deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-34840
Published: 2022-12-07
Description: Use of hard-coded credentials vulnerability in multiple Buffalo network devices allows a network-adjacent attacker to alter?configuration settings of the device. The affected products/versions are as follows: WZR-300HP firmware Ver. 2.00 and earlier, WZR-450HP firmware Ver. 2.00 and earlier, WZR-600DHP firmware Ver. 2.00 and earlier, WZR-900DHP firmware Ver. 1.15 and earlier, HW-450HP-ZWE firmware Ver. 2.00 and earlier, WZR-450HP-CWT firmware Ver. 2.00 and earlier, WZR-450HP-UB firmware Ver. 2.00 and earlier, WZR-600DHP2 firmware Ver. 1.15 and earlier, and WZR-D1100H firmware Ver. 2.00 and earlier.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-798, CWE-798
References: https://jvn.jp/en/vu/JVNVU92805279/index.html; https://www.buffalo.jp/news/detail/20221003-01.html; https://jvn.jp/en/vu/JVNVU92805279/index.html
CVE: CVE-2022-39044
Published: 2022-12-07
Description: Hidden functionality vulnerability in multiple Buffalo network devices allows a network-adjacent attacker with an administrative privilege to execute an arbitrary OS command. The affected products/versions are as follows: WCR-300 firmware Ver. 1.87 and earlier, WHR-HP-G300N firmware Ver. 2.00 and earlier, WHR-HP-GN firmware Ver. 1.87 and earlier, WPL-05G300 firmware Ver. 1.88 and earlier, WZR-300HP firmware Ver. 2.00 and earlier, WZR-450HP firmware Ver. 2.00 and earlier, WZR-600DHP firmware Ver. 2.00 and earlier, WZR-900DHP firmware Ver. 1.15 and earlier, WZR-HP-AG300H firmware Ver. 1.76 and earlier, WZR-HP-G302H firmware Ver. 1.86 and earlier, WLAE-AG300N firmware Ver. 1.86 and earlier, FS-600DHP firmware Ver. 3.40 and earlier, FS-G300N firmware Ver. 3.14 and earlier, FS-HP-G300N firmware Ver. 3.33 and earlier, FS-R600DHP firmware Ver. 3.40 and earlier, BHR-4GRV firmware Ver. 2.00 and earlier, DWR-HP-G300NH firmware Ver. 1.84 and earlier, DWR-PG firmware Ver. 1.83 and earlier, HW-450HP-ZWE firmware Ver. 2.00 and earlier, WER-A54G54 firmware Ver. 1.43 and earlier, WER-AG54 firmware Ver. 1.43 and earlier, WER-AM54G54 firmware Ver. 1.43 and earlier, WER-AMG54 firmware Ver. 1.43 and earlier, WHR-300 firmware Ver. 2.00 and earlier, WHR-300HP firmware Ver. 2.00 and earlier, WHR-AM54G54 firmware Ver. 1.43 and earlier, WHR-AMG54 firmware Ver. 1.43 and earlier, WHR-AMPG firmware Ver. 1.52 and earlier, WHR-G firmware Ver. 1.49 and earlier, WHR-G300N firmware Ver. 1.65 and earlier, WHR-G301N firmware Ver. 1.87 and earlier, WHR-G54S firmware Ver. 1.43 and earlier, WHR-G54S-NI firmware Ver. 1.24 and earlier, WHR-HP-AMPG firmware Ver. 1.43 and earlier, WHR-HP-G firmware Ver. 1.49 and earlier, WHR-HP-G54 firmware Ver. 1.43 and earlier, WLI-H4-D600 firmware Ver. 1.88 and earlier, WLI-TX4-AG300N firmware Ver. 1.53 and earlier, WS024BF firmware Ver. 1.60 and earlier, WS024BF-NW firmware Ver. 1.60 and earlier, WZR2-G108 firmware Ver. 1.33 and earlier, WZR2-G300N firmware Ver. 1.55 and earlier, WZR-450HP-CWT firmware Ver. 2.00 and earlier, WZR-450HP-UB firmware Ver. 2.00 and earlier, WZR-600DHP2 firmware Ver. 1.15 and earlier, WZR-AGL300NH firmware Ver. 1.55 and earlier, WZR-AMPG144NH firmware Ver. 1.49 and earlier, WZR-AMPG300NH firmware Ver. 1.51 and earlier, WZR-D1100H firmware Ver. 2.00 and earlier, WZR-G144N firmware Ver. 1.48 and earlier, WZR-G144NH firmware Ver. 1.48 and earlier, WZR-HP-G300NH firmware Ver. 1.84 and earlier, WZR-HP-G301NH firmware Ver. 1.84 and earlier, and WZR-HP-G450H firmware Ver. 1.90 and earlier.
CVSS Score: 6.8 (MEDIUM)
References: https://jvn.jp/en/vu/JVNVU92805279/index.html; https://www.buffalo.jp/news/detail/20221003-01.html; https://jvn.jp/en/vu/JVNVU92805279/index.html
CVE: CVE-2022-42458
Published: 2022-12-07
Description: Authentication bypass using an alternate path or channel vulnerability in bingo!CMS version1.7.4.1 and earlier allows a remote unauthenticated attacker to upload an arbitrary file. As a result, an arbitrary script may be executed and/or a file may be altered.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287, CWE-287
References: https://jvn.jp/en/jp/JVN74592196/index.html; https://www.bingo-cms.jp/information/20221011.html; https://jvn.jp/en/jp/JVN74592196/index.html
CVE: CVE-2022-45910
Published: 2022-12-07
Description: Improper neutralization of special elements used in an LDAP query ('LDAP Injection') vulnerability in ActiveDirectory and Sharepoint ActiveDirectory authority connectors of Apache ManifoldCF allows an attacker to manipulate the LDAP search queries (DoS, additional queries, filter manipulation) during user lookup, if the username or the domain string are passed to the UserACLs servlet without validation.

