deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-22452
Published: 2022-07-14
Description: IBM Security Verify Identity Manager 10.0 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 224918.
CVSS Score: 7.5 (HIGH)
CWE: CWE-307
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/224918; https://www.ibm.com/support/pages/node/6603405; https://exchange.xforce.ibmcloud.com/vulnerabilities/224918
CVE: CVE-2022-22453
Published: 2022-07-14
Description: IBM Security Verify Identity Manager 10.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 224919.
CVSS Score: 7.5 (HIGH)
CWE: CWE-326
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/224919; https://www.ibm.com/support/pages/node/6603405; https://exchange.xforce.ibmcloud.com/vulnerabilities/224919
CVE: CVE-2022-22460
Published: 2022-07-14
Description: IBM Security Verify Identity Manager 10.0 contains sensitive information in the source code repository that could be used in further attacks against the system. IBM X-Force ID: 225013.
CVSS Score: 7.5 (HIGH)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/225013; https://www.ibm.com/support/pages/node/6603405; https://exchange.xforce.ibmcloud.com/vulnerabilities/225013
CVE: CVE-2022-2401
Published: 2022-07-14
Description: Unrestricted information disclosure of all users in Mattermost version 6.7.0 and earlier allows team members to access some sensitive information by directly accessing the APIs.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200, CWE-200
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2022-2406
Published: 2022-07-14
Description: The legacy Slack import feature in Mattermost version 6.7.0 and earlier fails to properly limit the sizes of imported files, which allows an authenticated attacker to crash the server by importing large files via the Slack import REST API.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-400, CWE-770
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2022-2408
Published: 2022-07-14
Description: The Guest account feature in Mattermost version 6.7.0 and earlier fails to properly restrict the permissions, which allows a guest user to fetch a list of all public channels in the team, in spite of not being part of those channels.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200, CWE-863
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2022-31142
Published: 2022-07-14
Description: @fastify/bearer-auth is a Fastify plugin to require bearer Authorization headers. @fastify/bearer-auth prior to versions 7.0.2 and 8.0.1 does not securely use crypto.timingSafeEqual. A malicious attacker could estimate the length of one valid bearer token. According to the corresponding RFC 6750, the bearer token has only base64 valid characters, reducing the range of characters for a brute force attack. Version 7.0.2 and 8.0.1 of @fastify/bearer-auth contain a patch. There are currently no known workarounds. The package fastify-bearer-auth, which covers versions 6.0.3 and prior, is also vulnerable starting at version 5.0.1. Users of fastify-bearer-auth should upgrade to a patched version of @fastify/bearer-auth.
CVSS Score: 7.5 (HIGH)
CWE: CWE-208, CWE-203
References: https://github.com/fastify/fastify-bearer-auth/commit/0c468a616d7e56126dc468150f6a5a92e530b8e4; https://github.com/fastify/fastify-bearer-auth/commit/39353b15409ee99474545f615ffb16180cf3b716; https://github.com/fastify/fastify-bearer-auth/commit/f921a0582dc[PII_REDACTED]4a9b5041141b50c5b3f
CVE: CVE-2021-26382
Published: 2022-07-14
Description: An attacker with root account privileges can load any legitimately signed firmware image into the Audio Co-Processor (ACP,) irrespective of the respective signing key being declared as usable for authenticating an ACP firmware image, potentially resulting in a denial of service.
