deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-46648
Published: 2023-01-17
Description: ruby-git versions prior to v1.13.0 allows a remote authenticated attacker to execute an arbitrary ruby code by having a user to load a repository containing a specially crafted filename to the product. This vulnerability is different from CVE-2022-47318.
CVSS Score: 8.0 (HIGH)
CWE: CWE-94, CWE-94
References: https://github.com/ruby-git/ruby-git; https://github.com/ruby-git/ruby-git/pull/602; https://jvn.jp/en/jp/JVN16765254/index.html
CVE: CVE-2022-47318
Published: 2023-01-17
Description: ruby-git versions prior to v1.13.0 allows a remote authenticated attacker to execute an arbitrary ruby code by having a user to load a repository containing a specially crafted filename to the product. This vulnerability is different from CVE-2022-46648.
CVSS Score: 8.0 (HIGH)
CWE: CWE-94
References: https://github.com/ruby-git/ruby-git; https://github.com/ruby-git/ruby-git/pull/602; https://jvn.jp/en/jp/JVN16765254/index.html
CVE: CVE-2023-22278
Published: 2023-01-17
Description: m-FILTER prior to Ver.5.70R01 (Ver.5 Series) and m-FILTER prior to Ver.4.87R04 (Ver.4 Series) allows a remote unauthenticated attacker to bypass authentication and send users' unintended email when email is being sent under the certain conditions. The attacks exploiting this vulnerability have been observed.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-287
References: https://jvn.jp/en/jp/JVN55675303/index.html; https://jvn.jp/en/jp/JVN55675303/index.html
CVE: CVE-2023-22279
Published: 2023-01-17
Description: MAHO-PBX NetDevancer Lite/Uni/Pro/Cloud prior to Ver.1.11.00, MAHO-PBX NetDevancer VSG Lite/Uni prior to Ver.1.11.00, and MAHO-PBX NetDevancer MobileGate Home/Office prior to Ver.1.11.00 allow a remote unauthenticated attacker to execute an arbitrary OS command.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://jvn.jp/en/jp/JVN99957889/index.html; https://www.ate-mahoroba.jp/netdevancer/manual/; https://jvn.jp/en/jp/JVN99957889/index.html
CVE: CVE-2023-22280
Published: 2023-01-17
Description: MAHO-PBX NetDevancer Lite/Uni/Pro/Cloud prior to Ver.1.11.00, MAHO-PBX NetDevancer VSG Lite/Uni prior to Ver.1.11.00, and MAHO-PBX NetDevancer MobileGate Home/Office prior to Ver.1.11.00 allow a remote authenticated attacker with an administrative privilege to execute an arbitrary OS command.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78, CWE-78
References: https://jvn.jp/en/jp/JVN99957889/index.html; https://www.ate-mahoroba.jp/netdevancer/manual/; https://jvn.jp/en/jp/JVN99957889/index.html
CVE: CVE-2023-22286
Published: 2023-01-17
Description: Cross-site request forgery (CSRF) vulnerability in MAHO-PBX NetDevancer Lite/Uni/Pro/Cloud prior to Ver.1.11.00, MAHO-PBX NetDevancer VSG Lite/Uni prior to Ver.1.11.00, and MAHO-PBX NetDevancer MobileGate Home/Office prior to Ver.1.11.00 allows a remote unauthenticated attacker to hijack the user authentication and conduct user's unintended operations by having a user to view a malicious page while logged in.
