deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-46662
Published: 2022-12-21
Description: Roxio Creator LJB starts another program with an unquoted file path. Since a registered Windows service path contains spaces and are unquoted, if a malicious executable is placed on a certain path, the executable may be executed with the privilege of the Windows service. The affected product and versions are as follows: Roxio Creator LJB version number 12.2 build number 106B62B, version number 12.2 build number 106B63A, version number 12.2 build number 106B69A, version number 12.2 build number 106B71A, and version number 12.2 build number 106B74A)
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-428, CWE-428
References: https://jvn.jp/en/jp/JVN13075438/index.html; https://kb.corel.com/jp/129393; https://jvn.jp/en/jp/JVN13075438/index.html
CVE: CVE-2022-38060
Published: 2022-12-21
Description: A privilege escalation vulnerability exists in the sudo functionality of OpenStack Kolla git master 05194e7618. A misconfiguration in /etc/sudoers within a container can lead to increased privileges.
CVSS Score: 8.8 (HIGH)
CWE: CWE-269, CWE-426
References: https://talosintelligence.com/vulnerability_reports/TALOS-2022-1589; https://talosintelligence.com/vulnerability_reports/TALOS-2022-1589
CVE: CVE-2022-38065
Published: 2022-12-21
Description: A privilege escalation vulnerability exists in the oslo.privsep functionality of OpenStack git master 05194e7618 and prior. Overly permissive functionality within tools leveraging this library within a container can lead increased privileges.
CVSS Score: 8.8 (HIGH)
CWE: CWE-269, CWE-269
References: https://talosintelligence.com/vulnerability_reports/TALOS-2022-1599; https://talosintelligence.com/vulnerability_reports/TALOS-2022-1599
CVE: CVE-2022-40145
Published: 2022-12-21
Description: This vulnerable is about a potential code injection when an attacker has control of the target LDAP server using in the JDBC JNDI URL.

The function jaas.modules.src.main.java.porg.apache.karaf.jass.modules.jdbc.JDBCUtils#doCreateDatasource
use InitialContext.lookup(jndiName) without filtering.
An user can modify `options.put(JDBCUtils.DATASOURCE, "osgi:" + DataSource.class.getName());` to `options.put(JDBCUtils.DATASOURCE,"jndi:rmi://x.x.x.x:xxxx/Command");` in JdbcLoginModuleTest#setup.

This is vulnerable to a remote code execution (RCE) attack when a
configuration uses a JNDI LDAP data source URI when an attacker has
control of the target LDAP server.This issue affects all versions of Apache Karaf up to 4.4.1 and 4.3.7.

We encourage the users to upgrade to Apache Karaf at least 4.4.2 or 4.3.8
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20, CWE-74
References: https://karaf.apache.org/security/cve-2022-40145.txt; https://karaf.apache.org/security/cve-2022-40145.txt
CVE: CVE-2022-38655
Published: 2022-12-21
Description: BigFix WebUI non-master operators are missing controls that prevent them from being able to modify the relevance of fixlets or to deploy fixlets from the BES Support external site. 

CVSS Score: 6.4 (MEDIUM)
CWE: CWE-284
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0102140; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0102140
CVE: CVE-2022-42454
Published: 2022-12-21
Description: Insights for Vulnerability Remediation (IVR) is vulnerable to man-in-the-middle attacks that may lead to information disclosure.  This requires privileged network access.

CVSS Score: 6.4 (MEDIUM)
CWE: CWE-319
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0102168; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0102168
CVE: CVE-2022-44756
Published: 2022-12-21
Description: Insights for Vulnerability Remediation (IVR) is vulnerable to improper input validation.  This may lead to information disclosure.  This requires privileged access. 

CVSS Score: 6.4 (MEDIUM)
CWE: CWE-20, CWE-20
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0102168; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0102168
CVE: CVE-2022-47581
Published: 2022-12-21
Description: Isode M-Vault 16.0v0 through 17.x before 17.0v24 can crash upon an LDAP v1 bind request.
CVSS Score: 7.5 (HIGH)
References: https://www.isode.com/support/security/advisory/m-vault-denial-of-service-21-12-2022.html; https://www.isode.com/support/security/advisory/m-vault-denial-of-service-21-12-2022.html
CVE: CVE-2022-4287
Published: 2022-12-21
Description: Authentication bypass in local application lock feature in Devolutions Remote Desktop Manager  2022.3.26 and earlier on Windows allows malicious user to access the application.


