deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-29055
Published: 2022-06-23
Description: Cross Site Scripting (XSS) vulnerability in sourcecodester School File Management System 1.0 via the Firtstname parameter to the Update Account form in student_profile.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://packetstormsecurity.com/files/161394/School-File-Management-System-1.0-Cross-Site-Scripting.html; https://www.sourcecodester.com/php/14155/school-file-management-system.html; https://packetstormsecurity.com/files/161394/School-File-Management-System-1.0-Cross-Site-Scripting.html
CVE: CVE-2021-40954
Published: 2022-06-23
Description: Laiketui 3.5.0 is affected by an arbitrary file upload vulnerability that can allow an attacker to execute arbitrary code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://github.com/bettershop/LaikeTui/issues/11; https://github.com/bettershop/LaikeTui/issues/11
CVE: CVE-2021-40955
Published: 2022-06-23
Description: SQL injection exists in LaiKetui v3.5.0 the background administrator list.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/bettershop/LaikeTui/issues/12; https://github.com/bettershop/LaikeTui/issues/12
CVE: CVE-2021-40956
Published: 2022-06-23
Description: LaiKetui v3.5.0 has SQL injection in the background through the menu management function, and sensitive data can be obtained.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://github.com/bettershop/LaikeTui/issues/13; https://github.com/bettershop/LaikeTui/issues/13
CVE: CVE-2021-41432
Published: 2022-06-23
Description: A stored cross-site scripting (XSS) vulnerability exists in FlatPress 1.2.1 that allows for arbitrary execution of JavaScript commands through blog content.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/flatpressblog/flatpress/issues/88; https://github.com/flatpressblog/flatpress/issues/88
CVE: CVE-2021-46824
Published: 2022-06-23
Description: Cross Site Scripting (XSS) vulnerability in sourcecodester School File Management System 1.0 via the Lastname parameter to the Update Account form in student_profile.php.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://packetstormsecurity.com/files/161394/School-File-Management-System-1.0-Cross-Site-Scripting.html; https://www.exploit-db.com/exploits/49559; https://www.sourcecodester.com/php/14155/school-file-management-system.html
CVE: CVE-2022-22967
Published: 2022-06-23
Description: An issue was discovered in SaltStack Salt in versions before 3002.9, 3003.5, 3004.2. PAM auth fails to reject locked accounts, which allows a previously authorized user whose account is locked still run Salt commands when their account is locked. This affects both local shell accounts with an active session and salt-api users that authenticate via PAM eauth.
CVSS Score: 8.8 (HIGH)
CWE: CWE-863, CWE-863
References: https://repo.saltproject.io/; https://saltproject.io/security_announcements/salt-security-advisory-release-june-21st-2022/%2C; https://security.gentoo.org/glsa/202310-22
CVE: CVE-2022-22980
Published: 2022-06-23
Description: A Spring Data MongoDB application is vulnerable to SpEL Injection when using @Query or @Aggregation-annotated query methods with SpEL expressions that contain query parameter placeholders for value binding if the input is not sanitized.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-917
References: https://tanzu.vmware.com/security/cve-2022-22980; https://tanzu.vmware.com/security/cve-2022-22980
CVE: CVE-2022-29299
Published: 2022-06-23
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2021-20660. Reason: This candidate is a reservation duplicate of CVE-2021-20660. Notes: All CVE users should reference CVE-2021-20660 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2022-29301
Published: 2022-06-23
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2021-20660. Reason: This candidate is a reservation duplicate of CVE-2021-20660. Notes: All CVE users should reference CVE-2021-20660 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2022-29526
