mirror of
https://github.com/CVEProject/cvelist.git
synced 2025-08-04 08:44:25 +00:00
"-Synchronized-Data."
This commit is contained in:
CVE Team
parent
75dc7f89bf
commit
07b0441147
@ -70,12 +70,13 @@
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"refsource": "CONFIRM",
|
||||
"url": "https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2022-28732"
|
||||
"refsource": "MISC",
|
||||
"url": "https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2022-28732",
|
||||
"name": "https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2022-28732"
|
||||
}
|
||||
]
|
||||
},
|
||||
"source": {
|
||||
"discovery": "UNKNOWN"
|
||||
}
|
||||
}
|
||||
}
|
||||
@ -43,7 +43,7 @@
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "A carefully crafted request on AJAXPreview.jsp could trigger an XSS vulnerability on Apache JSPWiki, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim.\n\nThis vulnerability leverages CVE-2021-40369, where the Denounce plugin dangerously renders user-supplied URLs. Upon re-testing CVE-2021-40369, it appears that the patch was incomplete as it was still possible to insert malicious input via the Denounce plugin. \n\nApache JSPWiki users should upgrade to 2.11.3 or later. "
|
||||
"value": "A carefully crafted request on AJAXPreview.jsp could trigger an XSS vulnerability on Apache JSPWiki, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. This vulnerability leverages CVE-2021-40369, where the Denounce plugin dangerously renders user-supplied URLs. Upon re-testing CVE-2021-40369, it appears that the patch was incomplete as it was still possible to insert malicious input via the Denounce plugin. Apache JSPWiki users should upgrade to 2.11.3 or later."
|
||||
}
|
||||
]
|
||||
},
|
||||
@ -70,12 +70,13 @@
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"refsource": "CONFIRM",
|
||||
"url": "https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2022-28732"
|
||||
"refsource": "MISC",
|
||||
"url": "https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2022-28732",
|
||||
"name": "https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2022-28732"
|
||||
}
|
||||
]
|
||||
},
|
||||
"source": {
|
||||
"discovery": "UNKNOWN"
|
||||
}
|
||||
}
|
||||
}
|
||||
@ -43,7 +43,7 @@
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "A carefully crafted request on UserPreferences.jsp could trigger an CSRF vulnerability on Apache JSPWiki before 2.11.3, which could allow the attacker to modify the email associated with the attacked account, and then a reset password request from the login page. "
|
||||
"value": "A carefully crafted request on UserPreferences.jsp could trigger an CSRF vulnerability on Apache JSPWiki before 2.11.3, which could allow the attacker to modify the email associated with the attacked account, and then a reset password request from the login page."
|
||||
}
|
||||
]
|
||||
},
|
||||
@ -70,8 +70,9 @@
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"refsource": "CONFIRM",
|
||||
"url": "https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2022-28732"
|
||||
"refsource": "MISC",
|
||||
"url": "https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2022-28732",
|
||||
"name": "https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2022-28732"
|
||||
}
|
||||
]
|
||||
},
|
||||
@ -84,4 +85,4 @@
|
||||
"value": "Apache JSPWiki users should upgrade to 2.11.3 or later. Installations >= 2.7.0 can also enable user management workflows' manual approval to mitigate the issue. "
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
@ -43,7 +43,7 @@
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "A carefully crafted request on WeblogPlugin could trigger an XSS vulnerability on Apache JSPWiki, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. Apache JSPWiki users should upgrade to 2.11.3 or later. "
|
||||
"value": "A carefully crafted request on WeblogPlugin could trigger an XSS vulnerability on Apache JSPWiki, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. Apache JSPWiki users should upgrade to 2.11.3 or later."
|
||||
}
|
||||
]
|
||||
},
|
||||
@ -70,12 +70,13 @@
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"refsource": "CONFIRM",
|
||||
"url": "https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2022-28732"
|
||||
"refsource": "MISC",
|
||||
"url": "https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2022-28732",
|
||||
"name": "https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2022-28732"
|
||||
}
|
||||
]
|
||||
},
|
||||
"source": {
|
||||
"discovery": "UNKNOWN"
|
||||
}
|
||||
}
|
||||
}
|
||||
18
2022/2xxx/CVE-2022-2646.json
Normal file
18
2022/2xxx/CVE-2022-2646.json
Normal file
@ -0,0 +1,18 @@
|
||||
{
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2022-2646",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
@ -42,7 +42,7 @@
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "A carefully crafted invocation on the Image plugin could trigger an CSRF vulnerability on Apache JSPWiki before 2.11.3, which could allow a group privilege escalation of the attacker's account. Further examination of this issue established that it could also be used to modify the email associated with the attacked account, and then a reset password request from the login page. "
|
||||
"value": "A carefully crafted invocation on the Image plugin could trigger an CSRF vulnerability on Apache JSPWiki before 2.11.3, which could allow a group privilege escalation of the attacker's account. Further examination of this issue established that it could also be used to modify the email associated with the attacked account, and then a reset password request from the login page."
|
||||
}
|
||||
]
|
||||
},
|
||||
@ -69,8 +69,9 @@
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"refsource": "CONFIRM",
|
||||
"url": "https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2022-34158"
|
||||
"refsource": "MISC",
|
||||
"url": "https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2022-34158",
|
||||
"name": "https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2022-34158"
|
||||
}
|
||||
]
|
||||
},
|
||||
@ -83,4 +84,4 @@
|
||||
"value": "Apache JSPWiki users should upgrade to 2.11.3 or later. "
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
Loading…
x
Reference in New Issue
Block a user