rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-45935 Apache James server: Temporary File Information Disclosure
Usage of temporary files with insecure permissions by the Apache James server allows an attacker with local access to access private user data in transit. 

Vulnerable components includes the SMTP stack and IMAP APPEND command.

This issue affects Apache James server version 3.7.2 and prior versions.
Problem types: cwe_id: CWE-668
description: CWE-668 Exposure of Resource to Wrong Sphere
Affected products: vendor: Apache Software Foundation
product: Apache James server
default_status: unaffected
Credits: lang: en
value: Benoit Tellier
Published: 2023-01-06T09:33:30.150Z
CVE-2022-45936 
A vulnerability has been identified in Mendix Email Connector (All versions < V2.0.0). Affected versions of the module improperly handle access control for some module entities. This could allow authenticated remote attackers to read and manipulate sensitive information.
Problem types: cwe_id: CWE-284
description: CWE-284: Improper Access Control
Affected products: vendor: Siemens
product: Mendix Email Connector
Published: 2022-12-13T00:00:00.000Z
CVE-2022-45937 
A vulnerability has been identified in APOGEE PXC Compact (BACnet) (All versions < V3.5.5), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.20), APOGEE PXC Modular (BACnet) (All versions < V3.5.5), APOGEE PXC Modular (P2 Ethernet) (All versions < V2.8.20), TALON TC Compact (BACnet) (All versions < V3.5.5), TALON TC Modular (BACnet) (All versions < V3.5.5). A low privilege authenticated attacker with network access to the integrated web server could download sensitive information from the device containing user account credentials.
Problem types: cwe_id: CWE-284
description: CWE-284: Improper Access Control
Affected products: vendor: Siemens
product: APOGEE PXC Compact (BACnet)
default_status: unknown
vendor: Siemens
product: APOGEE PXC Compact (P2 Ethernet)
default_status: unknown
vendor: Siemens
product: APOGEE PXC Modular (BACnet)
default_status: unknown
vendor: Siemens
product: APOGEE PXC Modular (P2 Ethernet)
default_status: unknown
vendor: Siemens
product: TALON TC Compact (BACnet)
default_status: unknown
vendor: Siemens
product: TALON TC Modular (BACnet)
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
baseScore: 8.8
baseSeverity: HIGH
Published: 2022-12-13T00:00:00.000Z
CVE-2022-45938 
An issue was discovered in Comcast Defined Technologies microeisbss through 2021. An attacker can inject a stored XSS payload in the Device ID field under Inventory Management to achieve Remote Code Execution and privilege escalation..
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-06-02T00:00:00.000Z
CVE-2022-45939 
GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a source-code file, because lib-src/etags.c uses the system C library function in its implementation of the ctags program. For example, a victim may use the "ctags *" command (suggested in the ctags documentation) in a situation where the current working directory has contents that depend on untrusted input.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-28T00:00:00.000Z
CVE-2022-45942 
A Remote Code Execution (RCE) vulnerability was found in includes/baijiacms/common.inc.php in baijiacms v4.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-20T00:00:00.000Z
CVE-2022-45956 
Boa Web Server versions 0.94.13 through 0.94.14 fail to validate the correct security constraint on the HEAD HTTP method allowing everyone to bypass the Basic Authorization mechanism.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-12T00:00:00.000Z
CVE-2022-45957 
ZTE ZXHN-H108NS router with firmware version H108NSV1.0.7u_ZRD_GR2_A68 is vulnerable to remote stack buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-12T00:00:00.000Z
CVE-2022-45962 
Open Solutions for Education, Inc openSIS Community Edition v8.0 and earlier is vulnerable to SQL Injection via CalendarModal.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-13T00:00:00.000Z
CVE-2022-45963 
h3c firewall <= 3.10 ESS6703 has a privilege bypass vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-27T00:00:00.000Z
CVE-2022-45966 
here is an arbitrary file upload vulnerability in the file management function module of Classcms3.5.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-22T00:00:00.000Z
CVE-2022-45968 
Alist v3.4.0 is vulnerable to File Upload. A user with only file upload permission can upload any file to any folder (even a password protected one).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-12T00:00:00.000Z
CVE-2022-45969 
Alist v3.4.0 is vulnerable to Directory Traversal,
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-15T00:00:00.000Z
CVE-2022-45970 
Alist v3.5.1 is vulnerable to Cross Site Scripting (XSS) via the bulletin board.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-12T00:00:00.000Z
CVE-2022-45977 
Tenda AX12 V22.03.01.21_CN was found to have a command injection vulnerability via /goform/setMacFilterCfg function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-12T00:00:00.000Z
CVE-2022-45979 
Tenda AX12 v22.03.01.21_CN was discovered to contain a stack overflow via the ssid parameter at /goform/fast_setting_wifi_set .
