deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-44441
Published: 2023-01-04
Description: In wlan driver, there is a possible missing bounds check. This could lead to local denial of service in wlan services.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]91336001; https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]91336001
CVE: CVE-2022-44442
Published: 2023-01-04
Description: In wlan driver, there is a possible missing bounds check, This could lead to local denial of service in wlan services.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]91336001; https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]91336001
CVE: CVE-2022-44443
Published: 2023-01-04
Description: In wlan driver, there is a possible missing bounds check. This could lead to local denial of service in wlan services.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-126, CWE-125
References: https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]91336001; https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]91336001
CVE: CVE-2022-44444
Published: 2023-01-04
Description: In wlan driver, there is a possible missing bounds check. This could lead to local denial of service in wlan services.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-191, CWE-191
References: https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]91336001; https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]91336001
CVE: CVE-2022-44445
Published: 2023-01-04
Description: In wlan driver, there is a possible missing bounds check. This could lead to local denial of service in wlan services.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-126, CWE-125
References: https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]91336001; https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]91336001
CVE: CVE-2022-44446
Published: 2023-01-04
Description: In wlan driver, there is a possible missing bounds check. This could lead to local denial of service in wlan services.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-126, CWE-125
References: https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]91336001; https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]91336001
CVE: CVE-2023-0046
Published: 2023-01-04
Description: Improper Restriction of Names for Files and Other Resources in GitHub repository lirantal/daloradius prior to master-branch.
CVSS Score: 7.2 (HIGH)
CWE: CWE-641
References: https://github.com/lirantal/daloradius/commit/2013c2d1231e99dac918247b69b198ded1f30a1c; https://huntr.dev/bounties/2214dc41-f283-4342-95b1-34a2f4fea943; https://github.com/lirantal/daloradius/commit/2013c2d1231e99dac918247b69b198ded1f30a1c
CVE: CVE-2021-41977
Published: 2023-01-04
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2021. Notes: none.
CVE: CVE-2021-41978
Published: 2023-01-04
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2021. Notes: none.
CVE: CVE-2021-41979
Published: 2023-01-04
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2021. Notes: none.
CVE: CVE-2021-41980
Published: 2023-01-04
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2021. Notes: none.
CVE: CVE-2021-41981
Published: 2023-01-04
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2021. Notes: none.
CVE: CVE-2021-41982
Published: 2023-01-04
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2021. Notes: none.
CVE: CVE-2021-41983
Published: 2023-01-04
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2021. Notes: none.
CVE: CVE-2021-41984
Published: 2023-01-04
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2021. Notes: none.
CVE: CVE-2021-41985
Published: 2023-01-04
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2021. Notes: none.
CVE: CVE-2021-41986
Published: 2023-01-04
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2021. Notes: none.
CVE: CVE-2022-0259
Published: 2023-01-04
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none.
CVE: CVE-2022-29899
Published: 2023-01-04
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none.
CVE: CVE-2023-0048
Published: 2023-01-04
Description: Code Injection in GitHub repository lirantal/daloradius prior to master-branch.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: https://github.com/lirantal/daloradius/commit/3650eea7277a5c278063214a5b71dbd7d77fc5aa; https://huntr.dev/bounties/57abd666-4b9c-4f59-825d-1ec832153e79; https://github.com/lirantal/daloradius/commit/3650eea7277a5c278063214a5b71dbd7d77fc5aa
CVE: CVE-2022-45875
Published: 2023-01-04
Description: Improper validation of script alert plugin parameters in Apache DolphinScheduler to avoid remote command execution vulnerability.  This issue affects Apache DolphinScheduler version 3.0.1 and prior versions; version 3.1.0 and prior versions.
