deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-0968
Published: 2022-03-15
Description: The microweber application allows large characters to insert in the input field "fist & last name" which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request. in microweber/microweber in GitHub repository microweber/microweber prior to 1.2.12.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-190, CWE-190
References: https://github.com/microweber/microweber/commit/80e39084729a57dfe749626c3b9d35247a14c49e; https://huntr.dev/bounties/97e36678-11cf-42c6-889c-892d415d9f9e; https://github.com/microweber/microweber/commit/80e39084729a57dfe749626c3b9d35247a14c49e
CVE: CVE-2022-26779
Published: 2022-03-15
Description: Apache CloudStack prior to 4.16.1.0 used insecure random number generation for project invitation tokens. If a project invite is created based only on an email address, a random token is generated. An attacker with knowledge of the project ID and the fact that the invite is sent, could generate time deterministic tokens and brute force attempt to use them prior to the legitimate receiver accepting the invite. This feature is not enabled by default, the attacker is required to know or guess the project ID for the invite in addition to the invitation token, and the attacker would need to be an existing authorized user of CloudStack.
CVSS Score: 7.5 (HIGH)
CWE: CWE-338
References: http://www.openwall.com/lists/oss-security/2022/03/15/1; https://github.com/JLLeitschuh/security-research/security/advisories/GHSA-vpcc-9rh2-8jfp; https://lists.apache.org/thread/dmm07b1cyosovqr12ddhkko501p11h2h
CVE: CVE-2020-4989
Published: 2022-03-15
Description: IBM Engineering Workflow Management 7.0, 7.0.1, and 7.0.2 and IBM Rational Team Concert 6.0.6 and 6.0.0.1 could allow an authenticated user to obtain sensitive information about build definitions. IBM X-Force ID: 192707.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-668
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/192707; https://www.ibm.com/support/pages/node/6563261; https://exchange.xforce.ibmcloud.com/vulnerabilities/192707
CVE: CVE-2022-0778
Published: 2022-03-15
Description: The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this function is used when parsing certificates that contain elliptic curve public keys in compressed form or explicit elliptic curve parameters with a base point encoded in compressed form. It is possible to trigger the infinite loop by crafting a certificate that has invalid explicit curve parameters. Since certificate parsing happens prior to verification of the certificate signature, any process that parses an externally supplied certificate may thus be subject to a denial of service attack. The infinite loop can also be reached when parsing crafted private keys as they can contain explicit elliptic curve parameters. Thus vulnerable situations include: - TLS clients consuming server certificates - TLS servers consuming client certificates - Hosting providers taking certificates or private keys from customers - Certificate authorities parsing certification requests from subscribers - Anything else which parses ASN.1 elliptic curve parameters Also any other applications that use the BN_mod_sqrt() where the attacker can control the parameter values are vulnerable to this DoS issue. In the OpenSSL 1.0.2 version the public key is not parsed during initial parsing of the certificate which makes it slightly harder to trigger the infinite loop. However any operation which requires the public key from the certificate will trigger the infinite loop. In particular the attacker can use a self-signed certificate to trigger the loop during verification of the certificate signature. This issue affects OpenSSL versions 1.0.2, 1.1.1 and 3.0. It was addressed in the releases of 1.1.1n and 3.0.2 on the 15th March 2022. Fixed in OpenSSL 3.0.2 (Affected 3.0.0,3.0.1). Fixed in OpenSSL 1.1.1n (Affected 1.1.1-1.1.1m). Fixed in OpenSSL 1.0.2zd (Affected 1.0.2-1.0.2zc).
