deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-24888
Published: 2022-04-27
Description: Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Prior to versions 20.0.14.4, 21.0.8, 22.2.4, and 23.0.1, it is possible to create files and folders that have leading and trailing \n, \r, \t, and \v characters. The server rejects files and folders that have these characters in the middle of their names, so this might be an opportunity for injection. This issue is fixed in versions 20.0.14.4, 21.0.8, 22.2.4, and 23.0.1. There are currently no known workarounds.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-74
References: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-w3h6-p64h-q9jp; https://github.com/nextcloud/server/pull/29895; https://hackerone.com/reports/1402249
CVE: CVE-2022-24889
Published: 2022-04-27
Description: Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Prior to versions 21.0.8, 22.2.4, and 23.0.1, it is possible to trick administrators into enabling "recommended" apps for the Nextcloud server that they do not need, thus expanding their attack surface unnecessarily. This issue is fixed in versions 21.0.8 , 22.2.4, and 23.0.1.
CVSS Score: 2.4 (LOW)
CWE: CWE-345, CWE-345
References: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-5vw6-6prg-gvw6; https://github.com/nextcloud/server/pull/30615; https://hackerone.com/reports/1403614
CVE: CVE-2022-29505
Published: 2022-04-27
Description: Due to build misconfiguration in openssl dependency, LINE for Windows before 7.8 is vulnerable to DLL injection that could lead to privilege escalation.
CVSS Score: 7.8 (HIGH)
References: https://hackerone.com/reports/1423049; https://hackerone.com/reports/1423049
CVE: CVE-2021-29776
Published: 2022-04-27
Description: IBM QRadar SIEM 7.3, 7.4, and 7.5 could allow an authenticated user to obtain sensitive information from another user's dashboard providing the dashboard ID of that user. IBM X-Force ID: 203030.
CVSS Score: 4.3 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/203030; https://www.ibm.com/support/pages/node/6574787; https://exchange.xforce.ibmcloud.com/vulnerabilities/203030
CVE: CVE-2021-34587
Published: 2022-04-27
Description: In Bender/ebee Charge Controllers in multiple versions a long URL could lead to webserver crash. The URL is used as input of an sprintf to a stack variable.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-121, CWE-787
References: https://cert.vde.com/en/advisories/VDE-2021-047; https://cert.vde.com/en/advisories/VDE-2021-047
CVE: CVE-2021-34588
Published: 2022-04-27
Description: In Bender/ebee Charge Controllers in multiple versions are prone to unprotected data export. Backup export is protected via a random key. The key is set at user login. It is empty after reboot .
CVSS Score: 8.6 (HIGH)
CWE: CWE-425
References: https://cert.vde.com/en/advisories/VDE-2021-047; https://cert.vde.com/en/advisories/VDE-2021-047
CVE: CVE-2021-34589
Published: 2022-04-27
Description: In Bender/ebee Charge Controllers in multiple versions are prone to an RFID leak. The RFID of the last charge event can be read without authentication via the web interface.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://cert.vde.com/en/advisories/VDE-2021-047; https://cert.vde.com/en/advisories/VDE-2021-047
CVE: CVE-2021-34590
Published: 2022-04-27
Description: In Bender/ebee Charge Controllers in multiple versions are prone to Cross-site Scripting. An authenticated attacker could write HTML Code into configuration values. These values are not properly escaped when displayed.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://cert.vde.com/en/advisories/VDE-2021-047; https://cert.vde.com/en/advisories/VDE-2021-047
CVE: CVE-2021-34591
Published: 2022-04-27
Description: In Bender/ebee Charge Controllers in multiple versions are prone to Local privilege Escalation. An authenticated attacker could get root access via the suid applications socat, ip udhcpc and ifplugd.