CVSS Score: 4.4 (MEDIUM)
References: https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1027; https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1027
CVE: CVE-2021-26384
Published: 2022-07-14
Description: A malformed SMI (System Management Interface) command may allow an attacker to establish a corrupted SMI Trigger Info data structure, potentially leading to out-of-bounds memory reads and writes when triggering an SMI resulting in a potential loss of resources.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125, CWE-787
References: https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1027; https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1027
CVE: CVE-2021-4135
Published: 2022-07-14
Description: A memory leak vulnerability was found in the Linux kernel's eBPF for the Simulated networking device driver in the way user uses BPF for the device such that function nsim_map_alloc_elem being called. A local user could use this flaw to get unauthorized access to some data.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200, CWE-401
References: https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=481221775d53; https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=481221775d53
CVE: CVE-2022-23825
Published: 2022-07-14
Description: Aliases in the branch predictor may cause some AMD processors to predict the wrong branch type potentially leading to information disclosure.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-668
References: http://www.openwall.com/lists/oss-security/2022/11/08/1; http://www.openwall.com/lists/oss-security/2022/11/10/2; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/D4RW5FCIYFNCQOEFJEUIRW3DGYW7CWBG/
CVE: CVE-2022-31147
Published: 2022-07-14
Description: The jQuery Validation Plugin (jquery-validation) provides drop-in validation for forms. Versions of jquery-validation prior to 1.19.5 are vulnerable to regular expression denial of service (ReDoS) when an attacker is able to supply arbitrary input to the url2 method. This is due to an incomplete fix for CVE-2021-43306. Users should upgrade to version 1.19.5 to receive a patch.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1333, CWE-1333
References: https://github.com/jquery-validation/jquery-validation/commit/5bbd80d27fc6b607d2f7f106c89522051a9fb0dd; https://github.com/jquery-validation/jquery-validation/releases/tag/1.19.5; https://github.com/jquery-validation/jquery-validation/security/advisories/GHSA-ffmh-x56j-9rc3
CVE: CVE-2022-31156
Published: 2022-07-14
Description: Gradle is a build tool. Dependency verification is a security feature in Gradle Build Tool that was introduced to allow validation of external dependencies either through their checksum or cryptographic signatures. In versions 6.2 through 7.4.2, there are some cases in which Gradle may skip that verification and accept a dependency that would otherwise fail the build as an untrusted external artifact. This can occur in two ways. When signature verification is disabled but the verification metadata contains entries for dependencies that only have a `gpg` element but no `checksum` element. When signature verification is enabled, the verification metadata contains entries for dependencies with a `gpg` element but there is no signature file on the remote repository. In both cases, the verification will accept the dependency, skipping signature verification and not complaining that the dependency has no checksum entry. For builds that are vulnerable, there are two risks. Gradle could download a malicious binary from a repository outside your organization due to name squatting. For those still using HTTP only and not HTTPS for downloading dependencies, the build could download a malicious library instead of the expected one. Gradle 7.5 patches this issue by making sure to run checksum verification if signature verification cannot be completed, whatever the reason. Two workarounds are available: Remove all `gpg` elements from dependency verification metadata if you disable signature validation and/or avoid adding `gpg` entries for dependencies that do not have signature files.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-829, CWE-347
References: https://docs.gradle.org/7.5/release-notes.html; https://github.com/gradle/gradle/security/advisories/GHSA-j6wc-xfg8-jx2j; https://docs.gradle.org/7.5/release-notes.html
CVE: CVE-2022-32297
Published: 2022-07-14
Description: Piwigo v12.2.0 was discovered to contain SQL injection vulnerability via the Search function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://github.com/sth276/research/blob/main/piwigo_vul/Second-Order%20SQL%20Injection%20Vulnerabilities%20in%20Piwigo.md; https://github.com/sth276/research/blob/main/piwigo_vul/Second-Order%20SQL%20Injection%20Vulnerabilities%20in%20Piwigo.md
CVE: CVE-2022-32298
Published: 2022-07-14
Description: Toybox v0.8.7 was discovered to contain a NULL pointer dereference via the component httpd.c. This vulnerability can lead to a Denial of Service (DoS) via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://github.com/landley/toybox/issues/346; https://github.com/landley/toybox/issues/346
CVE: CVE-2022-32317
Published: 2022-07-14
Description: The MPlayer Project v1.5 was discovered to contain a heap use-after-free resulting in a double free in the preinit function at libvo/vo_v4l2.c. This vulnerability can lead to a Denial of Service (DoS) via a crafted file. The device=strdup statement is not executed on every call. Note: This has been disputed by third parties as invalid and not reproduceable.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416
References: https://bugs.gentoo.org/show_bug.cgi?id=858107; https://github.com/b17fr13nds/MPlayer_cve_poc; https://transfer.sh/m2WcuM/poc_dup.zip
CVE: CVE-2022-32318
Published: 2022-07-14
Description: Fast Food Ordering System v1.0 was discovered to contain a persistent cross-site scripting (XSS) vulnerability via the component /ffos/classes/Master.php?f=save_category.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://packetstormsecurity.com/files/167309/Fast-Food-Ordering-System-1.0-Cross-Site-Scripting.html; https://packetstormsecurity.com/files/167309/Fast-Food-Ordering-System-1.0-Cross-Site-Scripting.html
CVE: CVE-2022-32323
Published: 2022-07-14
Description: AutoTrace v0.40.0 was discovered to contain a heap overflow via the ReadImage function at input-bmp.c:660.