CVSS Score: 7.5 (HIGH)
CWE: CWE-835
References: http://packetstormsecurity.com/files/167344/OpenSSL-1.0.2-1.1.1-3.0-BN_mod_sqrt-Infinite-Loop.html; http://seclists.org/fulldisclosure/2022/May/33; http://seclists.org/fulldisclosure/2022/May/35
CVE: CVE-2022-0970
Published: 2022-03-15
Description: Cross-site Scripting (XSS) - Stored in GitHub repository getgrav/grav prior to 1.7.31.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/getgrav/grav/commit/f19297d5f70476e7bedae9f2acef6b43615538b8; https://huntr.dev/bounties/dd436c44-cbf4-48ac-8817-3a24872534ec; https://github.com/getgrav/grav/commit/f19297d5f70476e7bedae9f2acef6b43615538b8
CVE: CVE-2022-22771
Published: 2022-03-15
Description: The Server component of TIBCO Software Inc.'s TIBCO JasperReports Library, TIBCO JasperReports Library for ActiveMatrix BPM, TIBCO JasperReports Server, TIBCO JasperReports Server for AWS Marketplace, TIBCO JasperReports Server for ActiveMatrix BPM, and TIBCO JasperReports Server for Microsoft Azure contains a directory-traversal vulnerability that may theoretically allow web server users to access contents of the host system. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Library: version 7.9.0, TIBCO JasperReports Library for ActiveMatrix BPM: version 7.9.0, TIBCO JasperReports Server: versions 7.9.0 and 7.9.1, TIBCO JasperReports Server for AWS Marketplace: versions 7.9.0 and 7.9.1, TIBCO JasperReports Server for ActiveMatrix BPM: versions 7.9.0 and 7.9.1, and TIBCO JasperReports Server for Microsoft Azure: version 7.9.1.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22
References: https://www.tibco.com/services/support/advisories; https://www.tibco.com/support/advisories/2022/03/tibco-security-advisory-march-15-2022-tibco-jasperreports-library-2022-22771; https://www.tibco.com/services/support/advisories
CVE: CVE-2022-27195
Published: 2022-03-15
Description: Jenkins Parameterized Trigger Plugin 2.43 and earlier captures environment variables passed to builds triggered using Jenkins Parameterized Trigger Plugin, including password parameter values, in their `build.xml` files. These values are stored unencrypted and can be viewed by users with access to the Jenkins controller file system.
CVSS Score: 5.5 (MEDIUM)
References: http://www.openwall.com/lists/oss-security/2022/03/15/2; https://www.jenkins.io/security/advisory/2022-03-15/#SECURITY-2185; http://www.openwall.com/lists/oss-security/2022/03/15/2
CVE: CVE-2022-27196
Published: 2022-03-15
Description: Jenkins Favorite Plugin 2.4.0 and earlier does not escape the names of jobs in the favorite column, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure or Item/Create permissions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2022/03/15/2; https://www.jenkins.io/security/advisory/2022-03-15/#SECURITY-2557; http://www.openwall.com/lists/oss-security/2022/03/15/2
CVE: CVE-2022-27197
Published: 2022-03-15
Description: Jenkins Dashboard View Plugin 2.18 and earlier does not perform URL validation for the Iframe Portlet's Iframe source URL, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to configure views.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2022/03/15/2; https://www.jenkins.io/security/advisory/2022-03-15/#SECURITY-2559; http://www.openwall.com/lists/oss-security/2022/03/15/2
CVE: CVE-2022-27198
Published: 2022-03-15
Description: A cross-site request forgery (CSRF) vulnerability in Jenkins CloudBees AWS Credentials Plugin 189.v3551d5642995 and earlier allows attackers with Overall/Read permission to connect to an AWS service using an attacker-specified token.
CVSS Score: 8.0 (HIGH)
CWE: CWE-352
References: http://www.openwall.com/lists/oss-security/2022/03/15/2; https://www.jenkins.io/security/advisory/2022-03-15/#SECURITY-2351; http://www.openwall.com/lists/oss-security/2022/03/15/2
CVE: CVE-2022-27199
Published: 2022-03-15
Description: A missing permission check in Jenkins CloudBees AWS Credentials Plugin 189.v3551d5642995 and earlier allows attackers with Overall/Read permission to connect to an AWS service using an attacker-specified token.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: http://www.openwall.com/lists/oss-security/2022/03/15/2; https://www.jenkins.io/security/advisory/2022-03-15/#SECURITY-2351; http://www.openwall.com/lists/oss-security/2022/03/15/2
CVE: CVE-2022-27200
Published: 2022-03-15
Description: Jenkins Folder-based Authorization Strategy Plugin 1.3 and earlier does not escape the names of roles shown on the configuration form, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Overall/Administer permission.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2022/03/15/2; https://www.jenkins.io/security/advisory/2022-03-15/#SECURITY-2646; http://www.openwall.com/lists/oss-security/2022/03/15/2
CVE: CVE-2022-27201
Published: 2022-03-15
Description: Jenkins Semantic Versioning Plugin 1.13 and earlier does not restrict execution of an controller/agent message to agents, and implements no limitations about the file path that can be parsed, allowing attackers able to control agent processes to have Jenkins parse a crafted file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.
