deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2014-125048
Published: 2023-01-06
Description: A vulnerability, which was classified as critical, has been found in kassi xingwall. This issue affects some unknown processing of the file app/controllers/oauth.js. The manipulation leads to session fixiation. The patch is named e9f0d509e[PII_REDACTED]e29d9c099d36e0e1f6ae7. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217559.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-384, CWE-384
References: https://github.com/kassi/xingwall/commit/e9f0d509e[PII_REDACTED]e29d9c099d36e0e1f6ae7; https://vuldb.com/?ctiid.217559; https://vuldb.com/?id.217559
CVE: CVE-2014-125049
Published: 2023-01-06
Description: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, was found in typcn Blogile. Affected is the function getNav of the file server.js. The manipulation of the argument query leads to sql injection. The name of the patch is cfec31043b562ffefe29fe01af6d3c5ed1bf8f7d. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-217560. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/typcn/Blogile/commit/cfec31043b562ffefe29fe01af6d3c5ed1bf8f7d; https://vuldb.com/?ctiid.217560; https://vuldb.com/?id.217560
CVE: CVE-2015-10018
Published: 2023-01-06
Description: A vulnerability has been found in DBRisinajumi d2files and classified as critical. Affected by this vulnerability is the function actionUpload/actionDownloadFile of the file controllers/D2filesController.php. The manipulation leads to sql injection. Upgrading to version 1.0.0 is able to address this issue. The identifier of the patch is b5767f2ec9d0f3cbfda7f13c84740e2179c90574. It is recommended to upgrade the affected component. The identifier VDB-217561 was assigned to this vulnerability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/DBRisinajumi/d2files/commit/b5767f2ec9d0f3cbfda7f13c84740e2179c90574; https://github.com/DBRisinajumi/d2files/releases/tag/1.0.0; https://vuldb.com/?ctiid.217561
CVE: CVE-2019-25099
Published: 2023-01-06
Description: A vulnerability classified as critical was found in Arthmoor QSF-Portal. This vulnerability affects unknown code of the file index.php. The manipulation of the argument a leads to path traversal. The patch is identified as ea4f61e23ecb83247d174bc2e2cbab521c751a7d. It is recommended to apply a patch to fix this issue. VDB-217558 is the identifier assigned to this vulnerability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://github.com/Arthmoor/QSF-Portal/commit/ea4f61e23ecb83247d174bc2e2cbab521c751a7d; https://vuldb.com/?ctiid.217558; https://vuldb.com/?id.217558
CVE: CVE-2023-22475
Published: 2023-01-06
Description: Canarytokens is an open source tool which helps track activity and actions on your network. A Cross-Site Scripting vulnerability was identified in the history page of triggered Canarytokens prior to sha-fb61290. An attacker who discovers an HTTP-based Canarytoken (a URL) can use this to execute Javascript in the Canarytoken's trigger history page (domain: canarytokens.org) when the history page is later visited by the Canarytoken's creator.

This vulnerability could be used to disable or delete the affected Canarytoken, or view its activation history. It might also be used as a stepping stone towards revealing more information about the Canarytoken's creator to the attacker. For example, an attacker could recover the email address tied to the Canarytoken, or place Javascript on the history page that redirect the creator towards an attacker-controlled Canarytoken to show the creator's network location.

This vulnerability is similar to CVE-2022-31113, but affected parameters reported differently from the Canarytoken trigger request. An attacker could only act on the discovered Canarytoken. This issue did not expose other Canarytokens or other Canarytoken creators. Canarytokens Docker images sha-fb61290 and later contain a patch for this issue.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-79
References: https://github.com/thinkst/canarytokens/commit/fb612906f2217bbb[PII_REDACTED]891d16e20bad3e; https://github.com/thinkst/canarytokens/security/advisories/GHSA-3h2c-3fgr-74vh; https://github.com/thinkst/canarytokens/security/advisories/GHSA-5675-3424-hpqr
CVE: CVE-2019-5313
Published: 2023-01-06
Description: Rejected reason: CVE was unused by HPE.
CVE: CVE-2019-5316
Published: 2023-01-06
Description: Rejected reason: CVE was unused by HPE.
CVE: CVE-2019-5325
Published: 2023-01-06
Description: Rejected reason: CVE was unused by HPE.