CVSS Score: 7.3 (HIGH)
CWE: CWE-787
References: https://github.com/autotrace/autotrace/commit/2b44c173027736c64b3f379bd154c41bab745423; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4CZVCQH4L7KC5GXLU6SCESXR5TGSKQ2H/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UKZPC4WCDOJ7BPJOMZ46AV27RCABZRYA/
CVE: CVE-2022-32389
Published: 2022-07-14
Description: Isode SWIFT v4.0.2 was discovered to contain hard-coded credentials in the Registry Editor. This allows attackers to access sensitive information such as user credentials and certificates.
CVSS Score: 7.5 (HIGH)
CWE: CWE-798
References: https://gtn.com.np/wp-content/uploads/2022/06/SWIFT-CVE-REQUEST.pdf; https://swift.im/downloads.html; https://www.isode.com/products/swift.html
CVE: CVE-2022-32406
Published: 2022-07-14
Description: GtkRadiant v1.6.6 was discovered to contain a buffer overflow via the component q3map2. This vulnerability can cause a Denial of Service (DoS) via a crafted MAP file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-120
References: https://github.com/TTimo/GtkRadiant/issues/676; https://github.com/TTimo/GtkRadiant/issues/676
CVE: CVE-2022-32409
Published: 2022-07-14
Description: A local file inclusion (LFI) vulnerability in the component codemirror.php of Portal do Software Publico Brasileiro i3geo v7.0.5 allows attackers to execute arbitrary PHP code via a crafted HTTP request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://github.com/wagnerdracha/ProofOfConcept/blob/main/i3geo_proof_of_concept.txt; https://owasp.org/www-project-web-security-testing-guide/v42/4-Web_Application_Security_Testing/07-Input_Validation_Testing/11.1-Testing_for_Local_File_Inclusion; https://github.com/wagnerdracha/ProofOfConcept/blob/main/i3geo_proof_of_concept.txt
CVE: CVE-2022-32415
Published: 2022-07-14
Description: Product Show Room Site v1.0 is vulnerable to SQL Injection via /psrs/?p=products/view_product&id=.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/guydream/bug_report/blob/main/vendors/oretnom23/product-show-room-site/SQLi-1.md; https://github.com/guydream/bug_report/blob/main/vendors/oretnom23/product-show-room-site/SQLi-1.md
CVE: CVE-2022-32416
Published: 2022-07-14
Description: Product Show Room Site v1.0 is vulnerable to SQL Injection via /psrs/classes/Master.php?f=delete_product.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/Estbonxby/bug_report/blob/main/vendors/oretnom23/product-show-room-site/SQLi-1.md; https://github.com/Estbonxby/bug_report/blob/main/vendors/oretnom23/product-show-room-site/SQLi-1.md
CVE: CVE-2022-32417
Published: 2022-07-14
Description: PbootCMS v3.1.2 was discovered to contain a remote code execution (RCE) vulnerability via the function parserIfLabel at function.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://github.com/Snakinya/Vuln/issues/1; https://github.com/Snakinya/Vuln/issues/1
CVE: CVE-2022-32425
Published: 2022-07-14
Description: The login function of Mealie v1.0.0beta-2 allows attackers to enumerate existing usernames by timing the server's response time.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-203
References: https://github.com/hay-kot/mealie/issues/1336; https://github.com/hay-kot/mealie/issues/1336
CVE: CVE-2022-34092
Published: 2022-07-14
Description: Portal do Software Publico Brasileiro i3geo v7.0.5 was discovered to contain a cross-site scripting (XSS) vulnerability via svg2img.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/edmarmoretti/i3geo/issues/3; https://github.com/saladesituacao/i3geo/issues/3; https://github.com/wagnerdracha/ProofOfConcept/blob/main/i3geo_proof_of_concept.txt#L23
CVE: CVE-2022-34093
Published: 2022-07-14
Description: Portal do Software Publico Brasileiro i3geo v7.0.5 was discovered to contain a cross-site scripting (XSS) vulnerability via access_token.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/edmarmoretti/i3geo/issues/4; https://github.com/saladesituacao/i3geo/issues/4; https://github.com/wagnerdracha/ProofOfConcept/blob/main/i3geo_proof_of_concept.txt#L44
CVE: CVE-2022-34094
Published: 2022-07-14