CVSS Score: 8.8 (HIGH)
References: https://devolutions.net/security/advisories/DEVO-2022-0011; https://devolutions.net/security/advisories/DEVO-2022-0011
CVE: CVE-2022-40841
Published: 2022-12-21
Description: A cross-site scripting (XSS) vulnerability in NdkAdvancedCustomizationFields v3.5.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payloads injected into the "htmlNodes" parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://ndkadvancedcustomizationfields.com; https://github.com/daaaalllii/cve-s/blob/main/CVE-2022-40841/poc.txt; http://ndkadvancedcustomizationfields.com
CVE: CVE-2022-4630
Published: 2022-12-21
Description: Sensitive Cookie Without 'HttpOnly' Flag in GitHub repository lirantal/daloradius prior to master.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-1004, CWE-732
References: https://github.com/lirantal/daloradius/commit/6878619dc661b[PII_REDACTED]a1aeeb383ddc0166b; https://huntr.dev/bounties/401661ee-40e6-4ee3-a925-3716b96ece5c; https://github.com/lirantal/daloradius/commit/6878619dc661b[PII_REDACTED]a1aeeb383ddc0166b
CVE: CVE-2020-36620
Published: 2022-12-21
Description: A vulnerability was found in Brondahl EnumStringValues up to 4.0.0. It has been declared as problematic. This vulnerability affects the function GetStringValuesWithPreferences_Uncache of the file EnumStringValues/EnumExtensions.cs. The manipulation leads to resource consumption. Upgrading to version 4.0.1 is able to address this issue. The name of the patch is c0fc7806beb24883cc2f9543ebc50c[PII_REDACTED]. It is recommended to upgrade the affected component. VDB-216466 is the identifier assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-400
References: https://github.com/Brondahl/EnumStringValues/commit/c0fc7806beb24883cc2f9543ebc50c[PII_REDACTED]; https://github.com/Brondahl/EnumStringValues/releases/tag/4.0.1; https://vuldb.com/?id.216466
CVE: CVE-2020-36621
Published: 2022-12-21
Description: A vulnerability, which was classified as problematic, has been found in chedabob whatismyudid. Affected by this issue is the function exports.enrollment of the file routes/mobileconfig.js. The manipulation leads to cross site scripting. The attack may be launched remotely. The name of the patch is bb33d4325fba80e7ea68b79121dba025caf6f45f. It is recommended to apply a patch to fix this issue. VDB-216470 is the identifier assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-707, CWE-79
References: https://github.com/chedabob/whatismyudid/commit/bb33d4325fba80e7ea68b79121dba025caf6f45f; https://vuldb.com/?id.216470; https://github.com/chedabob/whatismyudid/commit/bb33d4325fba80e7ea68b79121dba025caf6f45f
CVE: CVE-2020-36622
Published: 2022-12-21
Description: A vulnerability was found in sah-comp bienlein and classified as problematic. This issue affects some unknown processing. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. The name of the patch is d7836a4f2b241e4745ede194f0f6fb47199cab6b. It is recommended to apply a patch to fix this issue. The identifier VDB-216473 was assigned to this vulnerability.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863, CWE-352
References: https://github.com/sah-comp/bienlein/commit/d7836a4f2b241e4745ede194f0f6fb47199cab6b; https://vuldb.com/?id.216473; https://github.com/sah-comp/bienlein/commit/d7836a4f2b241e4745ede194f0f6fb47199cab6b
CVE: CVE-2020-36623
Published: 2022-12-21
Description: A vulnerability was found in Pengu. It has been declared as problematic. Affected by this vulnerability is the function runApp of the file src/index.js. The manipulation leads to cross-site request forgery. The attack can be launched remotely. The name of the patch is aea66f12b8cdfc3c8c50ad6a9c89d8307e9d0a91. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-216475.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863, CWE-352
References: https://github.com/jtojnar/pengu/commit/aea66f12b8cdfc3c8c50ad6a9c89d8307e9d0a91; https://vuldb.com/?id.216475; https://github.com/jtojnar/pengu/commit/aea66f12b8cdfc3c8c50ad6a9c89d8307e9d0a91
CVE: CVE-2021-4263
Published: 2022-12-21
Description: A vulnerability, which was classified as problematic, has been found in leanote 2.6.1. This issue affects the function define of the file public/js/plugins/history.js. The manipulation of the argument content leads to cross site scripting. The attack may be initiated remotely. The identifier of the patch is 0f9733c[PII_REDACTED]50696dcc6d2b1482b7a0a19. It is recommended to apply a patch to fix this issue. The identifier VDB-216461 was assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-79
References: https://github.com/leanote/leanote/commit/0f9733c[PII_REDACTED]50696dcc6d2b1482b7a0a19; https://vuldb.com/?ctiid.216461; https://vuldb.com/?id.216461
CVE: CVE-2021-4264
Published: 2022-12-21
Description: A vulnerability was found in LinkedIn dustjs up to 2.x and classified as problematic. Affected by this issue is some unknown functionality. The manipulation leads to improperly controlled modification of object prototype attributes ('prototype pollution'). The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.0.0 is able to address this issue. The name of the patch is ddb[PII_REDACTED]d38c9d80189e9de60519ac307c3. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-216464.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-1321
References: https://github.com/linkedin/dustjs/commit/ddb[PII_REDACTED]d38c9d80189e9de60519ac307c3; https://github.com/linkedin/dustjs/issues/804; https://github.com/linkedin/dustjs/pull/805
CVE: CVE-2021-4265
Published: 2022-12-21
Description: A vulnerability was found in siwapp-ror. It has been rated as problematic. This issue affects some unknown processing. The manipulation leads to cross site scripting. The attack may be initiated remotely. The name of the patch is 924d16008cfcc09356c87db01848e45290cb58ca. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-216467.
