deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-21742
Published: 2022-06-20
Description: Realtek USB driver has a buffer overflow vulnerability due to insufficient parameter length verification in the API function. An unauthenticated LAN attacker can exploit this vulnerability to disrupt services.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-120, CWE-120
References: https://www.twcert.org.tw/tw/cp-132-6057-1cd0d-1.html; https://www.twcert.org.tw/tw/cp-132-6057-1cd0d-1.html
CVE: CVE-2022-26668
Published: 2022-06-20
Description: ASUS Control Center API has a broken access control vulnerability. An unauthenticated remote attacker can call privileged API functions to perform partial system operations or cause partial disrupt of service.
CVSS Score: 7.3 (HIGH)
CWE: CWE-269, CWE-863
References: https://www.twcert.org.tw/tw/cp-132-6055-c6500-1.html; https://www.twcert.org.tw/tw/cp-132-6055-c6500-1.html
CVE: CVE-2022-26669
Published: 2022-06-20
Description: ASUS Control Center is vulnerable to SQL injection. An authenticated remote attacker with general user privilege can inject SQL command to specific API parameters to acquire database schema or access data.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://www.twcert.org.tw/tw/cp-132-6056-b0d90-1.html; https://www.twcert.org.tw/tw/cp-132-6056-b0d90-1.html
CVE: CVE-2022-2130
Published: 2022-06-20
Description: Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 1.2.17.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/microweber/microweber/commit/dbd37dda91911360db23269897c737e0abae2c24; https://huntr.dev/bounties/0142970a-5cb8-4dba-8bbc-4fa2f3bee65c; https://github.com/microweber/microweber/commit/dbd37dda91911360db23269897c737e0abae2c24
CVE: CVE-2022-31734
Published: 2022-06-20
Description: Cisco Catalyst 2940 Series Switches provided by Cisco Systems, Inc. contain a reflected cross-site scripting vulnerability regarding error page generation. An arbitrary script may be executed on the web browser of the user who is using the product. The affected firmware is prior to 12.2(50)SY released in 2011, and Cisco Catalyst 2940 Series Switches have been retired since January 2015
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://jvn.jp/en/jp/JVN94363766/index.html; https://www.cisco.com/c/en/us/obsolete/switches/cisco-catalyst-2940-series-switches.html; https://jvn.jp/en/jp/JVN94363766/index.html
CVE: CVE-2021-25088
Published: 2022-06-20
Description: The XML Sitemaps WordPress plugin before 4.1.3 does not sanitise and escape a settings before outputting it in the Debug page, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/820c51d6-186e-4d63-b4a7-bd0a59c02cc8; https://wpscan.com/vulnerability/820c51d6-186e-4d63-b4a7-bd0a59c02cc8
CVE: CVE-2021-25104
Published: 2022-06-20
Description: The Ocean Extra WordPress plugin before 1.9.5 does not escape generated links which are then used when the OceanWP is active, leading to a Reflected Cross-Site Scripting issue
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/2ee6f1d8-3803-42f6-9193-3dd8f416b558; https://wpscan.com/vulnerability/2ee6f1d8-3803-42f6-9193-3dd8f416b558
CVE: CVE-2021-25121
Published: 2022-06-20
Description: The Rating by BestWebSoft WordPress plugin before 1.6 does not validate the submitted rating, allowing submission of long integer, causing a Denial of Service on the post/page when a user submit such rating
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-191, CWE-191
References: https://wpscan.com/vulnerability/efb1ddef-2123-416c-a932-856d41ed836d; https://wpscan.com/vulnerability/efb1ddef-2123-416c-a932-856d41ed836d
CVE: CVE-2022-0663
Published: 2022-06-20
Description: The Print, PDF, Email by PrintFriendly WordPress plugin before 5.2.3 does not sanitise and escape the Custom Button Text settings, which could allow high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://wpscan.com/vulnerability/b586b217-f91e-42d3-81f1-cc3ee3a4b01e; https://wpscan.com/vulnerability/b586b217-f91e-42d3-81f1-cc3ee3a4b01e
CVE: CVE-2022-1266
Published: 2022-06-20
Description: The Post Grid, Slider & Carousel Ultimate WordPress plugin before 1.5.0 does not sanitise and escape the Header Title, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/7800d583-fcfc-4360-9dc3-af3f73e12ab4; https://wpscan.com/vulnerability/7800d583-fcfc-4360-9dc3-af3f73e12ab4
