description: Information disclosure in video due to buffer over-read while parsing avi files in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://www.qualcomm.com/company/product-security/bulletins/november-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/november-2022-bulletin
CVE: CVE-2022-25679
Published: 2022-11-15
Description: Denial of service in video due to improper access control in broadcast receivers in Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-284
References: https://www.qualcomm.com/company/product-security/bulletins/november-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/november-2022-bulletin
CVE: CVE-2022-25710
Published: 2022-11-15
Description: Denial of service due to null pointer dereference when GATT is disconnected in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music
CVSS Score: 7.5 (HIGH)
CWE: CWE-476, CWE-476
References: https://www.qualcomm.com/company/product-security/bulletins/november-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/november-2022-bulletin
CVE: CVE-2022-25724
Published: 2022-11-15
Description: Memory corruption in graphics due to buffer overflow while validating the user address in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
CVSS Score: 8.4 (HIGH)
CWE: CWE-120, CWE-120
References: https://www.qualcomm.com/company/product-security/bulletins/november-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/november-2022-bulletin
CVE: CVE-2022-25727
Published: 2022-11-15
Description: Memory Corruption in modem due to improper length check while copying into memory in Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Voice & Music
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1284, CWE-1284
References: https://www.qualcomm.com/company/product-security/bulletins/november-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/november-2022-bulletin
CVE: CVE-2022-25741
Published: 2022-11-15
Description: Denial of service in WLAN due to potential null pointer dereference while accessing the memory location in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables
CVSS Score: 7.5 (HIGH)
CWE: CWE-476, CWE-476
References: https://www.qualcomm.com/company/product-security/bulletins/november-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/november-2022-bulletin
CVE: CVE-2022-25742
Published: 2022-11-15
Description: Denial of service in modem due to infinite loop while parsing IGMPv2 packet from server in Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Voice & Music
CVSS Score: 7.5 (HIGH)
CWE: CWE-835, CWE-835
References: https://www.qualcomm.com/company/product-security/bulletins/november-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/november-2022-bulletin
CVE: CVE-2022-25743
Published: 2022-11-15
Description: Memory corruption in graphics due to use-after-free while importing graphics buffer in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
CVSS Score: 8.4 (HIGH)
CWE: CWE-416, CWE-416
References: http://packetstormsecurity.com/files/172663/Qualcomm-Adreno-KGSL-Unchecked-Cast-Type-Confusion.html; https://www.qualcomm.com/company/product-security/bulletins/november-2022-bulletin; http://packetstormsecurity.com/files/172663/Qualcomm-Adreno-KGSL-Unchecked-Cast-Type-Confusion.html
CVE: CVE-2022-33234
Published: 2022-11-15
Description: Memory corruption in video due to configuration weakness. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables
CVSS Score: 7.3 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.qualcomm.com/company/product-security/bulletins/november-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/november-2022-bulletin
CVE: CVE-2022-33236
Published: 2022-11-15
Description: Transient DOS due to buffer over-read in WLAN firmware while parsing cipher suite info attributes. in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking
CVSS Score: 7.5 (HIGH)
CWE: CWE-125, CWE-125
References: https://www.qualcomm.com/company/product-security/bulletins/november-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/november-2022-bulletin
CVE: CVE-2022-33237
Published: 2022-11-15
Description: Transient DOS due to buffer over-read in WLAN firmware while processing PPE threshold. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking
CVSS Score: 7.5 (HIGH)
CWE: CWE-125, CWE-125
References: https://www.qualcomm.com/company/product-security/bulletins/november-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/november-2022-bulletin
CVE: CVE-2022-33239
Published: 2022-11-15
Description: Transient DOS due to loop with unreachable exit condition in WLAN firmware while parsing IPV6 extension header. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking
CVSS Score: 7.5 (HIGH)
CWE: CWE-835, CWE-835
References: https://www.qualcomm.com/company/product-security/bulletins/november-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/november-2022-bulletin
CVE: CVE-2022-3461
Published: 2022-11-15
Description: In PHOENIX CONTACT Automationworx Software Suite up to version 1.89 manipulated PC Worx or Config+ files could lead to a heap buffer overflow and a read access violation. Availability, integrity, or confidentiality of an application programming workstation might be compromised by attacks using these vulnerabilities.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://cert.vde.com/en/advisories/VDE-2022-048/; https://cert.vde.com/en/advisories/VDE-2022-048/
CVE: CVE-2022-3480
Published: 2022-11-15
Description: A remote, unauthenticated attacker could cause a denial-of-service of PHOENIX CONTACT FL MGUARD and TC MGUARD devices below version 8.9.0 by sending a larger number of unauthenticated HTTPS connections originating from different source IP’s. Configuring firewall limits for incoming connections cannot prevent the issue.

CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://cert.vde.com/en/advisories/VDE-2022-051/; https://cert.vde.com/en/advisories/VDE-2022-051/
CVE: CVE-2022-3737
Published: 2022-11-15
Description: In PHOENIX CONTACT Automationworx Software Suite up to version 1.89 memory can be read beyond the intended scope due to insufficient validation of input data. Availability, integrity, or confidentiality of an application programming workstation might be compromised by attacks using these vulnerabilities.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125, CWE-125
References: https://cert.vde.com/en/advisories/VDE-2022-048/; https://cert.vde.com/en/advisories/VDE-2022-048/
CVE: CVE-2022-40308
Published: 2022-11-15
Description: If anonymous read enabled, it's possible to read the database file directly without logging in.
