deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-22426
Published: 2022-06-10
Description: IBM Spectrum Copy Data Management Admin 2.2.0.0 through 2.2.15.0 could allow a local attacker to bypass authentication restrictions, caused by the lack of proper session management. An attacker could exploit this vulnerability to bypass authentication and gain unauthorized access to the Spectrum Copy Data Management catalog which contains metadata. IBM X-Force ID: 223718.
CVSS Score: 3.3 (LOW)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/223718; https://www.ibm.com/support/pages/node/6593721; https://exchange.xforce.ibmcloud.com/vulnerabilities/223718
CVE: CVE-2022-22479
Published: 2022-06-10
Description: IBM Spectrum Copy Data Management 2.2.0.0through 2.2.15.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 225887.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/225887; https://www.ibm.com/support/pages/node/6593721; https://exchange.xforce.ibmcloud.com/vulnerabilities/225887
CVE: CVE-2022-30610
Published: 2022-06-10
Description: IBM Spectrum Copy Data Management 2.2.0.0 through 2.2.15.0 is vulnerable to reverse tabnabbing where it could allow a page linked to from within IBM Spectrum Copy Data Management to rewrite it. An administrator could enter a link to a malicious URL that another administrator could then click. Once clicked, that malicious URL could then rewrite the original page with a phishing page. IBM X-Force ID: 227363.
CVSS Score: 4.5 (MEDIUM)
CWE: CWE-269
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/227363; https://www.ibm.com/support/pages/node/6593721; https://exchange.xforce.ibmcloud.com/vulnerabilities/227363
CVE: CVE-2022-30611
Published: 2022-06-10
Description: IBM Spectrum Copy Data Management 2.2.0.0 through 2.2.15.0 is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability using some fields of the form in the portal UI to inject malicious script into a Web page which would be executed in a victim's Web browser within the security context of the hosting Web site, once the page is viewed. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials. IBM X-Force ID: 227364.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/227364; https://www.ibm.com/support/pages/node/6593721; https://exchange.xforce.ibmcloud.com/vulnerabilities/227364
CVE: CVE-2022-31769
Published: 2022-06-10
Description: IBM Spectrum Copy Data Management 2.2.0.0 through 2.2.15.0 could allow a remote attacker to view product configuration information stored in PostgreSQL, which could be used in further attacks against the system. IBM X-Force ID: 228219.
CVSS Score: 5.3 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/228219; https://www.ibm.com/support/pages/node/6593721; https://exchange.xforce.ibmcloud.com/vulnerabilities/228219
CVE: CVE-2022-29948
Published: 2022-06-10
Description: Due to an insecure design, the Lepin EP-KP001 flash drive through KP001_V19 is vulnerable to an authentication bypass attack that enables an attacker to gain access to the stored encrypted data. Normally, the encrypted disk partition with this data is unlocked by entering the correct passcode (6 to 14 digits) via the keypad and pressing the Unlock button. This authentication is performed by an unknown microcontroller. By replacing this microcontroller on a target device with one from an attacker-controlled Lepin EP-KP001 whose passcode is known, it is possible to successfully unlock the target device and read the stored data in cleartext.
CVSS Score: 4.6 (MEDIUM)
References: http://packetstormsecurity.com/files/167550/Lepin-EP-KP001-KP001_V19-Authentication-Bypass.html; http://seclists.org/fulldisclosure/2022/Jun/27; https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2022-024.txt
CVE: CVE-2022-31402
Published: 2022-06-10
Description: ITOP v3.0.1 was discovered to contain a cross-site scripting (XSS) vulnerability via /itop/webservices/export-v2.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/YavuzSahbaz/CVE-2022-31402/blob/main/iTop%203.0.1%20XSS%20Vulnerability; https://sourceforge.net/projects/itop/; https://www.itophub.io/
CVE: CVE-2018-17240
Published: 2022-06-10
Description: There is a memory dump vulnerability on Netwave IP camera devices at //proc/kcore that allows an unauthenticated attacker to exfiltrate sensitive information from the network configuration (e.g., username and password).
