deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-41923
Published: 2022-11-23
Description: Grails Spring Security Core plugin is vulnerable to privilege escalation. The vulnerability allows an attacker access to one endpoint (i.e. the targeted endpoint) using the authorization requirements of a different endpoint (i.e. the donor endpoint). In some Grails framework applications, access to the targeted endpoint will be granted based on meeting the authorization requirements of the donor endpoint, which can result in a privilege escalation attack. This vulnerability has been patched in grails-spring-security-core versions 3.3.2, 4.0.5 and 5.1.1. Impacted Applications: Grails Spring Security Core plugin versions: 1.x 2.x >=3.0.0 <3.3.2 >=4.0.0 <4.0.5 >=5.0.0 <5.1.1 We strongly suggest that all Grails framework applications using the Grails Spring Security Core plugin be updated to a patched release of the plugin. Workarounds: Users should create a subclass extending one of the following classes from the `grails.plugin.springsecurity.web.access.intercept` package, depending on their security configuration: * `AnnotationFilterInvocationDefinition` * `InterceptUrlMapFilterInvocationDefinition` * `RequestmapFilterInvocationDefinition` In each case, the subclass should override the `calculateUri` method like so: ``` @Override protected String calculateUri(HttpServletRequest request) { UrlPathHelper.defaultInstance.getRequestUri(request) } ``` This should be considered a temporary measure, as the patched versions of grails-spring-security-core deprecates the `calculateUri` method. Once upgraded to a patched version of the plugin, this workaround is no longer needed. The workaround is especially important for version 2.x, as no patch is available version 2.x of the GSSC plugin.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-269, CWE-863
References: https://github.com/grails/GSSC-CVE-2022-41923; https://github.com/grails/grails-spring-security-core/security/advisories/GHSA-frqg-vvxg-jqqh; https://grails.org/blog/2022-11-22-ss-plugin-auth-cve.html
CVE: CVE-2022-41924
Published: 2022-11-23
Description: A vulnerability identified in the Tailscale Windows client allows a malicious website to reconfigure the Tailscale daemon `tailscaled`, which can then be used to remotely execute code. In the Tailscale Windows client, the local API was bound to a local TCP socket, and communicated with the Windows client GUI in cleartext with no Host header verification. This allowed an attacker-controlled website visited by the node to rebind DNS to an attacker-controlled DNS server, and then make local API requests in the client, including changing the coordination server to an attacker-controlled coordination server. An attacker-controlled coordination server can send malicious URL responses to the client, including pushing executables or installing an SMB share. These allow the attacker to remotely execute code on the node. All Windows clients prior to version v.1.32.3 are affected. If you are running Tailscale on Windows, upgrade to v1.32.3 or later to remediate the issue.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-346, CWE-352, CWE-346
References: https://emily.id.au/tailscale; https://github.com/tailscale/tailscale/security/advisories/GHSA-vqp6-rc3h-83cp; https://tailscale.com/security-bulletins/#ts-2022-004
CVE: CVE-2022-41925
Published: 2022-11-23
Description: A vulnerability identified in the Tailscale client allows a malicious website to access the peer API, which can then be used to access Tailscale environment variables. In the Tailscale client, the peer API was vulnerable to DNS rebinding. This allowed an attacker-controlled website visited by the node to rebind DNS for the peer API to an attacker-controlled DNS server, and then making peer API requests in the client, including accessing the node’s Tailscale environment variables. An attacker with access to the peer API on a node could use that access to read the node’s environment variables, including any credentials or secrets stored in environment variables. This may include Tailscale authentication keys, which could then be used to add new nodes to the user’s tailnet. The peer API access could also be used to learn of other nodes in the tailnet or send files via Taildrop. All Tailscale clients prior to version v1.32.3 are affected. Upgrade to v1.32.3 or later to remediate the issue.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://emily.id.au/tailscale; https://github.com/tailscale/tailscale/security/advisories/GHSA-qccm-wmcq-pwr6; https://tailscale.com/security-bulletins/#ts-2022-005