This issue affects Apache ManifoldCF version 2.23 and prior versions.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-90, CWE-74, CWE-74
References: https://lists.apache.org/thread/m693p0dq6jvwwvmy2wnhj6k854z0s444; https://lists.apache.org/thread/m693p0dq6jvwwvmy2wnhj6k854z0s444
CVE: CVE-2022-45217
Published: 2022-12-07
Description: A cross-site scripting (XSS) vulnerability in Book Store Management System v1.0.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Level parameter under the Add New System User module.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/sudoninja-noob/CVE-2022-45217/blob/main/CVE-2022-45217; https://www.sourcecodester.com/php/15748/book-store-management-system-project-using-php-codeigniter-3-free-source-code.html; https://github.com/sudoninja-noob/CVE-2022-45217/blob/main/CVE-2022-45217
CVE: CVE-2020-36565
Published: 2022-12-07
Description: Due to improper sanitization of user input on Windows, the static file handler allows for directory traversal, allowing an attacker to read files outside of the target directory that the server has permission to read.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: https://github.com/labstack/echo/commit/4422e3b66b9fd498ed1ae1d0242d660d0ed3faaa; https://github.com/labstack/echo/pull/1718; https://pkg.go.dev/vuln/GO-2021-0051
CVE: CVE-2022-41720
Published: 2022-12-07
Description: On Windows, restricted files can be accessed via os.DirFS and http.Dir. The os.DirFS function and http.Dir type provide access to a tree of files rooted at a given directory. These functions permit access to Windows device files under that root. For example, os.DirFS("C:/tmp").Open("COM1") opens the COM1 device. Both os.DirFS and http.Dir only provide read-only filesystem access. In addition, on Windows, an os.DirFS for the directory (the root of the current drive) can permit a maliciously crafted path to escape from the drive and access any path on the system. With fix applied, the behavior of os.DirFS("") has changed. Previously, an empty root was treated equivalently to "/", so os.DirFS("").Open("tmp") would open the path "/tmp". This now returns an error.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://go.dev/cl/455716; https://go.dev/issue/56694; https://groups.google.com/g/golang-announce/c/L_3rmdT0BMU/m/yZDrXjIiBQAJ
CVE: CVE-2022-41735
Published: 2022-12-07
Description: IBM Business Process Manager 21.0.1 through 21.0.3.1, 20.0.0.1 through 20.0.0.2 19.0.0.1 through 19.0.0.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.  IBM X-Force ID:  65687.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/237809; https://www.ibm.com/support/pages/node/6845496; https://exchange.xforce.ibmcloud.com/vulnerabilities/237809
CVE: CVE-2022-44361
Published: 2022-12-07
Description: An issue was discovered in ZZCMS 2022. There is a cross-site scripting (XSS) vulnerability in admin/ad_list.php.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/cri1stur/ZZcms/issues/1; https://github.com/cri1stur/ZZcms/issues/1
CVE: CVE-2022-44371
Published: 2022-12-07
Description: hope-boot 1.0.0 has a deserialization vulnerability that can cause Remote Code Execution (RCE).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502, CWE-502
References: https://github.com/java-aodeng/hope-boot/issues/83; https://github.com/java-aodeng/hope-boot/issues/83
CVE: CVE-2022-44393
Published: 2022-12-07