CVSS Score: 7.8 (HIGH)
CWE: CWE-250
References: https://cert.vde.com/en/advisories/VDE-2021-047; https://cert.vde.com/en/advisories/VDE-2021-047
CVE: CVE-2021-34592
Published: 2022-04-27
Description: In Bender/ebee Charge Controllers in multiple versions are prone to Command injection via Web interface. An authenticated attacker could enter shell commands into some input fields.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: https://cert.vde.com/en/advisories/VDE-2021-047; https://cert.vde.com/en/advisories/VDE-2021-047
CVE: CVE-2021-34601
Published: 2022-04-27
Description: In Bender/ebee Charge Controllers in multiple versions are prone to Hardcoded Credentials. Bender charge controller CC612 in version 5.20.1 and below is prone to hardcoded ssh credentials. An attacker may use the password to gain administrative access to the web-UI.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-259, CWE-798
References: https://cert.vde.com/en/advisories/VDE-2021-047; https://cert.vde.com/en/advisories/VDE-2021-047
CVE: CVE-2021-34602
Published: 2022-04-27
Description: In Bender/ebee Charge Controllers in multiple versions are prone to Command injection via Web interface. An authenticated attacker could enter shell commands into some input fields that are executed with root privileges.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://cert.vde.com/en/advisories/VDE-2021-047; https://cert.vde.com/en/advisories/VDE-2021-047
CVE: CVE-2021-38869
Published: 2022-04-27
Description: IBM QRadar SIEM 7.3, 7.4, and 7.5 in some situations may not automatically log users out after they exceede their idle timeout. IBM X-Force ID: 208341.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-384
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/208341; https://www.ibm.com/support/pages/node/6574787; https://exchange.xforce.ibmcloud.com/vulnerabilities/208341
CVE: CVE-2021-38874
Published: 2022-04-27
Description: IBM QRadar SIEM 7.3, 7.4, and 7.5 allows for users to access information across tenant and domain boundaries in some situations. IBM X-Force ID: 208397.
CVSS Score: 4.3 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/208397; https://www.ibm.com/support/pages/node/6574787; https://exchange.xforce.ibmcloud.com/vulnerabilities/208397
CVE: CVE-2021-38878
Published: 2022-04-27
Description: IBM QRadar 7.3, 7.4, and 7.5 could allow a malicious actor to impersonate an actor due to key exchange without entity authentication. IBM X-Force ID: 208756.
CVSS Score: 7.5 (HIGH)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/208756; https://www.ibm.com/support/pages/node/6574787; https://exchange.xforce.ibmcloud.com/vulnerabilities/208756
CVE: CVE-2021-38919
Published: 2022-04-27
Description: IBM QRadar SIEM 7.3, 7.4, and 7.5 in some senarios may reveal authorized service tokens to other QRadar users. IBM X-Force ID: 210021
CVSS Score: 7.5 (HIGH)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/210021; https://www.ibm.com/support/pages/node/6574787; https://exchange.xforce.ibmcloud.com/vulnerabilities/210021
CVE: CVE-2021-38939
Published: 2022-04-27
Description: IBM QRadar SIEM 7.3, 7.4, and 7.5 stores potentially sensitive information in log files that could be read by an user with access to creating domains. IBM X-Force ID: 211037.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-532
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/211037; https://www.ibm.com/support/pages/node/6574787; https://exchange.xforce.ibmcloud.com/vulnerabilities/211037
CVE: CVE-2022-22312
Published: 2022-04-27
Description: IBM Security Identity Manager (IBM Security Verify Password Synchronization Plug-in for Windows AD 10.x) is vulnerable to a denial of service, caused by a heap-based buffer overflow in the Password Synch Plug-in. An authenticated attacker could exploit this vulnerability to cause a denial of service. IBM X-Force ID: 217369.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/217369; https://www.ibm.com/support/pages/node/6574671; https://exchange.xforce.ibmcloud.com/vulnerabilities/217369
CVE: CVE-2022-22323
Published: 2022-04-27
Description: IBM Security Identity Manager (IBM Security Verify Password Synchronization Plug-in for Windows AD 10.x) is vulnerable to a denial of service, caused by a heap-based buffer overflow in the Password Synch Plug-in. An authenticated attacker could exploit this vulnerability to cause a denial of service. IBM X-Force ID: 218379.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/218379; https://www.ibm.com/support/pages/node/6574671; https://exchange.xforce.ibmcloud.com/vulnerabilities/218379
CVE: CVE-2022-22345
Published: 2022-04-27
Description: IBM QRadar 7.3, 7.4, and 7.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 220041.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/220041; https://www.ibm.com/support/pages/node/6574453; https://exchange.xforce.ibmcloud.com/vulnerabilities/220041
CVE: CVE-2022-22521
Published: 2022-04-27
Description: In Miele Benchmark Programming Tool with versions Prior to 1.2.71, executable files manipulated by attackers are unknowingly executed with users privileges. An attacker with low privileges may trick a user with administrative privileges to execute these binaries as admin.
CVSS Score: 7.3 (HIGH)
CWE: CWE-732, CWE-732
References: http://packetstormsecurity.com/files/166881/Miele-Benchmark-Programming-Tool-1.1.49-1.2.71-Privilege-Escalation.html; http://seclists.org/fulldisclosure/2022/Apr/42; https://cert.vde.com/en/advisories/VDE-2022-015/
CVE: CVE-2022-27336
Published: 2022-04-27
Description: Seacms v11.6 was discovered to contain a remote code execution (RCE) vulnerability via the component /admin/weixin.php.