Published: 2022-06-23
Description: Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege Assignment. When called with a non-zero flags parameter, the Faccessat function could incorrectly report that a file is accessible.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-269
References: https://github.com/golang/go/issues/52313; https://groups.google.com/g/golang-announce; https://groups.google.com/g/golang-announce/c/Y5qrqw_lWdU
CVE: CVE-2022-31361
Published: 2022-06-23
Description: Docebo Community Edition v4.0.5 and below was discovered to contain a SQL injection vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://blog.formalms.org/about/blog/20-life-after-docebo-the-forma-project-begins.html; https://www.swascan.com/security-advisory-docebo-community-edition/; https://blog.formalms.org/about/blog/20-life-after-docebo-the-forma-project-begins.html
CVE: CVE-2022-31362
Published: 2022-06-23
Description: Docebo Community Edition v4.0.5 and below was discovered to contain an arbitrary file upload vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://blog.formalms.org/about/blog/20-life-after-docebo-the-forma-project-begins.html; https://www.swascan.com/security-advisory-docebo-community-edition/; https://blog.formalms.org/about/blog/20-life-after-docebo-the-forma-project-begins.html
CVE: CVE-2022-31395
Published: 2022-06-23
Description: Algo Communication Products Ltd. 8373 IP Zone Paging Adapter Firmware 1.7.6 allows attackers to perform a directory traversal via a web request sent to /fm-data.lua.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22
References: https://n0ur5sec.medium.com/achievement-unlocked-cve-2022-31395-33299f32cc00; https://n0ur5sec.medium.com/achievement-unlocked-cve-2022-31395-33299f32cc00
CVE: CVE-2022-31787
Published: 2022-06-23
Description: IdeaTMS 2022 is vulnerable to SQL Injection via the PATH_INFO
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://gist.github.com/RNPG/ef10c0acceb650d43625a77d3472dd84; https://gist.github.com/This-is-Neo/c91e1a0ed5d40fbcf0dada43ea1d7479; https://gist.github.com/RNPG/ef10c0acceb650d43625a77d3472dd84
CVE: CVE-2022-32124
Published: 2022-06-23
Description: 74cmsSE v3.5.1 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the component /index/jobfairol/show/.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/PAINCLOWN/74cmsSE-Arbitrary-File-Reading/issues/3; https://github.com/PAINCLOWN/74cmsSE-Arbitrary-File-Reading/issues/3
CVE: CVE-2022-32125
Published: 2022-06-23
Description: 74cmsSE v3.5.1 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the path /job.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/PAINCLOWN/74cmsSE-Arbitrary-File-Reading/issues/3; https://github.com/PAINCLOWN/74cmsSE-Arbitrary-File-Reading/issues/3
CVE: CVE-2022-32126
Published: 2022-06-23
Description: 74cmsSE v3.5.1 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the path /company.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/PAINCLOWN/74cmsSE-Arbitrary-File-Reading/issues/3; https://github.com/PAINCLOWN/74cmsSE-Arbitrary-File-Reading/issues/3
CVE: CVE-2022-32127
Published: 2022-06-23
Description: 74cmsSE v3.5.1 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the path /company/view_be_browsed/total.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/PAINCLOWN/74cmsSE-Arbitrary-File-Reading/issues/3; https://github.com/PAINCLOWN/74cmsSE-Arbitrary-File-Reading/issues/3
CVE: CVE-2022-32128
Published: 2022-06-23
Description: 74cmsSE v3.5.1 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the path /company/service/increment/add/im.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/PAINCLOWN/74cmsSE-Arbitrary-File-Reading/issues/3; https://github.com/PAINCLOWN/74cmsSE-Arbitrary-File-Reading/issues/3
CVE: CVE-2022-32129
Published: 2022-06-23
Description: 74cmsSE v3.5.1 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the path /company/account/safety/trade.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/PAINCLOWN/74cmsSE-Arbitrary-File-Reading/issues/3; https://github.com/PAINCLOWN/74cmsSE-Arbitrary-File-Reading/issues/3