CVSS Score: 7.5 (HIGH)
CWE: CWE-401
References: https://github.com/BBge/CVE-2018-17240; https://github.com/BBge/CVE-2018-17240/blob/main/exploit.py; https://www.bbge.org/file/exploit.py
CVE: CVE-2022-31282
Published: 2022-06-10
Description: Bento4 MP4Dump v1.2 was discovered to contain a segmentation violation via an unknown address at /Source/C++/Core/Ap4DataBuffer.cpp:175.
CVSS Score: 5.5 (MEDIUM)
References: https://github.com/axiomatic-systems/Bento4/issues/708; https://github.com/axiomatic-systems/Bento4/issues/708
CVE: CVE-2022-31285
Published: 2022-06-10
Description: An issue was discovered in Bento4 1.2. The allocator is out of memory in /Source/C++/Core/Ap4Array.h.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-770
References: https://github.com/axiomatic-systems/Bento4/issues/702; https://github.com/axiomatic-systems/Bento4/issues/702
CVE: CVE-2022-31287
Published: 2022-06-10
Description: An issue was discovered in Bento4 v1.2. There is an allocation size request error in /Ap4RtpAtom.cpp.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-770
References: https://github.com/axiomatic-systems/Bento4/issues/703; https://github.com/axiomatic-systems/Bento4/issues/703
CVE: CVE-2022-2042
Published: 2022-06-10
Description: Use After Free in GitHub repository vim/vim prior to 8.2.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: http://seclists.org/fulldisclosure/2022/Oct/28; http://seclists.org/fulldisclosure/2022/Oct/41; http://seclists.org/fulldisclosure/2022/Oct/43
CVE: CVE-2022-21211
Published: 2022-06-10
Description: This affects all versions of package posix. When invoking the toString method, it will fallback to 0x0 value, as the value of toString is not invokable (not a function), and then it will crash with type-check.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-252
References: https://snyk.io/vuln/SNYK-JS-POSIX-2400719; https://snyk.io/vuln/SNYK-JS-POSIX-2400719
CVE: CVE-2022-24278
Published: 2022-06-10
Description: The package convert-svg-core before 0.6.4 are vulnerable to Directory Traversal due to improper sanitization of SVG tags. Exploiting this vulnerability is possible by using a specially crafted SVG file.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://github.com/neocotic/convert-svg/commit/2bbc498c[PII_REDACTED]206661dbac9e44d37d17c5; https://github.com/neocotic/convert-svg/issues/86; https://github.com/neocotic/convert-svg/pull/87
CVE: CVE-2022-24376
Published: 2022-06-10
Description: All versions of package git-promise are vulnerable to Command Injection due to an inappropriate fix of a prior [vulnerability](https://security.snyk.io/vuln/SNYK-JS-GITPROMISE-567476) in this package. **Note:** Please note that the vulnerability will not be fixed. The README file was updated with a warning regarding this issue.
CVSS Score: 7.2 (HIGH)
CWE: CWE-88
References: https://gist.github.com/lirantal/9da1fceb32f5279eb76a5fc1cb9707dd; https://snyk.io/vuln/SNYK-JS-GITPROMISE-2434310; https://gist.github.com/lirantal/9da1fceb32f5279eb76a5fc1cb9707dd
CVE: CVE-2022-24429
Published: 2022-06-10
Description: The package convert-svg-core before 0.6.3 are vulnerable to Arbitrary Code Injection when using a specially crafted SVG file. An attacker can read arbitrary files from the file system and then show the file content as a converted PNG file.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: https://github.com/neocotic/convert-svg/commit/a43dffaab0f1e419d5be84e2e7356b86ffac3cf1; https://github.com/neocotic/convert-svg/issues/84; https://snyk.io/vuln/SNYK-JS-CONVERTSVGCORE-2859212
CVE: CVE-2022-25845
Published: 2022-06-10
Description: The package com.alibaba:fastjson before 1.2.83 are vulnerable to Deserialization of Untrusted Data by bypassing the default autoType shutdown restrictions, which is possible under certain conditions. Exploiting this vulnerability allows attacking remote servers. Workaround: If upgrading is not possible, you can enable [safeMode](https://github.com/alibaba/fastjson/wiki/fastjson_safemode).