CVSS Score: 9.8 (CRITICAL)
References: http://note.youdao.com/noteshare?id=1f5c9012a358f0c4575e1ca57a55fe5e&sub=6C2906C73BB0477FB9DE8601D5495C0A; http://note.youdao.com/noteshare?id=1f5c9012a358f0c4575e1ca57a55fe5e&sub=6C2906C73BB0477FB9DE8601D5495C0A
CVE: CVE-2021-25266
Published: 2022-04-27
Description: An insecure data storage vulnerability allows a physical attacker with root privileges to retrieve TOTP secret keys from unlocked phones in Sophos Authenticator for Android version 3.4 and older, and Intercept X for Mobile (Android) before version 9.7.3495.
CVSS Score: 3.9 (LOW)
CWE: CWE-922
References: https://www.sophos.com/en-us/security-advisories/sophos-sa-20220427-ixm-storage; https://www.sophos.com/en-us/security-advisories/sophos-sa-20220427-ixm-storage
CVE: CVE-2022-1507
Published: 2022-04-27
Description: chafa: NULL Pointer Dereference in function gif_internal_decode_frame at libnsgif.c:599 allows attackers to cause a denial of service (crash) via a crafted input file. in GitHub repository hpjansson/chafa prior to 1.10.2. chafa: NULL Pointer Dereference in function gif_internal_decode_frame at libnsgif.c:599 allows attackers to cause a denial of service (crash) via a crafted input file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://github.com/hpjansson/chafa/commit/e4b777c7b7c144cd16a0ea96108267b1004fe6c9; https://huntr.dev/bounties/104d8c5d-cac5-4baa-9ac9-291ea0bcab95; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3PLHKTQYK6AO3M5NAVM3CDVQTZZS6MCO/
CVE: CVE-2022-22275
Published: 2022-04-27
Description: Improper Restriction of TCP Communication Channel in HTTP/S inbound traffic from WAN to DMZ bypassing security policy until TCP handshake potentially resulting in Denial of Service (DoS) attack if a target host is vulnerable.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0004; https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0004
CVE: CVE-2022-22276
Published: 2022-04-27
Description: A vulnerability in SonicOS SNMP service resulting exposure of sensitive information to an unauthorized user.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200, CWE-200
References: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0004; https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0004
CVE: CVE-2022-22277
Published: 2022-04-27
Description: A vulnerability in SonicOS SNMP service resulting exposure of Wireless Access Point sensitive information in cleartext.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200, CWE-200
References: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0004; https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0004
CVE: CVE-2022-22278
Published: 2022-04-27
Description: A vulnerability in SonicOS CFS (Content filtering service) returns a large 403 forbidden HTTP response message to the source address when users try to access prohibited resource this allows an attacker to cause HTTP Denial of Service (DoS) attack
CVSS Score: 7.5 (HIGH)
CWE: CWE-770, CWE-770
References: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0004; https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0004
CVE: CVE-2022-23822
Published: 2022-04-27
Description: In this physical attack, an attacker may potentially exploit the Zynq-7000 SoC First Stage Boot Loader (FSBL) by bypassing authentication and loading a malicious image onto the device. This in turn may further allow the attacker to perform additional attacks such as such as using the device as a decryption oracle. An anticipated mitigation via a 2022.1 patch will resolve the issue.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-863, CWE-863
References: https://github.com/Xilinx/embeddedsw/tree/master/lib/sw_apps/zynq_fsbl; https://support.xilinx.com/s/article/76974; https://github.com/Xilinx/embeddedsw/tree/master/lib/sw_apps/zynq_fsbl
CVE: CVE-2022-22315
Published: 2022-04-27
Description: IBM UrbanCode Deploy (UCD) 7.2.2.1 could allow an authenticated user with special permissions to obtain elevated privileges due to improper handling of permissions. IBM X-Force ID: 217955.