CVE: CVE-2020-24642
Published: 2023-01-06
Description: Rejected reason: CVE was unused by HPE.
CVE: CVE-2020-24643
Published: 2023-01-06
Description: Rejected reason: CVE was unused by HPE.
CVE: CVE-2020-24644
Published: 2023-01-06
Description: Rejected reason: CVE was unused by HPE.
CVE: CVE-2020-24645
Published: 2023-01-06
Description: Rejected reason: CVE was unused by HPE.
CVE: CVE-2020-7112
Published: 2023-01-06
Description: Rejected reason: CVE was unused by HPE.
CVE: CVE-2020-7118
Published: 2023-01-06
Description: Rejected reason: CVE was unused by HPE.
CVE: CVE-2014-125050
Published: 2023-01-06
Description: A vulnerability was found in ScottTZhang voter-js and classified as critical. Affected by this issue is some unknown functionality of the file main.js. The manipulation leads to sql injection. The patch is identified as 6317c67a56061aeeaeed3cf9ec665fd9983d8044. It is recommended to apply a patch to fix this issue. VDB-217562 is the identifier assigned to this vulnerability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/ScottTZhang/voter-js/commit/6317c67a56061aeeaeed3cf9ec665fd9983d8044; https://github.com/ScottTZhang/voter-js/pull/15; https://vuldb.com/?ctiid.217562
CVE: CVE-2014-125051
Published: 2023-01-06
Description: A vulnerability was found in himiklab yii2-jqgrid-widget up to 1.0.7. It has been declared as critical. This vulnerability affects the function addSearchOptionsRecursively of the file JqGridAction.php. The manipulation leads to sql injection. Upgrading to version 1.0.8 is able to address this issue. The name of the patch is a117e0f2df729e3ff726968794d9a5ac40e660b9. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-217564.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/himiklab/yii2-jqgrid-widget/commit/a117e0f2df729e3ff726968794d9a5ac40e660b9; https://github.com/himiklab/yii2-jqgrid-widget/releases/tag/1.0.8; https://vuldb.com/?ctiid.217564
CVE: CVE-2020-36643
Published: 2023-01-06
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2022-44149
Published: 2023-01-06
Description: The web service on Nexxt Amp300 ARN02304U8 42.103.1.5095 and 80.103.2.5045 devices allows remote OS command execution by placing &telnetd in the JSON host field to the ping feature of the goform/sysTools component. Authentication is required
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: http://packetstormsecurity.com/files/170366/Nexxt-Router-Firmware-42.103.1.5095-Remote-Code-Execution.html; http://packetstormsecurity.com/files/170366/Nexxt-Router-Firmware-80.103.2.5045-Remote-Code-Execution.html; https://cxsecurity.com/issue/WLB[PII_REDACTED]
CVE: CVE-2022-39072
Published: 2023-01-06
Description: There is a SQL injection vulnerability in Some ZTE Mobile Internet products. Due to insufficient validation of the input parameters of the SNTP interface, an authenticated attacker could use the vulnerability to execute stored XSS attacks.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1028624; https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1028624
CVE: CVE-2022-39073
Published: 2023-01-06
Description: There is a command injection vulnerability in ZTE MF286R, Due to insufficient validation of the input parameters, an attacker could use the vulnerability to execute arbitrary commands.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-77
References: https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1028664; https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1028664
CVE: CVE-2021-46867
Published: 2023-01-06
Description: The HW_KEYMASTER module has a problem in releasing memory.Successful exploitation of this vulnerability may result in out-of-bounds memory access.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125, CWE-125
References: https://consumer.huawei.com/en/support/bulletin/2023/1/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202301-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/1/
CVE: CVE-2021-46868
Published: 2023-01-06
Description: The HW_KEYMASTER module has a problem in releasing memory.Successful exploitation of this vulnerability may result in out-of-bounds memory access.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125, CWE-125
References: https://consumer.huawei.com/en/support/bulletin/2023/1/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202301-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/1/
CVE: CVE-2022-46761
Published: 2023-01-06
Description: The system has a vulnerability that may cause dynamic hiding and restoring of app icons.Successful exploitation of this vulnerability may cause malicious hiding of app icons.
