deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-31152
Published: 2022-09-02
Description: Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. The Matrix specification specifies a list of [event authorization rules](https://spec.matrix.org/v1.2/rooms/v9/#authorization-rules) which must be checked when determining if an event should be accepted into a room. In versions of Synapse up to and including version 1.61.0, some of these rules are not correctly applied. An attacker could craft events which would be accepted by Synapse but not a spec-conformant server, potentially causing divergence in the room state between servers. Administrators of homeservers with federation enabled are advised to upgrade to version 1.62.0 or higher. Federation can be disabled by setting [`federation_domain_whitelist`](https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html#federation_domain_whitelist) to an empty list (`[]`) as a workaround.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-703, CWE-755
References: https://github.com/matrix-org/synapse/pull/13087; https://github.com/matrix-org/synapse/pull/13088; https://github.com/matrix-org/synapse/releases/tag/v1.62.0
CVE: CVE-2022-31196
Published: 2022-09-02
Description: Databasir is a database metadata management platform. Databasir <= 1.06 has Server-Side Request Forgery (SSRF) vulnerability. The SSRF is triggered by a sending a **single** HTTP POST request to create a databaseType. By supplying a `jdbcDriverFileUrl` that returns a non `200` response code, the url is executed, the response is logged (both in terminal and in database) and is included in the response. This would allow an attackers to obtain the real IP address and scan Intranet information. This issue was fixed in version 1.0.7.
CVSS Score: 7.6 (HIGH)
CWE: CWE-918
References: https://github.com/vran-dev/databasir/commit/226c20e0c[PII_REDACTED]a91d6b3e5083bd2462058; https://github.com/vran-dev/databasir/releases/tag/v1.0.7; https://github.com/vran-dev/databasir/security/advisories/GHSA-qvg8-427f-852q
CVE: CVE-2022-35933
Published: 2022-09-02
Description: This package is a PrestaShop module that allows users to post reviews and rate products. There is a vulnerability where the attacker could steal an administrator's cookie. The issue is fixed in version 5.0.2.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/PrestaShop/productcomments/commit/314456d739155aa71f0b235827e8e0f24b97c26b; https://github.com/PrestaShop/productcomments/security/advisories/GHSA-prrh-qvhf-x788; https://github.com/PrestaShop/productcomments/commit/314456d739155aa71f0b235827e8e0f24b97c26b
CVE: CVE-2022-31176
Published: 2022-09-02
Description: Grafana Image Renderer is a Grafana backend plugin that handles rendering of panels & dashboards to PNGs using a headless browser (Chromium/Chrome). An internal security review identified an unauthorized file disclosure vulnerability. It is possible for a malicious user to retrieve unauthorized files under some network conditions or via a fake datasource (if user has admin permissions in Grafana). All Grafana installations should be upgraded to version 3.6.1 as soon as possible. As a workaround it is possible to [disable HTTP remote rendering](https://grafana.com/docs/grafana/latest/setup-grafana/configure-grafana/#plugingrafana-image-renderer).
CVSS Score: 8.3 (HIGH)
CWE: CWE-200, CWE-306
References: https://github.com/grafana/grafana-image-renderer/pull/364; https://github.com/grafana/grafana-image-renderer/security/advisories/GHSA-2cfh-233g-m4c5; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2022-36638
Published: 2022-09-02
Description: An access control issue in the component print.php of Garage Management System v1.0 allows unauthenticated attackers to access data for all existing orders.
