deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-35728
Published: 2022-08-04
Description: In BIG-IP Versions 17.0.x before 17.0.0.1, 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5.1, and all versions of 13.1.x, and BIG-IQ version 8.x before 8.2.0 and all versions of 7.x, an authenticated user's iControl REST token may remain valid for a limited time after logging out from the Configuration utility. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 8.1 (HIGH)
CWE: CWE-613
References: https://support.f5.com/csp/article/K55580033; https://support.f5.com/csp/article/K55580033
CVE: CVE-2022-35735
Published: 2022-08-04
Description: In BIG-IP Versions 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5.1, and all versions of 13.1.x, an authenticated attacker with Resource Administrator or Manager privileges can create or modify existing monitor objects in the Configuration utility in an undisclosed manner leading to a privilege escalation. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 7.2 (HIGH)
CWE: CWE-74
References: https://support.f5.com/csp/article/K13213418; https://support.f5.com/csp/article/K13213418
CVE: CVE-2022-34970
Published: 2022-08-04
Description: Crow before 1.0+4 has a heap-based buffer overflow via the function qs_parse in query_string.h. On successful exploitation this vulnerability allows attackers to remotely execute arbitrary code in the context of the vulnerable service.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-193
References: https://cwe.mitre.org/data/definitions/193.html; https://github.com/0xhebi/CVE-2022-34970/blob/master/report.md; https://github.com/CrowCpp/Crow/pull/486
CVE: CVE-2022-34993
Published: 2022-08-04
Description: Totolink A3600R_Firmware V4.1.2cu.5182_B20201102 contains a hard code password for root in /etc/shadow.sample.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: http://www.totolink.cn/home/menu/detail.html?menu_listtpl=download&id=63&ids=36image[PII_REDACTED]5532193; https://github.com/cilan2/iot/blob/main/1.md; http://www.totolink.cn/home/menu/detail.html?menu_listtpl=download&id=63&ids=36image[PII_REDACTED]5532193
CVE: CVE-2022-35929
Published: 2022-08-04
Description: cosign is a container signing and verification utility. In versions prior to 1.10.1 cosign can report a false positive if any attestation exists. `cosign verify-attestation` used with the `--type` flag will report a false positive verification when there is at least one attestation with a valid signature and there are NO attestations of the type being verified (--type defaults to "custom"). This can happen when signing with a standard keypair and with "keyless" signing with Fulcio. This vulnerability can be reproduced with the `distroless.dev/static@sha256:dd7614b5a12bc4d617b223c588b4e0c833402b8f4991fb5702ea83afad1986e2` image. This image has a `vuln` attestation but not an `spdx` attestation. However, if you run `cosign verify-attestation --type=spdx` on this image, it incorrectly succeeds. This issue has been addressed in version 1.10.1 of cosign. Users are advised to upgrade. There are no known workarounds for this issue.
CVSS Score: 7.1 (HIGH)
CWE: CWE-347
References: https://github.com/sigstore/cosign/commit/c5fda01a8ff33ca981f45a9f13e7fb6bd2080b94; https://github.com/sigstore/cosign/security/advisories/GHSA-vjxv-45g9-9296; https://github.com/sigstore/cosign/commit/c5fda01a8ff33ca981f45a9f13e7fb6bd2080b94
CVE: CVE-2022-35142
Published: 2022-08-04
Description: An issue in Renato v0.17.0 allows attackers to cause a Denial of Service (DoS) via a crafted payload injected into the Search parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://raneto.com/; https://cwe.mitre.org/data/definitions/703.html; https://gainsec.com/2022/08/04/cve-2022-35142-cve-2022-35143-cve-2022-35144/
CVE: CVE-2022-35143
Published: 2022-08-04
Description: Renato v0.17.0 employs weak password complexity requirements, allowing attackers to crack user passwords via brute-force attacks.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-521
References: http://raneto.com/; https://cwe.mitre.org/data/definitions/521.html; https://gainsec.com/2022/08/04/cve-2022-35142-cve-2022-35143-cve-2022-35144/
CVE: CVE-2022-35144
Published: 2022-08-04
Description: Renato v0.17.0 was discovered to contain a cross-site scripting (XSS) vulnerability.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: http://raneto.com/; https://cwe.mitre.org/data/definitions/79.html; https://gainsec.com/2022/08/04/cve-2022-35142-cve-2022-35143-cve-2022-35144/
CVE: CVE-2022-35858
Published: 2022-08-04
Description: The TEE_PopulateTransientObject and __utee_from_attr functions in Samsung mTower 0.3.0 allow a trusted application to trigger a memory overwrite, denial of service, and information disclosure by invoking the function TEE_PopulateTransientObject with a large number in the parameter attrCount.