CVSS Score: 7.5 (HIGH)
CWE: CWE-276
References: https://consumer.huawei.com/en/support/bulletin/2023/1/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202301-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/1/
CVE: CVE-2022-46762
Published: 2023-01-06
Description: The memory management module has a logic bypass vulnerability.Successful exploitation of this vulnerability may affect data confidentiality.
CVSS Score: 7.5 (HIGH)
CWE: CWE-693
References: https://consumer.huawei.com/en/support/bulletin/2023/1/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202301-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/1/
CVE: CVE-2022-47974
Published: 2023-01-06
Description: The Bluetooth AVRCP module has a vulnerability that can lead to DoS attacks.Successful exploitation of this vulnerability may cause the Bluetooth process to restart.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-287
References: https://consumer.huawei.com/en/support/bulletin/2023/1/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202301-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/1/
CVE: CVE-2022-47975
Published: 2023-01-06
Description: The DUBAI module has a double free vulnerability. Successful exploitation of this vulnerability may affect system availability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-415, CWE-415
References: https://consumer.huawei.com/en/support/bulletin/2023/1/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202301-[PII_REDACTED]; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202302-[PII_REDACTED]
CVE: CVE-2022-47976
Published: 2023-01-06
Description: The DMSDP module of the distributed hardware has a vulnerability that may cause imposter control connections.Successful exploitation of this vulnerability may disconnect normal service connections.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: https://consumer.huawei.com/en/support/bulletin/2023/1/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202301-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/1/
CVE: CVE-2014-125052
Published: 2023-01-06
Description: A vulnerability was found in JervenBolleman sparql-identifiers and classified as critical. This issue affects some unknown processing of the file src/main/java/org/identifiers/db/RegistryDao.java. The manipulation leads to sql injection. The patch is named 44bb0db91c064e305b192fc73521d1dfd25bde52. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217571.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/JervenBolleman/sparql-identifiers/commit/44bb0db91c064e305b192fc73521d1dfd25bde52; https://vuldb.com/?ctiid.217571; https://vuldb.com/?id.217571
CVE: CVE-2018-25067
Published: 2023-01-06
Description: A vulnerability, which was classified as critical, was found in JoomGallery up to 3.3.3. This affects an unknown part of the file administrator/components/com_joomgallery/views/config/tmpl/default.php of the component Image Sort Handler. The manipulation leads to sql injection. Upgrading to version 3.3.4 is able to address this issue. The identifier of the patch is dc414ee954e849082260f8613e15a1c1e1d354a1. It is recommended to upgrade the affected component. The identifier VDB-217569 was assigned to this vulnerability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://github.com/JoomGallery/JoomGallery/commit/dc414ee954e849082260f8613e15a1c1e1d354a1; https://github.com/JoomGallery/JoomGallery/pull/122; https://github.com/JoomGallery/JoomGallery/releases/tag/v3.3.4
CVE: CVE-2018-25068
Published: 2023-01-06
Description: A vulnerability has been found in devent globalpom-utils up to 4.5.0 and classified as critical. This vulnerability affects the function createTmpDir of the file globalpomutils-fileresources/src/main/java/com/anrisoftware/globalpom/fileresourcemanager/FileResourceManagerProvider.java. The manipulation leads to insecure temporary file. The attack can be initiated remotely. Upgrading to version 4.5.1 is able to address this issue. The patch is identified as 77a820bac2f68e662ce261ecb050c643bd7ee560. It is recommended to upgrade the affected component. VDB-217570 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-377, CWE-668
References: https://github.com/devent/globalpom-utils/commit/77a820bac2f68e662ce261ecb050c643bd7ee560; https://github.com/devent/globalpom-utils/releases/tag/globalpomutils-4.5.1; https://vuldb.com/?ctiid.217570
CVE: CVE-2013-10008
Published: 2023-01-06
Description: A vulnerability was found in sheilazpy eShop. It has been classified as critical. Affected is an unknown function. The manipulation leads to sql injection. The name of the patch is e096c5849c4dc09e[PII_REDACTED]14a62a5413884. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-217572.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/sheilazpy/eShop/commit/e096c5849c4dc09e[PII_REDACTED]14a62a5413884; https://vuldb.com/?ctiid.217572; https://vuldb.com/?id.217572
CVE: CVE-2022-2482
Published: 2023-01-06
Description: 
A vulnerability exists in Nokia’s ASIK AirScale system module (versions 474021A.101 and 474021A.102) that could allow an attacker to place a script on the file system accessible from Linux. A script placed in the appropriate place could allow for arbitrary code execution in the bootloader.


