CVE-2022-23082

CureKit - Path Traversal in isFileOutsideDir

In CureKit versions v1.0.1 through v1.1.3 are vulnerable to path traversal as the function isFileOutsideDir fails to sanitize the user input which may lead to path traversal.

CVSS 3.1 · 7.5 High EPSS 1.3% KEV · Not listed

Vendors

Mend

Products

Curekit

CVE-2022-23081

Openlibrary - Reflected XSS

In openlibrary versions deploy-2016-07-0 through deploy-2021-12-22 are vulnerable to Reflected XSS.

CVSS 2.0 · 4.3 Medium EPSS 1.0% KEV · Not listed

Vendors

Openlibrary

Products

Openlibrary

CVE-2022-23080

directus - SSRF which leads to internal port scan

In directus versions v9.0.0-beta.2 through 9.6.0 are vulnerable to server-side request forgery (SSRF) in the media upload functionality which allows a low privileged user to perform internal network port scans.

CVSS 3.1 · 5.0 Medium EPSS < 1% KEV · Not listed

Vendors

Rangerstudio

Products

Directus

CVE-2022-23079

motoradmin - host header Injection in the reset password functionality

In motor-admin versions 0.0.1 through 0.2.56 are vulnerable to host header injection in the password reset functionality where malicious actor can send fake password reset email to arbitrary victim.

CVSS 2.0 · 6.8 Medium EPSS 1.4% KEV · Not listed

Vendors

Getmotoradmin

Products

Motor Admin

CVE-2022-23078

Habitica - Open redirect in login page

In habitica versions v4.119.0 through v4.232.2 are vulnerable to open redirect via the login page.

CVSS 2.0 · 5.8 Medium EPSS 1.2% KEV · Not listed

Vendors

Habitica

Products

Habitica

CVE-2022-23077

Habitica - DOM XSS in login page

In habitica versions v4.119.0 through v4.232.2 are vulnerable to DOM XSS via the login page.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Habitica

Products

Habitica

CVE-2022-23074

Recipes - Stored XSS in Name Parameter

In Recipes, versions 0.17.0 through 1.2.5 are vulnerable to Stored Cross-Site Scripting (XSS), in the ‘Name’ field of Keyword, Food and Unit components. When a victim accesses the Keyword/Food/Unit endpoints, the XSS payload will trigger. A low privileged attacker will have the victim's API key and can lead to admin's account takeover.

CVSS 2.0 · 3.5 Low EPSS < 1% KEV · Not listed

Vendors

Tandoor

Products

Recipes

CVE-2022-23073

Recipes - Stored XSS in Clipboard

In Recipes, versions 1.0.5 through 1.2.5 are vulnerable to Stored Cross-Site Scripting (XSS), in copy to clipboard functionality. When a victim accesses the food list page, then adds a new Food with a malicious javascript payload in the ‘Name’ parameter and clicks on the clipboard icon, an XSS payload will trigger. A low privileged attacker will have the victim's API key and can lead to admin's account takeover.

CVSS 2.0 · 3.5 Low EPSS < 1% KEV · Not listed

Vendors

Tandoor

Products

Recipes

CVE-2022-23072

Recipes - Stored XSS in Add to Cart

In Recipes, versions 1.0.5 through 1.2.5 are vulnerable to Stored Cross-Site Scripting (XSS), in “Add to Cart” functionality. When a victim accesses the food list page, then adds a new Food with a malicious javascript payload in the ‘Name’ parameter and clicks on the Add to Shopping Cart icon, an XSS payload will trigger. A low privileged attacker will have the victim's API key and can lead to admin's account takeover.

CVSS 2.0 · 3.5 Low EPSS < 1% KEV · Not listed

Vendors

Tandoor

Products

Recipes

CVE-2022-23071

Recipes - SSRF on Import

In Recipes, versions 0.9.1 through 1.2.5 are vulnerable to Server Side Request Forgery (SSRF), in the “Import Recipe” functionality. When an attacker enters the localhost URL, a low privileged attacker can access/read the internal file system to access sensitive information.

