deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-38444
Published: 2022-10-14
Description: Adobe Dimension versions 3.4.5 is affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://helpx.adobe.com/security/products/dimension/apsb22-57.html; https://helpx.adobe.com/security/products/dimension/apsb22-57.html
CVE: CVE-2022-38445
Published: 2022-10-14
Description: Adobe Dimension versions 3.4.5 is affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://helpx.adobe.com/security/products/dimension/apsb22-57.html; https://helpx.adobe.com/security/products/dimension/apsb22-57.html
CVE: CVE-2022-38446
Published: 2022-10-14
Description: Adobe Dimension versions 3.4.5 is affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://helpx.adobe.com/security/products/dimension/apsb22-57.html; https://helpx.adobe.com/security/products/dimension/apsb22-57.html
CVE: CVE-2022-38447
Published: 2022-10-14
Description: Adobe Dimension versions 3.4.5 is affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://helpx.adobe.com/security/products/dimension/apsb22-57.html; https://helpx.adobe.com/security/products/dimension/apsb22-57.html
CVE: CVE-2022-38448
Published: 2022-10-14
Description: Adobe Dimension versions 3.4.5 is affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://helpx.adobe.com/security/products/dimension/apsb22-57.html; https://helpx.adobe.com/security/products/dimension/apsb22-57.html
CVE: CVE-2022-38449
Published: 2022-10-14
Description: Adobe Acrobat Reader versions 22.002.20212 (and earlier) and 20.005.30381 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/acrobat/apsb22-46.html; https://helpx.adobe.com/security/products/acrobat/apsb22-46.html
CVE: CVE-2022-38450
Published: 2022-10-14
Description: Adobe Acrobat Reader versions 22.002.20212 (and earlier) and 20.005.30381 (and earlier) are affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://helpx.adobe.com/security/products/acrobat/apsb22-46.html; https://helpx.adobe.com/security/products/acrobat/apsb22-46.html
CVE: CVE-2022-39309
Published: 2022-10-14
Description: GoCD is a continuous delivery server. GoCD helps you automate and streamline the build-test-release cycle for continuous delivery of your product. GoCD versions prior to 21.1.0 leak the symmetric key used to encrypt/decrypt any secure variables/secrets in GoCD configuration to authenticated agents. A malicious/compromised agent may then expose that key from memory, and potentially allow an attacker the ability to decrypt secrets intended for other agents/environments if they also are able to obtain access to encrypted configuration values from the GoCD server. This issue is fixed in GoCD version 21.1.0. There are currently no known workarounds.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-200, CWE-499, CWE-668
References: https://github.com/gocd/gocd/commit/691b479f[PII_REDACTED]da141760e9c5d1f5b60e8a; https://github.com/gocd/gocd/releases/tag/21.1.0; https://github.com/gocd/gocd/security/advisories/GHSA-f9qg-xcxq-cgv9
CVE: CVE-2022-39310
Published: 2022-10-14
Description: GoCD is a continuous delivery server. GoCD helps you automate and streamline the build-test-release cycle for continuous delivery of your product. GoCD versions prior to 21.1.0 can allow one authenticated agent to impersonate another agent, and thus receive work packages for other agents due to broken access control and incorrect validation of agent tokens within the GoCD server. Since work packages can contain sensitive information such as credentials intended only for a given job running against a specific agent environment, this can cause accidental information disclosure. Exploitation requires knowledge of agent identifiers and ability to authenticate as an existing agent with the GoCD server. This issue is fixed in GoCD version 21.1.0. There are currently no known workarounds.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-284
References: https://github.com/gocd/gocd/pull/8877; https://github.com/gocd/gocd/security/advisories/GHSA-4fp5-33jh-hgcq; https://www.gocd.org/releases/#21-1-0
CVE: CVE-2022-39311
Published: 2022-10-14
Description: GoCD is a continuous delivery server. GoCD helps you automate and streamline the build-test-release cycle for continuous delivery of your product. GoCD versions prior to 21.1.0 are vulnerable to remote code execution on the server from a malicious or compromised agent. The Spring RemoteInvocation endpoint exposed agent communication and allowed deserialization of arbitrary java objects, as well as subsequent remote code execution. Exploitation requires agent-level authentication, thus an attacker would need to either compromise an existing agent, its network communication or register a new agent to practically exploit this vulnerability. This issue is fixed in GoCD version 21.1.0. There are currently no known workarounds.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-502, CWE-502
References: https://github.com/gocd/gocd/commit/7b88b70d6f7f429562d5cab49a80ea856e34cdc8; https://github.com/gocd/gocd/security/advisories/GHSA-2hjh-3p3p-8hcm; https://www.gocd.org/releases/#21-1-0
CVE: CVE-2022-41416
Published: 2022-10-14
Description: Online Tours & Travels Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /user/update_booking.php.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/ouoer/bug_report/blob/main/vendors/mayuri_k/online-tours-travels-management-system/SQLi-1.md; https://github.com/ouoer/bug_report/blob/main/vendors/mayuri_k/online-tours-travels-management-system/SQLi-1.md
CVE: CVE-2022-41623
Published: 2022-10-14
Description: Sensitive Data Exposure in Villatheme ALD - AliExpress Dropshipping and Fulfillment for WooCommerce premium plugin <= 1.1.0 on WordPress.