CVSS Score: 7.8 (HIGH)
CWE: CWE-401
References: https://github.com/Samsung/mTower/blob/18f4b592a8a973ce5972f4e2658ea0f6e3686284/tee/lib/libutee/tee_api_objects.c#L283; https://github.com/Samsung/mTower/issues/71; https://github.com/Samsung/mTower/blob/18f4b592a8a973ce5972f4e2658ea0f6e3686284/tee/lib/libutee/tee_api_objects.c#L283
CVE: CVE-2021-32771
Published: 2022-08-04
Description: Contiki-NG is an open-source, cross-platform operating system for IoT devices. In affected versions it is possible to cause a buffer overflow when copying an IPv6 address prefix in the RPL-Classic implementation in Contiki-NG. In order to trigger the vulnerability, the Contiki-NG system must have joined an RPL DODAG. After that, an attacker can send a DAO packet with a Target option that contains a prefix length larger than 128 bits. The problem was fixed after the release of Contiki-NG 4.7. Users unable to upgrade may apply the patch in Contiki-NG PR #1615.
CVSS Score: 8.1 (HIGH)
CWE: CWE-120
References: https://github.com/contiki-ng/contiki-ng/pull/1615; https://github.com/contiki-ng/contiki-ng/pull/1615/commits/587ae59956e00316fd44fd7072ac3a6a07b4b20f; https://github.com/contiki-ng/contiki-ng/releases/tag/release%2Fv4.8
CVE: CVE-2022-35926
Published: 2022-08-04
Description: Contiki-NG is an open-source, cross-platform operating system for IoT devices. Because of insufficient validation of IPv6 neighbor discovery options in Contiki-NG, attackers can send neighbor solicitation packets that trigger an out-of-bounds read. The problem exists in the module os/net/ipv6/uip-nd6.c, where memory read operations from the main packet buffer, <code>uip_buf</code>, are not checked if they go out of bounds. In particular, this problem can occur when attempting to read the 2-byte option header and the Source Link-Layer Address Option (SLLAO). This attack requires ipv6 be enabled for the network. The problem has been patched in the develop branch of Contiki-NG. The upcoming 4.8 release of Contiki-NG will include the patch.Users unable to upgrade may apply the patch in Contiki-NG PR #1654.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-125
References: https://github.com/contiki-ng/contiki-ng/pull/1654; https://github.com/contiki-ng/contiki-ng/pull/1654/commits/a4597001d50a04f4b9c78f323ba731e2f979802c; https://github.com/contiki-ng/contiki-ng/releases/tag/release%2Fv4.8
CVE: CVE-2022-35927
Published: 2022-08-04
Description: Contiki-NG is an open-source, cross-platform operating system for IoT devices. In the RPL-Classic routing protocol implementation in the Contiki-NG operating system, an incoming DODAG Information Option (DIO) control message can contain a prefix information option with a length parameter. The value of the length parameter is not validated, however, and it is possible to cause a buffer overflow when copying the prefix in the set_ip_from_prefix function. This vulnerability affects anyone running a Contiki-NG version prior to 4.7 that can receive RPL DIO messages from external parties. To obtain a patched version, users should upgrade to Contiki-NG 4.7 or later. There are no workarounds for this issue.