CVE: CVE-2022-1472
Published: 2022-06-20
Description: The Better Find and Replace WordPress plugin before 1.3.6 does not properly sanitise, validate and escape various parameters before using them in an SQL statement, leading to an SQL Injection
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://wpscan.com/vulnerability/9c608b14-dc5e-469e-b97a-84696fae804c; https://wpscan.com/vulnerability/9c608b14-dc5e-469e-b97a-84696fae804c
CVE: CVE-2022-1603
Published: 2022-06-20
Description: The Mail Subscribe List WordPress plugin before 2.1.4 does not have CSRF check in place when deleting subscribed users, which could allow attackers to make a logged in admin perform such action and delete arbitrary users from the subscribed list
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/0e12ba6f-a86f-4cc6-9013-8a15586098d0; https://wpscan.com/vulnerability/0e12ba6f-a86f-4cc6-9013-8a15586098d0
CVE: CVE-2022-1610
Published: 2022-06-20
Description: The Seamless Donations WordPress plugin before 5.1.9 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/88014da6-6179-4527-8f67-fbb610804d93; https://wpscan.com/vulnerability/88014da6-6179-4527-8f67-fbb610804d93
CVE: CVE-2022-1614
Published: 2022-06-20
Description: The WP-EMail WordPress plugin before 2.69.0 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDR, which makes it possible to bypass IP-based anti-spamming restrictions.
CVSS Score: 7.5 (HIGH)
CWE: CWE-639
References: https://wpscan.com/vulnerability/a5940d0b-6b88-4418-87e2-02c0897bc2f1; https://wpscan.com/vulnerability/a5940d0b-6b88-4418-87e2-02c0897bc2f1
CVE: CVE-2022-1630
Published: 2022-06-20
Description: The WP-EMail WordPress plugin before 2.69.0 does not protect its log deletion functionality with nonce checks, allowing attacker to make a logged in admin delete logs via a CSRF attack
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/178d0c49-3a93-4948-8734-f3d7518361b3; https://wpscan.com/vulnerability/178d0c49-3a93-4948-8734-f3d7518361b3
CVE: CVE-2022-1717
Published: 2022-06-20
Description: The Custom Share Buttons with Floating Sidebar WordPress plugin before 4.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/79a532e9-bc6e-4722-8d67-9c15720d06a6; https://wpscan.com/vulnerability/79a532e9-bc6e-4722-8d67-9c15720d06a6
CVE: CVE-2022-1801
Published: 2022-06-20
Description: The Very Simple Contact Form WordPress plugin before 11.6 exposes the solution to the captcha in the rendered contact form, both as hidden input fields and as plain text in the page, making it very easy for bots to bypass the captcha check, rendering the page a likely target for spam bots.
CVSS Score: 7.5 (HIGH)
CWE: CWE-804, CWE-287
References: https://wpscan.com/vulnerability/a5c97809-2ffc-4efb-8c80-1b734361cd06; https://wpscan.com/vulnerability/a5c97809-2ffc-4efb-8c80-1b734361cd06
CVE: CVE-2022-1818
Published: 2022-06-20
Description: The Multi-page Toolkit WordPress plugin through 2.6 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping as well
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/9d6c628f-cdea-481c-a2e5-101dc167718d; https://wpscan.com/vulnerability/9d6c628f-cdea-481c-a2e5-101dc167718d
CVE: CVE-2022-1823
Published: 2022-06-20
Description: Improper privilege management vulnerability in McAfee Consumer Product Removal Tool prior to version 10.4.128 could allow a local user to modify a configuration file and perform a LOLBin (Living off the land) attack. This could result in the user gaining elevated permissions and being able to execute arbitrary code, through not correctly checking the integrity of the configuration file.
CVSS Score: 7.9 (HIGH)
CWE: CWE-269
References: https://service.mcafee.com/?articleId=TS103318&page=shell&shell=article-view; https://service.mcafee.com/?articleId=TS103318&page=shell&shell=article-view
CVE: CVE-2022-1824
Published: 2022-06-20
Description: An uncontrolled search path vulnerability in McAfee Consumer Product Removal Tool prior to version 10.4.128 could allow a local attacker to perform a sideloading attack by using a specific file name. This could result in the user gaining elevated permissions and being able to execute arbitrary code as there were insufficient checks on the executable being signed by McAfee.