CVSS Score: 7.5 (HIGH)
CWE: CWE-202
References: https://patchstack.com/database/vulnerability/woocommerce-alidropship/wordpress-ald-aliexpress-dropshipping-and-fulfillment-for-woocommerce-plugin-1-1-0-sensitive-data-exposure?_s_id=cve; https://villatheme.com/extensions/aliexpress-dropshipping-and-fulfillment-for-woocommerce/#tab-changelog; https://patchstack.com/database/vulnerability/woocommerce-alidropship/wordpress-ald-aliexpress-dropshipping-and-fulfillment-for-woocommerce-plugin-1-1-0-sensitive-data-exposure?_s_id=cve
CVE: CVE-2022-42339
Published: 2022-10-14
Description: Adobe Acrobat Reader versions 22.002.20212 (and earlier) and 20.005.30381 (and earlier) are affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://helpx.adobe.com/security/products/acrobat/apsb22-46.html; https://helpx.adobe.com/security/products/acrobat/apsb22-46.html
CVE: CVE-2022-42340
Published: 2022-10-14
Description: Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by an Improper Input Validation vulnerability that could result in arbitrary file system read. Exploitation of this issue does not require user interaction.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-20
References: https://helpx.adobe.com/security/products/coldfusion/apsb22-44.html; https://helpx.adobe.com/security/products/coldfusion/apsb22-44.html
CVE: CVE-2022-42341
Published: 2022-10-14
Description: Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary file system read. Exploitation of this issue does not require user interaction.
CVSS Score: 7.5 (HIGH)
CWE: CWE-611
References: https://helpx.adobe.com/security/products/coldfusion/apsb22-44.html; https://helpx.adobe.com/security/products/coldfusion/apsb22-44.html
CVE: CVE-2022-42342
Published: 2022-10-14
Description: Adobe Acrobat Reader versions 22.002.20212 (and earlier) and 20.005.30381 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/acrobat/apsb22-46.html; https://helpx.adobe.com/security/products/acrobat/apsb22-46.html
CVE: CVE-2022-41436
Published: 2022-10-14
Description: An issue in OXHOO TP50 OXH1.50 allows unauthenticated attackers to access the administrative panel via browsing to the URL http://device_ip/index1.html.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-287, CWE-287
References: https://github.com/NF-Security-Team/CVEs/blob/main/CVE-OXHOO/Readme.md; https://github.com/NF-Security-Team/CVEs/blob/main/CVE-OXHOO/Readme.md
CVE: CVE-2017-20149
Published: 2022-10-15
Description: The Mikrotik RouterOS web server allows memory corruption in releases before Stable 6.38.5 and Long-term 6.37.5, aka Chimay-Red. A remote and unauthenticated user can trigger the vulnerability by sending a crafted HTTP request. An attacker can use this vulnerability to execute arbitrary code on the affected system, as exploited in the wild in mid-2017 and later.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://github.com/BigNerd95/Chimay-Red; https://www.bleepingcomputer.com/news/security/hajime-botnet-makes-a-comeback-with-massive-scan-for-mikrotik-routers/; https://github.com/BigNerd95/Chimay-Red
CVE: CVE-2022-42961
Published: 2022-10-15
Description: An issue was discovered in wolfSSL before 5.5.0. A fault injection attack on RAM via Rowhammer leads to ECDSA key disclosure. Users performing signing operations with private ECC keys, such as in server-side TLS connections, might leak faulty ECC signatures. These signatures can be processed via an advanced technique for ECDSA key recovery. (In 5.5.0 and later, WOLFSSL_CHECK_SIG_FAULTS can be used to address the vulnerability.)
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-285
References: https://github.com/wolfSSL/wolfssl/releases/tag/v5.5.0-stable; https://github.com/wolfSSL/wolfssl/releases/tag/v5.5.0-stable
CVE: CVE-2022-3518
Published: 2022-10-15
Description: A vulnerability classified as problematic has been found in SourceCodester Sanitization Management System 1.0. Affected is an unknown function of the component User Creation Handler. The manipulation of the argument First Name/Middle Name/Last Name leads to cross site scripting. It is possible to launch the attack remotely. VDB-211014 is the identifier assigned to this vulnerability.