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-12T00:00:00.000Z
CVE-2022-45980 
Tenda AX12 V22.03.01.21_CN was discovered to contain a Cross-Site Request Forgery (CSRF) via /goform/SysToolRestoreSet .
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-12T00:00:00.000Z
CVE-2022-45982 
thinkphp 6.0.0~6.0.13 and 6.1.0~6.1.1 contains a deserialization vulnerability. This vulnerability allows attackers to execute arbitrary code via a crafted payload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-08T00:00:00.000Z
CVE-2022-45988 
starsoftcomm CooCare 5.304 allows local attackers to escalate privileges and execute arbitrary commands via a crafted file upload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-03-03T00:00:00.000Z
CVE-2022-45990 
A cross-site scripting (XSS) vulnerability in the component /signup_script.php of Ecommerce-Website v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the eMail parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-05T00:00:00.000Z
CVE-2022-45995 
There is an unauthorized buffer overflow vulnerability in Tenda AX12 v22.03.01.21 _ cn. This vulnerability can cause the web service not to restart or even execute arbitrary code. It is a different vulnerability from CVE-2022-2414.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-01-05T00:00:00.000Z
CVE-2022-45996 
Tenda W20E V16.01.0.6(3392) is vulnerable to Command injection via cmd_get_ping_output.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-12T00:00:00.000Z
CVE-2022-45997 
Tenda W20E V16.01.0.6(3392) is vulnerable to Buffer Overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-12T00:00:00.000Z
CVE-2022-46020 
WBCE CMS v1.5.4 can implement getshell by modifying the upload file type.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-20T00:00:00.000Z
CVE-2022-46021 
X-Man 1.0 has a SQL injection vulnerability, which can cause data leakage.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-03-31T00:00:00.000Z
CVE-2022-46025 
Totolink N200RE_V5 V9.3.5u.6255_B20211224 is vulnerable to Incorrect Access Control. The device allows remote attackers to obtain Wi-Fi system information, such as Wi-Fi SSID and Wi-Fi password, without logging into the management page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-01-10T00:00:00.000Z
CVE-2022-46047 
AeroCMS v0.0.1 is vulnerable to SQL Injection via the delete parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-13T00:00:00.000Z
CVE-2022-46051 
The approve parameter from the AeroCMS-v0.0.1 CMS system is vulnerable to SQL injection attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-13T00:00:00.000Z
CVE-2022-46058 
AeroCMS v0.0.1 was discovered to contain a cross-site scripting (XSS) vulnerability via add_post.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Comments text field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-13T00:00:00.000Z
CVE-2022-46059 
AeroCMS v0.0.1 is vulnerable to Cross Site Request Forgery (CSRF).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-13T00:00:00.000Z
CVE-2022-46061 
AeroCMS v0.0.1 is vulnerable to ClickJacking.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-13T00:00:00.000Z
CVE-2022-46062 
Gym Management System v0.0.1 is vulnerable to Cross Site Request Forgery (CSRF).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-13T00:00:00.000Z
CVE-2022-46070 
GV-ASManager V6.0.1.0 contains a Local File Inclusion vulnerability in GeoWebServer via Path.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-11T00:00:00.000Z
CVE-2022-46071 
There is SQL Injection vulnerability at Helmet Store Showroom v1.0 Login Page. This vulnerability can be exploited to bypass admin access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-14T00:00:00.000Z
CVE-2022-46072 
Helmet Store Showroom v1.0 vulnerable to unauthenticated SQL Injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-14T00:00:00.000Z
CVE-2022-46073 
Helmet Store Showroom 1.0 is vulnerable to Cross Site Scripting (XSS).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-14T00:00:00.000Z
CVE-2022-46074 
Helmet Store Showroom 1.0 is vulnerable to Cross Site Request Forgery (CSRF). An unauthenticated user can add an admin account due to missing CSRF protection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-14T00:00:00.000Z
CVE-2022-46076 
D-Link DIR-869 DIR869Ax_FW102B15 is vulnerable to Authentication Bypass via phpcgi.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-20T00:00:00.000Z
CVE-2022-46080 
Nexxt Nebula 1200-AC 15.03.06.60 allows authentication bypass and command execution by using the HTTPD service to enable TELNET.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-07-06T00:00:00.000Z
CVE-2022-46081 
In Garmin Connect 4.61, terminating a LiveTrack session wouldn't prevent the LiveTrack API from continued exposure of private personal information. NOTE: this is disputed by the vendor because the LiveTrack API service is not a customer-controlled product.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-01-04T00:00:00.000Z
CVE-2022-46087 
CloudSchool v3.0.1 is vulnerable to Cross Site Scripting (XSS). A normal user can steal session cookies of the admin users through notification received by the admin user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-01-30T00:00:00.000Z
CVE-2022-46088 
Online Flight Booking Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the feedback form.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-05T00:00:00.000Z