CVSS Score: 8.1 (HIGH)
CWE: CWE-352, CWE-352
References: https://jvn.jp/en/jp/JVN99957889/index.html; https://www.ate-mahoroba.jp/netdevancer/manual/; https://jvn.jp/en/jp/JVN99957889/index.html
CVE: CVE-2023-22296
Published: 2023-01-17
Description: Reflected cross-site scripting vulnerability in MAHO-PBX NetDevancer series MAHO-PBX NetDevancer Lite/Uni/Pro/Cloud prior to Ver.1.11.00, MAHO-PBX NetDevancer VSG Lite/Uni prior to Ver.1.11.00, and MAHO-PBX NetDevancer MobileGate Home/Office prior to Ver.1.11.00 allows a remote unauthenticated attacker to inject an arbitrary script.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://jvn.jp/en/jp/JVN99957889/index.html; https://www.ate-mahoroba.jp/netdevancer/manual/; https://jvn.jp/en/jp/JVN99957889/index.html
CVE: CVE-2023-22298
Published: 2023-01-17
Description: Open redirect vulnerability in pgAdmin 4 versions prior to v6.14 allows a remote unauthenticated attacker to redirect a user to an arbitrary web site and conduct a phishing attack by having a user to access a specially crafted URL.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601, CWE-601
References: https://github.com/pgadmin-org/pgadmin4; https://github.com/pgadmin-org/pgadmin4/issues/5343; https://jvn.jp/en/jp/JVN03832974/index.html
CVE: CVE-2023-22303
Published: 2023-01-17
Description: TP-Link SG105PE firmware prior to 'TL-SG105PE(UN) 1.0_1.0.0 Build 20221208' contains an authentication bypass vulnerability. Under the certain conditions, an attacker may impersonate an administrator of the product. As a result, information may be obtained and/or the product's settings may be altered with the privilege of the administrator.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287, CWE-287
References: https://jvn.jp/en/jp/JVN78481846/index.html; https://www.tp-link.com/en/business-networking/easy-smart-switch/tl-sg105pe/; https://www.tp-link.com/jp/support/download/tl-sg105pe/v1/#Firmware
CVE: CVE-2023-22304
Published: 2023-01-17
Description: OS command injection vulnerability in PIX-RT100 versions RT100_TEQ_2.1.1_EQ101 and RT100_TEQ_2.1.2_EQ101 allows a network-adjacent attacker who can access product settings to execute an arbitrary OS command.
CVSS Score: 8.0 (HIGH)
CWE: CWE-78, CWE-78
References: https://jvn.jp/en/jp/JVN57296685/index.html; https://www.pixela.co.jp/products/network/pix_rt100/update.html; https://jvn.jp/en/jp/JVN57296685/index.html
CVE: CVE-2023-22316
Published: 2023-01-17
Description: Hidden functionality vulnerability in PIX-RT100 versions RT100_TEQ_2.1.1_EQ101 and RT100_TEQ_2.1.2_EQ101 allows a network-adjacent attacker to access the product via undocumented Telnet or SSH services.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-912
References: https://jvn.jp/en/jp/JVN57296685/index.html; https://www.pixela.co.jp/products/network/pix_rt100/update.html; https://jvn.jp/en/jp/JVN57296685/index.html
CVE: CVE-2023-22357
Published: 2023-01-17
Description: Active debug code exists in OMRON CP1L-EL20DR-D all versions, which may lead to a command that is not specified in FINS protocol being executed without authentication. A remote unauthenticated attacker may read/write in arbitrary area of the device memory, which may lead to overwriting the firmware, causing a denial-of-service (DoS) condition, and/or arbitrary code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-489
References: https://jvn.jp/en/vu/JVNVU97575890/index.html; https://jvn.jp/en/vu/JVNVU97575890/index.html
CVE: CVE-2023-22366
Published: 2023-01-17
Description: CX-Motion-MCH v2.32 and earlier contains an access of uninitialized pointer vulnerability. Having a user to open a specially crafted project file may lead to information disclosure and/or arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-824, CWE-824
References: https://jvn.jp/en/vu/JVNVU91744508/index.html; https://jvn.jp/en/vu/JVNVU91744508/index.html
CVE: CVE-2015-10058
Published: 2023-01-17