CVE: CVE-2022-41927
Published: 2022-11-23
Description: XWiki Platform is vulnerable to Cross-Site Request Forgery (CSRF) that may allow attackers to delete or rename tags without needing any confirmation. The problem has been patched in XWiki 13.10.7, 14.4.1 and 14.5RC1. Workarounds: It's possible to patch existing instances directly by editing the page Main.Tags and add this kind of check, in the code for renaming and for deleting: ``` #if (!$services.csrf.isTokenValid($request.get('form_token'))) #set ($discard = $response.sendError(401, "Wrong CSRF token")) #end ```
CVSS Score: 7.4 (HIGH)
CWE: CWE-352
References: https://github.com/xwiki/xwiki-platform/commit/7fd4cda0590180c4d34f557597e9e10e263def9e; https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-mq7h-5574-hw9f; https://github.com/xwiki/xwiki-platform/commit/7fd4cda0590180c4d34f557597e9e10e263def9e
CVE: CVE-2022-41928
Published: 2022-11-23
Description: XWiki Platform vulnerable to Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in AttachmentSelector.xml. The issue can also be reproduced by inserting the dangerous payload in the `height` or `alt` macro properties. This has been patched in versions 13.10.7, 14.4.2, and 14.5. The issue can be fixed on a running wiki by updating `XWiki.AttachmentSelector` with the versions below: - 14.5-rc-1+: https://github.com/xwiki/xwiki-platform/commit/eb15147adf94bddb92626f862c1710d45bcd64a7#diff-e1513599ab698991f6cbba55d38f3f464432ced8d137a668b1f7618c7e747e23 - 14.4.2+: https://github.com/xwiki/xwiki-platform/commit/c02f8eb1f3c953d124f2c097021536f8bc00fa8d#diff-e1513599ab698991f6cbba55d38f3f464432ced8d137a668b1f7618c7e747e23 - 13.10.7+: https://github.com/xwiki/xwiki-platform/commit/efd0df0468d46149ba68b66660b93f31b6318515#diff-e1513599ab698991f6cbba55d38f3f464432ced8d137a668b1f7618c7e747e23
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-95
References: https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-9hqh-fmhg-vq2j; https://jira.xwiki.org/browse/XWIKI-19800; https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-9hqh-fmhg-vq2j
CVE: CVE-2022-41929
Published: 2022-11-23
Description: org.xwiki.platform:xwiki-platform-oldcore is missing authorization in User#setDisabledStatus, which may allow an incorrectly authorized user with only Script rights to enable or disable a user. This operation is meant to only be available for users with admin rights. This problem has been patched in XWiki 13.10.7, 14.4.2 and 14.5RC1.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-862
References: https://github.com/xwiki/xwiki-platform/commit/0b732f2ef0224e2aaf10e2e1ef48dbd3fb6e10cd; https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-2gj2-vj98-j2qq; https://jira.xwiki.org/browse/XWIKI-19804
CVE: CVE-2022-41930
Published: 2022-11-23
Description: org.xwiki.platform:xwiki-platform-user-profile-ui is missing authorization to enable or disable users. Any user (logged in or not) with access to the page XWiki.XWikiUserProfileSheet can enable or disable any user profile. This might allow to a disabled user to re-enable themselves, or to an attacker to disable any user of the wiki. The problem has been patched in XWiki 13.10.7, 14.5RC1 and 14.4.2. Workarounds: The problem can be patched immediately by editing the page `XWiki.XWikiUserProfileSheet` in the wiki and by performing the changes contained in https://github.com/xwiki/xwiki-platform/commit/5be1cc0adf917bf10899c47723fa451e950271fa.