CVSS Score: 3.5 (LOW)
CWE: CWE-707, CWE-79
References: https://github.com/siwapp/siwapp-ror/commit/924d16008cfcc09356c87db01848e45290cb58ca; https://github.com/siwapp/siwapp-ror/pull/365; https://vuldb.com/?id.216467
CVE: CVE-2021-4266
Published: 2022-12-21
Description: A vulnerability classified as problematic has been found in Webdetails cpf up to 9.5.0.0-80. Affected is an unknown function of the file core/src/main/java/pt/webdetails/cpf/packager/DependenciesPackage.java. The manipulation of the argument baseUrl leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 9.5.0.0-81 is able to address this issue. The name of the patch is 3bff900d228e8cae3af256b447c5d15bdb03c174. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-216468.
CVSS Score: 3.5 (LOW)
CWE: CWE-707, CWE-79
References: https://github.com/siwapp/siwapp-ror/pull/365; https://github.com/webdetails/cpf/commit/3bff900d228e8cae3af256b447c5d15bdb03c174; https://github.com/webdetails/cpf/releases/tag/9.5.0.0-81
CVE: CVE-2021-4267
Published: 2022-12-21
Description: A vulnerability classified as problematic was found in tad_discuss. Affected by this vulnerability is an unknown functionality. The manipulation of the argument DiscussTitle leads to cross site scripting. The attack can be launched remotely. The name of the patch is af94d034ff8db642d05fd8788179eab05f433958. It is recommended to apply a patch to fix this issue. The identifier VDB-216469 was assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-707, CWE-79
References: https://github.com/tad0616/tad_discuss/commit/af94d034ff8db642d05fd8788179eab05f433958; https://github.com/tad0616/tad_discuss/pull/19; https://vuldb.com/?id.216469
CVE: CVE-2021-4268
Published: 2022-12-21
Description: A vulnerability, which was classified as problematic, was found in phpRedisAdmin up to 1.17.3. This affects an unknown part. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. Upgrading to version 1.18.0 is able to address this issue. The name of the patch is b9039adbb264c81333328faa9575ecf8e0d2be94. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-216471.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863, CWE-352
References: https://github.com/erikdubbelboer/phpRedisAdmin/commit/b9039adbb264c81333328faa9575ecf8e0d2be94; https://github.com/erikdubbelboer/phpRedisAdmin/releases/tag/v1.18.0; https://vuldb.com/?id.216471
CVE: CVE-2021-4269
Published: 2022-12-21
Description: A vulnerability has been found in SimpleRisk and classified as problematic. This vulnerability affects the function checkAndSetValidation of the file simplerisk/js/common.js. The manipulation of the argument title leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 20220306-001 is able to address this issue. The name of the patch is 591405b4ed160fbefc1dca1e55c5745079a7bb48. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-216472.