CVE-2022-46089 
Cross Site Scripting (XSS) vulnerability in the add-airline form of Online Flight Booking Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the airline parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-07T00:00:00.000Z
CVE-2022-46091 
Cross Site Scripting (XSS) vulnerability in the feedback form of Online Flight Booking Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the airline parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-07T00:00:00.000Z
CVE-2022-46093 
Hospital Management System v1.0 is vulnerable to SQL Injection. Attackers can gain administrator privileges without the need for a password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-01-13T00:00:00.000Z
CVE-2022-46095 
Sourcecodester Covid-19 Directory on Vaccination System 1.0 was discovered to contain a Cross-Site Scripting (XSS) vulnerability via verification.php because the program does not verify the txtvaccinationID parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-21T00:00:00.000Z
CVE-2022-46096 
A Cross site scripting (XSS) vulnerability in Sourcecodester Online Covid-19 Directory on Vaccination System v1.0 allows attackers to execute arbitrary code via the txtfullname parameter or txtphone parameter to register.php without logging in.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-21T00:00:00.000Z
CVE-2022-46101 
AyaCMS v3.1.2 was found to have a code flaw in the ust_sql.inc.php file, which allows attackers to cause command execution by inserting malicious code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-22T00:00:00.000Z
CVE-2022-46102 
AyaCMS 3.1.2 is vulnerable to Arbitrary file upload via /aya/module/admin/fst_down.inc.php
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-22T00:00:00.000Z
CVE-2022-46109 
Tenda AC15 V15.03.06.23 is vulnerable to Buffer Overflow via function formSetClientState.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-16T00:00:00.000Z
CVE-2022-46117 
Helmet Store Showroom Site v1.0 is vulnerable to SQL Injection via /hss/?page=view_product&id=.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-14T00:00:00.000Z
CVE-2022-46118 
Helmet Store Showroom Site v1.0 is vulnerable to SQL Injection via /hss/?page=product_per_brand&bid=.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-14T00:00:00.000Z
CVE-2022-46119 
Helmet Store Showroom Site v1.0 is vulnerable to SQL Injection via /hss/?page=categories&c=.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-14T00:00:00.000Z
CVE-2022-46120 
Helmet Store Showroom Site v1.0 is vulnerable to SQL Injection via /hss/admin/?page=products/view_product&id=.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-14T00:00:00.000Z
CVE-2022-46121 
Helmet Store Showroom Site v1.0 is vulnerable to SQL Injection via /hss/admin/?page=products/manage_product&id=.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-14T00:00:00.000Z
CVE-2022-46122 
Helmet Store Showroom Site v1.0 is vulnerable to SQL Injection via /hss/admin/categories/view_category.php?id=.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-14T00:00:00.000Z
CVE-2022-46123 
Helmet Store Showroom Site v1.0 is vulnerable to SQL Injection via /hss/admin/categories/manage_category.php?id=.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-14T00:00:00.000Z
CVE-2022-46124 
Helmet Store Showroom Site v1.0 is vulnerable to SQL Injection via /hss/admin/?page=user/manage_user&id=.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-14T00:00:00.000Z
CVE-2022-46125 
Helmet Store Showroom Site v1.0 is vulnerable to SQL Injection via /hss/admin/?page=client/manage_client&id=.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-14T00:00:00.000Z
CVE-2022-46126 
Helmet Store Showroom Site v1.0 is vulnerable to SQL Injection via /hss/admin/brands/manage_brand.php?id=.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-14T00:00:00.000Z
CVE-2022-46127 
Helmet Store Showroom Site v1.0 is vulnerable to SQL Injection via /hss/classes/Master.php?f=delete_product.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-14T00:00:00.000Z
CVE-2022-46128 
phpgurukul Doctor Appointment Management System V 1.0.0 is vulnerable to Cross Site Scripting (XSS) via searchdata=.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-01-25T00:00:00.000Z
CVE-2022-46135 
In AeroCms v0.0.1, there is an arbitrary file upload vulnerability at /admin/posts.php?source=edit_post , through which we can upload webshell and control the web server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-16T00:00:00.000Z
CVE-2022-46137 
AeroCMS v0.0.1 is vulnerable to Directory Traversal. The impact is: obtain sensitive information (remote). The component is: AeroCMS v0.0.1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-16T00:00:00.000Z
CVE-2022-46139 
TP-Link TL-WR940N V4 3.16.9 and earlier allows authenticated attackers to cause a Denial of Service (DoS) via uploading a crafted firmware image during the firmware update process.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-20T00:00:00.000Z
CVE-2022-46141 
A vulnerability has been identified in SIMATIC STEP 7 (TIA Portal) (All versions < V19). An information disclosure vulnerability could allow a local attacker to gain access to the access level password of the SIMATIC S7-1200 and S7-1500 CPUs, when entered by a legitimate user in the hardware configuration of the affected application.