CVE: CVE-2022-32130
Published: 2022-06-23
Description: 74cmsSE v3.5.1 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the path /company/down_resume/total/nature.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/PAINCLOWN/74cmsSE-Arbitrary-File-Reading/issues/3; https://github.com/PAINCLOWN/74cmsSE-Arbitrary-File-Reading/issues/3
CVE: CVE-2022-32131
Published: 2022-06-23
Description: 74cmsSE v3.5.1 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the path /index/notice/show.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/PAINCLOWN/74cmsSE-Arbitrary-File-Reading/issues/3; https://github.com/PAINCLOWN/74cmsSE-Arbitrary-File-Reading/issues/3
CVE: CVE-2022-32534
Published: 2022-06-23
Description: The Bosch Ethernet switch PRA-ES8P2S with software version 1.01.05 and earlier was found to be vulnerable to command injection through its diagnostics web interface. This allows execution of shell commands.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20, CWE-78
References: https://psirt.bosch.com/security-advisories/BOSCH-SA-247052-BT.html; https://psirt.bosch.com/security-advisories/BOSCH-SA-247052-BT.html
CVE: CVE-2022-32535
Published: 2022-06-23
Description: The Bosch Ethernet switch PRA-ES8P2S with software version 1.01.05 runs its web server with root privilege. In combination with CVE-2022-23534 this could give an attacker root access to the switch.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-250, CWE-269
References: https://psirt.bosch.com/security-advisories/BOSCH-SA-247052-BT.html; https://psirt.bosch.com/security-advisories/BOSCH-SA-247052-BT.html
CVE: CVE-2022-32536
Published: 2022-06-23
Description: The user access rights validation in the web server of the Bosch Ethernet switch PRA-ES8P2S with software version 1.01.05 was insufficient. This would allow a non-administrator user to obtain administrator user access rights.
CVSS Score: 8.8 (HIGH)
CWE: CWE-269, CWE-269
References: https://psirt.bosch.com/security-advisories/BOSCH-SA-247052-BT.html; https://psirt.bosch.com/security-advisories/BOSCH-SA-247052-BT.html
CVE: CVE-2022-32552
Published: 2022-06-23
Description: Pure Storage FlashArray products running Purity//FA 6.2.0 - 6.2.3, 6.1.0 - 6.1.12, 6.0.0 - 6.0.8, 5.3.0 - 5.3.17, 5.2.x and prior Purity//FA releases, and Pure Storage FlashBlade products running Purity//FB 3.3.0, 3.2.0 - 3.2.4, 3.1.0 - 3.1.12, 3.0.x and prior Purity//FB releases are vulnerable to a privilege escalation via the manipulation of Python environment variables which can be exploited by a logged-in user to escape a restricted shell to an unrestricted shell with root privileges. No other Pure Storage products or services are affected. Remediation is available from Pure Storage via a self-serve “opt-in” patch, manual patch application or a software upgrade to an unaffected version of Purity software.
CVSS Score: 8.8 (HIGH)
References: https://support.purestorage.com/Pure_Security/Security_Bundle_2022-04-04/Security_Advisory_for_%E2%80%9Csecurity-bundle-2022-04-04; https://support.purestorage.com/Pure_Security/Security_Bundle_2022-04-04/Security_Advisory_for_%E2%80%9Csecurity-bundle-2022-04-04
CVE: CVE-2022-32553
Published: 2022-06-23
Description: Pure Storage FlashArray products running Purity//FA 6.2.0 - 6.2.3, 6.1.0 - 6.1.12, 6.0.0 - 6.0.8, 5.3.0 - 5.3.17, 5.2.x and prior Purity//FA releases, and Pure Storage FlashBlade products running Purity//FB 3.3.0, 3.2.0 - 3.2.4, 3.1.0 - 3.1.12, 3.0.x and prior Purity//FB releases are vulnerable to a privilege escalation via the manipulation of environment variables which can be exploited by a logged-in user to escape a restricted shell to an unrestricted shell with root privileges. No other Pure Storage products or services are affected. Remediation is available from Pure Storage via a self-serve “opt-in” patch, manual patch application or a software upgrade to an unaffected version of Purity software.