This attack can be performed only by authenticated users which can login to DS.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: http://www.openwall.com/lists/oss-security/2023/11/22/2; https://lists.apache.org/thread/r0wqzkjsoq17j6ww381kmpx3jjp9hb6r; http://www.openwall.com/lists/oss-security/2023/11/22/2
CVE: CVE-2023-22457
Published: 2023-01-04
Description: CKEditor Integration UI adds support for editing wiki pages using CKEditor. Prior to versions 1.64.3,t he `CKEditor.HTMLConverter` document lacked a protection against Cross-Site Request Forgery (CSRF), allowing to execute macros with the rights of the current user. If a privileged user with programming rights was tricked into executing a GET request to this document with certain parameters (e.g., via an image with a corresponding URL embedded in a comment or via a redirect), this would allow arbitrary remote code execution and the attacker could gain rights, access private information or impact the availability of the wiki. The issue has been patched in the CKEditor Integration version 1.64.3. This has also been patched in the version of the CKEditor integration that is bundled starting with XWiki 14.6 RC1. There are no known workarounds for this other than upgrading the CKEditor integration to a fixed version.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-352
References: https://github.com/xwiki-contrib/application-ckeditor/commit/6b[PII_REDACTED]aefc526df7512bc664918aa6849b; https://github.com/xwiki-contrib/application-ckeditor/security/advisories/GHSA-6mjp-2rm6-9g85; https://jira.xwiki.org/browse/CKEDITOR-475
CVE: CVE-2023-22460
Published: 2023-01-04
Description: go-ipld-prime is an implementation of the InterPlanetary Linked Data (IPLD) spec interfaces, a batteries-included codec implementations of IPLD for CBOR and JSON, and tooling for basic operations on IPLD objects. Encoding data which contains a Bytes kind Node will pass a Bytes token to the JSON encoder which will panic as it doesn't expect to receive Bytes tokens. Such an encode should be treated as an error, as plain JSON should not be able to encode Bytes. This only impacts uses of the `json` codec. `dag-json` is not impacted. Use of `json` as a decoder is not impacted. This issue is fixed in v0.19.0. As a workaround, one may prefer the `dag-json` codec, which has the ability to encode bytes.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://github.com/ipld/go-ipld-prime/pull/472; https://github.com/ipld/go-ipld-prime/releases/tag/v0.19.0; https://github.com/ipld/go-ipld-prime/security/advisories/GHSA-c653-6hhg-9x92
CVE: CVE-2023-22461
Published: 2023-01-04
Description: The `sanitize-svg` package, a small SVG sanitizer to prevent cross-site scripting attacks, uses a deny-list-pattern to sanitize SVGs to prevent XSS. In doing so, literal `<script>`-tags and on-event handlers were detected in versions prior to 0.4.0. As a result, downstream software that relies on `sanitize-svg` and expects resulting SVGs to be safe, may be vulnerable to cross-site scripting. This vulnerability was addressed in v0.4.0. There are no known workarounds


CVSS Score: 7.6 (HIGH)
CWE: CWE-79, CWE-80
References: https://github.com/mattkrick/sanitize-svg/commit/b107e453ede7b58adcccae74a3e474c012eec85d; https://github.com/mattkrick/sanitize-svg/security/advisories/GHSA-h857-2g56-468g; https://github.com/mattkrick/sanitize-svg/commit/b107e453ede7b58adcccae74a3e474c012eec85d
CVE: CVE-2022-48216
Published: 2023-01-04
Description: Uniswap Universal Router before 1.1.0 mishandles reentrancy. This would have allowed theft of funds.