CVSS Score: 3.5 (LOW)
CWE: CWE-707, CWE-79
References: https://github.com/simplerisk/code/commit/591405b4ed160fbefc1dca1e55c5745079a7bb48; https://github.com/simplerisk/code/releases/tag/20220306-001; https://vuldb.com/?id.216472
CVE: CVE-2021-4270
Published: 2022-12-21
Description: A vulnerability was found in Imprint CMS. It has been classified as problematic. Affected is the function SearchForm of the file ImprintCMS/Models/ViewHelpers.cs. The manipulation of the argument query leads to cross site scripting. It is possible to launch the attack remotely. The name of the patch is 6140b140ccd02b5e4e7d6ba013ac[PII_REDACTED]f4. It is recommended to apply a patch to fix this issue. VDB-216474 is the identifier assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-707, CWE-79
References: https://github.com/peders/Imprint-CMS/commit/6140b140ccd02b5e4e7d6ba013ac[PII_REDACTED]f4; https://vuldb.com/?id.216474; https://github.com/peders/Imprint-CMS/commit/6140b140ccd02b5e4e7d6ba013ac[PII_REDACTED]f4
CVE: CVE-2021-4271
Published: 2022-12-21
Description: A vulnerability was found in panicsteve w2wiki. It has been rated as problematic. Affected by this issue is the function toHTML of the file index.php of the component Markdown Handler. The manipulation leads to cross site scripting. The attack may be launched remotely. The name of the patch is 8f1d0470b4ddb1c7699e3308e765c11ed29542b6. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-216476.
CVSS Score: 3.5 (LOW)
CWE: CWE-707, CWE-79
References: https://github.com/panicsteve/w2wiki/commit/8f1d0470b4ddb1c7699e3308e765c11ed29542b6; https://vuldb.com/?id.216476; https://github.com/panicsteve/w2wiki/commit/8f1d0470b4ddb1c7699e3308e765c11ed29542b6
CVE: CVE-2021-4272
Published: 2022-12-21
Description: A vulnerability classified as problematic has been found in studygolang. This affects an unknown part of the file static/js/topics.js. The manipulation of the argument contentHtml leads to cross site scripting. It is possible to initiate the attack remotely. The name of the patch is 0fb30f9640bd5fa0cae58922eac6c00bb1a94391. It is recommended to apply a patch to fix this issue. The identifier VDB-216477 was assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-707, CWE-79
References: https://github.com/studygolang/studygolang/commit/0fb30f9640bd5fa0cae58922eac6c00bb1a94391; https://vuldb.com/?id.216477; https://github.com/studygolang/studygolang/commit/0fb30f9640bd5fa0cae58922eac6c00bb1a94391
CVE: CVE-2021-4273
Published: 2022-12-21
Description: A vulnerability classified as problematic was found in studygolang. This vulnerability affects the function Search of the file http/controller/search.go. The manipulation of the argument q leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 97ba556d42fa89dfaa7737e9cd3a8ddaf670bb23. It is recommended to apply a patch to fix this issue. VDB-216478 is the identifier assigned to this vulnerability.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-707, CWE-79
References: https://github.com/studygolang/studygolang/commit/97ba556d42fa89dfaa7737e9cd3a8ddaf670bb23; https://github.com/studygolang/studygolang/pull/158; https://vuldb.com/?id.216478
CVE: CVE-2021-4274
Published: 2022-12-21
Description: A vulnerability, which was classified as problematic, has been found in sileht bird-lg. This issue affects some unknown processing of the file templates/layout.html. The manipulation of the argument request_args leads to cross site scripting. The attack may be initiated remotely. The name of the patch is ef6b32c527478fefe7a4436e10b96ee28ed5b308. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-216479.
CVSS Score: 3.5 (LOW)
CWE: CWE-707, CWE-79
References: https://github.com/sileht/bird-lg/commit/ef6b32c527478fefe7a4436e10b96ee28ed5b308; https://github.com/sileht/bird-lg/pull/82; https://vuldb.com/?id.216479
CVE: CVE-2022-36221
Published: 2022-12-21
Description: Nokia Fastmile 3tg00118abad52 is affected by an authenticated path traversal vulnerability which allows attackers to read any named pipe file on the system.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://eddiez.me/hacking-the-nokia-fastmile-pt2/#pipe-path-traversal; https://eddiez.me/hacking-the-nokia-fastmile-pt2/#pipe-path-traversal
CVE: CVE-2022-36222
Published: 2022-12-21
Description: Nokia Fastmile 3tg00118abad52 devices shipped by Optus are shipped with a default hardcoded admin account of admin:Nq+L5st7o This account can be used locally to access the web admin interface.