Description: A vulnerability, which was classified as problematic, was found in Wikisource Category Browser. This affects an unknown part of the file index.php. The manipulation of the argument lang leads to cross site scripting. It is possible to initiate the attack remotely. The patch is named 764f4e8ce3f9242637df77530c70ae8a2ec4b6a1. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-218415.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/wikisource/ws-cat-browser/commit/764f4e8ce3f9242637df77530c70ae8a2ec4b6a1; https://vuldb.com/?ctiid.218415; https://vuldb.com/?id.218415
CVE: CVE-2015-10059
Published: 2023-01-17
Description: A vulnerability has been found in s134328 Webapplication-Veganguide and classified as problematic. This vulnerability affects unknown code of the file p05-integration/app/shared/api/apiService.js. The manipulation of the argument country/city leads to cross site scripting. The attack can be initiated remotely. The name of the patch is 2aa760fa4e779e40a28206a32ac22ac10356f519. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-218416.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/s134328/Webapplication-Veganguide/commit/2aa760fa4e779e40a28206a32ac22ac10356f519; https://vuldb.com/?ctiid.218416; https://vuldb.com/?id.218416
CVE: CVE-2015-10060
Published: 2023-01-17
Description: A vulnerability was found in MNBikeways database and classified as critical. This issue affects some unknown processing of the file Data/views.py. The manipulation of the argument id1/id2 leads to sql injection. The identifier of the patch is 829a027aca7c17f5a7ec1addca8dd5d5542f86ac. It is recommended to apply a patch to fix this issue. The identifier VDB-218417 was assigned to this vulnerability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/MNBikeways/database/commit/829a027aca7c17f5a7ec1addca8dd5d5542f86ac; https://vuldb.com/?ctiid.218417; https://vuldb.com/?id.218417
CVE: CVE-2017-20170
Published: 2023-01-17
Description: A vulnerability was found in ollpu parontalli. It has been classified as critical. Affected is an unknown function of the file httpdocs/index.php. The manipulation of the argument s leads to sql injection. The patch is identified as 6891bb2dec57dca6daabc15a6d2808c8896620e5. It is recommended to apply a patch to fix this issue. VDB-218418 is the identifier assigned to this vulnerability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://github.com/ollpu/parontalli/commit/6891bb2dec57dca6daabc15a6d2808c8896620e5; https://vuldb.com/?ctiid.218418; https://vuldb.com/?id.218418
CVE: CVE-2013-10013
Published: 2023-01-17
Description: A vulnerability was found in Bricco Authenticator Plugin. It has been declared as critical. This vulnerability affects the function authenticate/compare of the file src/java/talentum/escenic/plugins/authenticator/authenticators/DBAuthenticator.java. The manipulation leads to sql injection. Upgrading to version 1.39 is able to address this issue. The name of the patch is a5456633ff75e8f13705974c7ed1ce77f3f142d5. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-218428.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/Bricco/authenticator-plugin/commit/a5456633ff75e8f13705974c7ed1ce77f3f142d5; https://github.com/Bricco/authenticator-plugin/releases/tag/1.39; https://vuldb.com/?ctiid.218428
CVE: CVE-2015-10061
Published: 2023-01-17
Description: A vulnerability was found in evandro-machado Trabalho-Web2. It has been classified as critical. This affects an unknown part of the file src/java/br/com/magazine/dao/ClienteDAO.java. The manipulation leads to sql injection. The patch is named f59ac954625d0a4f6d34f069a2e26686a7a20aeb. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-218427.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/evandro-machado/Trabalho-Web2/commit/f59ac954625d0a4f6d34f069a2e26686a7a20aeb; https://vuldb.com/?ctiid.218427; https://vuldb.com/?id.218427
CVE: CVE-2016-15021
Published: 2023-01-17
Description: A vulnerability was found in nickzren alsdb. It has been rated as critical. This issue affects some unknown processing. The manipulation leads to sql injection. Upgrading to version v2 is able to address this issue. The identifier of the patch is cbc79a68145e845f951113d184b4de207c341599. It is recommended to upgrade the affected component. The identifier VDB-218429 was assigned to this vulnerability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/nickzren/alsdb/commit/cbc79a68145e845f951113d184b4de207c341599; https://github.com/nickzren/alsdb/releases/tag/v2; https://vuldb.com/?ctiid.218429