Description: Sanitization Management System v1.0 is vulnerable to SQL Injection via /php-sms/admin/?page=services/view_service&id=.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/Serces-X/vul_report/blob/main/vendors/oretnom23/Sanitization-Management-System/SQLi-1.md; https://github.com/Serces-X/vul_report/blob/main/vendors/oretnom23/Sanitization-Management-System/SQLi-1.md
CVE: CVE-2022-43581
Published: 2022-12-07
Description: IBM Content Navigator 3.0.0, 3.0.1, 3.0.2, 3.0.3, 3.0.4, 3.0.5, 3.0.6, 3.0.7, 3.0.8, 3.0.9, 3.0.10, 3.0.11, and 3.0.12 is vulnerable to missing authorization and could allow an authenticated user to load external plugins and execute code.  IBM X-Force ID:  238805.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119, CWE-862
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/238805; https://www.ibm.com/support/pages/node/6844453; https://exchange.xforce.ibmcloud.com/vulnerabilities/238805
CVE: CVE-2022-44351
Published: 2022-12-07
Description: Skycaiji v2.5.1 was discovered to contain a deserialization vulnerability via /SkycaijiApp/admin/controller/Mystore.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502, CWE-502
References: https://github.com/zorlan/skycaiji/issues/46; https://github.com/zorlan/skycaiji/issues/46
CVE: CVE-2022-44373
Published: 2022-12-07
Description: A stack overflow vulnerability exists in TrendNet Wireless AC Easy-Upgrader TEW-820AP (Version v1.0R, firmware version 1.01.B01) which may result in remote code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://github.com/johnawm/vulner-box/blob/master/TRENDNet/TEW-820AP/02/README.md; https://github.com/johnawm/vulner-box/blob/master/TRENDNet/TEW-820AP/02/README.md
CVE: CVE-2022-45550
Published: 2022-12-07
Description: AyaCMS 3.1.2 is vulnerable to Remote Code Execution (RCE).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://github.com/loadream/AyaCMS/issues/8; https://shimo.im/docs/KrkEVb29pwsxZ6AJ; https://github.com/loadream/AyaCMS/issues/8
CVE: CVE-2022-46770
Published: 2022-12-07
Description: qubes-mirage-firewall (aka Mirage firewall for QubesOS) 0.8.x through 0.8.3 allows guest OS users to cause a denial of service (CPU consumption and loss of forwarding) via a crafted multicast UDP packet (IP address range of 224.0.0.0 through 239.255.255.255).
CVSS Score: 7.5 (HIGH)
CWE: CWE-835, CWE-835
References: http://packetstormsecurity.com/files/171610/Qubes-Mirage-Firewall-0.8.3-Denial-Of-Service.html; https://github.com/mirage/qubes-mirage-firewall/issues/166; http://packetstormsecurity.com/files/171610/Qubes-Mirage-Firewall-0.8.3-Denial-Of-Service.html
CVE: CVE-2022-23486
Published: 2022-12-07
Description: libp2p-rust is the official rust language Implementation of the libp2p networking stack. In versions prior to 0.45.1 an attacker node can cause a victim node to allocate a large number of small memory chunks, which can ultimately lead to the victim’s process running out of memory and thus getting killed by its operating system. When executed continuously, this can lead to a denial of service attack, especially relevant on a larger scale when run against more than one node of a libp2p based network. Users are advised to upgrade to `libp2p` `v0.45.1` or above. Users unable to upgrade should reference the DoS Mitigation page for more information on how to incorporate mitigation strategies, monitor their application, and respond to attacks: https://docs.libp2p.io/reference/dos-mitigation/.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-770
References: https://github.com/libp2p/rust-libp2p/security/advisories/GHSA-jvgw-gccv-q5p8; https://github.com/libp2p/rust-libp2p/security/advisories/GHSA-jvgw-gccv-q5p8
CVE: CVE-2022-23487
Published: 2022-12-07