Description: Portal do Software Publico Brasileiro i3geo v7.0.5 was discovered to contain a cross-site scripting (XSS) vulnerability via request_token.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/edmarmoretti/i3geo/issues/5; https://github.com/saladesituacao/i3geo/issues/5; https://github.com/wagnerdracha/ProofOfConcept/blob/main/i3geo_proof_of_concept.txt#L65
CVE: CVE-2022-2418
Published: 2022-07-15
Description: A vulnerability was found in URVE Web Manager. It has been classified as critical. This affects an unknown part of the file kreator.html5/img_upload.php. The manipulation leads to unrestricted upload. Access to the local network is required for this attack. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.0 (HIGH)
CWE: CWE-434, CWE-434
References: https://github.com/joinia/webray.com.cn/blob/main/URVE/URVE%20Web%20Manager%20img_upload.php%20File%20upload%20vulnerability.md; https://vuldb.com/?id.203901; https://github.com/joinia/webray.com.cn/blob/main/URVE/URVE%20Web%20Manager%20img_upload.php%20File%20upload%20vulnerability.md
CVE: CVE-2022-2419
Published: 2022-07-15
Description: A vulnerability was found in URVE Web Manager. It has been declared as critical. This vulnerability affects unknown code of the file _internal/collector/upload.php. The manipulation leads to unrestricted upload. Access to the local network is required for this attack to succeed. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.0 (HIGH)
CWE: CWE-434, CWE-434
References: https://github.com/joinia/webray.com.cn/blob/main/URVE/URVE%20Web%20Manager%20upload.php%20File%20upload%20vulnerability.md; https://vuldb.com/?id.203902; https://github.com/joinia/webray.com.cn/blob/main/URVE/URVE%20Web%20Manager%20upload.php%20File%20upload%20vulnerability.md
CVE: CVE-2022-2420
Published: 2022-07-15
Description: A vulnerability was found in URVE Web Manager. It has been rated as critical. This issue affects some unknown processing of the file _internal/uploader.php. The manipulation leads to unrestricted upload. The attack needs to be approached within the local network. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.0 (HIGH)
CWE: CWE-434, CWE-434
References: https://github.com/joinia/webray.com.cn/blob/main/URVE/URVE%20Web%20Manager%20uploader.php%20%20File%20upload%20vulnerability.md; https://vuldb.com/?id.203903; https://github.com/joinia/webray.com.cn/blob/main/URVE/URVE%20Web%20Manager%20uploader.php%20%20File%20upload%20vulnerability.md
CVE: CVE-2022-1881
Published: 2022-07-15
Description: In affected versions of Octopus Server an Insecure Direct Object Reference vulnerability exists where it is possible for a user to download Project Exports from a Project they do not have permissions to access. This vulnerability only impacts projects within the same Space.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-639
References: https://advisories.octopus.com/post/2022/sa2022-06/; https://advisories.octopus.com/post/2022/sa2022-06/
CVE: CVE-2022-29890
Published: 2022-07-15
Description: In affected versions of Octopus Server the help sidebar can be customized to include a Cross-Site Scripting payload in the support link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://advisories.octopus.com/post/2022/sa2022-07/; https://advisories.octopus.com/post/2022/sa2022-07/
CVE: CVE-2020-35261
Published: 2022-07-15
Description: Cross Site Scripting (XSS) vulnerability in sourcecodester Multi Restaurant Table Reservation System 1.0 via the Restaurant Name field to /dashboard/profile.php.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/yunaranyancat/poc-dump/tree/main/MultiRestaurantReservationSystem/1.0; https://packetstormsecurity.com/files/159786/Multi-Restaurant-Table-Reservation-System-1.0-Cross-Site-Scripting.html; https://www.exploit-db.com/exploits/49135
CVE: CVE-2020-36550
Published: 2022-07-15
Description: Cross Site Scripting (XSS) vulnerability in sourcecodester Multi Restaurant Table Reservation System 1.0 via the Table Name field to /dashboard/table-list.php.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/yunaranyancat/poc-dump/tree/main/MultiRestaurantReservationSystem/1.0; https://packetstormsecurity.com/files/159786/Multi-Restaurant-Table-Reservation-System-1.0-Cross-Site-Scripting.html; https://www.exploit-db.com/exploits/49135
CVE: CVE-2020-36551
Published: 2022-07-15