CVSS Score: 7.9 (HIGH)
CWE: CWE-427, CWE-427
References: https://service.mcafee.com/?articleId=TS103318&page=shell&shell=article-view; https://service.mcafee.com/?articleId=TS103318&page=shell&shell=article-view
CVE: CVE-2022-1826
Published: 2022-06-20
Description: The Cross-Linker WordPress plugin through 3.0.1.9 does not have CSRF check in place when creating Cross-Links, which could allow attackers to make a logged in admin perform such action via a CSRF attack
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/b9dba241-d94c-4ce5-8730-445ba8005e66; https://wpscan.com/vulnerability/b9dba241-d94c-4ce5-8730-445ba8005e66
CVE: CVE-2022-1827
Published: 2022-06-20
Description: The PDF24 Article To PDF WordPress plugin through 4.2.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/0bd25283-e079-4010-b139-cce9afb1d54d; https://wpscan.com/vulnerability/0bd25283-e079-4010-b139-cce9afb1d54d
CVE: CVE-2022-1828
Published: 2022-06-20
Description: The PDF24 Articles To PDF WordPress plugin through 4.2.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/877ce7a5-b1ff-4d03-9cd8-6beed5595af8; https://wpscan.com/vulnerability/877ce7a5-b1ff-4d03-9cd8-6beed5595af8
CVE: CVE-2022-1829
Published: 2022-06-20
Description: The Inline Google Maps WordPress plugin through 5.11 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack, and lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/8353aa12-dbb7-433f-9dd9-d61a3f303d4b; https://wpscan.com/vulnerability/8353aa12-dbb7-433f-9dd9-d61a3f303d4b
CVE: CVE-2022-1830
Published: 2022-06-20
Description: The Amazon Einzeltitellinks WordPress plugin through 1.3.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/a6b3e927-41e2-4e48-b9e1-8c58a1b9a933; https://wpscan.com/vulnerability/a6b3e927-41e2-4e48-b9e1-8c58a1b9a933
CVE: CVE-2022-1831
Published: 2022-06-20
Description: The WPlite WordPress plugin through 1.3.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/91c44a4f-b599-46c0-a8df-d1fb87472abe; https://wpscan.com/vulnerability/91c44a4f-b599-46c0-a8df-d1fb87472abe
CVE: CVE-2022-1832
Published: 2022-06-20
Description: The CaPa Protect WordPress plugin through 0.5.8.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and disable the applied protection.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/e025f821-81c3-4072-a89e-a5b3d0fb1275; https://wpscan.com/vulnerability/e025f821-81c3-4072-a89e-a5b3d0fb1275
CVE: CVE-2022-1889
Published: 2022-06-20
Description: The Newsletter WordPress plugin before 7.4.6 does not escape and sanitise the preheader_text setting, which could allow high privilege users to perform Stored Cross-Site Scripting attacks when the unfilteredhtml is disallowed
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/ee3832e2-ce40-4063-a23e-44c7f7f5f46a; https://wpscan.com/vulnerability/ee3832e2-ce40-4063-a23e-44c7f7f5f46a
CVE: CVE-2022-1895
Published: 2022-06-20
Description: The underConstruction WordPress plugin before 1.20 does not have CSRF check in place when deactivating the construction mode, which could allow attackers to make a logged in admin perform such action via a CSRF attack
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/bd9ef7e0-ebbb-4b91-8c58-265218a3c536; https://wpscan.com/vulnerability/bd9ef7e0-ebbb-4b91-8c58-265218a3c536
CVE: CVE-2022-1896
Published: 2022-06-20
Description: The underConstruction WordPress plugin before 1.21 does not sanitise or escape the "Display a custom page using your own HTML" setting before outputting it, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiletred_html capability is disallowed.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/3e8bd875-2435-4a15-8ee8-8a00882b499c; https://wpscan.com/vulnerability/3e8bd875-2435-4a15-8ee8-8a00882b499c
CVE: CVE-2022-1905
Published: 2022-06-20
Description: The Events Made Easy WordPress plugin before 2.2.81 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://wpscan.com/vulnerability/ff5fd894-aff3-400a-8eec-fad9d50f788e; https://wpscan.com/vulnerability/ff5fd894-aff3-400a-8eec-fad9d50f788e
CVE: CVE-2022-1915
Published: 2022-06-20