CVSS Score: 8.1 (HIGH)
CWE: CWE-502
References: https://github.com/alibaba/fastjson/commit/35db4adad70c32089542f23c272def1ad920a60d; https://github.com/alibaba/fastjson/commit/8f3410f81cbd437f7c459f8868445d50ad301f15; https://github.com/alibaba/fastjson/releases/tag/1.2.83
CVE: CVE-2022-25851
Published: 2022-06-10
Description: The package jpeg-js before 0.4.4 are vulnerable to Denial of Service (DoS) where a particular piece of input will cause to enter an infinite loop and never return.
CVSS Score: 7.5 (HIGH)
CWE: CWE-835
References: https://github.com/jpeg-js/jpeg-js/commit/9ccd35fb5f55a6c4f1902ac5b0f270f675750c27; https://github.com/jpeg-js/jpeg-js/issues/105; https://github.com/jpeg-js/jpeg-js/pull/106/
CVE: CVE-2022-25863
Published: 2022-06-10
Description: The package gatsby-plugin-mdx before 2.14.1, from 3.0.0 and before 3.15.2 are vulnerable to Deserialization of Untrusted Data when passing input through to the gray-matter package, due to its default configurations that are missing input sanitization. Exploiting this vulnerability is possible when passing input in both webpack (MDX files in src/pages or MDX file imported as a component in frontend / React code) and data mode (querying MDX nodes via GraphQL). Workaround: If an older version of gatsby-plugin-mdx must be used, input passed into the plugin should be sanitized ahead of processing.
CVSS Score: 8.1 (HIGH)
CWE: CWE-502
References: https://drive.google.com/file/d/1EoCzbwTWOM8-fjvwMbH3bqcZ2iKksxTW/view?usp=sharing; https://github.com/gatsbyjs/gatsby/pull/35830; https://github.com/gatsbyjs/gatsby/pull/35830/commits/f214eb0694c61e348b2751cecd1aace2046bc46e
CVE: CVE-2022-29092
Published: 2022-06-10
Description: Dell SupportAssist Client Consumer versions (3.11.0 and versions prior) and Dell SupportAssist Client Commercial versions (3.2.0 and versions prior) contain a privilege escalation vulnerability. A non-admin user can exploit the vulnerability and gain admin access to the system.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427, CWE-427
References: https://www.dell.com/support/kbdoc/en-us/000200456/dsa-2022-139-dell-supportassist-for-home-pcs-and-business-pcs-security-update-for-multiple-security-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000200456/dsa-2022-139-dell-supportassist-for-home-pcs-and-business-pcs-security-update-for-multiple-security-vulnerabilities
CVE: CVE-2022-29093
Published: 2022-06-10
Description: Dell SupportAssist Client Consumer versions (3.10.4 and versions prior) and Dell SupportAssist Client Commercial versions (3.1.1 and versions prior) contain an arbitrary file deletion vulnerability. Authenticated non-admin user could exploit the issue and delete arbitrary files on the system.
CVSS Score: 7.1 (HIGH)
CWE: CWE-22, CWE-22
References: https://www.dell.com/support/kbdoc/en-us/000200456/dsa-2022-139-dell-supportassist-for-home-pcs-and-business-pcs-security-update-for-multiple-security-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000200456/dsa-2022-139-dell-supportassist-for-home-pcs-and-business-pcs-security-update-for-multiple-security-vulnerabilities
CVE: CVE-2022-29094
Published: 2022-06-10
Description: Dell SupportAssist Client Consumer versions (3.10.4 and versions prior) and Dell SupportAssist Client Commercial versions (3.1.1 and versions prior) contain an arbitrary file deletion/overwrite vulnerability. Authenticated non-admin user could exploit the issue and delete or overwrite arbitrary files on the system.