CVSS Score: 7.5 (HIGH)
References: http://www.openwall.com/lists/oss-security/2022/11/15/2; https://lists.apache.org/thread/x01pnn0jjsw512cscxsbxzrjmz64n4cc; http://www.openwall.com/lists/oss-security/2022/11/15/2
CVE: CVE-2022-40309
Published: 2022-11-15
Description: Users with write permissions to a repository can delete arbitrary directories.
CVSS Score: 4.3 (MEDIUM)
References: http://www.openwall.com/lists/oss-security/2022/11/15/3; https://lists.apache.org/thread/1odl4p85r96n27k577jk6ftrp19xfc27; http://www.openwall.com/lists/oss-security/2022/11/15/3
CVE: CVE-2022-3240
Published: 2022-11-15
Description: The "Follow Me Plugin" plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.1.1. This is due to missing nonce validation on the FollowMeIgniteSocialMedia_options_page() function. This makes it possible for unauthenticated attackers to modify the plugin's settings and inject malicious JavaScript via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://plugins.trac.wordpress.org/browser/follow-me/trunk/follow-me.php#L261; https://www.wordfence.com/threat-intel/vulnerabilities/id/25fab7b3-59ce-44ca-83fa-bd25b7f31af0?source=cve; https://www.wordfence.com/vulnerability-advisories-continued/#CVE-2022-3240
CVE: CVE-2022-3893
Published: 2022-11-15
Description: Cross-site Scripting (XSS) vulnerability in BlueSpiceCustomMenu extension of BlueSpice allows user with admin permissions to inject arbitrary HTML into the custom menu navigation of the application.
CVSS Score: 2.3 (LOW)
CWE: CWE-79, CWE-79
References: https://en.wiki.bluespice.com/wiki/Security:Security_Advisories/BSSA-2022-06; https://en.wiki.bluespice.com/wiki/Security:Security_Advisories/BSSA-2022-06
CVE: CVE-2022-3895
Published: 2022-11-15
Description: Some UI elements of the Common User Interface Component are not properly sanitizing output and therefore prone to output arbitrary HTML (XSS).
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://en.wiki.bluespice.com/wiki/Security:Security_Advisories/BSSA-2022-08; https://en.wiki.bluespice.com/wiki/Security:Security_Advisories/BSSA-2022-08
CVE: CVE-2022-3958
Published: 2022-11-15
Description: Cross-site Scripting (XSS) vulnerability in BlueSpiceUserSidebar extension of BlueSpice allows user with regular account and edit permissions to inject arbitrary HTML into the personal menu navigation of their own and other users. This allows for targeted attacks.
CVSS Score: 3.3 (LOW)
CWE: CWE-79, CWE-79
References: https://en.wiki.bluespice.com/wiki/Security:Security_Advisories/BSSA-2022-07; https://en.wiki.bluespice.com/wiki/Security:Security_Advisories/BSSA-2022-07
CVE: CVE-2022-41611
Published: 2022-11-15
Description: Cross-site Scripting (XSS) vulnerability in BlueSpiceDiscovery skin of BlueSpice allows user with admin privileges to inject arbitrary HTML into the main navigation of the application.
CVSS Score: 2.3 (LOW)
CWE: CWE-79, CWE-79
References: https://en.wiki.bluespice.com/wiki/Security:Security_Advisories/BSSA-2022-03; https://en.wiki.bluespice.com/wiki/Security:Security_Advisories/BSSA-2022-03
CVE: CVE-2022-41789
Published: 2022-11-15
Description: Cross-site Scripting (XSS) vulnerability in BlueSpiceDiscovery skin of BlueSpice allows logged in user with edit permissions to inject arbitrary HTML into the default page header of a wikipage.
CVSS Score: 3.3 (LOW)
CWE: CWE-79, CWE-79
References: https://en.wiki.bluespice.com/wiki/Security:Security_Advisories/BSSA-2022-04; https://en.wiki.bluespice.com/wiki/Security:Security_Advisories/BSSA-2022-04
CVE: CVE-2022-41814
Published: 2022-11-15
Description: Cross-site Scripting (XSS) vulnerability in BlueSpiceFoundation extension of BlueSpice allows user with regular account and edit permissions to inject arbitrary HTML into the history view of a wikipage.
CVSS Score: 3.3 (LOW)
CWE: CWE-79, CWE-79
References: https://en.wiki.bluespice.com/wiki/Security:Security_Advisories/BSSA-2022-04; https://en.wiki.bluespice.com/wiki/Security:Security_Advisories/BSSA-2022-04
CVE: CVE-2022-42000
Published: 2022-11-15
Description: Cross-site Scripting (XSS) vulnerability in BlueSpiceSocialProfile extension of BlueSpice allows user with comment permissions to inject arbitrary HTML into the comment section of a wikipage.
CVSS Score: 3.3 (LOW)
CWE: CWE-79, CWE-79
References: https://en.wiki.bluespice.com/wiki/Security:Security_Advisories/BSSA-2022-04; https://en.wiki.bluespice.com/wiki/Security:Security_Advisories/BSSA-2022-04