CVE-2022-4647
published 2022-12-22CVE-2022-4647: Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.3.2.
PriorityP424medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EPSS
0.49%
38.3th percentile
Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.3.2.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microweber | microweber | <= 1.3.1 | — |
| microweber | microweber | 0 – 1.3.1 | — |
| microweber | microweber_microweber | >= unspecified < 1.3.2 | 1.3.2 |
CVSS provenance
nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvdv3.05.1MEDIUMCVSS:3.0/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:L
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Microweber vulnerable to Stored Cross-Site Scripting
ghsa·2022-12-22
CVE-2022-4647 [MEDIUM] CWE-79 Microweber vulnerable to Stored Cross-Site Scripting
Microweber vulnerable to Stored Cross-Site Scripting
Microweber versions 1.3.1 and prior are vulnerable to stored Cross-site Scripting (XSS). A patch is available on the 1.4, dev, and laravel-sail branches.
OSV
Microweber vulnerable to Stored Cross-Site Scripting
osv·2022-12-22
CVE-2022-4647 [MEDIUM] Microweber vulnerable to Stored Cross-Site Scripting
Microweber vulnerable to Stored Cross-Site Scripting
Microweber versions 1.3.1 and prior are vulnerable to stored Cross-site Scripting (XSS). A patch is available on the 1.4, dev, and laravel-sail branches.
Red Hat
vim: heap buffer overflow in get_one_sourceline
vendor_redhat·2022-03-28·CVSS 7.8
CVE-2022-1160 [HIGH] CWE-120 vim: heap buffer overflow in get_one_sourceline
vim: heap buffer overflow in get_one_sourceline
heap buffer overflow in get_one_sourceline in GitHub repository vim/vim prior to 8.2.4647.
A heap buffer overflow flaw was found in vim's get_one_sourceline() function of scriptfile.c file. This flaw occurs when "source" can read past the end of the copied line. This flaw allows an attacker to trick a user into opening a crafted file, triggering a heap-overflow and causing an application to crash, which leads to a denial of service.
Statement: Red Hat Enterprise Linux - 6, 7, 8, 9 are not affected, because vulnerable code is not present in binary RPMs of Vim shipped with RHEL.
Red Hat Enterprise Virtualization 4 consumes RHEL-8 vim, and as RHEL 8 is not affected, Hence, RHEV is also not affected.
Red Hat Product Security has rated this iss
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/microweber/microweber/commit/20df56615e61624f5fff149849753869e4b3b936https://huntr.dev/bounties/ccdd243d-726c-4199-b742-25c571491242https://github.com/microweber/microweber/commit/20df56615e61624f5fff149849753869e4b3b936https://huntr.dev/bounties/ccdd243d-726c-4199-b742-25c571491242
2022-12-22
Published