CVSS Score: 7.5 (HIGH)
CWE: CWE-667, CWE-667
References: https://github.com/Uniswap/universal-router/commit/d82c6685ef566d9b280651c99f4b93a8454c08a8; https://github.com/Uniswap/universal-router/compare/v1.0.1...v1.1.0; https://github.com/Uniswap/universal-router/pull/189
CVE: CVE-2023-0049
Published: 2023-01-04
Description: Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.1143.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: http://seclists.org/fulldisclosure/2023/Mar/17; https://github.com/vim/vim/commit/7b17eb4b063a234376c1ec909ee293e42cff290c; https://huntr.dev/bounties/5e6f325c-ba54-4bf0-b050-dca048fd3fd9
CVE: CVE-2023-22463
Published: 2023-01-04
Description: KubePi is a k8s panel. The jwt authentication function of KubePi through version 1.6.2 uses hard-coded Jwtsigkeys, resulting in the same Jwtsigkeys for all online projects. This means that an attacker can forge any jwt token to take over the administrator account of any online project. Furthermore, they may use the administrator to take over the k8s cluster of the target enterprise. `session.go`, the use of hard-coded JwtSigKey, allows an attacker to use this value to forge jwt tokens arbitrarily. The JwtSigKey is confidential and should not be hard-coded in the code. The vulnerability has been fixed in 1.6.3. In the patch, JWT key is specified in app.yml. If the user leaves it blank, a random key will be used. There are no workarounds aside from upgrading.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://github.com/KubeOperator/KubePi/blob/da784f5532ea2495b92708cacb32703bff3a45a3/internal/api/v1/session/session.go#L35; https://github.com/KubeOperator/KubePi/commit/3be58b8df5bc05d2343c30371dd5fcf6a9fbbf8b; https://github.com/KubeOperator/KubePi/releases/tag/v1.6.3
CVE: CVE-2023-22464
Published: 2023-01-04
Description: ViewVC is a browser interface for CVS and Subversion version control repositories. Versions prior to 1.2.3 and 1.1.30 are vulnerable to cross-site scripting. The impact of this vulnerability is mitigated by the need for an attacker to have commit privileges to a Subversion repository exposed by an otherwise trusted ViewVC instance. The attack vector involves files with unsafe names (names that, when embedded into an HTML stream, would cause the browser to run unwanted code), which themselves can be challenging to create. Users should update to at least version 1.2.3 (if they are using a 1.2.x version of ViewVC) or 1.1.30 (if they are using a 1.1.x version).

ViewVC 1.0.x is no longer supported, so users of that release lineage should implement one of the following workarounds. Users can edit their ViewVC EZT view templates to manually HTML-escape changed path "copyfrom paths" during rendering. Locate in your template set's `revision.ezt` file references to those changed paths, and wrap them with `[format "html"]` and `[end]`.  For most users, that means that references to `[changes.copy_path]` will become `[format "html"][changes.copy_path][end]`. (This workaround should be reverted after upgrading to a patched version of ViewVC, else "copyfrom path" names will be doubly escaped.)

CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-80, CWE-79
References: https://github.com/viewvc/viewvc/issues/311; https://github.com/viewvc/viewvc/releases/tag/1.1.30; https://github.com/viewvc/viewvc/releases/tag/1.2.3
CVE: CVE-2023-22465
Published: 2023-01-04
Description: Http4s is a Scala interface for HTTP services. Starting with version 0.1.0 and prior to versions 0.21.34, 0.22.15, 0.23.17, and 1.0.0-M38, the `User-Agent` and `Server` header parsers are susceptible to a fatal error on certain inputs.  In http4s, modeled headers are lazily parsed, so this only applies to services that explicitly request these typed headers. Fixes are released in 0.21.34, 0.22.15, 0.23.17, and 1.0.0-M38. As a workaround, use the weakly typed header interface.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-20
References: https://github.com/http4s/http4s/security/advisories/GHSA-54w6-vxfh-fw7f; https://github.com/http4s/http4s/security/advisories/GHSA-54w6-vxfh-fw7f
CVE: CVE-2022-46180
Published: 2023-01-04
Description: Discourse Mermaid (discourse-mermaid-theme-component) allows users of Discourse, open-source forum software, to create graphs using the Mermaid syntax. Users of discourse-mermaid-theme-component version 1.0.0 who can create posts are able to inject arbitrary HTML on that post. The issue has been fixed on the `main` branch of the GitHub repository, with 1.1.0 named as a patched version. Admins can update the theme component through the admin UI. As a workaround, admins can temporarily disable discourse-mermaid-theme-component.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-74, CWE-79
References: https://github.com/discourse/discourse-mermaid-theme-component/commit/c10bc4a08bf865cee20e5d5dffba535762813f0f; https://github.com/discourse/discourse-mermaid-theme-component/pull/14; https://github.com/discourse/discourse-mermaid-theme-component/security/advisories/GHSA-8437-hgcm-p3q3
CVE: CVE-2021-38928
Published: 2023-01-04
Description: IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.1.2.1 uses Cross-Origin Resource Sharing (CORS) which could allow an attacker to carry out privileged actions and retrieve sensitive information as the domain name is not being limited to only trusted domains.  IBM X-Force ID:  210323.