CVSS Score: 6.5 (MEDIUM)
References: http://www.openwall.com/lists/oss-security/2022/03/15/2; https://www.jenkins.io/security/advisory/2022-03-15/#SECURITY-2124; http://www.openwall.com/lists/oss-security/2022/03/15/2
CVE: CVE-2022-27202
Published: 2022-03-15
Description: Jenkins Extended Choice Parameter Plugin 346.vd87693c5a_86c and earlier does not escape the value and description of extended choice parameters of radio buttons or check boxes type, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2022/03/15/2; https://www.jenkins.io/security/advisory/2022-03-15/#SECURITY-2232; http://www.openwall.com/lists/oss-security/2022/03/15/2
CVE: CVE-2022-27203
Published: 2022-03-15
Description: Jenkins Extended Choice Parameter Plugin 346.vd87693c5a_86c and earlier allows attackers with Item/Configure permission to read values from arbitrary JSON and Java properties files on the Jenkins controller.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: http://www.openwall.com/lists/oss-security/2022/03/15/2; https://www.jenkins.io/security/advisory/2022-03-15/#SECURITY-1351; http://www.openwall.com/lists/oss-security/2022/03/15/2
CVE: CVE-2022-27204
Published: 2022-03-15
Description: A cross-site request forgery vulnerability in Jenkins Extended Choice Parameter Plugin 346.vd87693c5a_86c and earlier allows attackers to connect to an attacker-specified URL.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://www.openwall.com/lists/oss-security/2022/03/15/2; https://www.jenkins.io/security/advisory/2022-03-15/#SECURITY-1350; http://www.openwall.com/lists/oss-security/2022/03/15/2
CVE: CVE-2022-27205
Published: 2022-03-15
Description: A missing permission check in Jenkins Extended Choice Parameter Plugin 346.vd87693c5a_86c and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: http://www.openwall.com/lists/oss-security/2022/03/15/2; https://www.jenkins.io/security/advisory/2022-03-15/#SECURITY-1350; http://www.openwall.com/lists/oss-security/2022/03/15/2
CVE: CVE-2022-27206
Published: 2022-03-15
Description: Jenkins GitLab Authentication Plugin 1.13 and earlier stores the GitLab client secret unencrypted in the global config.xml file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-522
References: http://www.openwall.com/lists/oss-security/2022/03/15/2; https://www.jenkins.io/security/advisory/2022-03-15/#SECURITY-1891; http://www.openwall.com/lists/oss-security/2022/03/15/2
CVE: CVE-2022-27207
Published: 2022-03-15
Description: Jenkins global-build-stats Plugin 1.5 and earlier does not escape multiple fields in the chart configuration on the 'Global Build Stats' page, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Overall/Administer permission.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2022/03/15/2; https://www.jenkins.io/security/advisory/2022-03-15/#SECURITY-1886; http://www.openwall.com/lists/oss-security/2022/03/15/2
CVE: CVE-2022-27208
Published: 2022-03-15
Description: Jenkins Kubernetes Continuous Deploy Plugin 2.3.1 and earlier allows users with Credentials/Create permission to read arbitrary files on the Jenkins controller.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: http://www.openwall.com/lists/oss-security/2022/03/15/2; https://www.jenkins.io/security/advisory/2022-03-15/#SECURITY-2096; http://www.openwall.com/lists/oss-security/2022/03/15/2
CVE: CVE-2022-27209
Published: 2022-03-15
Description: A missing permission check in Jenkins Kubernetes Continuous Deploy Plugin 2.3.1 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: http://www.openwall.com/lists/oss-security/2022/03/15/2; https://www.jenkins.io/security/advisory/2022-03-15/#SECURITY-2636; http://www.openwall.com/lists/oss-security/2022/03/15/2
CVE: CVE-2022-27210
Published: 2022-03-15
Description: A cross-site request forgery (CSRF) vulnerability in Jenkins Kubernetes Continuous Deploy Plugin 2.3.1 and earlier allows attackers to connect to an attacker-specified SSH server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: http://www.openwall.com/lists/oss-security/2022/03/15/2; https://www.jenkins.io/security/advisory/2022-03-15/#SECURITY-2681; http://www.openwall.com/lists/oss-security/2022/03/15/2