CVE: CVE-2023-0337
Published: 2023-01-17
Description: Cross-site Scripting (XSS) - Reflected in GitHub repository lirantal/daloradius prior to master-branch.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/lirantal/daloradius/commit/e77a769c7503e63a2e3c05262cb5f8f81a4a7bbe; https://huntr.dev/bounties/1c50a5a5-3f55-4b6f-b861-4d5cdb6eb81b; https://github.com/lirantal/daloradius/commit/e77a769c7503e63a2e3c05262cb5f8f81a4a7bbe
CVE: CVE-2023-0338
Published: 2023-01-17
Description: Cross-site Scripting (XSS) - Reflected in GitHub repository lirantal/daloradius prior to master-branch.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/lirantal/daloradius/commit/e77a769c7503e63a2e3c05262cb5f8f81a4a7bbe; https://huntr.dev/bounties/fcae1b67-db37-4d24-9137-8dda95573e77; https://github.com/lirantal/daloradius/commit/e77a769c7503e63a2e3c05262cb5f8f81a4a7bbe
CVE: CVE-2022-2893
Published: 2023-01-17
Description: RONDS EPM version 1.19.5 does not properly validate the filename 
parameter, which could allow an unauthorized user to specify file paths 
and download files.  




CVSS Score: 8.2 (HIGH)
CWE: CWE-22
References: https://www.cisa.gov/uscert/ics/advisories/icsa-23-012-02; https://www.cisa.gov/uscert/ics/advisories/icsa-23-012-02
CVE: CVE-2022-3091
Published: 2023-01-17
Description: RONDS EPM version 1.19.5 has a vulnerability in which a function could 
allow unauthenticated users to leak credentials. In some circumstances, 
an attacker can exploit this vulnerability to execute operating system 
(OS) commands. 




CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://www.cisa.gov/uscert/ics/advisories/icsa-23-012-02; https://www.cisa.gov/uscert/ics/advisories/icsa-23-012-02
CVE: CVE-2022-4621
Published: 2023-01-17
Description: Panasonic Sanyo CCTV Network Cameras versions 1.02-05 and 2.03-0x are 
vulnerable to CSRFs that can be exploited to allow an attacker to 
perform changes with administrator level privileges. 




CVSS Score: 7.5 (HIGH)
CWE: CWE-352
References: https://archives.connect.panasonic.com/security/sanyo/index.html; https://www.cisa.gov/uscert/ics/advisories/icsa-23-012-04; https://archives.connect.panasonic.com/security/sanyo/index.html
CVE: CVE-2023-0158
Published: 2023-01-17
Description: NLnet Labs Krill supports direct access to the RRDP repository content through its built-in web server at the "/rrdp" endpoint. Prior to 0.12.1 a direct query for any existing directory under "/rrdp/", rather than an RRDP file such as "/rrdp/notification.xml" as would be expected, causes Krill to crash. If the built-in "/rrdp" endpoint is exposed directly to the internet, then malicious remote parties can cause the publication server to crash. The repository content is not affected by this, but the availability of the server and repository can cause issues if this attack is persistent and is not mitigated.
CVSS Score: 7.5 (HIGH)
CWE: CWE-248
References: https://www.nlnetlabs.nl/downloads/krill/CVE-2023-0158.txt; https://www.nlnetlabs.nl/downloads/krill/CVE-2023-0158.txt
CVE: CVE-2018-14628
Published: 2023-01-17
Description: An information leak vulnerability was discovered in Samba's LDAP server. Due to missing access control checks, an authenticated but unprivileged attacker could discover the names and preserved attributes of deleted objects in the LDAP store.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: http://www.openwall.com/lists/oss-security/2023/11/28/4; https://bugzilla.redhat.com/show_bug.cgi?id=1625445; https://bugzilla.samba.org/show_bug.cgi?id=13595
CVE: CVE-2022-41858
Published: 2023-01-17
Description: A flaw was found in the Linux kernel. A NULL pointer dereference may occur while a slip driver is in progress to detach in sl_tx_timeout in drivers/net/slip/slip.c. This issue could allow an attacker to crash the system or leak internal kernel information.