CVSS Score: 7.5 (HIGH)
CWE: CWE-862
References: https://github.com/xwiki/xwiki-platform/commit/5be1cc0adf917bf10899c47723fa451e950271fa; https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-p5v9-g8w8-5q4v; https://jira.xwiki.org/browse/XWIKI-19792
CVE: CVE-2021-29334
Published: 2022-11-23
Description: An issue was discovered in JIZHI CMS 1.9.4. There is a CSRF vulnerability that can add an admin account via index, /admin.php/Admin/adminadd.html
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://gist.github.com/yinfei6/17bbeece7cf5a8f9c31f7a517d85b247; https://gist.github.com/yinfei6/17bbeece7cf5a8f9c31f7a517d85b247
CVE: CVE-2022-41931
Published: 2022-11-23
Description: xwiki-platform-icon-ui is vulnerable to Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection'). Any user with view rights on commonly accessible documents including the icon picker macro can execute arbitrary Groovy, Python or Velocity code in XWiki due to improper neutralization of the macro parameters of the icon picker macro. The problem has been patched in XWiki 13.10.7, 14.5 and 14.4.2. Workarounds: The [patch](https://github.com/xwiki/xwiki-platform/commit/47eb8a5fba550f477944eb6da8ca91b87eaf1d01) can be manually applied by editing `IconThemesCode.IconPickerMacro` in the object editor. The whole document can also be replaced by the current version by importing the document from the XAR archive of a fixed version as the only changes to the document have been security fixes and small formatting changes.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-95
References: https://github.com/xwiki/xwiki-platform/commit/47eb8a5fba550f477944eb6da8ca91b87eaf1d01; https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-5j7g-cf6r-g2h7; https://jira.xwiki.org/browse/XWIKI-19805
CVE: CVE-2022-41934
Published: 2022-11-23
Description: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with view rights on commonly accessible documents including the menu macro can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation due to improper escaping of the macro content and parameters of the menu macro. The problem has been patched in XWiki 14.6RC1, 13.10.8 and 14.4.3. The patch (commit `2fc20891`) for the document `Menu.MenuMacro` can be manually applied or a XAR archive of a patched version can be imported. The menu macro was basically unchanged since XWiki 11.6 so on XWiki 11.6 or later the patch for version of 13.10.8 (commit `59ccca24a`) can most likely be applied, on XWiki version 14.0 and later the versions in XWiki 14.6 and 14.4.3 should be appropriate.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-74, CWE-116
References: https://github.com/xwiki/xwiki-platform/commit/2fc20891e6c6b0ca05ee07e315e7f435e8919f8d; https://github.com/xwiki/xwiki-platform/commit/59ccca24a8465a19f40c51d65fcc2c09c1edea16; https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-6w8h-26xx-cf8q
CVE: CVE-2022-41935
Published: 2022-11-23
Description: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users without the right to view documents can deduce their existence by repeated Livetable queries. The issue has been patched in XWiki 14.6RC1, 13.10.8, and 14.4.3, the response is not properly cleaned up of obfuscated entries. As a workaround, The patch for the document `XWiki.LiveTableResultsMacros` can be manually applied or a XAR archive of a patched version can be imported, on versions 12.10.11, 13.9-rc-1, and 13.4.4. There are no known workarounds for this issue.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://github.com/xwiki/xwiki-platform/commit/1450b6e3c69ac7df25e5a2571186d1f43402facd#diff-5a739e5865b1f1ad9d79b724791be51b0095a0170cc078911c940478b13b949a; https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-p2x4-6ghr-6vmq; https://jira.xwiki.org/browse/XWIKI-19999
CVE: CVE-2022-41946
Published: 2022-11-23
Description: pgjdbc is an open source postgresql JDBC Driver. In affected versions a prepared statement using either `PreparedStatement.setText(int, InputStream)` or `PreparedStatemet.setBytea(int, InputStream)` will create a temporary file if the InputStream is larger than 2k. This will create a temporary file which is readable by other users on Unix like systems, but not MacOS. On Unix like systems, the system's temporary directory is shared between all users on that system. Because of this, when files and directories are written into this directory they are, by default, readable by other users on that same system. This vulnerability does not allow other users to overwrite the contents of these directories or files. This is purely an information disclosure vulnerability. Because certain JDK file system APIs were only added in JDK 1.7, this this fix is dependent upon the version of the JDK you are using. Java 1.7 and higher users: this vulnerability is fixed in 4.5.0. Java 1.6 and lower users: no patch is available. If you are unable to patch, or are stuck running on Java 1.6, specifying the java.io.tmpdir system environment variable to a directory that is exclusively owned by the executing user will mitigate this vulnerability.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-200, CWE-377, CWE-668