CVSS Score: 8.8 (HIGH)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/217955; https://www.ibm.com/support/pages/node/6575143; https://exchange.xforce.ibmcloud.com/vulnerabilities/217955
CVE: CVE-2022-24372
Published: 2022-04-27
Description: Linksys MR9600 devices before 2.0.5 allow attackers to read arbitrary files via a symbolic link to the root directory of a NAS SMB share.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-59
References: https://www.linksys.com/de/linksys-dual-band-mesh-wifi-6-router-mr9600/p/p-mr9600/; https://www.linksys.com/mesh-routers/linksys-dual-band-mesh-wifi-6-router-mr9600/p/p-mr9600/; https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2021-046.txt
CVE: CVE-2022-28193
Published: 2022-04-27
Description: NVIDIA Jetson Linux Driver Package contains a vulnerability in the Cboot module tegrabl_cbo.c, where insufficient validation of untrusted data may allow a local attacker with elevated privileges to cause a memory buffer overflow, which may lead to code execution, loss of integrity, limited denial of service, and some impact to confidentiality.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-20, CWE-787
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5343; https://nvidia.custhelp.com/app/answers/detail/a_id/5343
CVE: CVE-2022-28194
Published: 2022-04-27
Description: NVIDIA Jetson Linux Driver Package contains a vulnerability in the Cboot module tegrabl_cbo.c, where, if TFTP is enabled, a local attacker with elevated privileges can cause a memory buffer overflow, which may lead to code execution, loss of Integrity, limited denial of service, and some impact to confidentiality.
CVSS Score: 7.3 (HIGH)
CWE: CWE-119, CWE-119
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5343; https://nvidia.custhelp.com/app/answers/detail/a_id/5343
CVE: CVE-2022-28195
Published: 2022-04-27
Description: NVIDIA Jetson Linux Driver Package contains a vulnerability in the Cboot ext4_read_file function, where insufficient validation of untrusted data may allow a highly privileged local attacker to cause a integer overflow, which may lead to code execution, escalation of privileges, limited denial of service, and some impact to confidentiality and integrity. The scope of impact can extend to other components.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-20, CWE-190
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5343; https://nvidia.custhelp.com/app/answers/detail/a_id/5343
CVE: CVE-2022-28196
Published: 2022-04-27
Description: NVIDIA Jetson Linux Driver Package contains a vulnerability in the Cboot blob_decompress function, where insufficient validation of untrusted data may allow a local attacker with elevated privileges to cause a memory buffer overflow, which may lead to code execution, limited loss of Integrity, and limited denial of service. The scope of impact can extend to other components.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-20, CWE-787
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5343; https://nvidia.custhelp.com/app/answers/detail/a_id/5343
CVE: CVE-2022-28197
Published: 2022-04-27
Description: NVIDIA Jetson Linux Driver Package contains a vulnerability in the Cboot ext4_mount function, where Insufficient validation of untrusted data may allow a highly privileged local attacker to cause an integer overflow. This difficult-to-exploit vulnerability may lead to code execution, escalation of privileges, limited denial of service, and some impact to confidentiality and integrity. The scope of impact can extend to other components.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-190, CWE-190
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5343; https://nvidia.custhelp.com/app/answers/detail/a_id/5343
CVE: CVE-2022-24735
Published: 2022-04-27
Description: Redis is an in-memory database that persists on disk. By exploiting weaknesses in the Lua script execution environment, an attacker with access to Redis prior to version 7.0.0 or 6.2.7 can inject Lua code that will execute with the (potentially higher) privileges of another Redis user. The Lua script execution environment in Redis provides some measures that prevent a script from creating side effects that persist and can affect the execution of the same, or different script, at a later time. Several weaknesses of these measures have been publicly known for a long time, but they had no security impact as the Redis security model did not endorse the concept of users or privileges. With the introduction of ACLs in Redis 6.0, these weaknesses can be exploited by a less privileged users to inject Lua code that will execute at a later time, when a privileged user executes a Lua script. The problem is fixed in Redis versions 7.0.0 and 6.2.7. An additional workaround to mitigate this problem without patching the redis-server executable, if Lua scripting is not being used, is to block access to `SCRIPT LOAD` and `EVAL` commands using ACL rules.
CVSS Score: 3.9 (LOW)
CWE: CWE-94, CWE-94
References: https://github.com/redis/redis/pull/10651; https://github.com/redis/redis/releases/tag/6.2.7; https://github.com/redis/redis/releases/tag/7.0.0
CVE: CVE-2022-24736
Published: 2022-04-27
Description: Redis is an in-memory database that persists on disk. Prior to versions 6.2.7 and 7.0.0, an attacker attempting to load a specially crafted Lua script can cause NULL pointer dereference which will result with a crash of the redis-server process. The problem is fixed in Redis versions 7.0.0 and 6.2.7. An additional workaround to mitigate this problem without patching the redis-server executable, if Lua scripting is not being used, is to block access to `SCRIPT LOAD` and `EVAL` commands using ACL rules.