CVE: CVE-2022-27211
Published: 2022-03-15
Description: A missing permission check in Jenkins Kubernetes Continuous Deploy Plugin 2.3.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified SSH server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: http://www.openwall.com/lists/oss-security/2022/03/15/2; https://www.jenkins.io/security/advisory/2022-03-15/#SECURITY-2681; http://www.openwall.com/lists/oss-security/2022/03/15/2
CVE: CVE-2022-27212
Published: 2022-03-15
Description: Jenkins List Git Branches Parameter Plugin 0.0.9 and earlier does not escape the name of the 'List Git branches (and more)' parameter, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2022/03/15/2; https://www.jenkins.io/security/advisory/2022-03-15/#SECURITY-2167; http://www.openwall.com/lists/oss-security/2022/03/15/2
CVE: CVE-2022-27213
Published: 2022-03-15
Description: Jenkins Environment Dashboard Plugin 1.1.10 and earlier does not escape the Environment order and the Component order configuration values in its views, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with View/Configure permission.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2022/03/15/2; https://www.jenkins.io/security/advisory/2022-03-15/#SECURITY-2252; http://www.openwall.com/lists/oss-security/2022/03/15/2
CVE: CVE-2022-27214
Published: 2022-03-15
Description: A cross-site request forgery (CSRF) vulnerability in Jenkins Release Helper Plugin 1.3.3 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: http://www.openwall.com/lists/oss-security/2022/03/15/2; https://www.jenkins.io/security/advisory/2022-03-15/#SECURITY-2274; http://www.openwall.com/lists/oss-security/2022/03/15/2
CVE: CVE-2022-27215
Published: 2022-03-15
Description: A missing permission check in Jenkins Release Helper Plugin 1.3.3 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: http://www.openwall.com/lists/oss-security/2022/03/15/2; https://www.jenkins.io/security/advisory/2022-03-15/#SECURITY-2274; http://www.openwall.com/lists/oss-security/2022/03/15/2
CVE: CVE-2022-27216
Published: 2022-03-15
Description: Jenkins dbCharts Plugin 0.5.2 and earlier stores JDBC connection passwords unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-522
References: http://www.openwall.com/lists/oss-security/2022/03/15/2; https://www.jenkins.io/security/advisory/2022-03-15/#SECURITY-2159; http://www.openwall.com/lists/oss-security/2022/03/15/2
CVE: CVE-2022-27217
Published: 2022-03-15
Description: Jenkins Vmware vRealize CodeStream Plugin 1.2 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission, or access to the Jenkins controller file system.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-522
References: http://www.openwall.com/lists/oss-security/2022/03/15/2; https://www.jenkins.io/security/advisory/2022-03-15/#SECURITY-2238; http://www.openwall.com/lists/oss-security/2022/03/15/2
CVE: CVE-2022-27218
Published: 2022-03-15
Description: Jenkins incapptic connect uploader Plugin 1.15 and earlier stores tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission, or access to the Jenkins controller file system.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-522
References: http://www.openwall.com/lists/oss-security/2022/03/15/2; https://www.jenkins.io/security/advisory/2022-03-15/#SECURITY-2273; http://www.openwall.com/lists/oss-security/2022/03/15/2
CVE: CVE-2022-25485
Published: 2022-03-15
Description: CuppaCMS v1.0 was discovered to contain a local file inclusion via the url parameter in /alerts/alertLightbox.php.
CVSS Score: 7.8 (HIGH)
CWE: CWE-829
References: https://github.com/CuppaCMS/CuppaCMS/issues/24; https://github.com/CuppaCMS/CuppaCMS/issues/24
CVE: CVE-2022-25486
Published: 2022-03-15
Description: CuppaCMS v1.0 was discovered to contain a local file inclusion via the url parameter in /alerts/alertConfigField.php.