References: https://github.com/pgjdbc/pgjdbc/commit/9008dc9aade6dbfe4efafcd6872ebc55f4699cf5; https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-562r-vg33-8x8h; https://lists.debian.org/debian-lts-announce/2022/12/msg00003.html
CVE: CVE-2022-44140
Published: 2022-11-23
Description: Jizhicms v2.3.3 was discovered to contain a SQL injection vulnerability via the /Member/memberedit.html component.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/Cherry-toto/jizhicms/issues/81; https://github.com/Cherry-toto/jizhicms/issues/81
CVE: CVE-2022-45866
Published: 2022-11-23
Description: qpress before PierreLvx/qpress 20220819 and before version 11.3, as used in Percona XtraBackup and other products, allows directory traversal via ../ in a .qp file.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://github.com/EvgeniyPatlan/qpress/commit/ddb312090ebd5794e81bc6fb1dfb4e79eda48761; https://github.com/PierreLvx/qpress/compare/20170415...20220819; https://github.com/PierreLvx/qpress/pull/6
CVE: CVE-2022-41932
Published: 2022-11-23
Description: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to make XWiki create many new schemas and fill them with tables just by using a crafted user identifier in the login form. This may lead to degraded database performance. The problem has been patched in XWiki 13.10.8, 14.6RC1 and 14.4.2. Users are advised to upgrade. There are no known workarounds for this issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-770
References: https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-4x5r-6v26-7j4v; https://jira.xwiki.org/browse/XWIKI-19886; https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-4x5r-6v26-7j4v
CVE: CVE-2022-41933
Published: 2022-11-23
Description: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. When the `reset a forgotten password` feature of XWiki was used, the password was then stored in plain text in database. This only concerns XWiki 13.1RC1 and newer versions. Note that it only concerns the reset password feature available from the "Forgot your password" link in the login view: the features allowing a user to change their password, or for an admin to change a user password are not impacted. This vulnerability is particularly dangerous in combination with other vulnerabilities allowing to perform data leak of personal data from users, such as GHSA-599v-w48h-rjrm. Note that this vulnerability only concerns the users of the main wiki: in case of farms, the users registered on subwiki are not impacted thanks to a bug we discovered when investigating this. The problem has been patched in version 14.6RC1, 14.4.3 and 13.10.8. The patch involves a migration of the impacted users as well as the history of the page, to ensure no password remains in plain text in the database. This migration also involves to inform the users about the possible disclosure of their passwords: by default, two emails are automatically sent to the impacted users. A first email to inform about the possibility that their password have been leaked, and a second email using the reset password feature to ask them to set a new password. It's also possible for administrators to set some properties for the migration: it's possible to decide if the user password should be reset (default) or if the passwords should be kept but only hashed. Note that in the first option, the users won't be able to login anymore until they set a new password if they were impacted. Note that in both options, mails will be sent to users to inform them and encourage them to change their passwords.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-312, CWE-522
References: https://github.com/xwiki/xwiki-platform/commit/443e8398b75a1295067d74afb[PII_REDACTED]d863a#diff-f8a8f8ba80dfc55f044e2e60b521ce379176430ca6921b0f87b79cf682531f79L322; https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-599v-w48h-rjrm; https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-q2hm-2h45-v5g3
CVE: CVE-2022-43196
Published: 2022-11-23
Description: dedecmdv6 v6.1.9 is vulnerable to Arbitrary file deletion via file_manage_control.php.
CVSS Score: 9.1 (CRITICAL)
References: https://gist.github.com/yinfei6/f6c8a9ac39afae45c3f2aa32a7f1b205; https://gist.github.com/yinfei6/f6c8a9ac39afae45c3f2aa32a7f1b205
CVE: CVE-2022-44117
Published: 2022-11-23
Description: Boa 0.94.14rc21 is vulnerable to SQL Injection via username. NOTE: the is disputed by multiple third parties because Boa does not ship with any support for SQL.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://gist.github.com/yinfei6/20bd1d3ebe0803c2d8756ace3e173676; https://gist.github.com/yinfei6/20bd1d3ebe0803c2d8756ace3e173676
CVE: CVE-2022-44118
Published: 2022-11-23
Description: dedecmdv6 v6.1.9 is vulnerable to Remote Code Execution (RCE) via file_manage_control.php.