CVSS Score: 2.4 (LOW)
CWE: CWE-707
References: https://github.com/lohith19/CVE-2022-3518/blob/main/POC; https://vuldb.com/?id.211014; https://github.com/lohith19/CVE-2022-3518/blob/main/POC
CVE: CVE-2022-3519
Published: 2022-10-15
Description: A vulnerability classified as problematic was found in SourceCodester Sanitization Management System 1.0. Affected by this vulnerability is an unknown functionality of the component Quote Requests Tab. The manipulation of the argument Manage Remarks leads to cross site scripting. The attack can be launched remotely. The associated identifier of this vulnerability is VDB-211015.
CVSS Score: 2.4 (LOW)
CWE: CWE-707
References: https://vuldb.com/?id.211015; https://vuldb.com/?id.211015
CVE: CVE-2022-42968
Published: 2022-10-16
Description: Gitea before 1.17.3 does not sanitize and escape refs in the git backend. Arguments to git commands are mishandled.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-88, CWE-88
References: https://github.com/go-gitea/gitea/pull/21463; https://github.com/go-gitea/gitea/releases/tag/v1.17.3; https://security.gentoo.org/glsa/202210-14
CVE: CVE-2022-41323
Published: 2022-10-16
Description: In Django 3.2 before 3.2.16, 4.0 before 4.0.8, and 4.1 before 4.1.2, internationalized URLs were subject to a potential denial of service attack via the locale parameter, which is treated as a regular expression.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1333
References: https://docs.djangoproject.com/en/4.0/releases/security/; https://github.com/django/django/commit/5b6b257fa7ec37ff[PII_REDACTED]0c67e2dd11c924; https://groups.google.com/forum/#%21forum/django-announce
CVE: CVE-2022-42969
Published: 2022-10-16
Description: The py library through 1.11.0 for Python allows remote attackers to conduct a ReDoS (Regular expression Denial of Service) attack via a Subversion repository with crafted info data, because the InfoSvnCommand argument is mishandled. Note: This has been disputed by multiple third parties as not being reproduceable and they argue this is not a valid vulnerability.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-1333, CWE-1333
References: https://github.com/pytest-dev/py/blob/cb87a83960523a2367d0f19226a73aed4ce4291d/py/_path/svnurl.py#L316; https://github.com/pytest-dev/py/issues/287; https://news.ycombinator.com/item?id=34163710
CVE: CVE-2022-3521
Published: 2022-10-16
Description: A vulnerability has been found in Linux Kernel and classified as problematic. This vulnerability affects the function kcm_tx_work of the file net/kcm/kcmsock.c of the component kcm. The manipulation leads to race condition. It is recommended to apply a patch to fix this issue. VDB-211018 is the identifier assigned to this vulnerability.
CVSS Score: 2.6 (LOW)
CWE: CWE-362
References: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=ec7eede369fe5b0d085ac51fdbb95184f87bfc6c; https://lists.debian.org/debian-lts-announce/2022/12/msg00031.html; https://lists.debian.org/debian-lts-announce/2022/12/msg00034.html
CVE: CVE-2022-3522
Published: 2022-10-16
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2022-3523
Published: 2022-10-16
Description: A vulnerability was found in Linux Kernel. It has been classified as problematic. Affected is an unknown function of the file mm/memory.c of the component Driver Handler. The manipulation leads to use after free. It is possible to launch the attack remotely. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-211020.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-119, CWE-416
References: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=16ce101db85db694a91380aa4c89b25530871d33; https://vuldb.com/?id.211020; https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=16ce101db85db694a91380aa4c89b25530871d33
CVE: CVE-2022-3524
Published: 2022-10-16
Description: A vulnerability was found in Linux Kernel. It has been declared as problematic. Affected by this vulnerability is the function ipv6_renew_options of the component IPv6 Handler. The manipulation leads to memory leak. The attack can be launched remotely. It is recommended to apply a patch to fix this issue. The identifier VDB-211021 was assigned to this vulnerability.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-404, CWE-401
References: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=3c52c6bb831f6335c176a0fc7214e26f43adbd11; https://lists.debian.org/debian-lts-announce/2022/12/msg00031.html; https://lists.debian.org/debian-lts-announce/2022/12/msg00034.html
CVE: CVE-2022-3526
Published: 2022-10-16
Description: A vulnerability classified as problematic was found in Linux Kernel. This vulnerability affects the function macvlan_handle_frame of the file drivers/net/macvlan.c of the component skb. The manipulation leads to memory leak. The attack can be initiated remotely. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-211024.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-404, CWE-401
References: https://git.kernel.org/pub/scm/linux/kernel/git/pabeni/net-next.git/commit/?id=e16b859872b87650bb55b12cca5a5fcdc49c1442; https://vuldb.com/?id.211024; https://git.kernel.org/pub/scm/linux/kernel/git/pabeni/net-next.git/commit/?id=e16b859872b87650bb55b12cca5a5fcdc49c1442
CVE: CVE-2022-3527
Published: 2022-10-16
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2022-3528
Published: 2022-10-16
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2022-3529
Published: 2022-10-16
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2022-3530
Published: 2022-10-16
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2022-42975
Published: 2022-10-17
Description: socket/transport.ex in Phoenix before 1.6.14 mishandles check_origin wildcarding. NOTE: LiveView applications are unaffected by default because of the presence of a LiveView CSRF token.