CVSS Score: 8.8 (HIGH)
References: https://support.purestorage.com/Pure_Security/Security_Bundle_2022-04-04/Security_Advisory_for_%E2%80%9Csecurity-bundle-2022-04-04; https://support.purestorage.com/Pure_Security/Security_Bundle_2022-04-04/Security_Advisory_for_%E2%80%9Csecurity-bundle-2022-04-04
CVE: CVE-2022-32554
Published: 2022-06-23
Description: Pure Storage FlashArray products running Purity//FA 6.2.0 - 6.2.3, 6.1.0 - 6.1.12, 6.0.0 - 6.0.8, 5.3.0 - 5.3.17, 5.2.x and prior Purity//FA releases, and Pure Storage FlashBlade products running Purity//FB 3.3.0, 3.2.0 - 3.2.4, 3.1.0 - 3.1.12, 3.0.x and prior Purity//FB releases are vulnerable to possibly exposed credentials for accessing the product’s management interface. The password may be known outside Pure Storage and could be used on an affected system, if reachable, to execute arbitrary instructions with root privileges. No other Pure Storage products or services are affected. Remediation is available from Pure Storage via a self-serve “opt-in” patch, manual patch application or a software upgrade to an unaffected version of Purity software.
CVSS Score: 9.8 (CRITICAL)
References: https://support.purestorage.com/Pure_Security/Security_Bundle_2022-04-04/Security_Advisory_for_%E2%80%9Csecurity-bundle-2022-04-04; https://support.purestorage.com/Pure_Security/Security_Bundle_2022-04-04/Security_Advisory_for_%E2%80%9Csecurity-bundle-2022-04-04
CVE: CVE-2022-33024
Published: 2022-06-23
Description: There is an Assertion `int decode_preR13_entities(BITCODE_RL, BITCODE_RL, unsigned int, BITCODE_RL, BITCODE_RL, Bit_Chain *, Dwg_Data *' failed at dwg2dxf: decode.c:5801 in libredwg v0.12.4.4608.
CVSS Score: 7.5 (HIGH)
CWE: CWE-617
References: https://github.com/LibreDWG/libredwg/issues/492; https://github.com/LibreDWG/libredwg/issues/492
CVE: CVE-2022-33025
Published: 2022-06-23
Description: LibreDWG v0.12.4.4608 was discovered to contain a heap-use-after-free via the function decode_preR13_section at decode_r11.c.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://github.com/LibreDWG/libredwg/issues/487; https://github.com/LibreDWG/libredwg/issues/487
CVE: CVE-2022-33026
Published: 2022-06-23
Description: LibreDWG v0.12.4.4608 was discovered to contain a heap buffer overflow via the function bit_calc_CRC at bits.c.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/LibreDWG/libredwg/issues/484; https://github.com/LibreDWG/libredwg/issues/484
CVE: CVE-2022-33027
Published: 2022-06-23
Description: LibreDWG v0.12.4.4608 was discovered to contain a heap-use-after-free via the function dwg_add_handleref at dwg.c.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://github.com/LibreDWG/libredwg/issues/490; https://github.com/LibreDWG/libredwg/issues/490
CVE: CVE-2022-33028
Published: 2022-06-23
Description: LibreDWG v0.12.4.4608 was discovered to contain a heap buffer overflow via the function dwg_add_object at decode.c.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/LibreDWG/libredwg/issues/489; https://github.com/LibreDWG/libredwg/issues/489
CVE: CVE-2022-33032
Published: 2022-06-23
Description: LibreDWG v0.12.4.4608 was discovered to contain a heap-buffer-overflow via the function decode_preR13_section_hdr at decode_r11.c.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/LibreDWG/libredwg/issues/488; https://github.com/LibreDWG/libredwg/issues/488
CVE: CVE-2022-33033
Published: 2022-06-23
Description: LibreDWG v0.12.4.4608 was discovered to contain a double-free via the function dwg_read_file at dwg.c.