CVSS Score: 7.1 (HIGH)
CWE: CWE-22, CWE-22
References: https://www.dell.com/support/kbdoc/en-us/000200456/dsa-2022-139-dell-supportassist-for-home-pcs-and-business-pcs-security-update-for-multiple-security-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000200456/dsa-2022-139-dell-supportassist-for-home-pcs-and-business-pcs-security-update-for-multiple-security-vulnerabilities
CVE: CVE-2022-29095
Published: 2022-06-10
Description: Dell SupportAssist Client Consumer versions (3.10.4 and prior) and Dell SupportAssist Client Commercial versions (3.1.1 and prior) contain a cross-site scripting vulnerability. A remote unauthenticated malicious user could potentially exploit this vulnerability under specific conditions leading to execution of malicious code on a vulnerable system.
CVSS Score: 8.3 (HIGH)
CWE: CWE-16, CWE-79
References: https://www.dell.com/support/kbdoc/en-us/000200456/dsa-2022-139-dell-supportassist-for-home-pcs-and-business-pcs-security-update-for-multiple-security-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000200456/dsa-2022-139-dell-supportassist-for-home-pcs-and-business-pcs-security-update-for-multiple-security-vulnerabilities
CVE: CVE-2022-32981
Published: 2022-06-10
Description: An issue was discovered in the Linux kernel through 5.18.3 on powerpc 32-bit platforms. There is a buffer overflow in ptrace PEEKUSER and POKEUSER (aka PEEKUSR and POKEUSR) when accessing floating point registers.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: http://www.openwall.com/lists/oss-security/2022/06/14/3; https://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux.git/commit/?id=8e[PII_REDACTED]fc97778a5e5c99bca1ce0bbc5ec9; http://www.openwall.com/lists/oss-security/2022/06/14/3
CVE: CVE-2021-41754
Published: 2022-06-10
Description: dynamicMarkt <= 3.10 is affected by SQL injection in the parent parameter of index.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/blockomat2100/PoCs/blob/main/dynamicMarkt/vulns.md; https://www.heise.de/download/product/dynamicmarkt-3.10-marktplatz-software-90441; https://github.com/blockomat2100/PoCs/blob/main/dynamicMarkt/vulns.md
CVE: CVE-2021-41755
Published: 2022-06-10
Description: dynamicMarkt <= 3.10 is affected by SQL injection in the kat1 parameter of index.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/blockomat2100/PoCs/blob/main/dynamicMarkt/vulns.md; https://www.heise.de/download/product/dynamicmarkt-3.10-marktplatz-software-90441; https://github.com/blockomat2100/PoCs/blob/main/dynamicMarkt/vulns.md
CVE: CVE-2021-41756
Published: 2022-06-10
Description: dynamicMarkt <= 3.10 is affected by SQL injection in the kat parameter of index.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/blockomat2100/PoCs/blob/main/dynamicMarkt/vulns.md; https://www.heise.de/download/product/dynamicmarkt-3.10-marktplatz-software-90441; https://github.com/blockomat2100/PoCs/blob/main/dynamicMarkt/vulns.md
CVE: CVE-2017-20037
Published: 2022-06-11
Description: A vulnerability has been found in SICUNET Access Controller 0.32-05z and classified as critical. Affected by this vulnerability is an unknown functionality. The manipulation of the argument c leads to privilege escalation. The attack can be launched remotely.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-269
References: http://seclists.org/fulldisclosure/2017/Mar/25; https://vuldb.com/?id.98905; http://seclists.org/fulldisclosure/2017/Mar/25
CVE: CVE-2017-20038
Published: 2022-06-11