CVSS Score: 5.3 (MEDIUM)
References: https://senzee.net/index.php/2022/07/21/vulnerability-of-garage-management-system-1-0/; https://www.sourcecodester.com/php/15485/garage-management-system-using-phpmysql-source-code.html; https://senzee.net/index.php/2022/07/21/vulnerability-of-garage-management-system-1-0/
CVE: CVE-2022-36639
Published: 2022-09-02
Description: A stored cross-site scripting (XSS) vulnerability in /client.php of Garage Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the name parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://senzee.net/index.php/2022/07/21/vulnerability-of-garage-management-system-1-0/; https://www.sourcecodester.com/php/15485/garage-management-system-using-phpmysql-source-code.html; https://senzee.net/index.php/2022/07/21/vulnerability-of-garage-management-system-1-0/
CVE: CVE-2022-36640
Published: 2022-09-02
Description: influxData influxDB before v1.8.10 contains no authentication mechanism or controls, allowing unauthenticated attackers to execute arbitrary commands. NOTE: the CVE ID assignment is disputed because the vendor's documentation states "If InfluxDB is being deployed on a publicly accessible endpoint, we strongly recommend authentication be enabled. Otherwise the data will be publicly available to any unauthenticated user. The default settings do NOT enable authentication and authorization.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-276
References: http://influxdata.com; http://influxdb.com; http://www.krsecu.com/CVE/409b5310045bd6b9a984a5fb63bd8786d5c5681a8ad5b1c815c84b2b90002ad7.docx
CVE: CVE-2022-36642
Published: 2022-09-02
Description: A local file disclosure vulnerability in /appConfig/userDB.json of Telos Alliance Omnia MPX Node through 1.0.0-1.4.9 allows attackers to access users credentials which makes him able to gain initial access to the control panel with high privilege because the cleartext storage of sensitive information which can be unlatched by exploiting the LFD vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-862
References: https://cyber-guy.gitbook.io/cyber-guy/pocs/omnia-node-mpx-auth-bypass-via-lfd; https://cyber-guy.gitbook.io/cyber-guys-blog/blogs/bypassing-mpx-node-authentication-firmware-analysis; https://drive.google.com/drive/folders/1jm9h8JNmezTt7AbHYRY7gPC4lXGDNklL
CVE: CVE-2022-36647
Published: 2022-09-02
Description: PKUVCL davs2 v1.6.205 was discovered to contain a global buffer overflow via the function parse_sequence_header() at source/common/header.cc:269.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-120
References: https://github.com/pkuvcl/davs2/issues/29; https://github.com/pkuvcl/davs2/issues/29
CVE: CVE-2020-29260
Published: 2022-09-02
Description: libvncclient v0.9.13 was discovered to contain a memory leak via the function rfbClientCleanup().
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://github.com/LibVNC/libvncserver/commit/bef41f6ec4097a8ee094f90a1b34a708fbd757ec; https://lists.debian.org/debian-lts-announce/2022/09/msg00035.html; https://github.com/LibVNC/libvncserver/commit/bef41f6ec4097a8ee094f90a1b34a708fbd757ec
CVE: CVE-2022-36754
Published: 2022-09-02
Description: Expense Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /Home/debit_credit_p.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/mikeccltt/0724/blob/main/ci_ems/sql.md; https://github.com/mikeccltt/0724/blob/main/ci_ems/sql.md
CVE: CVE-2022-3099
Published: 2022-09-03
Description: Use After Free in GitHub repository vim/vim prior to 9.0.0360.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://github.com/vim/vim/commit/35d21c6830fc2d68aca838424a0e786821c5891c; https://huntr.dev/bounties/403210c7-6cc7-4874-8934-b57f88bd4f5e; https://lists.debian.org/debian-lts-announce/2022/11/msg00009.html
CVE: CVE-2022-3118
Published: 2022-09-04
Description: A vulnerability was found in Sourcecodehero ERP System Project. It has been rated as critical. This issue affects some unknown processing of the file /pages/processlogin.php. The manipulation of the argument user leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-207845 was assigned to this vulnerability.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://s2.loli.net/2022/09/02/N4FESXldmKWvQOw.png; https://vuldb.com/?id.207845; https://s2.loli.net/2022/09/02/N4FESXldmKWvQOw.png
CVE: CVE-2022-39196
Published: 2022-09-05
Description: Blackboard Learn 1.10.1 allows remote authenticated users to read unintended files by entering student credentials and then directly visiting a certain webapps/bbcms/execute/ URL. Note: The vendor disputes this stating this cannot be reproduced.
CVSS Score: 6.5 (MEDIUM)
References: https://github.com/DayiliWaseem/CVE-2022-39196-; https://github.com/DayiliWaseem/CVE-2022-39196-
CVE: CVE-2022-39824
Published: 2022-09-05
Description: Server-side JavaScript injection in Appsmith through 1.7.14 allows remote attackers to execute arbitrary JavaScript code from the server via the currentItem property of the list widget, e.g., to perform DoS attacks or achieve an information leak.
CVSS Score: 8.9 (HIGH)
CWE: CWE-79
References: https://github.com/FCncdn/Appsmith-Js-Injection-POC; https://github.com/appsmithorg/appsmith/releases; https://github.com/FCncdn/Appsmith-Js-Injection-POC
CVE: CVE-2022-39828
Published: 2022-09-05
Description: sign_pFwInfo in Samsung mTower through 0.3.0 has a missing check on the return value of EC_KEY_set_private_key, leading to a denial of service.