CVSS Score: 7.8 (HIGH)
CWE: CWE-829
References: https://github.com/CuppaCMS/CuppaCMS/issues/15; https://github.com/CuppaCMS/CuppaCMS/issues/25; https://github.com/hansmach1ne/MyExploits/tree/main/Multiple_LFIs_in_CuppaCMS_alerts
CVE: CVE-2022-25487
Published: 2022-03-15
Description: Atom CMS v2.0 was discovered to contain a remote code execution (RCE) vulnerability via /admin/uploads.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: http://packetstormsecurity.com/files/166532/Atom-CMS-1.0.2-Shell-Upload.html; https://github.com/thedigicraft/Atom.CMS/issues/256; http://packetstormsecurity.com/files/166532/Atom-CMS-1.0.2-Shell-Upload.html
CVE: CVE-2022-25488
Published: 2022-03-15
Description: Atom CMS v2.0 was discovered to contain a SQL injection vulnerability via the id parameter in /admin/ajax/avatar.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/thedigicraft/Atom.CMS/issues/257; https://github.com/thedigicraft/Atom.CMS/issues/257
CVE: CVE-2022-25489
Published: 2022-03-15
Description: Atom CMS v2.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the "A" parameter in /widgets/debug.php.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/thedigicraft/Atom.CMS/issues/258; https://github.com/thedigicraft/Atom.CMS/issues/258
CVE: CVE-2022-25490
Published: 2022-03-15
Description: HMS v1.0 was discovered to contain a SQL injection vulnerability via the editid parameter in department.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/kabirkhyrul/HMS/discussions/8; https://github.com/kabirkhyrul/HMS/discussions/8
CVE: CVE-2022-25491
Published: 2022-03-15
Description: HMS v1.0 was discovered to contain a SQL injection vulnerability via the editid parameter in appointment.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://github.com/kabirkhyrul/HMS/discussions/8; https://github.com/kabirkhyrul/HMS/discussions/8
CVE: CVE-2022-25492
Published: 2022-03-15
Description: HMS v1.0 was discovered to contain a SQL injection vulnerability via the medicineid parameter in ajaxmedicine.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/kabirkhyrul/HMS/discussions/8; https://github.com/kabirkhyrul/HMS/discussions/8
CVE: CVE-2022-25493
Published: 2022-03-15
Description: HMS v1.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via treatmentrecord.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/kabirkhyrul/HMS/discussions/10; https://github.com/kabirkhyrul/HMS/discussions/10
CVE: CVE-2022-25494
Published: 2022-03-15
Description: Online Banking System v1.0 was discovered to contain a SQL injection vulnerability via staff_login.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/g33kyrash/Online-Banking-system/issues/16; https://github.com/g33kyrash/Online-Banking-system/issues/16
CVE: CVE-2022-25495
Published: 2022-03-15
Description: The component /jquery_file_upload/server/php/index.php of CuppaCMS v1.0 allows attackers to upload arbitrary files and execute arbitrary code via a crafted PHP file.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://github.com/CuppaCMS/CuppaCMS/issues/26; https://github.com/CuppaCMS/CuppaCMS/issues/26
CVE: CVE-2022-25497
Published: 2022-03-15
Description: CuppaCMS v1.0 was discovered to contain an arbitrary file read via the copy function.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-552
References: https://github.com/CuppaCMS/CuppaCMS/issues/28; https://github.com/CuppaCMS/CuppaCMS/issues/28
CVE: CVE-2022-25498
Published: 2022-03-15
Description: CuppaCMS v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the saveConfigData function in /classes/ajax/Functions.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://github.com/CuppaCMS/CuppaCMS/issues/29; https://github.com/CuppaCMS/CuppaCMS/issues/29
CVE: CVE-2021-45848
Published: 2022-03-15
Description: Denial of service (DoS) vulnerability in Nicotine+ 3.0.3 and later allows a user with a modified Soulseek client to crash Nicotine+ by sending a file download request with a file path containing a null character.
CVSS Score: 7.5 (HIGH)
CWE: CWE-116
References: https://github.com/nicotine-plus/nicotine-plus/issues/1777; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HWYV53KERFH2EC4XI2IVVQFTV75E5XM6/; https://security.gentoo.org/glsa/202210-20
CVE: CVE-2021-29134
Published: 2022-03-15
Description: The avatar middleware in Gitea before 1.13.6 allows Directory Traversal via a crafted URL.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: https://github.com/go-gitea/gitea/pull/15125/files; https://github.com/go-gitea/gitea/releases/tag/v1.13.6; https://github.com/go-gitea/gitea/pull/15125/files