Description: js-libp2p is the official javascript Implementation of libp2p networking stack. Versions older than `v0.38.0` of js-libp2p are vulnerable to targeted resource exhaustion attacks. These attacks target libp2p’s connection, stream, peer, and memory management. An attacker can cause the allocation of large amounts of memory, ultimately leading to the process getting killed by the host’s operating system. While a connection manager tasked with keeping the number of connections within manageable limits has been part of js-libp2p, this component was designed to handle the regular churn of peers, not a targeted resource exhaustion attack. Users are advised to update their js-libp2p dependency to `v0.38.0` or greater. There are no known workarounds for this vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-770
References: https://github.com/libp2p/js-libp2p/security/advisories/GHSA-f44q-634c-jvwv; https://github.com/libp2p/js-libp2p/security/advisories/GHSA-f44q-634c-jvwv
CVE: CVE-2022-4341
Published: 2022-12-07
Description: A vulnerability has been found in csliuwy coder-chain_gdut and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /back/index.php/user/User/?1. The manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-215095.
CVSS Score: 3.5 (LOW)
CWE: CWE-707, CWE-79
References: https://gitee.com/csliuwy/coder-chain_gdut/issues/I53DPF; https://vuldb.com/?id.215095; https://gitee.com/csliuwy/coder-chain_gdut/issues/I53DPF
CVE: CVE-2022-23491
Published: 2022-12-07
Description: Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi 2022.12.07 removes root certificates from "TrustCor" from the root store. These are in the process of being removed from Mozilla's trust store. TrustCor's root certificates are being removed pursuant to an investigation prompted by media reporting that TrustCor's ownership also operated a business that produced spyware. Conclusions of Mozilla's investigation can be found in the linked google group discussion.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-345, CWE-345
References: https://github.com/certifi/python-certifi/security/advisories/GHSA-43fp-rhv2-5gv8; https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/oxX69KFvsm4/m/yLohoVqtCgAJ; https://github.com/certifi/python-certifi/security/advisories/GHSA-43fp-rhv2-5gv8
CVE: CVE-2022-23471
Published: 2022-12-07
Description: containerd is an open source container runtime. A bug was found in containerd's CRI implementation where a user can exhaust memory on the host. In the CRI stream server, a goroutine is launched to handle terminal resize events if a TTY is requested. If the user's process fails to launch due to, for example, a faulty command, the goroutine will be stuck waiting to send without a receiver, resulting in a memory leak. Kubernetes and crictl can both be configured to use containerd's CRI implementation and the stream server is used for handling container IO. This bug has been fixed in containerd 1.6.12 and 1.5.16.  Users should update to these versions to resolve the issue. Users unable to upgrade should ensure that only trusted images and commands are used and that only trusted users have permissions to execute commands in running containers.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-400, CWE-401
References: https://github.com/containerd/containerd/commit/a05d175400b1145e5e6a735a6710579d181e7fb0; https://github.com/containerd/containerd/security/advisories/GHSA-2qjp-425j-52j9; https://security.gentoo.org/glsa/202401-31
CVE: CVE-2022-2002
Published: 2022-12-07
Description: GE CIMPICITY versions 2022 and prior is 