CVSS Score: 5.4 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/210323; https://www.ibm.com/support/pages/node/6852467; https://exchange.xforce.ibmcloud.com/vulnerabilities/210323
CVE: CVE-2022-22337
Published: 2023-01-04
Description: IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.1.2.1 could disclose sensitive information to an authenticated user.  IBM X-Force ID:  219507.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/219507; https://www.ibm.com/support/pages/node/6852459; https://exchange.xforce.ibmcloud.com/vulnerabilities/219507
CVE: CVE-2022-22338
Published: 2023-01-04
Description: IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.1.2.1 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database.  IBM X-Force ID:  219510.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/219510; https://www.ibm.com/support/pages/node/6852453; https://exchange.xforce.ibmcloud.com/vulnerabilities/219510
CVE: CVE-2022-22352
Published: 2023-01-04
Description: IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.1.2.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.  IBM X-Force ID:  220398.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/220398; https://www.ibm.com/support/pages/node/6852443; https://exchange.xforce.ibmcloud.com/vulnerabilities/220398
CVE: CVE-2022-25926
Published: 2023-01-04
Description: Versions of the package window-control before 1.4.5 are vulnerable to Command Injection via the sendKeys function, due to improper input sanitization.
CVSS Score: 7.4 (HIGH)
CWE: CWE-78, CWE-94
References: https://github.com/bruno-robert/window-control/commit/075c854534a749d887655a906759f5a7eee95173; https://github.com/bruno-robert/window-control/releases/tag/v1.4.5; https://security.snyk.io/vuln/SNYK-JS-WINDOWCONTROL-3186345
CVE: CVE-2022-43920
Published: 2023-01-04
Description: IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.1.2.1 could allow an authenticated user to gain privileges in a different group due to an access control vulnerability in the Sftp server adapter.  IBM X-Force ID:  241362.
CVSS Score: 6.3 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/241362; https://www.ibm.com/support/pages/node/6852465; https://exchange.xforce.ibmcloud.com/vulnerabilities/241362
CVE: CVE-2022-46456
Published: 2023-01-04
Description: NASM v2.16 was discovered to contain a global buffer overflow in the component dbgdbg_typevalue at /output/outdbg.c.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-120, CWE-120
References: https://bugzilla.nasm.us/show_bug.cgi?id=3392814; https://bugzilla.nasm.us/show_bug.cgi?id=3392814
CVE: CVE-2022-46457
Published: 2023-01-04
Description: NASM v2.16 was discovered to contain a segmentation violation in the component ieee_write_file at /output/outieee.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://bugzilla.nasm.us/show_bug.cgi?id=3392809; https://bugzilla.nasm.us/show_bug.cgi?id=3392809
CVE: CVE-2023-0051
Published: 2023-01-04
Description: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1144.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122
References: http://seclists.org/fulldisclosure/2023/Mar/17; https://github.com/vim/vim/commit/c32949b0779106ed5710ae3bffc5053e49083ab4; https://huntr.dev/bounties/1c8686db-baa6-42dc-ba45-aed322802de9
CVE: CVE-2022-45049
Published: 2023-01-04
Description: A reflected XSS vulnerability has been found in Axiell Iguana CMS, allowing an attacker to execute code in a victim's browser. The url parameter on the novelist.php endpoint does not properly neutralise user input, resulting in the vulnerability.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://csirt.divd.nl/CVE-2022-45049/; https://csirt.divd.nl/DIVD-2022-00064/; https://csirt.divd.nl/CVE-2022-45049/
CVE: CVE-2022-45051
Published: 2023-01-04
Description: A reflected XSS vulnerability has been found in Axiell Iguana CMS, allowing an attacker to execute code in a victim's browser. The module parameter on the Service.template.cls endpoint does not properly neutralise user input, resulting in the vulnerability.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://csirt.divd.nl/CVE-2022-45051/; https://csirt.divd.nl/DIVD-2022-00064/; https://csirt.divd.nl/CVE-2022-45051/
CVE: CVE-2022-45052
Published: 2023-01-04
Description: A Local File Inclusion vulnerability has been found in Axiell Iguana CMS. Due to insufficient neutralisation of user input on the url parameter on the Proxy.type.php endpoint, external users are capable of accessing files on the server.