CVSS Score: 3.3 (LOW)
CWE: CWE-476, CWE-476
References: https://github.com/redis/redis/pull/10651; https://github.com/redis/redis/releases/tag/6.2.7; https://github.com/redis/redis/releases/tag/7.0.0
CVE: CVE-2021-3523
Published: 2022-04-27
Description: A flaw was found in 3Scale APICast in versions prior to 2.11.0, where it incorrectly identified connections for reuse. This flaw allows an attacker to bypass security restrictions for an API request when hosting multiple APIs on the same IP address.
CVSS Score: 7.5 (HIGH)
CWE: CWE-281, CWE-281
References: https://bugzilla.redhat.com/show_bug.cgi?id=1954805; https://bugzilla.redhat.com/show_bug.cgi?id=1954805
CVE: CVE-2022-24891
Published: 2022-04-27
Description: ESAPI (The OWASP Enterprise Security API) is a free, open source, web application security control library. Prior to version 2.3.0.0, there is a potential for a cross-site scripting vulnerability in ESAPI caused by a incorrect regular expression for "onsiteURL" in the **antisamy-esapi.xml** configuration file that can cause "javascript:" URLs to fail to be correctly sanitized. This issue is patched in ESAPI 2.3.0.0. As a workaround, manually edit the **antisamy-esapi.xml** configuration files to change the "onsiteURL" regular expression. More information about remediation of the vulnerability, including the workaround, is available in the maintainers' release notes and security bulletin.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/ESAPI/esapi-java-legacy/blob/develop/documentation/ESAPI-security-bulletin8.pdf; https://github.com/ESAPI/esapi-java-legacy/blob/develop/documentation/esapi4java-core-2.3.0.0-release-notes.txt; https://github.com/ESAPI/esapi-java-legacy/security/advisories/GHSA-q77q-vx4q-xx6q
CVE: CVE-2022-29859
Published: 2022-04-27
Description: component/common/network/dhcp/dhcps.c in ambiot amb1_sdk (aka SDK for Ameba1) before 2022-03-11 mishandles data structures for DHCP packet data.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/ambiot/amb1_sdk/commit/4b73f58f32914d0081d79a79e53a3215c8c1ea56; https://www.amebaiot.com/zh/security_bulletin/cve-2022-29859/; https://github.com/ambiot/amb1_sdk/commit/4b73f58f32914d0081d79a79e53a3215c8c1ea56
CVE: CVE-2022-29869
Published: 2022-04-28
Description: cifs-utils through 6.14, with verbose logging, can cause an information leak when a file contains = (equal sign) characters but is not a valid credentials file.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-532
References: https://github.com/piastry/cifs-utils/commit/8acc963a2e7e9d63fe1f2e7f73f5a03f83d9c379; https://github.com/piastry/cifs-utils/pull/7; https://lists.debian.org/debian-lts-announce/2022/05/msg00020.html
CVE: CVE-2022-28719
Published: 2022-04-28
Description: Missing authentication for critical function in AssetView prior to Ver.13.2.0 allows a remote unauthenticated attacker with some knowledge on the system configuration to upload a crafted configuration file to the managing server, which may result in the managed clients to execute arbitrary code with the administrative privilege.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://jvn.jp/en/jp/JVN54857505/index.html; https://www.hammock.jp/assetview/info/220422.html; https://jvn.jp/en/jp/JVN54857505/index.html
CVE: CVE-2022-1509
Published: 2022-04-28
Description: Command Injection Vulnerability in GitHub repository hestiacp/hestiacp prior to 1.5.12. An authenticated remote attacker with low privileges can execute arbitrary code under root context.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-77, CWE-77
References: https://github.com/hestiacp/hestiacp/commit/d50f95cf208049dfb6ac67a[PII_REDACTED]745bd60; https://huntr.dev/bounties/09e69dff-f281-4e51-8312-ed7ab7606338; https://github.com/hestiacp/hestiacp/commit/d50f95cf208049dfb6ac67a[PII_REDACTED]745bd60
CVE: CVE-2022-29811
Published: 2022-04-28
Description: In JetBrains Hub before 2022.1.14638 stored XSS via project icon was possible.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.jetbrains.com/privacy-security/issues-fixed/; https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2022-29812
Published: 2022-04-28
Description: In JetBrains IntelliJ IDEA before 2022.1 notification mechanisms about using Unicode directionality formatting characters were insufficient
CVSS Score: 2.3 (LOW)
CWE: CWE-176
References: https://www.jetbrains.com/privacy-security/issues-fixed/; https://www.jetbrains.com/privacy-security/issues-fixed/