CVSS Score: 8.4 (HIGH)
CWE: CWE-798, CWE-798
References: https://eddiez.me/hacking-the-nokia-fastmile-pt2/#identical-super-admin-passwords; https://eddiez.me/hacking-the-nokia-fastmile-pt2/#identical-super-admin-passwords
CVE: CVE-2022-46095
Published: 2022-12-21
Description: Sourcecodester Covid-19 Directory on Vaccination System 1.0 was discovered to contain a Cross-Site Scripting (XSS) vulnerability via verification.php because the program does not verify the txtvaccinationID parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/Frank-Z7/z-vulnerabilitys/blob/main/covid-19-vaccination-poc/covid-19-vaccination.md; https://www.sourcecodester.com/php/15244/design-and-implementation-covid-19-directory-vacination.html; https://github.com/Frank-Z7/z-vulnerabilitys/blob/main/covid-19-vaccination-poc/covid-19-vaccination.md
CVE: CVE-2022-46096
Published: 2022-12-21
Description: A Cross site scripting (XSS) vulnerability in Sourcecodester Online Covid-19 Directory on Vaccination System v1.0 allows attackers to execute arbitrary code via the txtfullname parameter or txtphone parameter to register.php without logging in.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/Frank-Z7/z-vulnerabilitys/blob/main/covid-19-vaccination-poc2/covid-19-vaccination2.md; https://github.com/Frank-Z7/z-vulnerabilitys/blob/main/covid-19-vaccination-poc2/covid-19-vaccination2.md
CVE: CVE-2022-4631
Published: 2022-12-21
Description: A vulnerability, which was classified as problematic, was found in WP-Ban. Affected is an unknown function of the file ban-options.php. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The name of the patch is 22b925449c84faa9b7496abe4f8f5661cb5eb3bf. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-216480.
CVSS Score: 3.5 (LOW)
CWE: CWE-707, CWE-79
References: https://github.com/lesterchan/wp-ban/commit/22b925449c84faa9b7496abe4f8f5661cb5eb3bf; https://vuldb.com/?id.216480; https://github.com/lesterchan/wp-ban/commit/22b925449c84faa9b7496abe4f8f5661cb5eb3bf
CVE: CVE-2022-4632
Published: 2022-12-21
Description: A vulnerability has been found in Auto Upload Images up to 3.3.0 and classified as problematic. Affected by this vulnerability is an unknown functionality. The manipulation leads to cross site scripting. The attack can be launched remotely. Upgrading to version 3.3.1 is able to address this issue. The name of the patch is 895770ee93887ec78429c78ffdfb865bee6f9436. It is recommended to upgrade the affected component. The identifier VDB-216481 was assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-79
References: https://github.com/airani/wp-auto-upload/commit/895770ee93887ec78429c78ffdfb865bee6f9436; https://github.com/airani/wp-auto-upload/releases/tag/v3.3.1; https://vuldb.com/?id.216481
CVE: CVE-2022-4633
Published: 2022-12-21
Description: A vulnerability was found in Auto Upload Images up to 3.3.0 and classified as problematic. Affected by this issue is some unknown functionality of the file src/setting-page.php of the component Settings Handler. The manipulation leads to cross-site request forgery. The attack may be launched remotely. Upgrading to version 3.3.1 is able to address this issue. The name of the patch is 895770ee93887ec78429c78ffdfb865bee6f9436. It is recommended to upgrade the affected component. VDB-216482 is the identifier assigned to this vulnerability.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://github.com/airani/wp-auto-upload/commit/895770ee93887ec78429c78ffdfb865bee6f9436; https://github.com/airani/wp-auto-upload/releases/tag/v3.3.1; https://vuldb.com/?id.216482
CVE: CVE-2022-23551
Published: 2022-12-21
Description: aad-pod-identity assigns Azure Active Directory identities to Kubernetes applications and has now been deprecated as of 24 October 2022. The NMI component in AAD Pod Identity intercepts and validates token requests based on regex. In this case, a token request made with backslash in the request (example: `/metadata/identity\oauth2\token/`) would bypass the NMI validation and be sent to IMDS allowing a pod in the cluster to access identities that it shouldn't have access to. This issue has been fixed and has been included in AAD Pod Identity release version 1.8.13. If using the AKS pod-managed identities add-on, no action is required. The clusters should now be running the version 1.8.13 release.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-863, CWE-1259
References: https://github.com/Azure/aad-pod-identity/commit/7e01970391bde6c360d077066ca17d059204cb5d; https://github.com/Azure/aad-pod-identity/releases/tag/v1.8.13; https://github.com/Azure/aad-pod-identity/security/advisories/GHSA-p82q-rxpm-hjpc
CVE: CVE-2022-23529
Published: 2022-12-21
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The issue is not a vulnerability. Notes: none.
CVE: CVE-2022-46334
Published: 2022-12-21
Description: Proofpoint Enterprise Protection (PPS/PoD) contains a vulnerability which allows the pps user to escalate to root privileges due to unnecessary permissions. This affects all versions 8.19.0 and below.


CVSS Score: 7.8 (HIGH)
CWE: CWE-269, CWE-269
References: https://www.proofpoint.com/security/security-advisories/pfpt-sa-2022-0004; https://www.proofpoint.com/security/security-advisories/pfpt-sa-2022-0004