Description: The WP Zillow Review Slider WordPress plugin before 2.4 does not escape a settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite)
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/c3c28edf-19bc-4f3a-b58e-f1c67557aa29; https://wpscan.com/vulnerability/c3c28edf-19bc-4f3a-b58e-f1c67557aa29
CVE: CVE-2022-1939
Published: 2022-06-20
Description: The Allow svg files WordPress plugin before 1.1 does not properly validate uploaded files, which could allow high privilege users such as admin to upload PHP files even when they are not allowed to
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: https://wpscan.com/vulnerability/4d7b62e1-558b-4504-a6e2-78246a8b554f; https://wpscan.com/vulnerability/4d7b62e1-558b-4504-a6e2-78246a8b554f
CVE: CVE-2022-1945
Published: 2022-06-20
Description: The Coming Soon & Maintenance Mode by Colorlib WordPress plugin before 1.0.99 does not sanitize and escape some settings, allowing high privilege users such as admin to perform Stored Cross-Site Scripting when unfiltered_html is disallowed (for example in multisite setup)
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://wpscan.com/vulnerability/4ad297e5-c92d-403c-abf4-9decf7e8378b; https://wpscan.com/vulnerability/4ad297e5-c92d-403c-abf4-9decf7e8378b
CVE: CVE-2022-25772
Published: 2022-06-20
Description: A cross-site scripting (XSS) vulnerability in the web tracking component of Mautic before 4.3.0 allows remote attackers to inject executable javascript
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-79, CWE-79
References: https://github.com/mautic/mautic/security/advisories/GHSA-pjpc-87mp-4332; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00847.html; https://github.com/mautic/mautic/security/advisories/GHSA-pjpc-87mp-4332
CVE: CVE-2021-41682
Published: 2022-06-20
Description: There is a heap-use-after-free at ecma-helpers-string.c:1940 in ecma_compare_ecma_non_direct_strings in JerryScript 2.4.0
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://github.com/jerryscript-project/jerryscript/issues/4747; https://github.com/jerryscript-project/jerryscript/issues/4747
CVE: CVE-2021-41683
Published: 2022-06-20
Description: There is a stack-overflow at ecma-helpers.c:326 in ecma_get_lex_env_type in JerryScript 2.4.0
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/jerryscript-project/jerryscript/issues/4745; https://github.com/jerryscript-project/jerryscript/issues/4745
CVE: CVE-2022-1720
Published: 2022-06-20
Description: Buffer Over-read in function grab_file_name in GitHub repository vim/vim prior to 8.2.4956. This vulnerability is capable of crashing the software, memory modification, and possible remote execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-126, CWE-125
References: http://seclists.org/fulldisclosure/2022/Oct/28; http://seclists.org/fulldisclosure/2022/Oct/41; http://seclists.org/fulldisclosure/2022/Oct/43
CVE: CVE-2022-2134
Published: 2022-06-20
Description: Allocation of Resources Without Limits or Throttling in GitHub repository inventree/inventree prior to 0.8.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-770, CWE-770
References: https://github.com/inventree/inventree/commit/63b4ff3eb6e80861962fafe79c9b483cd7239d6c; https://huntr.dev/bounties/57b0f272-a97f-4cb3-b546-c863c68a561a; https://github.com/inventree/inventree/commit/63b4ff3eb6e80861962fafe79c9b483cd7239d6c
CVE: CVE-2022-31794
Published: 2022-06-20
Description: An issue was discovered on Fujitsu ETERNUS CentricStor CS8000 (Control Center) devices before 8.1A SP02 P04. The vulnerability resides in the requestTempFile function in hw_view.php. An attacker is able to influence the unitName POST parameter and inject special characters such as semicolons, backticks, or command-substitution sequences in order to force the application to execute arbitrary commands.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://cwe.mitre.org/data/definitions/78.html; https://research.nccgroup.com/2022/05/27/technical-advisory-fujitsu-centricstor-control-center-v8-1-unauthenticated-command-injection/; https://support.ts.fujitsu.com/ProductSecurity/content/Fujitsu-PSIRT-PSS-IS-2022-050316-Security-Notice-SF.pdf