Description: A vulnerability was found in SICUNET Access Controller 0.32-05z and classified as critical. Affected by this issue is some unknown functionality of the file card_scan_decoder.php. The manipulation of the argument No/door leads to privilege escalation. The attack may be launched remotely.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-269
References: http://seclists.org/fulldisclosure/2017/Mar/25; https://vuldb.com/?id.98906; http://seclists.org/fulldisclosure/2017/Mar/25
CVE: CVE-2017-20039
Published: 2022-06-11
Description: A vulnerability was found in SICUNET Access Controller 0.32-05z. It has been classified as very critical. This affects an unknown part. The manipulation leads to weak authentication. It is possible to initiate the attack remotely.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-259, CWE-798
References: http://seclists.org/fulldisclosure/2017/Mar/25; https://vuldb.com/?id.98907; http://seclists.org/fulldisclosure/2017/Mar/25
CVE: CVE-2017-20040
Published: 2022-06-11
Description: A vulnerability was found in SICUNET Access Controller 0.32-05z. It has been declared as problematic. This vulnerability affects unknown code of the component Password Storage. The manipulation leads to weak encryption. Attacking locally is a requirement.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-312, CWE-312
References: http://seclists.org/fulldisclosure/2017/Mar/25; https://vuldb.com/?id.98908; http://seclists.org/fulldisclosure/2017/Mar/25
CVE: CVE-2021-41502
Published: 2022-06-11
Description: An issue was discovered in Subrion CMS v4.2.1 There is a stored cross-site scripting (XSS) vulnerability that can execute malicious JavaScript code by modifying the name of the uploaded image, closing the html tag, or adding the onerror attribute.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/intelliants/subrion/issues/885; https://github.com/intelliants/subrion/issues/885
CVE: CVE-2021-41738
Published: 2022-06-11
Description: ZeroShell 3.9.5 has a command injection vulnerability in /cgi-bin/kerbynet IP parameter, which may allow an authenticated attacker to execute system commands.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://medium.com/%40rootless724; https://medium.com/%40rootless724
CVE: CVE-2021-44266
Published: 2022-06-11
Description: GUnet Open eClass (aka openeclass) before 3.12.2 allows XSS via the modules/auth/formuser.php auth parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://docs.openeclass.org/el/current#%CE%AD%CE%BA%CE%B4%CE%BF%CF%83%CE%B7_3122; https://emaragkos.gr/cve-2021-44266/; https://hg.gunet.gr/openeclass/rev/e0ed11f5768d
CVE: CVE-2022-30780
Published: 2022-06-11
Description: Lighttpd 1.4.56 through 1.4.58 allows a remote attacker to cause a denial of service (CPU consumption from stuck connections) because connection_read_header_more in connections.c has a typo that disrupts use of multiple read operations on large headers.
CVSS Score: 7.5 (HIGH)
CWE: CWE-682
References: https://github.com/lighttpd/lighttpd1.4; https://github.com/p0dalirius/CVE-2022-30780-lighttpd-denial-of-service; https://podalirius.net/en/cves/2022-30780/
CVE: CVE-2018-25034
Published: 2022-06-12
Description: A vulnerability, which was classified as problematic, has been found in Thomson TCW710 ST5D.10.05. This issue affects some unknown processing of the file /goform/wlanPrimaryNetwork. The manipulation of the argument ServiceSetIdentifier with the input ><script>alert(1)</script> as part of POST Request leads to basic cross site scripting (Persistent). The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-126695.