CVSS Score: 7.5 (HIGH)
References: https://github.com/Samsung/mTower/blob/18f4b592a8a973ce5972f4e2658ea0f6e3686284/tools/fwinfogen.c#L193; https://github.com/Samsung/mTower/issues/76; https://www.openssl.org/docs/manmaster/man3/EC_KEY_set_private_key.html
CVE: CVE-2022-39829
Published: 2022-09-05
Description: There is a NULL pointer dereference in aes256_encrypt in Samsung mTower through 0.3.0 due to a missing check on the return value of EVP_CIPHER_CTX_new.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://github.com/Samsung/mTower/blob/18f4b592a8a973ce5972f4e2658ea0f6e3686284/tools/ecdsa_keygen.c#L135; https://github.com/Samsung/mTower/issues/75; https://www.openssl.org/docs/manmaster/man3/EVP_CIPHER_CTX_new.html
CVE: CVE-2022-39830
Published: 2022-09-05
Description: sign_pFwInfo in Samsung mTower through 0.3.0 has a missing check on the return value of EC_KEY_set_public_key_affine_coordinates, leading to a denial of service.
CVSS Score: 7.5 (HIGH)
References: https://github.com/Samsung/mTower/blob/18f4b592a8a973ce5972f4e2658ea0f6e3686284/tools/fwinfogen.c#L194; https://github.com/Samsung/mTower/issues/77; https://www.openssl.org/docs/manmaster/man3/EC_KEY_set_public_key_affine_coordinates.html
CVE: CVE-2022-39831
Published: 2022-09-05
Description: An issue was discovered in PSPP 1.6.2. There is a heap-based buffer overflow at the function read_bytes_internal in utilities/pspp-dump-sav.c, which allows attackers to cause a denial of service (application crash) or possibly have unspecified other impact. This issue is different from CVE-2018-20230.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OECANCPD4WSSBJLSC3EE472M5DXRTIS4/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VQKWIVW5WJ5ZQNNQFRKTRKD7J3LRLUYW/; https://savannah.gnu.org/bugs/?62977
CVE: CVE-2022-39832
Published: 2022-09-05
Description: An issue was discovered in PSPP 1.6.2. There is a heap-based buffer overflow at the function read_string in utilities/pspp-dump-sav.c, which allows attackers to cause a denial of service (application crash) or possibly have unspecified other impact.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OECANCPD4WSSBJLSC3EE472M5DXRTIS4/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VQKWIVW5WJ5ZQNNQFRKTRKD7J3LRLUYW/; https://savannah.gnu.org/bugs/index.php?63000
CVE: CVE-2022-39839
Published: 2022-09-05
Description: Cotonti Siena 0.9.20 allows admins to conduct stored XSS attacks via a forum post.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/Cotonti/Cotonti/issues/1661; https://github.com/Cotonti/Cotonti/issues/1661
CVE: CVE-2022-39840
Published: 2022-09-05
Description: Cotonti Siena 0.9.20 allows admins to conduct stored XSS attacks via a direct message (DM).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/Cotonti/Cotonti/issues/1660; https://github.com/Cotonti/Cotonti/issues/1660
CVE: CVE-2022-39049
Published: 2022-09-05
Description: An attacker who is logged into OTRS as an admin user may manipulate the URL to cause execution of JavaScript in the context of OTRS.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-79
References: https://otrs.com/release-notes/otrs-security-advisory-2022-10/; https://otrs.com/release-notes/otrs-security-advisory-2022-10/
CVE: CVE-2022-39050
Published: 2022-09-05
Description: An attacker who is logged into OTRS as an admin user may manipulate customer URL field to store JavaScript code to be run later by any other agent when clicking the customer URL link. Then the stored JavaScript is executed in the context of OTRS. The same issue applies for the usage of external data sources e.g. database or ldap
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://otrs.com/release-notes/otrs-security-advisory-2022-11/; https://otrs.com/release-notes/otrs-security-advisory-2022-11/
CVE: CVE-2022-39051
Published: 2022-09-05
Description: Attacker might be able to execute malicious Perl code in the Template toolkit, by having the admin installing an unverified 3th party package
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-913, CWE-913
References: https://otrs.com/release-notes/otrs-security-advisory-2022-12/; https://otrs.com/release-notes/otrs-security-advisory-2022-12/
CVE: CVE-2022-39842
Published: 2022-09-05