CVSS Score: 7.1 (HIGH)
CWE: CWE-416, CWE-476
References: https://github.com/torvalds/linux/commit/ec4eb8a86ade4d22633e1da2a7d85a846b7d1798; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://github.com/torvalds/linux/commit/ec4eb8a86ade4d22633e1da2a7d85a846b7d1798
CVE: CVE-2022-41859
Published: 2023-01-17
Description: In freeradius, the EAP-PWD function compute_password_element() leaks information about the password which allows an attacker to substantially reduce the size of an offline dictionary attack.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200, CWE-522
References: https://freeradius.org/security/; https://github.com/FreeRADIUS/freeradius-server/commit/9e5e8f2f; https://freeradius.org/security/
CVE: CVE-2022-41860
Published: 2023-01-17
Description: In freeradius, when an EAP-SIM supplicant sends an unknown SIM option, the server will try to look that option up in the internal dictionaries. This lookup will fail, but the SIM code will not check for that failure. Instead, it will dereference a NULL pointer, and cause the server to crash.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://freeradius.org/security/; https://github.com/FreeRADIUS/freeradius-server/commit/f1cdbb33ec61c4a64a; https://freeradius.org/security/
CVE: CVE-2022-41861
Published: 2023-01-17
Description: A flaw was found in freeradius. A malicious RADIUS client or home server can send a malformed abinary attribute which can cause the server to crash.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400, CWE-20
References: https://freeradius.org/security/; https://github.com/FreeRADIUS/freeradius-server/commit/0ec2b39d260e; https://freeradius.org/security/
CVE: CVE-2022-4121
Published: 2023-01-17
Description: In libetpan a null pointer dereference in mailimap_mailbox_data_status_free in low-level/imap/mailimap_types.c was found that could lead to a remote denial of service or other potential consequences.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://github.com/dinhvh/libetpan/commit/5c9eb6b6ba64c4eb927d7a[PII_REDACTED]81aacbba; https://github.com/dinhvh/libetpan/issues/420; https://github.com/dinhvh/libetpan/commit/5c9eb6b6ba64c4eb927d7a[PII_REDACTED]81aacbba
CVE: CVE-2015-10062
Published: 2023-01-17
Description: A vulnerability, which was classified as problematic, was found in galaxy-data-resource up to 14.10.0. This affects an unknown part of the component Command Line Template. The manipulation leads to injection. Upgrading to version 14.10.1 is able to address this issue. The patch is named 50d65f45d3f5be5d1fbff2e45ac5cec075f07d42. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-218451.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-74
References: https://github.com/blankenberg/galaxy-data-resource/commit/50d65f45d3f5be5d1fbff2e45ac5cec075f07d42; https://github.com/blankenberg/galaxy-data-resource/releases/tag/v14.10.1; https://vuldb.com/?ctiid.218451
CVE: CVE-2015-10063
Published: 2023-01-17
Description: A vulnerability was found in saemorris TheRadSystem and classified as critical. This issue affects the function redirect of the file _login.php. The manipulation of the argument user/pass leads to sql injection. The attack may be initiated remotely. The identifier of the patch is bfba26bd34af31648a11af35a0bb66f1948752a6. It is recommended to apply a patch to fix this issue. The identifier VDB-218453 was assigned to this vulnerability.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://github.com/saemorris/TheRadSystem/commit/bfba26bd34af31648a11af35a0bb66f1948752a6; https://vuldb.com/?ctiid.218453; https://vuldb.com/?id.218453
CVE: CVE-2015-10064
Published: 2023-01-17
Description: A vulnerability was found in VictorFerraresi pokemon-database-php. It has been declared as critical. Affected by this vulnerability is an unknown functionality. The manipulation leads to sql injection. The patch is named dd0e1e6cdf648d6a3deff441f515bcb1d7573d68. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-218455.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/VictorFerraresi/pokemon-database-php/commit/dd0e1e6cdf648d6a3deff441f515bcb1d7573d68; https://vuldb.com/?ctiid.218455; https://vuldb.com/?id.218455