CVSS 3.1 · 6.5 Medium EPSS 1.0% KEV · Not listed

Vendors

Tandoor

Products

Recipes

CVE-2022-23068

ToolJet - HTML Injection in Invite New User

ToolJet versions v0.6.0 to v1.10.2 are vulnerable to HTML injection where an attacker can inject malicious code inside the first name and last name field while inviting a new user which will be reflected in the invitational e-mail.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Tooljet

Products

Tooljet

CVE-2022-23067

ToolJet - Token Leakage via Referer Header

ToolJet versions v0.5.0 to v1.2.2 are vulnerable to token leakage via Referer header that leads to account takeover . If the user opens the invite link/signup link and then clicks on any external links within the page, it leaks the password set token/signup token in the referer header. Using these tokens the attacker can access the user’s account.

CVSS 3.1 · 8.8 High EPSS 1.3% KEV · Not listed

Vendors

Tooljet

Products

Tooljet

CVE-2022-23066

Solana rBPF - Incorrect Calculation in sdiv instruction

In Solana rBPF versions 0.2.26 and 0.2.27 are affected by Incorrect Calculation which is caused by improper implementation of sdiv instruction. This can lead to the wrong execution path, resulting in huge loss in specific cases. For example, the result of a sdiv instruction may decide whether to transfer tokens or not. The vulnerability affects both integrity and may cause serious availability problems.

CVSS 3.1 · 9.1 Critical EPSS 2.5% KEV · Not listed

Vendors

Solana

Products

Rbpf

CVE-2022-23065

Vendure - XSS via SVG File Upload

In Vendure versions 0.1.0-alpha.2 to 1.5.1 are affected by Stored XSS vulnerability, where an attacker having catalog permission can upload a SVG file that contains malicious JavaScript into the “Assets” tab. The uploaded file will affect administrators as well as regular users.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Vendure

Products

Vendure

CVE-2022-23064

Snipe-IT - Host Header Injection

In Snipe-IT, versions v3.0-alpha to v5.3.7 are vulnerable to Host Header Injection. By sending a specially crafted host header in the reset password request, it is possible to send password reset links to users which once clicked lead to an attacker controlled server and thus leading to password reset token leak. This leads to account take over.

CVSS 3.1 · 8.8 High EPSS 1.3% KEV · Not listed

Vendors

Snipeitapp

Products

Snipe-it

CVE-2022-23063

Shopizer - Insufficient Session Expiration

In Shopizer versions 2.3.0 to 3.0.1 are vulnerable to Insufficient Session Expiration. When a password has been changed by the user or by an administrator, a user that was already logged in, will still have access to the application even after the password was changed.

CVSS 3.1 · 8.8 High EPSS 1.2% KEV · Not listed

Vendors

Shopizer

Products

Shopizer

CVE-2022-23061

Shopizer - IDOR delete superadmin

In Shopizer versions 2.0 to 2.17.0 a regular admin can permanently delete a superadmin (although this cannot happen according to the documentation) via Insecure Direct Object Reference (IDOR) vulnerability.

CVSS 3.1 · 6.5 Medium EPSS 1.1% KEV · Not listed

Vendors

Shopizer

Products

Shopizer

CVE-2022-23060

Shopizer - Stored XSS in Manage Files

A Stored Cross Site Scripting (XSS) vulnerability exists in Shopizer versions 2.0 through 2.17.0, where a privileged user (attacker) can inject malicious JavaScript in the filename under the “Manage files” tab

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Shopizer

Products

Shopizer

CVE-2022-23059

Shopizer - Stored XSS in Manage Images

A Stored Cross Site Scripting (XSS) vulnerability exists in Shopizer versions 2.0 through 2.17.0 via the “Manage Images” tab, which allows an attacker to upload a SVG file containing malicious JavaScript code.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Shopizer

Products

Shopizer

CVE-2022-23058

ERPNext - Stored XSS in My Settings

ERPNext in versions v12.0.9-v13.0.3 are affected by a stored XSS vulnerability that allows low privileged users to store malicious scripts in the ‘username’ field in ‘my settings’ which can lead to full account takeover.

CVSS 2.0 · 3.5 Low EPSS < 1% KEV · Not listed

Vendors

Frappe

Products

Erpnext