vulnerable when data from faulting address controls code flow starting at gmmiObj!CGmmiOptionContainer, which could allow an attacker to execute arbitrary code. 

 

 


CVSS Score: 7.8 (HIGH)
CWE: CWE-822
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-326-04; https://www.cisa.gov/uscert/ics/advisories/icsa-22-326-04
CVE: CVE-2022-2948
Published: 2022-12-07
Description: GE CIMPICITY versions 2022 and prior is 

vulnerable to a heap-based buffer overflow, which could allow an attacker to execute arbitrary code. 

 


CVSS Score: 7.8 (HIGH)
CWE: CWE-122
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-326-04; https://www.cisa.gov/uscert/ics/advisories/icsa-22-326-04
CVE: CVE-2022-2952
Published: 2022-12-07
Description: GE CIMPICITY versions 2022 and prior is 

vulnerable when data from a faulting address controls code flow starting at gmmiObj!CGmmiOptionContainer, which could allow an attacker to execute arbitrary code.

 


CVSS Score: 7.8 (HIGH)
CWE: CWE-824
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-326-04; https://www.cisa.gov/uscert/ics/advisories/icsa-22-326-04
CVE: CVE-2022-3084
Published: 2022-12-08
Description: GE CIMPICITY versions 2022 and prior is vulnerable when data from a faulting address controls code flow starting at gmmiObj!CGmmiRootOptionTable, which could allow an attacker to execute arbitrary code. 


CVSS Score: 7.8 (HIGH)
CWE: CWE-824
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-326-04; https://www.cisa.gov/uscert/ics/advisories/icsa-22-326-04
CVE: CVE-2022-3092
Published: 2022-12-08
Description: GE CIMPICITY versions 2022 and prior is 





vulnerable to an out-of-bounds write, which could allow an attacker to execute arbitrary code. 

 

 

 


CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-326-04; https://www.cisa.gov/uscert/ics/advisories/icsa-22-326-04
CVE: CVE-2022-4261
Published: 2022-12-08
Description: Rapid7 Nexpose and InsightVM versions prior to 6.6.172 failed to reliably validate the authenticity of update contents. This failure could allow an attacker to provide a malicious update and alter the functionality of Rapid7 Nexpose. The attacker would need some pre-existing mechanism to provide a malicious update, either through a social engineering effort, privileged access to replace downloaded updates in transit, or by performing an Attacker-in-the-Middle attack on the update service itself.


CVSS Score: 4.4 (MEDIUM)
CWE: CWE-494, CWE-494
References: https://docs.rapid7.com/release-notes/insightvm/20221207/; https://docs.rapid7.com/release-notes/nexpose/20221207/; https://www.rapid7.com/blog/post/2022/12/7/cve-2022-4261-rapid7-nexpose-update-validation-issue-fixed
CVE: CVE-2022-4291
Published: 2022-12-08
Description: The aswjsflt.dll library from Avast Antivirus windows contained a potentially exploitable heap corruption vulnerability that could enable an attacker to bypass the sandbox of the application it was loaded into, if applicable. This issue was fixed in version 18.0.1478 of the Script Shield Component.