CVSS Score: 7.5 (HIGH)
CWE: CWE-863
References: https://github.com/phoenixframework/phoenix/commit/6e7185b33a59e0b1d1c0b4223adf340a73e963ae; https://github.com/phoenixframework/phoenix/commit/6e7185b33a59e0b1d1c0b4223adf340a73e963ae
CVE: CVE-2022-42980
Published: 2022-10-17
Description: go-admin (aka GO Admin) 2.0.12 uses the string go-admin as a production JWT key.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798, CWE-798
References: https://github.com/go-admin-team/go-admin/issues/716; https://github.com/go-admin-team/go-admin/issues/716
CVE: CVE-2022-42983
Published: 2022-10-17
Description: anji-plus AJ-Report 0.9.8.6 allows remote attackers to bypass login authentication by spoofing JWT Tokens.
CVSS Score: 8.8 (HIGH)
CWE: CWE-290, CWE-290
References: https://gitee.com/anji-plus/report/issues/I5VVZ0; https://github.com/anji-plus/report/issues/7; https://gitee.com/anji-plus/report/issues/I5VVZ0
CVE: CVE-2022-2052
Published: 2022-10-17
Description: Multiple Trumpf Products in multiple versions use default privileged Windows users and passwords. An adversary may use these accounts to remotely gain full access to the system.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: https://cert.vde.com/en/advisories/VDE-2022-023/; https://cert.vde.com/en/advisories/VDE-2022-023/
CVE: CVE-2022-39052
Published: 2022-10-17
Description: An external attacker is able to send a specially crafted email (with many recipients) and trigger a potential DoS of the system
CVSS Score: 7.5 (HIGH)
CWE: CWE-835, CWE-835
References: https://otrs.com/release-notes/otrs-security-advisory-2022-13/; https://otrs.com/release-notes/otrs-security-advisory-2022-13/
CVE: CVE-2022-3281
Published: 2022-10-17
Description: WAGO Series PFC100/PFC200, Series Touch Panel 600, Compact Controller CC100 and Edge Controller in multiple versions are prone to a loss of MAC-Address-Filtering after reboot. This may allow an remote attacker to circumvent the reach the network that should be protected by the MAC address filter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-440
References: https://cert.vde.com/en/advisories/VDE-2022-042/; https://cert.vde.com/en/advisories/VDE-2022-042/
CVE: CVE-2022-3501
Published: 2022-10-17
Description: Article template contents with sensitive data could be accessed from agents without permissions.
CVSS Score: 3.5 (LOW)
CWE: CWE-200, CWE-862
References: https://otrs.com/release-notes/otrs-security-advisory-2022-14/; https://otrs.com/release-notes/otrs-security-advisory-2022-14/
CVE: CVE-2022-3531
Published: 2022-10-17
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2022-3532
Published: 2022-10-17
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2022-3533
Published: 2022-10-17
Description: A vulnerability was found in Linux Kernel. It has been rated as problematic. This issue affects the function parse_usdt_arg of the file tools/lib/bpf/usdt.c of the component BPF. The manipulation of the argument reg_name leads to memory leak. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-211031.
CVSS Score: 3.5 (LOW)
CWE: CWE-404
References: https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next.git/commit/?id=0dc9254e03704c75f2ebc9cbef2ce4de83fba603; https://vuldb.com/?id.211031; https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next.git/commit/?id=0dc9254e03704c75f2ebc9cbef2ce4de83fba603
CVE: CVE-2022-3534
Published: 2022-10-17
Description: A vulnerability classified as critical has been found in Linux Kernel. Affected is the function btf_dump_name_dups of the file tools/lib/bpf/btf_dump.c of the component libbpf. The manipulation leads to use after free. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-211032.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119, CWE-416
References: https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next.git/commit/?id=93c660ca40b5d2f7c1b1626e955a8e9fa30e0749; https://vuldb.com/?id.211032; https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next.git/commit/?id=93c660ca40b5d2f7c1b1626e955a8e9fa30e0749
CVE: CVE-2022-3535
Published: 2022-10-17
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2022-2563
Published: 2022-10-17
Description: The Tutor LMS WordPress plugin before 2.0.10 does not escape some course parameters, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/98cd761c-7527-4224-965d-d34472b5c19f; https://wpscan.com/vulnerability/98cd761c-7527-4224-965d-d34472b5c19f