Description: An issue was discovered in the Linux kernel before 5.19. In pxa3xx_gcu_write in drivers/video/fbdev/pxa3xx-gcu.c, the count parameter has a type conflict of size_t versus int, causing an integer overflow and bypassing the size check. After that, because it is used as the third argument to copy_from_user(), a heap overflow may occur. NOTE: the original discoverer disputes that the overflow can actually happen.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-190
References: https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.19; https://github.com/torvalds/linux/commit/a09d2d00af53b43c6f11e6ab3cb58443c2cac8a7; https://lists.debian.org/debian-lts-announce/2022/10/msg00000.html
CVE: CVE-2022-39843
Published: 2022-09-05
Description: 123elf Lotus 1-2-3 before 1.0.0rc3 for Linux, and Lotus 1-2-3 R3 for UNIX and other platforms through 9.8.2, allow attackers to execute arbitrary code via a crafted worksheet. This occurs because of a stack-based buffer overflow in the cell format processing routines, as demonstrated by a certain function call from process_fmt() that can be reached via a w3r_format element in a wk3 document.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/taviso/123elf/issues/103; https://github.com/taviso/123elf/releases/tag/v1.0.0rc3; https://github.com/taviso/123elf/issues/103
CVE: CVE-2022-3120
Published: 2022-09-05
Description: A vulnerability classified as critical was found in SourceCodester Clinics Patient Management System. Affected by this vulnerability is an unknown functionality of the file index.php of the component Login. The manipulation of the argument user_name leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-207847.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://github.com/joinia/webray.com.cn/blob/main/Clinic%27s-Patient-Management-System/cpms.md; https://vuldb.com/?id.207847; https://github.com/joinia/webray.com.cn/blob/main/Clinic%27s-Patient-Management-System/cpms.md
CVE: CVE-2022-3008
Published: 2022-09-05
Description: The tinygltf library uses the C library function wordexp() to perform file path expansion on untrusted paths that are provided from the input file. This function allows for command injection by using backticks. An attacker could craft an untrusted path input that would result in a path expansion. We recommend upgrading to 2.6.0 or past commit 52ff00a38447f06a17eab1caa2cf0730a119c751
CVSS Score: 8.1 (HIGH)
CWE: CWE-78, CWE-77
References: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49053; https://github.com/syoyo/tinygltf/blob/master/README.md; https://github.com/syoyo/tinygltf/commit/52ff00a38447f06a17eab1caa2cf0730a119c751
CVE: CVE-2022-38369
Published: 2022-09-05
Description: Apache IoTDB version 0.13.0 is vulnerable by session id attack. Users should upgrade to version 0.13.1 which addresses this issue.
CVSS Score: 8.8 (HIGH)
CWE: CWE-384
References: http://www.openwall.com/lists/oss-security/2022/09/05/1; https://lists.apache.org/thread/7nk03ywvx3t3yjbcxzt7zy4nyc89y9b0; http://www.openwall.com/lists/oss-security/2022/09/05/1
CVE: CVE-2022-38370
Published: 2022-09-05
Description: Apache IoTDB grafana-connector version 0.13.0 contains an interface without authorization, which may expose the internal structure of database. Users should upgrade to version 0.13.1 which addresses this issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-862
References: http://www.openwall.com/lists/oss-security/2022/09/05/2; https://lists.apache.org/thread/kcpqgstvgf8sxy9ktxm1836nlwc8xy3j; http://www.openwall.com/lists/oss-security/2022/09/05/2
CVE: CVE-2022-38749
Published: 2022-09-05
Description: Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-121, CWE-787
References: https://bitbucket.org/snakeyaml/snakeyaml/issues/525/got-stackoverflowerror-for-many-open; https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47024; https://lists.debian.org/debian-lts-announce/2022/10/msg00001.html
CVE: CVE-2022-38750
Published: 2022-09-05
Description: Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-121, CWE-787
References: https://bitbucket.org/snakeyaml/snakeyaml/issues/526/stackoverflow-oss-fuzz-47027; https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47027; https://lists.debian.org/debian-lts-announce/2022/10/msg00001.html
CVE: CVE-2022-38751
Published: 2022-09-05
Description: Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-121, CWE-787