CVSS Score: 9.8 (CRITICAL)
References: https://gist.github.com/yinfei6/56bb396f579cb67840ed1ecb77460a5b; https://gist.github.com/yinfei6/56bb396f579cb67840ed1ecb77460a5b
CVE: CVE-2022-44120
Published: 2022-11-23
Description: dedecmdv6 6.1.9 is vulnerable to SQL Injection. via sys_sql_query.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://gist.github.com/yinfei6/73295ac40b5b3fc0b55db58c17eecfda; https://gist.github.com/yinfei6/73295ac40b5b3fc0b55db58c17eecfda
CVE: CVE-2022-44789
Published: 2022-11-23
Description: A logical issue in O_getOwnPropertyDescriptor() in Artifex MuJS 1.0.0 through 1.3.x before 1.3.2 allows an attacker to achieve Remote Code Execution through memory corruption, via the loading of a crafted JavaScript file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://github.com/alalng/CVE-2022-44789/blob/main/PublicReferenceURL.txt; https://github.com/ccxvii/mujs/commit/edb50ad66f7601ca9a3544a0e9045e8a8c60561f; https://github.com/ccxvii/mujs/releases/tag/1.3.2
CVE: CVE-2022-45276
Published: 2022-11-23
Description: An issue in the /index/user/user_edit.html component of YJCMS v1.0.9 allows unauthenticated attackers to obtain the Administrator account password.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-425, CWE-425
References: https://github.com/Zoe0427/YJCMS; https://github.com/Zoe0427/YJCMS
CVE: CVE-2022-45278
Published: 2022-11-23
Description: Jizhicms v2.3.3 was discovered to contain a SQL injection vulnerability via the /index.php/admins/Fields/get_fields.html component.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/Cherry-toto/jizhicms/issues/83; https://github.com/Cherry-toto/jizhicms/issues/83
CVE: CVE-2022-45280
Published: 2022-11-23
Description: A cross-site scripting (XSS) vulnerability in the Url parameter in /login.php of EyouCMS v1.6.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/weng-xianhu/eyoucms/issues/32; https://github.com/weng-xianhu/eyoucms/issues/32
CVE: CVE-2022-45868
Published: 2022-11-23
Description: The web-based admin console in H2 Database Engine before 2.2.220 can be started via the CLI with the argument -webAdminPassword, which allows the user to specify the password in cleartext for the web admin console. Consequently, a local user (or an attacker that has obtained local access through some means) would be able to discover the password by listing processes and their arguments. NOTE: the vendor states "This is not a vulnerability of H2 Console ... Passwords should never be passed on the command line and every qualified DBA or system administrator is expected to know that." Nonetheless, the issue was fixed in 2.2.220.
CVSS Score: 8.4 (HIGH)
CWE: CWE-312
References: https://github.com/advisories/GHSA-22wj-vf5f-wrvj; https://github.com/h2database/h2database/blob/96832bf5a97cdc0adc1f2066ed61c54990d66ab5/h2/src/main/org/h2/server/web/WebServer.java#L346-L347; https://github.com/h2database/h2database/issues/3686
CVE: CVE-2022-45872
Published: 2022-11-23
Description: iTerm2 before 3.4.18 mishandles a DECRQSS response.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: https://iterm2.com/downloads.html; https://iterm2.com/downloads.html
CVE: CVE-2022-45873
Published: 2022-11-23
Description: systemd 250 and 251 allows local users to achieve a systemd-coredump deadlock by triggering a crash that has a long backtrace. This occurs in parse_elf_object in shared/elf-util.c. The exploitation methodology is to crash a binary calling the same function recursively, and put it in a deeply nested directory to make its backtrace large enough to cause the deadlock. This must be done 16 times when MaxConnections=16 is set for the systemd/units/systemd-coredump.socket file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-400, CWE-400
References: https://github.com/systemd/systemd/commit/076b807be472630692c5348c60d0c2b7b28ad437; https://github.com/systemd/systemd/pull/24853#issuecomment[PII_REDACTED]; https://github.com/systemd/systemd/pull/25055#issuecomment[PII_REDACTED]
CVE: CVE-2022-44748
Published: 2022-11-24
Description: A directory traversal vulnerability in the ZIP archive extraction routines of KNIME Server since 4.3.0 can result in arbitrary files being overwritten on the server's file system. This vulnerability is also known as 'Zip-Slip'.





An attacker can create a KNIME workflow that, when being uploaded, can overwrite arbitrary files that the operating system user running the KNIME Server process has write access to. The user must be authenticated and have permissions to upload files to KNIME Server.


This can impact data integrity (file contents are changed) or cause errors in other software (vital files being corrupted). It can even lead to remote code execution if executable files are being replaced and subsequently executed by the KNIME Server process user. In all cases the attacker has to know the location of files on the server's file system, though.

Note that users that have permissions to upload workflows usually also have permissions to run them on the KNIME Server and can therefore already execute arbitrary code in the context of the KNIME Executor's operating system user.

There is no workaround to prevent this vulnerability from being exploited. Updates to fixed versions 4.13.6, 4.14.3, or 4.15.3 are advised.



CVSS Score: 7.1 (HIGH)
CWE: CWE-22, CWE-22
References: https://www.knime.com/security/advisories; https://www.knime.com/security/advisories