CVSS Score: 8.1 (HIGH)
CWE: CWE-120, CWE-120
References: https://github.com/contiki-ng/contiki-ng/pull/1589; https://github.com/contiki-ng/contiki-ng/pull/1589/commits/4fffab0e632c4d01910fa957d1fd9ef321eb87d2; https://github.com/contiki-ng/contiki-ng/security/advisories/GHSA-9rm9-3phh-p4wm
CVE: CVE-2022-31793
Published: 2022-08-04
Description: do_request in request.c in muhttpd before 1.1.7 allows remote attackers to read arbitrary files by constructing a URL with a single character before a desired path on the filesystem. This occurs because the code skips over the first character when serving files. Arris NVG443, NVG599, NVG589, and NVG510 devices and Arris-derived BGW210 and BGW320 devices are affected.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://inglorion.net/software/muhttpd/; https://blog.malwarebytes.com/exploits-and-vulnerabilities/2022/08/millions-of-arris-routers-are-vulnerable-to-path-traversal-attacks/; https://derekabdine.com/blog/2022-arris-advisory
CVE: CVE-2022-35930
Published: 2022-08-04
Description: PolicyController is a utility used to enforce supply chain policy in Kubernetes clusters. In versions prior to 0.2.1 PolicyController will report a false positive, resulting in an admission when it should not be admitted when there is at least one attestation with a valid signature and there are NO attestations of the type being verified (--type defaults to "custom"). An example image that can be used to test this is `ghcr.io/distroless/static@sha256:dd7614b5a12bc4d617b223c588b4e0c833402b8f4991fb5702ea83afad1986e2`. Users should upgrade to version 0.2.1 to resolve this issue. There are no workarounds for users unable to upgrade.
CVSS Score: 7.1 (HIGH)
CWE: CWE-347
References: https://github.com/sigstore/policy-controller/commit/e852af36fb7d42678b21d7e97503c25bd1fd05c8; https://github.com/sigstore/policy-controller/releases/tag/v0.2.1; https://github.com/sigstore/policy-controller/security/advisories/GHSA-739f-hw6h-7wq8
CVE: CVE-2022-37030
Published: 2022-08-04
Description: Weak permissions on the configuration file in the PAM module in Grommunio Gromox 0.5 through 1.x before 1.28 allow a local unprivileged user in the gromox group to have the PAM stack execute arbitrary code upon loading the Gromox PAM module.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276
References: http://www.openwall.com/lists/oss-security/2022/08/04/1; https://bugzilla.suse.com/show_bug.cgi?id=1201949; http://www.openwall.com/lists/oss-security/2022/08/04/1
CVE: CVE-2022-37415
Published: 2022-08-05
Description: The Uniwill SparkIO.sys driver 1.0 is vulnerable to a stack-based buffer overflow via IOCTL 0x40002008.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://gist.github.com/alfarom256/220cb75816ca2b5556e7fc8d8d2803a0; https://gist.github.com/alfarom256/220cb75816ca2b5556e7fc8d8d2803a0
CVE: CVE-2022-21186
Published: 2022-08-05
Description: The package @acrontum/filesystem-template before 0.0.2 are vulnerable to Arbitrary Command Injection due to the fetchRepo API missing sanitization of the href field of external input.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/acrontum/filesystem-template/pull/14/commits/baeb727b60991ad82d9e63ac660883793abc0acc; https://security.snyk.io/vuln/SNYK-JS-ACRONTUMFILESYSTEMTEMPLATE-2419071; https://github.com/acrontum/filesystem-template/pull/14/commits/baeb727b60991ad82d9e63ac660883793abc0acc
CVE: CVE-2022-37416
Published: 2022-08-05
Description: Ittiam libmpeg2 before 2022-07-27 uses memcpy with overlapping memory blocks in impeg2_mc_fullx_fully_8x8.
CVSS Score: 6.5 (MEDIUM)
References: https://android-review.googlesource.com/c/platform/external/libmpeg2/+/2132593; https://issuetracker.google.com/issues/231026247; https://android-review.googlesource.com/c/platform/external/libmpeg2/+/2132593
CVE: CVE-2022-37431
Published: 2022-08-05
Description: A Reflected Cross-site scripting (XSS) issue was discovered in dotCMS Core through 22.06. This occurs in the admin portal when the configuration has XSS_PROTECTION_ENABLED=false. NOTE: the vendor disputes this because the current product behavior, in effect, has XSS_PROTECTION_ENABLED=true in all configurations
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://fortiguard.fortinet.com/zeroday/FG-VD-22-062; https://fortiguard.fortinet.com/zeroday/FG-VD-22-062
CVE: CVE-2022-37434
Published: 2022-08-05
Description: zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some common applications bundle the affected zlib source code but may be unable to call inflateGetHeader (e.g., see the nodejs/node reference).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-120
References: http://seclists.org/fulldisclosure/2022/Oct/37; http://seclists.org/fulldisclosure/2022/Oct/38; http://seclists.org/fulldisclosure/2022/Oct/41
CVE: CVE-2022-2626
Published: 2022-08-05
Description: Incorrect Privilege Assignment in GitHub repository hestiacp/hestiacp prior to 1.6.6.