Problem types: cwe_id: CWE-316
description: CWE-316: Cleartext Storage of Sensitive Information in Memory
Affected products: vendor: Siemens
product: SIMATIC STEP 7 (TIA Portal)
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C
baseScore: 4.2
baseSeverity: MEDIUM
Published: 2023-12-12T11:25:26.583Z
CVE-2022-46145 authentik vulnerable to unauthorized user creation and potential account takeover
authentik is an open-source identity provider. Versions prior to 2022.11.2 and 2022.10.2 are vulnerable to unauthorized user creation and potential account takeover. With the default flows, unauthenticated users can create new accounts in authentik. If a flow exists that allows for email-verified password recovery, this can be used to overwrite the email address of admin accounts and take over their accounts. authentik 2022.11.2 and 2022.10.2 fix this issue. As a workaround, a policy can be created and bound to the `default-user-settings-flow flow` with the contents `return request.user.is_authenticated`.
Problem types: cwe_id: CWE-287
description: CWE-287: Improper Authentication
Affected products: vendor: goauthentik
product: authentik
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2022-12-02T17:12:42.046Z
CVE-2022-46146 Prometheus Exporter Toolkit vulnerable to basic authentication bypass
Prometheus Exporter Toolkit is a utility package to build exporters. Prior to versions 0.7.2 and 0.8.2, if someone has access to a Prometheus web.yml file and users' bcrypted passwords, they can bypass security by poisoning the built-in authentication cache. Versions 0.7.2 and 0.8.2 contain a fix for the issue. There is no workaround, but attacker must have access to the hashed password to use this functionality.
Problem types: cwe_id: CWE-303
description: CWE-303: Incorrect Implementation of Authentication Algorithm
cwe_id: CWE-287
description: CWE-287: Improper Authentication
Affected products: vendor: prometheus
product: exporter-toolkit
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
baseScore: 6.2
baseSeverity: MEDIUM
Published: 2022-11-29T00:00:00.000Z
CVE-2022-46147 Drag and Drop XBlock v2 has XSS Issues in Xblock Input Fields
Drag and Drop XBlock v2 implements a drag-and-drop style problem, where a learner has to drag items to zones on a target image. Versions prior to 3.0.0 are vulnerable to cross-site scripting in multiple XBlock Fields. Any platform that has deployed the XBlock may be impacted. Version 3.0.0 contains a patch for this issue. There are no known workarounds.
Problem types: cwe_id: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: openedx
product: xblock-drag-and-drop-v2
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 8.4
baseSeverity: HIGH
Published: 2022-11-28T00:00:00.000Z
CVE-2022-46148 Discourse allows self-XSS through malicious composer message
Discourse is an open-source messaging platform. In versions 2.8.10 and prior on the `stable` branch and versions 2.9.0.beta11 and prior on the `beta` and `tests-passed` branches, users composing malicious messages and navigating to drafts page could self-XSS. This vulnerability can lead to a full XSS on sites which have modified or disabled Discourse’s default Content Security Policy. This issue is patched in the latest stable, beta and tests-passed versions of Discourse.
Problem types: cwe_id: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: discourse
product: discourse
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: LOW
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 7.1
baseSeverity: HIGH
Published: 2022-11-29T00:00:00.000Z