CVSS Score: 8.8 (HIGH)
CWE: CWE-552, CWE-552
References: https://csirt.divd.nl/CVE-2022-45052/; https://csirt.divd.nl/DIVD-2022-00064/; https://csirt.divd.nl/CVE-2022-45052/
CVE: CVE-2022-48217
Published: 2023-01-04
Description: The tf_remapper_node component 1.1.1 for Robot Operating System (ROS) allows attackers, who control the source code of a different node in the same ROS application, to change a robot's behavior. This occurs because a topic name depends on the attacker-controlled old_tf_topic_name and/or new_tf_topic_name parameter. NOTE: the vendor's position is "it is the responsibility of the programmer to make sure that only known and required parameters are set and unexpected parameters are not."
CVSS Score: 8.1 (HIGH)
CWE: CWE-75
References: https://github.com/tradr-project/tf_remapper_cpp/issues/1; https://github.com/tradr-project/tf_remapper_cpp/issues/1
CVE: CVE-2023-0054
Published: 2023-01-04
Description: Out-of-bounds Write in GitHub repository vim/vim prior to 9.0.1145.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: http://seclists.org/fulldisclosure/2023/Mar/17; https://github.com/vim/vim/commit/3ac1d97a1d[PII_REDACTED]d[PII_REDACTED]0435f7731; https://huntr.dev/bounties/b289ee0f-fd16-4147-bd01-c6289c45e49d
CVE: CVE-2021-4300
Published: 2023-01-04
Description: A vulnerability has been found in ghostlander Halcyon and classified as critical. Affected by this vulnerability is the function CBlock::AddToBlockIndex of the file src/main.cpp of the component Block Verification. The manipulation leads to improper access controls. The attack can be launched remotely. Upgrading to version 1.1.1.0-hal is able to address this issue. The identifier of the patch is 0675b25ae9cc10b5fdc8ea3a32c642979762d45e. It is recommended to upgrade the affected component. The identifier VDB-217417 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-284
References: https://github.com/ghostlander/Halcyon/commit/0675b25ae9cc10b5fdc8ea3a32c642979762d45e; https://github.com/ghostlander/Halcyon/releases/tag/v1.1.1.0-hal; https://vuldb.com/?ctiid.217417
CVE: CVE-2021-4302
Published: 2023-01-04
Description: A vulnerability was found in slackero phpwcms up to 1.9.26. It has been classified as problematic. This affects an unknown part of the component SVG File Handler. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 1.9.27 is able to address this issue. The patch is named b39db9c7ad3800f319195ff0e26a0981395b1c54. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-217419.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/slackero/phpwcms/commit/b39db9c7ad3800f319195ff0e26a0981395b1c54; https://github.com/slackero/phpwcms/releases/tag/v1.9.27; https://vuldb.com/?ctiid.217419
CVE: CVE-2022-4875
Published: 2023-01-04
Description: A vulnerability has been found in fossology and classified as problematic. This vulnerability affects unknown code. The manipulation of the argument sql/VarValue leads to cross site scripting. The attack can be initiated remotely. The patch is identified as 8e0eba001662c7eb35f045b70dd458a4643b4553. It is recommended to apply a patch to fix this issue. VDB-217426 is the identifier assigned to this vulnerability.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-79
References: https://github.com/fossology/fossology/commit/8e0eba001662c7eb35f045b70dd458a4643b4553; https://github.com/fossology/fossology/pull/2356; https://vuldb.com/?ctiid.217426
CVE: CVE-2023-0055
Published: 2023-01-04
Description: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository pyload/pyload prior to 0.5.0b3.dev32.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-614, CWE-319
References: https://github.com/pyload/pyload/commit/7b53b8d43c2c072b457dcd19c8a09bcfc3721703; https://huntr.dev/bounties/ed88e240-99ff-48a1-bf32-8e1ef5f13cce; https://github.com/pyload/pyload/commit/7b53b8d43c2c072b457dcd19c8a09bcfc3721703