CVSS Score: 7.8 (HIGH)
CWE: CWE-415
References: https://github.com/LibreDWG/libredwg/issues/493; https://github.com/LibreDWG/libredwg/issues/493
CVE: CVE-2022-33034
Published: 2022-06-23
Description: LibreDWG v0.12.4.4608 was discovered to contain a stack overflow via the function copy_bytes at decode_r2007.c.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/LibreDWG/libredwg/issues/494; https://github.com/LibreDWG/libredwg/issues/494
CVE: CVE-2022-33067
Published: 2022-06-23
Description: Lrzip v0.651 was discovered to contain multiple invalid arithmetic shifts via the functions get_magic in lrzip.c and Predictor::init in libzpaq/libzpaq.cpp. These vulnerabilities allow attackers to cause a Denial of Service via unspecified vectors.
CVSS Score: 5.5 (MEDIUM)
References: https://github.com/ckolivas/lrzip/issues/224; https://github.com/ckolivas/lrzip/issues/224
CVE: CVE-2022-33068
Published: 2022-06-23
Description: An integer overflow in the component hb-ot-shape-fallback.cc of Harfbuzz v4.3.0 allows attackers to cause a Denial of Service (DoS) via unspecified vectors.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-190
References: https://github.com/harfbuzz/harfbuzz/commit/62e803b36173fd096d7ad460dd1d1db9be542593; https://github.com/harfbuzz/harfbuzz/issues/3557; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FQBJ24W6TXLSAQWCFW7IBGUMX4AJI3S4/
CVE: CVE-2022-33069
Published: 2022-06-23
Description: Ethereum Solidity v0.8.14 contains an assertion failure via SMTEncoder::indexOrMemberAssignment() at SMTEncoder.cpp.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-617
References: https://github.com/ethereum/solidity/issues/12973; https://github.com/ethereum/solidity/issues/12973
CVE: CVE-2022-33070
Published: 2022-06-23
Description: Protobuf-c v1.4.0 was discovered to contain an invalid arithmetic shift via the function parse_tag_and_wiretype in protobuf-c/protobuf-c.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via unspecified vectors.
CVSS Score: 5.5 (MEDIUM)
References: https://github.com/protobuf-c/protobuf-c/issues/506; https://github.com/protobuf-c/protobuf-c/pull/508; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FFN2GHUEGTSHRD7J5PKQ5DRSJSEQ2IKN/
CVE: CVE-2022-33092
Published: 2022-06-23
Description: 74cmsSE v3.5.1 was discovered to contain a SQL injection vulnerability via the keyword parameter at /home/job/index.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://github.com/PAINCLOWN/74cmsSE-Arbitrary-File-Reading/issues/6; https://github.com/PAINCLOWN/74cmsSE-Arbitrary-File-Reading/issues/6
CVE: CVE-2022-33093
Published: 2022-06-23
Description: 74cmsSE v3.5.1 was discovered to contain a SQL injection vulnerability via the key parameter at /freelance/resume_list.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://github.com/PAINCLOWN/74cmsSE-Arbitrary-File-Reading/issues/8; https://github.com/PAINCLOWN/74cmsSE-Arbitrary-File-Reading/issues/8
CVE: CVE-2022-33094
Published: 2022-06-23
Description: 74cmsSE v3.5.1 was discovered to contain a SQL injection vulnerability via the keyword parameter at /home/job/map.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://github.com/PAINCLOWN/74cmsSE-Arbitrary-File-Reading/issues/4; https://github.com/PAINCLOWN/74cmsSE-Arbitrary-File-Reading/issues/4
CVE: CVE-2022-33095
Published: 2022-06-23
Description: 74cmsSE v3.5.1 was discovered to contain a SQL injection vulnerability via the keyword parameter at /home/jobfairol/resumelist.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://github.com/PAINCLOWN/74cmsSE-Arbitrary-File-Reading/issues/5; https://github.com/PAINCLOWN/74cmsSE-Arbitrary-File-Reading/issues/5
CVE: CVE-2022-33096
Published: 2022-06-23
Description: 74cmsSE v3.5.1 was discovered to contain a SQL injection vulnerability via the keyword parameter at /home/resume/index.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://github.com/PAINCLOWN/74cmsSE-Arbitrary-File-Reading/issues/9; https://github.com/PAINCLOWN/74cmsSE-Arbitrary-File-Reading/issues/9
CVE: CVE-2022-33097
Published: 2022-06-23
Description: 74cmsSE v3.5.1 was discovered to contain a SQL injection vulnerability via the keyword parameter at /home/campus/campus_job.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://github.com/PAINCLOWN/74cmsSE-Arbitrary-File-Reading/issues/7; https://github.com/PAINCLOWN/74cmsSE-Arbitrary-File-Reading/issues/7
CVE: CVE-2022-33105
Published: 2022-06-23
Description: Redis v7.0 was discovered to contain a memory leak via the component streamGetEdgeID.