CVSS Score: 7.2 (HIGH)
CWE: CWE-266
References: https://github.com/hestiacp/hestiacp/commit/b178b9719bb2c98cf8a6db70065086f596afad81; https://huntr.dev/bounties/704aacc9-edff-4da5-90a6-4adf8dbf36fe; https://github.com/hestiacp/hestiacp/commit/b178b9719bb2c98cf8a6db70065086f596afad81
CVE: CVE-2022-2636
Published: 2022-08-05
Description: Improper Control of Generation of Code ('Code Injection') in GitHub repository hestiacp/hestiacp prior to 1.6.6.
CVSS Score: 8.5 (HIGH)
CWE: CWE-94, CWE-94
References: https://github.com/hestiacp/hestiacp/commit/b178b9719bb2c98cf8a6db70065086f596afad81; https://huntr.dev/bounties/357c0390-631c-4684-b6e1-a6d8b2453d66; https://github.com/hestiacp/hestiacp/commit/b178b9719bb2c98cf8a6db70065086f596afad81
CVE: CVE-2022-2664
Published: 2022-08-05
Description: A vulnerability classified as critical has been found in Private Cloud Management Platform. Affected is an unknown function of the file /management/api/rcx_management/global_config_query of the component POST Request Handler. The manipulation leads to improper authentication. It is possible to launch the attack remotely. VDB-205614 is the identifier assigned to this vulnerability.
CVSS Score: 7.3 (HIGH)
CWE: CWE-287
References: https://vuldb.com/?id.205614; https://vuldb.com/?id.205614
CVE: CVE-2022-2665
Published: 2022-08-05
Description: A vulnerability classified as critical was found in SourceCodester Simple E-Learning System. Affected by this vulnerability is an unknown functionality of the file classroom.php. The manipulation of the argument post_id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-205615.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://vuldb.com/?id.205615; https://vuldb.com/?id.205615
CVE: CVE-2022-2667
Published: 2022-08-05
Description: A vulnerability was found in SourceCodester Loan Management System and classified as critical. This issue affects some unknown processing of the file delete_lplan.php. The manipulation of the argument lplan_id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-205619.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/cxaqhq/Loan-Management-System-Sqlinjection; https://vuldb.com/?id.205619; https://github.com/cxaqhq/Loan-Management-System-Sqlinjection
CVE: CVE-2022-2671
Published: 2022-08-05
Description: A vulnerability was found in SourceCodester Garage Management System and classified as critical. This issue affects some unknown processing of the file removeUser.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-205655.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://vuldb.com/?id.205655; https://vuldb.com/?id.205655
CVE: CVE-2022-2672
Published: 2022-08-05
Description: A vulnerability was found in SourceCodester Garage Management System. It has been classified as critical. Affected is an unknown function of the file createUser.php. The manipulation of the argument userName/uemail leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-205656.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://vuldb.com/?id.205656; https://vuldb.com/?id.205656
CVE: CVE-2022-2673
Published: 2022-08-05
Description: A vulnerability was found in Rigatur Online Booking and Hotel Management System aff6409. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file login.php of the component POST Request Handler. The manipulation of the argument email/pass leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-205657 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://vuldb.com/?id.205657; https://vuldb.com/?id.205657
CVE: CVE-2022-2674
Published: 2022-08-05
Description: A vulnerability was found in SourceCodester Best Fee Management System. It has been rated as critical. Affected by this issue is the function login of the file admin_class.php. The manipulation of the argument username leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-205658 is the identifier assigned to this vulnerability.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://vuldb.com/?id.205658; https://vuldb.com/?id.205658
CVE: CVE-2022-35936
Published: 2022-08-05
Description: Ethermint is an Ethereum library. In Ethermint running versions before `v0.17.2`, the contract `selfdestruct` invocation permanently removes the corresponding bytecode from the internal database storage. However, due to a bug in the `DeleteAccount`function, all contracts that used the identical bytecode (i.e shared the same `CodeHash`) will also stop working once one contract invokes `selfdestruct`, even though the other contracts did not invoke the `selfdestruct` OPCODE. This vulnerability has been patched in Ethermint version v0.18.0. The patch has state machine-breaking changes for applications using Ethermint, so a coordinated upgrade procedure is required. A workaround is available. If a contract is subject to DoS due to this issue, the user can redeploy the same contract, i.e. with identical bytecode, so that the original contract's code is recovered. The new contract deployment restores the `bytecode hash -> bytecode` entry in the internal state.