CVE: CVE-2022-23739
Published: 2023-01-17
Description: An incorrect authorization vulnerability was identified in GitHub Enterprise Server, allowing for escalation of privileges in GraphQL API requests from GitHub Apps. This vulnerability allowed an app installed on an organization to gain access to and modify most organization-level resources that are not tied to a repository regardless of granted permissions, such as users and organization-wide projects. Resources associated with repositories were not impacted, such as repository file content, repository-specific projects, issues, or pull requests. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.7.1 and was fixed in versions 3.3.16, 3.4.11, 3.5.8, 3.6.4, 3.7.1. This vulnerability was reported via the GitHub Bug Bounty program.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-863, CWE-863
References: https://docs.github.com/en/enterprise-server%403.3/admin/release-notes#3.3.16; https://docs.github.com/en/enterprise-server%403.4/admin/release-notes#3.4.11; https://docs.github.com/en/enterprise-server%403.5/admin/release-notes#3.5.8
CVE: CVE-2022-3650
Published: 2023-01-17
Description: A privilege escalation flaw was found in Ceph. Ceph-crash.service allows a local attacker to escalate privileges to root in the form of a crash dump, and dump privileged information.
CVSS Score: 7.8 (HIGH)
CWE: CWE-842
References: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OEVVWT5ZFLYCVZNDJTDX7R6RY2W7JHP5/; https://seclists.org/oss-sec/2022/q4/41; https://security.gentoo.org/glsa/202312-10
CVE: CVE-2022-40704
Published: 2023-01-17
Description: A XSS vulnerability was found in phoromatic_r_add_test_details.php in phoronix-test-suite.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/phoronix-test-suite/phoronix-test-suite/commit/d3880d9d3ba795138444da83f1153c3c3ac27640; https://github.com/phoronix-test-suite/phoronix-test-suite/issues/650; https://github.com/phoronix-test-suite/phoronix-test-suite/commit/d3880d9d3ba795138444da83f1153c3c3ac27640
CVE: CVE-2022-47853
Published: 2023-01-17
Description: TOTOlink A7100RU V7.4cu.2313_B20191024 is vulnerable to Command Injection Vulnerability in the httpd service. An attacker can obtain a stable root shell through a specially constructed payload.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://github.com/Am1ngl/ttt/tree/main/16; https://github.com/Am1ngl/ttt/tree/main/16
CVE: CVE-2023-22875
Published: 2023-01-17
Description: 
IBM QRadar SIEM 7.4 and 7.5copies certificate key files used for SSL/TLS in the QRadar web user interface to managed hosts in the deployment that do not require that key. IBM X-Force ID: 244356.


CVSS Score: 8.4 (HIGH)
CWE: CWE-200
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/244356; https://www.ibm.com/support/pages/node/6855643; https://exchange.xforce.ibmcloud.com/vulnerabilities/244356
CVE: CVE-2006-20001
Published: 2023-01-17
Description: A carefully crafted If: request header can cause a memory read, or write of a single zero byte, in a pool (heap) memory location beyond the header value sent. This could cause the process to crash.

This issue affects Apache HTTP Server 2.4.54 and earlier.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://httpd.apache.org/security/vulnerabilities_24.html; https://security.gentoo.org/glsa/202309-01; https://httpd.apache.org/security/vulnerabilities_24.html
CVE: CVE-2022-36760
Published: 2023-01-17
Description: Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server allows an attacker to smuggle requests to the AJP server it forwards requests to.  This issue affects Apache HTTP Server Apache HTTP Server 2.4 version 2.4.54 and prior versions.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-444, CWE-444
References: https://httpd.apache.org/security/vulnerabilities_24.html; https://security.gentoo.org/glsa/202309-01; https://httpd.apache.org/security/vulnerabilities_24.html