CVSS Score: 8.4 (HIGH)
CWE: CWE-1274
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-307-02; https://www.cisa.gov/uscert/ics/advisories/icsa-22-307-02
CVE: CVE-2022-2483
Published: 2023-01-06
Description: 
The bootloader in the Nokia ASIK AirScale system module (versions 474021A.101 and 474021A.102) loads public keys for firmware verification signature. If an attacker modifies the flash contents to corrupt the keys, secure boot could be permanently disabled on a given device.


CVSS Score: 8.4 (HIGH)
CWE: CWE-1282
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-307-02; https://www.cisa.gov/uscert/ics/advisories/icsa-22-307-02
CVE: CVE-2022-2484
Published: 2023-01-06
Description: 


The signature check in the Nokia ASIK AirScale system module version 474021A.101 can be bypassed allowing an attacker to run modified firmware. This could result in the execution of a malicious kernel, arbitrary programs, or modified Nokia programs.




CVSS Score: 8.4 (HIGH)
CWE: CWE-1274
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-307-02; https://www.cisa.gov/uscert/ics/advisories/icsa-22-307-02
CVE: CVE-2022-40201
Published: 2023-01-06
Description: Bentley Systems MicroStation Connect versions 

10.17.0.209 and prior are vulnerable to a Stack-Based Buffer Overflow when a malformed design (DGN) file is parsed. This may allow an attacker to execute arbitrary code.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121
References: https://www.bentley.com/advisories/be-2023-0003/; https://www.cisa.gov/uscert/ics/advisories/icsa-22-293-01; https://www.bentley.com/advisories/be-2023-0003/
CVE: CVE-2022-41613
Published: 2023-01-06
Description: Bentley Systems MicroStation Connect versions 

10.17.0.209 and prior are vulnerable to an Out-of-Bounds Read when when parsing DGN files, which may allow an attacker to crash the product, disclose sensitive information, or execute arbitrary code.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://www.bentley.com/advisories/be-2023-0003/; https://www.cisa.gov/uscert/ics/advisories/icsa-22-293-01; https://www.bentley.com/advisories/be-2023-0003/
CVE: CVE-2022-44939
Published: 2023-01-06
Description: Efs Software Easy Chat Server Version 3.1 was discovered to contain a DLL hijacking vulnerability via the component TextShaping.dll. This vulnerability allows attackers to execute arbitrary code via a crafted DLL.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427, CWE-427
References: https://github.com/RashidKhanPathan/WindowsPrivilegeEscalation/blob/main/DLL%20Hijacking/CVE-2022-44939/Research.txt; https://github.com/RashidKhanPathan/WindowsPrivilegeEscalation/blob/main/DLL%20Hijacking/CVE-2022-44939/Research.txt
CVE: CVE-2014-125053
Published: 2023-01-06
Description: A vulnerability was found in Piwigo-Guest-Book up to 1.3.0. It has been declared as critical. This vulnerability affects unknown code of the file include/guestbook.inc.php of the component Navigation Bar. The manipulation of the argument start leads to sql injection. Upgrading to version 1.3.1 is able to address this issue. The patch is identified as 0cdd1c388edf15089c3a7541cefe7756e560581d. It is recommended to upgrade the affected component. VDB-217582 is the identifier assigned to this vulnerability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/Piwigo/Piwigo-Guest-Book/commit/0cdd1c388edf15089c3a7541cefe7756e560581d; https://github.com/Piwigo/Piwigo-Guest-Book/releases/tag/1.3.1; https://vuldb.com/?ctiid.217582
CVE: CVE-2022-45911
Published: 2023-01-06
Description: An issue was discovered in Zimbra Collaboration (ZCS) 9.0. XSS can occur on the Classic UI login page by injecting arbitrary JavaScript code in the username field. This occurs before the user logs into the system, which means that even if the attacker executes arbitrary JavaScript, they will not get any sensitive information.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://wiki.zimbra.com/wiki/Security_Center; https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories; https://wiki.zimbra.com/wiki/Security_Center