Description: Cross Site Scripting (XSS) vulnerability in sourcecodester Multi Restaurant Table Reservation System 1.0 via the Item Name field to /dashboard/menu-list.php.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/yunaranyancat/poc-dump/tree/main/MultiRestaurantReservationSystem/1.0; https://packetstormsecurity.com/files/159786/Multi-Restaurant-Table-Reservation-System-1.0-Cross-Site-Scripting.html; https://www.exploit-db.com/exploits/49135
CVE: CVE-2020-36552
Published: 2022-07-15
Description: Cross Site Scripting (XSS) vulnerability in sourcecodester Multi Restaurant Table Reservation System 1.0 via the Made field to /dashboard/menu-list.php.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/yunaranyancat/poc-dump/tree/main/MultiRestaurantReservationSystem/1.0; https://packetstormsecurity.com/files/159786/Multi-Restaurant-Table-Reservation-System-1.0-Cross-Site-Scripting.html; https://www.exploit-db.com/exploits/49135
CVE: CVE-2020-36553
Published: 2022-07-15
Description: Cross Site Scripting (XSS) vulnerability in sourcecodester Multi Restaurant Table Reservation System 1.0 via the Area(food_type) field to /dashboard/menu-list.php.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/yunaranyancat/poc-dump/tree/main/MultiRestaurantReservationSystem/1.0; https://packetstormsecurity.com/files/159786/Multi-Restaurant-Table-Reservation-System-1.0-Cross-Site-Scripting.html; https://www.exploit-db.com/exploits/49135
CVE: CVE-2021-36461
Published: 2022-07-15
Description: An Arbitrary File Upload vulnerability exists in Microweber 1.1.3 that allows attackers to getshell via the Settings Upload Picture section by uploading pictures with malicious code, user.ini.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://github.com/microweber/microweber/issues/751; https://github.com/microweber/microweber/issues/751
CVE: CVE-2022-30242
Published: 2022-07-15
Description: Honeywell Alerton Ascent Control Module (ACM) through 2022-05-04 allows unauthenticated configuration changes from remote users. This enables configuration data to be stored on the controller and then implemented. A user with malicious intent can send a crafted packet to change the controller configuration without the knowledge of other users, altering the controller's function capabilities. The changed configuration is not updated in the User Interface, which creates an inconsistency between the configuration display and the actual configuration on the controller. After the configuration change, remediation requires reverting to the correct configuration, requiring either physical or remote access depending on the configuration that was altered.
CVSS Score: 6.8 (MEDIUM)
References: https://blog.scadafence.com; https://github.com/scadafence/Honeywell-Alerton-Vulnerabilities; https://www.honeywell.com/us/en/product-security
CVE: CVE-2022-30243
Published: 2022-07-15
Description: Honeywell Alerton Visual Logic through 2022-05-04 allows unauthenticated programming writes from remote users. This enables code to be stored on the controller and then run without verification. A user with malicious intent can send a crafted packet to change and/or stop the program without the knowledge of other users, altering the controller's function. After the programming change, the program needs to be overwritten in order for the controller to restore its original operational function.
CVSS Score: 8.8 (HIGH)
CWE: CWE-829
References: https://blog.scadafence.com; https://github.com/scadafence/Honeywell-Alerton-Vulnerabilities; https://www.honeywell.com/us/en/product-security
CVE: CVE-2022-30244
Published: 2022-07-15
Description: Honeywell Alerton Ascent Control Module (ACM) through 2022-05-04 allows unauthenticated programming writes from remote users. This enables code to be store on the controller and then run without verification. A user with malicious intent can send a crafted packet to change and/or stop the program without the knowledge of other users, altering the controller's function. After the programming change, the program needs to be overwritten in order for the controller to restore its original operational function.
CVSS Score: 8.0 (HIGH)
CWE: CWE-829
References: https://blog.scadafence.com; https://github.com/scadafence/Honeywell-Alerton-Vulnerabilities; https://www.honeywell.com/us/en/product-security