CVSS Score: 7.7 (HIGH)
CWE: CWE-119, CWE-787
References: https://support.norton.com/sp/static/external/tools/security-advisories.html; https://support.norton.com/sp/static/external/tools/security-advisories.html
CVE: CVE-2022-23492
Published: 2022-12-08
Description: go-libp2p is the offical libp2p implementation in the Go programming language. Version `0.18.0` and older of go-libp2p are vulnerable to targeted resource exhaustion attacks. These attacks target libp2p’s connection, stream, peer, and memory management. An attacker can cause the allocation of large amounts of memory, ultimately leading to the process getting killed by the host’s operating system. While a connection manager tasked with keeping the number of connections within manageable limits has been part of go-libp2p, this component was designed to handle the regular churn of peers, not a targeted resource exhaustion attack. Users are advised to upgrade their version of go-libp2p to version `0.18.1` or newer. Users unable to upgrade may consult the denial of service (dos) mitigation page for more information on how to incorporate mitigation strategies, monitor your application, and respond to attacks. 
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-770
References: https://docs.libp2p.io/reference/dos-mitigation/; https://github.com/libp2p/go-libp2p/commit/15d7dfbf54264ead8e6f49ca658d79c90635e2de; https://github.com/libp2p/go-libp2p/security/advisories/GHSA-j7qp-mfxf-8xjw
CVE: CVE-2022-23476
Published: 2022-12-08
Description: Nokogiri is an open source XML and HTML library for the Ruby programming language. Nokogiri `1.13.8` and `1.13.9` fail to check the return value from `xmlTextReaderExpand` in the method `Nokogiri::XML::Reader#attribute_hash`. This can lead to a null pointer exception when invalid markup is being parsed. For applications using `XML::Reader` to parse untrusted inputs, this may potentially be a vector for a denial of service attack. Users are advised to upgrade to Nokogiri `>= 1.13.10`. Users may be able to search their code for calls to either `XML::Reader#attributes` or `XML::Reader#attribute_hash` to determine if they are affected.
CVSS Score: 7.5 (HIGH)
CWE: CWE-252, CWE-476
References: https://github.com/sparklemotion/nokogiri/commit/85410e38410f670cbbc8c5b00d07b843caee88ce; https://github.com/sparklemotion/nokogiri/commit/9fe0761c47c0d4270d1a5220cfd25de080350d50; https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-qv4q-mr5r-qprj
CVE: CVE-2022-46792
Published: 2022-12-08
Description: Hasura GraphQL Engine before 2.15.2 mishandles row-level authorization in the Update Many API for Postgres backends. The fixed versions are 2.10.2, 2.11.3, 2.12.1, 2.13.2, 2.14.1, and 2.15.2. (Versions before 2.10.0 are unaffected.)
CVSS Score: 8.8 (HIGH)
CWE: CWE-863, CWE-863
References: https://github.com/hasura/graphql-engine/security/advisories/GHSA-g7mj-g7f4-hgrg; https://groups.google.com/g/hasura-security-announce/c/kzK-uPAKGUU; https://hasura.io/blog/critical-vulnerability-in-hasuras-graphql-engine-v2-10-0/
CVE: CVE-2022-4347
Published: 2022-12-08
Description: A vulnerability was found in xiandafu beetl-bbs. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file WebUtils.java. The manipulation of the argument user leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-215107.
CVSS Score: 3.5 (LOW)
CWE: CWE-707
References: https://gitee.com/xiandafu/beetl-bbs/issues/I5XD5O; https://vuldb.com/?id.215107; https://gitee.com/xiandafu/beetl-bbs/issues/I5XD5O
CVE: CVE-2022-4348
Published: 2022-12-08
Description: A vulnerability was found in y_project RuoYi-Cloud. It has been rated as problematic. Affected by this issue is some unknown functionality of the component JSON Handler. The manipulation leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-215108.
CVSS Score: 3.5 (LOW)
CWE: CWE-707
References: https://gitee.com/y_project/RuoYi-Cloud/issues/I5IRC8; https://vuldb.com/?id.215108; https://gitee.com/y_project/RuoYi-Cloud/issues/I5IRC8
CVE: CVE-2022-4349
Published: 2022-12-08
Description: A vulnerability classified as problematic has been found in CTF-hacker pwn. This affects an unknown part of the file delete.html. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-215109 was assigned to this vulnerability.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863, CWE-352
References: https://gitee.com/CTF-hacker/pwn/issues/I5WAAB; https://vuldb.com/?id.215109; https://gitee.com/CTF-hacker/pwn/issues/I5WAAB