CVSS Score: 3.5 (LOW)
CWE: CWE-80, CWE-79
References: https://alquimistadesistemas.com/auditando-router-thomson-tcw710; https://vuldb.com/?ctiid.126695; https://vuldb.com/?id.126695
CVE: CVE-2018-25035
Published: 2022-06-12
Description: A vulnerability, which was classified as problematic, was found in Thomson TCW710 ST5D.10.05. Affected is an unknown function of the file /goform/RGFirewallEL. The manipulation of the argument EmailAddress/SmtpServerName with the input ><script>alert(1)</script> as part of POST Request leads to cross site scripting (Persistent). It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-80, CWE-79
References: https://alquimistadesistemas.com/auditando-router-thomson-tcw710; https://vuldb.com/?id.126696; https://alquimistadesistemas.com/auditando-router-thomson-tcw710
CVE: CVE-2018-25036
Published: 2022-06-12
Description: A vulnerability has been found in Thomson TCW710 ST5D.10.05 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /goform/RgTime. The manipulation of the argument TimeServer1/TimeServer2/TimeServer3 with the input ><script>alert(1)</script> as part of POST Request leads to cross site scripting (Persistent). The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-80, CWE-79
References: https://alquimistadesistemas.com/auditando-router-thomson-tcw710; https://vuldb.com/?id.126697; https://alquimistadesistemas.com/auditando-router-thomson-tcw710
CVE: CVE-2018-25037
Published: 2022-06-12
Description: A vulnerability was found in Thomson TCW710 ST5D.10.05 and classified as problematic. Affected by this issue is some unknown functionality of the file /goform/RgDdns. The manipulation of the argument DdnsHostName with the input ><script>alert(1)</script> as part of POST Request leads to cross site scripting (Persistent). The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-80, CWE-79
References: https://alquimistadesistemas.com/auditando-router-thomson-tcw710; https://vuldb.com/?id.126698; https://alquimistadesistemas.com/auditando-router-thomson-tcw710
CVE: CVE-2018-25038
Published: 2022-06-12
Description: A vulnerability was found in Thomson TCW710 ST5D.10.05. It has been classified as problematic. This affects an unknown part of the file /goform/RgDhcp. The manipulation of the argument PppUserName with the input ><script>alert(1)</script> as part of POST Request leads to cross site scripting (Persistent). It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-80, CWE-79
References: https://alquimistadesistemas.com/auditando-router-thomson-tcw710; https://vuldb.com/?id.126699; https://alquimistadesistemas.com/auditando-router-thomson-tcw710
CVE: CVE-2018-25039
Published: 2022-06-12
Description: A vulnerability was found in Thomson TCW710 ST5D.10.05. It has been declared as problematic. This vulnerability affects unknown code of the file /goform/RgUrlBlock.asp. The manipulation of the argument BasicParentalNewKeyword with the input ><script>alert(1)</script> as part of POST Request leads to cross site scripting (Persistent). The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-80, CWE-79
References: https://alquimistadesistemas.com/auditando-router-thomson-tcw710; https://vuldb.com/?id.126700; https://alquimistadesistemas.com/auditando-router-thomson-tcw710
CVE: CVE-2021-41749
Published: 2022-06-12
Description: In the SEOmatic plugin up to 3.4.11 for Craft CMS 3, it is possible for unauthenticated attackers to perform a Server-Side Template Injection, allowing for remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://github.com/nystudio107/craft-seomatic/blob/develop/CHANGELOG.md; https://github.com/nystudio107/craft-seomatic/commit/3fee7d50147cdf3f999cfc1e04cbc3fb3d9f2f7d; https://github.com/nystudio107/craft-seomatic/blob/develop/CHANGELOG.md
CVE: CVE-2021-41750
Published: 2022-06-12
Description: A cross-site scripting (XSS) vulnerability in the SEOmatic plugin 3.4.10 for Craft CMS 3 allows remote attackers to inject arbitrary web script via a GET to /index.php?action=seomatic/file/seo-file-link with url parameter containing the base64 encoded URL of a malicious web page / file and fileName parameter containing an arbitrary filename with the intended content-type to be rendered in the user's browser as the extension.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/nystudio107/craft-seomatic/blob/develop/CHANGELOG.md; https://github.com/nystudio107/craft-seomatic/commit/4e46b792ce973ac0c652fb330055f41aca1981c8; https://github.com/nystudio107/craft-seomatic/commit/5f2cdc7c39e0a4bfb60d2f84131508f0a87b2873