CVSS Score: 7.5 (HIGH)
CWE: CWE-401
References: https://github.com/redis/redis/commit/4a7a4e42db8ff757cdf3f4a824f[PII_REDACTED]4ef; https://github.com/redis/redis/pull/10753; https://github.com/redis/redis/pull/10829
CVE: CVE-2022-33113
Published: 2022-06-23
Description: Jfinal CMS v5.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the keyword text field under the publish blog module.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/jflyfox/jfinal_cms/issues/39; https://github.com/jflyfox/jfinal_cms/issues/39
CVE: CVE-2022-33114
Published: 2022-06-23
Description: Jfinal CMS v5.1.0 was discovered to contain a SQL injection vulnerability via the attrVal parameter at /jfinal_cms/system/dict/list.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/jflyfox/jfinal_cms/issues/38; https://github.com/jflyfox/jfinal_cms/issues/38
CVE: CVE-2022-33124
Published: 2022-06-23
Description: AIOHTTP 3.8.1 can report a "ValueError: Invalid IPv6 URL" outcome, which can lead to a Denial of Service (DoS). NOTE: multiple third parties dispute this issue because there is no example of a context in which denial of service would occur, and many common contexts have exception handing in the calling application
CVSS Score: 5.5 (MEDIUM)
References: https://github.com/aio-libs/aiohttp/issues/6772; https://github.com/aio-libs/aiohttp/issues/6772
CVE: CVE-2022-33127
Published: 2022-06-23
Description: The function that calls the diff tool in Diffy 3.4.1 does not properly handle double quotes in a filename when run in a windows environment. This allows attackers to execute arbitrary commands via a crafted string.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/samg/diffy/blob/56fd935aea256742f7352b050592542d3d153bf6/CHANGELOG#L1; https://github.com/samg/diffy/commit/478f392082b66d38f54a02b4bb9c41be32fd6593; https://github.com/samg/diffy/blob/56fd935aea256742f7352b050592542d3d153bf6/CHANGELOG#L1
CVE: CVE-2022-34011
Published: 2022-06-23
Description: OneBlog v2.3.4 was discovered to contain a Server-Side Request Forgery (SSRF) vulnerability via the parameter entryUrls.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-918
References: https://gitee.com/yadong.zhang/DBlog/issues/I5CB2A; https://gitee.com/yadong.zhang/DBlog/issues/I5CB2A
CVE: CVE-2022-34012
Published: 2022-06-23
Description: Insecure permissions in OneBlog v2.3.4 allows low-level administrators to reset the passwords of high-level administrators who hold greater privileges.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-732
References: https://gitee.com/yadong.zhang/DBlog/issues/I5CB2O; https://gitee.com/yadong.zhang/DBlog/issues/I5CB2O
CVE: CVE-2022-34013
Published: 2022-06-23
Description: OneBlog v2.3.4 was discovered to contain a Server-Side Request Forgery (SSRF) vulnerability via the Logo parameter under the Link module.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-918
References: https://gitee.com/yadong.zhang/DBlog/issues/I5CB2A; https://gitee.com/yadong.zhang/DBlog/issues/I5CB2A