CVSS Score: 8.2 (HIGH)
CWE: CWE-668
References: https://github.com/evmos/ethermint/blob/c9d42d667b753147977a725e98ed116c933c76cb/x/evm/keeper/statedb.go#L199-L203; https://github.com/evmos/ethermint/commit/[PII_REDACTED]7a26dbe950512acbda4ed95b2a451; https://github.com/evmos/ethermint/security/advisories/GHSA-f92v-grc2-w2fg
CVE: CVE-2016-3098
Published: 2022-08-05
Description: Cross-site request forgery (CSRF) vulnerability in administrate 0.1.4 and earlier allows remote attackers to hijack the user's OAuth autorization code.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://seclists.org/oss-sec/2016/q2/0; https://seclists.org/oss-sec/2016/q2/0
CVE: CVE-2020-1691
Published: 2022-08-05
Description: In Moodle 3.8, messages required extra sanitizing before updating the conversation overview, to prevent the risk of stored cross-site scripting.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://moodle.org/mod/forum/discuss.php?d=395953; https://moodle.org/mod/forum/discuss.php?d=395953
CVE: CVE-2020-1754
Published: 2022-08-05
Description: In Moodle before 3.8.2, 3.7.5, 3.6.9 and 3.5.11, users viewing the grade history report without the 'access all groups' capability were not restricted to viewing grades of users within their own groups.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284, CWE-732
References: https://moodle.org/mod/forum/discuss.php?d=398350; https://moodle.org/mod/forum/discuss.php?d=398350
CVE: CVE-2021-27798
Published: 2022-08-05
Description: A vulnerability in Brocade Fabric OS versions 7.4.1b and 7.3.1d could allow local users to conduct privileged directory transversal. Brocade Fabric OS versions 7.4.1.x and 7.3.x have reached end of life. Brocade Fabric OS Users should upgrade to supported versions as described in the Product End-of-Life published report.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2022-2012; https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2022-2012
CVE: CVE-2021-36861
Published: 2022-08-05
Description: Cross-Site Request Forgery (CSRF) vulnerability in Rich Reviews by Starfish plugin <= 1.9.14 at WordPress allows an attacker to delete reviews.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/rich-reviews/wordpress-rich-reviews-by-starfish-plugin-1-9-14-cross-site-request-forgery-csrf-vulnerability; https://wordpress.org/plugins/rich-reviews/#developers; https://patchstack.com/database/vulnerability/rich-reviews/wordpress-rich-reviews-by-starfish-plugin-1-9-14-cross-site-request-forgery-csrf-vulnerability
CVE: CVE-2021-46676
Published: 2022-08-05
Description: A XSS vulnerability exist in Pandora FMS version 756 and below, that allows an attacker to perform javascript code executions via the transactional maps name field.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/; https://www.incibe.es/en/cve-assignment-publication/coordinated-cves; https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/
CVE: CVE-2021-46677
Published: 2022-08-05
Description: A XSS vulnerability exist in Pandora FMS version 756 and below, that allows an attacker to perform javascript code executions via the event filter name field.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/; https://www.incibe.es/en/cve-assignment-publication/coordinated-cves; https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/
CVE: CVE-2021-46678
Published: 2022-08-05
Description: A XSS vulnerability exist in Pandora FMS version 756 and below, that allows an attacker to perform javascript code executions via the service name field.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/; https://www.incibe.es/en/cve-assignment-publication/coordinated-cves; https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/
CVE: CVE-2021-46679
Published: 2022-08-05
Description: A XSS vulnerability exist in Pandora FMS version 756 and below, that allows an attacker to perform javascript code executions via service elements.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/; https://www.incibe.es/en/cve-assignment-publication/coordinated-cves; https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/
CVE: CVE-2021-46680
Published: 2022-08-05
Description: A XSS vulnerability exist in Pandora FMS version 756 and below, that allows an attacker to perform javascript code executions via the module form name field.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/; https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/