References: https://bitbucket.org/snakeyaml/snakeyaml/issues/530/stackoverflow-oss-fuzz-47039; https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47039; https://lists.debian.org/debian-lts-announce/2022/10/msg00001.html
CVE: CVE-2022-38752
Published: 2022-09-05
Description: Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stack-overflow.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-121, CWE-787
References: https://bitbucket.org/snakeyaml/snakeyaml/issues/531/stackoverflow-oss-fuzz-47081; https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47081; https://security.gentoo.org/glsa/202305-28
CVE: CVE-2022-3123
Published: 2022-09-05
Description: Cross-site Scripting (XSS) - Reflected in GitHub repository splitbrain/dokuwiki prior to 2022-07-31a.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/splitbrain/dokuwiki/commit/63e9a247c072008a031f9db39fa496f6aca489b6; https://huntr.dev/bounties/d72a979b-57db-4201-9500-66b49a5c1345; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LLNV7GYZPGLIKBLISVQUREQXE3WHI5R2/
CVE: CVE-2022-2830
Published: 2022-09-05
Description: Deserialization of Untrusted Data vulnerability in the message processing component of Bitdefender GravityZone Console allows an attacker to pass unsafe commands to the environment. This issue affects: Bitdefender GravityZone Console On-Premise versions prior to 6.29.2-1. Bitdefender GravityZone Cloud Console versions prior to 6.27.2-2.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502
References: https://www.bitdefender.com/support/security-advisories/deserialization-of-untrusted-data-in-gravityzone-console-va-10573; https://www.bitdefender.com/support/security-advisories/deserialization-of-untrusted-data-in-gravityzone-console-va-10573
CVE: CVE-2022-2083
Published: 2022-09-05
Description: The Simple Single Sign On WordPress plugin through 4.1.0 leaks its OAuth client_secret, which could be used by attackers to gain unauthorized access to the site.
CVSS Score: 7.5 (HIGH)
CWE: CWE-319
References: https://lana.codes/lanavdb/0bab7575-45fc-432d-945e-6100c35c574c/; https://wpscan.com/vulnerability/2bbfc855-6901-462f-8a93-120d7fb5d268; https://lana.codes/lanavdb/0bab7575-45fc-432d-945e-6100c35c574c/
CVE: CVE-2022-2271
Published: 2022-09-05
Description: The WP Database Backup WordPress plugin before 5.9 does not escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/b064940f-9614-4b7b-b2c4-e[PII_REDACTED]3; https://wpscan.com/vulnerability/b064940f-9614-4b7b-b2c4-e[PII_REDACTED]3
CVE: CVE-2022-2376
Published: 2022-09-05
Description: The Directorist WordPress plugin before 7.3.1 discloses the email address of all users in an AJAX action available to both unauthenticated and any authenticated users
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://wpscan.com/vulnerability/437c4330-376a-4392-86c6-c4c7ed9583ad; https://wpscan.com/vulnerability/437c4330-376a-4392-86c6-c4c7ed9583ad
CVE: CVE-2022-2543
Published: 2022-09-05
Description: The Visual Portfolio, Photo Gallery & Post Grid WordPress plugin before 2.18.0 does not have proper authorisation checks in some of its REST endpoints, allowing unauthenticated users to call them and inject arbitrary CSS in arbitrary saved layouts
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-862
References: https://wpscan.com/vulnerability/5dc8b671-f2fa-47be-8664-9005c4fdbea8; https://wpscan.com/vulnerability/5dc8b671-f2fa-47be-8664-9005c4fdbea8
CVE: CVE-2022-2565
Published: 2022-09-05
Description: The Simple Payment Donations & Subscriptions WordPress plugin before 4.2.1 does not sanitise and escape user input given in its forms, which could allow unauthenticated attackers to perform Cross-Site Scripting attacks against admins
CVSS Score: 7.2 (HIGH)
CWE: CWE-79
References: https://wpscan.com/vulnerability/d89eff7d-a3e6-4876-aa0e-6d17e206af83; https://wpscan.com/vulnerability/d89eff7d-a3e6-4876-aa0e-6d17e206af83
CVE: CVE-2022-2597
Published: 2022-09-05
Description: The Visual Portfolio, Photo Gallery & Post Grid WordPress plugin before 2.19.0 does not have proper authorisation checks in some of its REST endpoints, allowing users with a role as low as contributor to call them and inject arbitrary CSS in arbitrary saved layouts
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-863
References: https://wpscan.com/vulnerability/3ffcee7c-1e03-448c-8006-a9405658cdb7; https://wpscan.com/vulnerability/3ffcee7c-1e03-448c-8006-a9405658cdb7