CVE: CVE-2022-45913
Published: 2023-01-06
Description: An issue was discovered in Zimbra Collaboration (ZCS) 9.0. XSS can occur via one of attributes in webmail URLs to execute arbitrary JavaScript code, leading to information disclosure.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://wiki.zimbra.com/wiki/Security_Center; https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories; https://wiki.zimbra.com/wiki/Security_Center
CVE: CVE-2023-0106
Published: 2023-01-07
Description: Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/usememos/memos/commit/0f8ce3dd1696722f951d7195ad1f88b39a5d15d7; https://huntr.dev/bounties/5c0809cb-f4ff-4447-bed6-b5625fb374bb; https://github.com/usememos/memos/commit/0f8ce3dd1696722f951d7195ad1f88b39a5d15d7
CVE: CVE-2023-0107
Published: 2023-01-07
Description: Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/usememos/memos/commit/0f8ce3dd1696722f951d7195ad1f88b39a5d15d7; https://huntr.dev/bounties/0b28fa57-acb0-47c8-ac48-962ff3898156; https://github.com/usememos/memos/commit/0f8ce3dd1696722f951d7195ad1f88b39a5d15d7
CVE: CVE-2023-0108
Published: 2023-01-07
Description: Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/usememos/memos/commit/46c13a4b7f675b92d297df6dabb4441f13c7cd9c; https://huntr.dev/bounties/f66d33df-6588-4ab4-80a0[PII_REDACTED]44; https://github.com/usememos/memos/commit/46c13a4b7f675b92d297df6dabb4441f13c7cd9c
CVE: CVE-2023-0110
Published: 2023-01-07
Description: Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/usememos/memos/commit/46c13a4b7f675b92d297df6dabb4441f13c7cd9c; https://huntr.dev/bounties/6e4a1961-dbca-46f6-ae21-c25a621e54a7; https://github.com/usememos/memos/commit/46c13a4b7f675b92d297df6dabb4441f13c7cd9c
CVE: CVE-2023-0111
Published: 2023-01-07
Description: Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/usememos/memos/commit/46c13a4b7f675b92d297df6dabb4441f13c7cd9c; https://huntr.dev/bounties/70da256c-977a-487e-8a6a-9ae22caedbe3; https://github.com/usememos/memos/commit/46c13a4b7f675b92d297df6dabb4441f13c7cd9c
CVE: CVE-2023-0112
Published: 2023-01-07
Description: Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/usememos/memos/commit/46c13a4b7f675b92d297df6dabb4441f13c7cd9c; https://huntr.dev/bounties/ec2a29dc-79a3-44bd-a58b-15f676934af6; https://github.com/usememos/memos/commit/46c13a4b7f675b92d297df6dabb4441f13c7cd9c
CVE: CVE-2014-125054
Published: 2023-01-07
Description: A vulnerability classified as critical was found in koroket RedditOnRails. This vulnerability affects unknown code of the component Vote Handler. The manipulation leads to improper access controls. The attack can be initiated remotely. The patch is identified as 7f3c7407d95d532fcc342b00d68d0ea09ca71030. It is recommended to apply a patch to fix this issue. VDB-217594 is the identifier assigned to this vulnerability.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284
References: https://github.com/koroket/RedditOnRails/commit/7f3c7407d95d532fcc342b00d68d0ea09ca71030; https://vuldb.com/?ctiid.217594; https://vuldb.com/?id.217594
CVE: CVE-2014-125055
Published: 2023-01-07
Description: A vulnerability, which was classified as problematic, was found in agnivade easy-scrypt. Affected is the function VerifyPassphrase of the file scrypt.go. The manipulation leads to observable timing discrepancy. The complexity of an attack is rather high. The exploitability is told to be difficult. Upgrading to version 1.0.0 is able to address this issue. The name of the patch is 477c10cf3b144ddf96526aa09f5fdea613f21812. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-217596.
CVSS Score: 2.6 (LOW)
CWE: CWE-208
References: https://github.com/agnivade/easy-scrypt/commit/477c10cf3b144ddf96526aa09f5fdea613f21812; https://github.com/agnivade/easy-scrypt/releases/tag/v1.0.0; https://vuldb.com/?ctiid.217596