CVE: CVE-2022-31795
Published: 2022-06-20
Description: An issue was discovered on Fujitsu ETERNUS CentricStor CS8000 (Control Center) devices before 8.1A SP02 P04. The vulnerability resides in the grel_finfo function in grel.php. An attacker is able to influence the username (user), password (pw), and file-name (file) parameters and inject special characters such as semicolons, backticks, or command-substitution sequences in order to force the application to execute arbitrary commands.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://cwe.mitre.org/data/definitions/78.html; https://research.nccgroup.com/2022/05/27/technical-advisory-fujitsu-centricstor-control-center-v8-1-unauthenticated-command-injection/; https://support.ts.fujitsu.com/ProductSecurity/content/Fujitsu-PSIRT-PSS-IS-2022-050316-Security-Notice-SF.pdf
CVE: CVE-2022-32983
Published: 2022-06-20
Description: Knot Resolver through 5.5.1 may allow DNS cache poisoning when there is an attempt to limit forwarding actions by filters.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-290
References: https://github.com/CZ-NIC/knot-resolver/commit/ccb9d9794db5eb757c33becf65cb1cf48ecfd968; https://knot-resolver.readthedocs.io/en/stable/modules-policy.html#forwarding; https://github.com/CZ-NIC/knot-resolver/commit/ccb9d9794db5eb757c33becf65cb1cf48ecfd968
CVE: CVE-2022-33913
Published: 2022-06-20
Description: In Mahara 21.04 before 21.04.6, 21.10 before 21.10.4, and 22.04.2, files can sometimes be downloaded through thumb.php with no permission check.
CVSS Score: 7.5 (HIGH)
CWE: CWE-862
References: https://mahara.org/interaction/forum/topic.php?id=9138; https://mahara.org/interaction/forum/topic.php?id=9138
CVE: CVE-2022-22317
Published: 2022-06-20
Description: IBM Curam Social Program Management 8.0.0 and 8.0.1 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 218281.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-613
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/218281; https://www.ibm.com/support/pages/node/6596049; https://exchange.xforce.ibmcloud.com/vulnerabilities/218281
CVE: CVE-2022-22318
Published: 2022-06-20
Description: IBM Curam Social Program Management 8.0.0 and 8.0.1 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-613
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/218283; https://www.ibm.com/support/pages/node/6596049; https://exchange.xforce.ibmcloud.com/vulnerabilities/218283
CVE: CVE-2022-22414
Published: 2022-06-20
Description: IBM Robotic Process Automation 21.0.2 could allow a local user to obtain sensitive web service configuration credentials from system memory. IBM X-Force ID: 223026.
CVSS Score: 5.5 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/223026; https://www.ibm.com/support/pages/node/6596071; https://exchange.xforce.ibmcloud.com/vulnerabilities/223026
CVE: CVE-2022-2128
Published: 2022-06-20
Description: Unrestricted Upload of File with Dangerous Type in GitHub repository polonel/trudesk prior to 1.2.4.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://github.com/polonel/trudesk/commit/fb2ef82b0a39d0a560a261e07c3c73ba25332ecb; https://huntr.dev/bounties/ec40ec76-c7db-4384-a33b-024f3dd21d75; https://github.com/polonel/trudesk/commit/fb2ef82b0a39d0a560a261e07c3c73ba25332ecb
CVE: CVE-2017-20065
Published: 2022-06-20
Description: A vulnerability was found in Supsystic Popup Plugin 1.7.6 and classified as problematic. This issue affects some unknown processing. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-352
References: http://seclists.org/fulldisclosure/2017/Feb/97; https://map.httpcs.com/alert/284665; https://vuldb.com/?id.97385
CVE: CVE-2017-20066
Published: 2022-06-20
Description: A vulnerability has been found in Adminer Login 1.4.4 and classified as problematic. This vulnerability affects unknown code. The manipulation leads to improper access controls. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-284, CWE-863
References: http://seclists.org/fulldisclosure/2017/Feb/96; https://sumofpwn.nl/advisory/2016/wordpress_adminer_plugin_allows_public__local__database_login.html; https://vuldb.com/?id.97384