Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
Vulnerability Details :

CVE-2022-0482

Summary
Assigner-@huntrdev
Assigner Org ID-c09c270a-b464-47c1-9133-acb35b22c19a
Published At-09 Mar, 2022 | 10:20
Updated At-02 Aug, 2024 | 23:32
Rejected At-
Credits

Exposure of Private Personal Information to an Unauthorized Actor in alextselegidis/easyappointments

Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository alextselegidis/easyappointments prior to 1.4.3.

Vendors
-
Not available
Products
-
Metrics (CVSS)
VersionBase scoreBase severityVector
Weaknesses
Attack Patterns
Solution/Workaround
References
HyperlinkResource Type
EPSS History
Score
Latest Score
-
N/A
No data available for selected date range
Percentile
Latest Percentile
-
N/A
No data available for selected date range
Stakeholder-Specific Vulnerability Categorization (SSVC)
▼Common Vulnerabilities and Exposures (CVE)
cve.org
Assigner:@huntrdev
Assigner Org ID:c09c270a-b464-47c1-9133-acb35b22c19a
Published At:09 Mar, 2022 | 10:20
Updated At:02 Aug, 2024 | 23:32
Rejected At:
▼CVE Numbering Authority (CNA)
Exposure of Private Personal Information to an Unauthorized Actor in alextselegidis/easyappointments

Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository alextselegidis/easyappointments prior to 1.4.3.

Affected Products
Vendor
alextselegidis
Product
alextselegidis/easyappointments
Versions
Affected
  • From unspecified before 1.4.3 (custom)
Problem Types
TypeCWE IDDescription
CWECWE-359CWE-359 Exposure of Private Personal Information to an Unauthorized Actor
Type: CWE
CWE ID: CWE-359
Description: CWE-359 Exposure of Private Personal Information to an Unauthorized Actor
Metrics
VersionBase scoreBase severityVector
3.09.1CRITICAL
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Version: 3.0
Base score: 9.1
Base severity: CRITICAL
Vector:
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
https://huntr.dev/bounties/2fe771ef-b615-45ef-9b4d-625978042e26
x_refsource_CONFIRM
https://github.com/alextselegidis/easyappointments/commit/44af526a6fc5e898bc1e0132b2af9eb3a9b2c466
x_refsource_MISC
http://packetstormsecurity.com/files/166701/Easy-Appointments-Information-Disclosure.html
x_refsource_MISC
https://opencirt.com/hacking/securing-easy-appointments-cve-2022-0482/
x_refsource_MISC
Hyperlink: https://huntr.dev/bounties/2fe771ef-b615-45ef-9b4d-625978042e26
Resource:
x_refsource_CONFIRM
Hyperlink: https://github.com/alextselegidis/easyappointments/commit/44af526a6fc5e898bc1e0132b2af9eb3a9b2c466
Resource:
x_refsource_MISC
Hyperlink: http://packetstormsecurity.com/files/166701/Easy-Appointments-Information-Disclosure.html
Resource:
x_refsource_MISC
Hyperlink: https://opencirt.com/hacking/securing-easy-appointments-cve-2022-0482/
Resource:
x_refsource_MISC
▼Authorized Data Publishers (ADP)
CVE Program Container
Affected Products
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
https://huntr.dev/bounties/2fe771ef-b615-45ef-9b4d-625978042e26
x_refsource_CONFIRM
x_transferred
https://github.com/alextselegidis/easyappointments/commit/44af526a6fc5e898bc1e0132b2af9eb3a9b2c466
x_refsource_MISC
x_transferred
http://packetstormsecurity.com/files/166701/Easy-Appointments-Information-Disclosure.html
x_refsource_MISC
x_transferred
https://opencirt.com/hacking/securing-easy-appointments-cve-2022-0482/
x_refsource_MISC
x_transferred
Hyperlink: https://huntr.dev/bounties/2fe771ef-b615-45ef-9b4d-625978042e26
Resource:
x_refsource_CONFIRM
x_transferred
Hyperlink: https://github.com/alextselegidis/easyappointments/commit/44af526a6fc5e898bc1e0132b2af9eb3a9b2c466
Resource:
x_refsource_MISC
x_transferred
Hyperlink: http://packetstormsecurity.com/files/166701/Easy-Appointments-Information-Disclosure.html
Resource:
x_refsource_MISC
x_transferred
Hyperlink: https://opencirt.com/hacking/securing-easy-appointments-cve-2022-0482/
Resource:
x_refsource_MISC
x_transferred
Information is not available yet
▼National Vulnerability Database (NVD)
nvd.nist.gov
Source:security@huntr.dev
Published At:09 Mar, 2022 | 11:15
Updated At:03 Jun, 2022 | 17:23

Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository alextselegidis/easyappointments prior to 1.4.3.

CISA Catalog
Date AddedDue DateVulnerability NameRequired Action
N/A
Date Added: N/A
Due Date: N/A
Vulnerability Name: N/A
Required Action: N/A
Metrics
TypeVersionBase scoreBase severityVector
Primary3.19.1CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Secondary3.09.1CRITICAL
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Primary2.06.4MEDIUM
AV:N/AC:L/Au:N/C:P/I:P/A:N
Type: Primary
Version: 3.1
Base score: 9.1
Base severity: CRITICAL
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Type: Secondary
Version: 3.0
Base score: 9.1
Base severity: CRITICAL
Vector:
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Type: Primary
Version: 2.0
Base score: 6.4
Base severity: MEDIUM
Vector:
AV:N/AC:L/Au:N/C:P/I:P/A:N
CPE Matches
easyappointments
easyappointments
>>easyappointments>>Versions before 1.4.3(exclusive)
cpe:2.3:a:easyappointments:easyappointments:*:*:*:*:*:wordpress:*:*
Weaknesses
CWE IDTypeSource
CWE-359Primarysecurity@huntr.dev
CWE-863Secondarynvd@nist.gov
CWE ID: CWE-359
Type: Primary
Source: security@huntr.dev
CWE ID: CWE-863
Type: Secondary
Source: nvd@nist.gov
Evaluator Description
Evaluator Impact

Evaluator Solution

Vendor Statements
References
HyperlinkSourceResource
http://packetstormsecurity.com/files/166701/Easy-Appointments-Information-Disclosure.htmlsecurity@huntr.dev
Exploit
Third Party Advisory
VDB Entry
https://github.com/alextselegidis/easyappointments/commit/44af526a6fc5e898bc1e0132b2af9eb3a9b2c466security@huntr.dev
Patch
Third Party Advisory
https://huntr.dev/bounties/2fe771ef-b615-45ef-9b4d-625978042e26security@huntr.dev
Exploit
Patch
Third Party Advisory
https://opencirt.com/hacking/securing-easy-appointments-cve-2022-0482/security@huntr.dev
Third Party Advisory
Hyperlink: http://packetstormsecurity.com/files/166701/Easy-Appointments-Information-Disclosure.html
Source: security@huntr.dev
Resource:
Exploit
Third Party Advisory
VDB Entry
Hyperlink: https://github.com/alextselegidis/easyappointments/commit/44af526a6fc5e898bc1e0132b2af9eb3a9b2c466
Source: security@huntr.dev
Resource:
Patch
Third Party Advisory
Hyperlink: https://huntr.dev/bounties/2fe771ef-b615-45ef-9b4d-625978042e26
Source: security@huntr.dev
Resource:
Exploit
Patch
Third Party Advisory
Hyperlink: https://opencirt.com/hacking/securing-easy-appointments-cve-2022-0482/
Source: security@huntr.dev
Resource:
Third Party Advisory

Change History

0
Information is not available yet

Similar CVEs

59Records found
CVE-2023-34218
Matching Score-4
Assigner-JetBrains s.r.o.
ShareView Details
Matching Score-4
Assigner-JetBrains s.r.o.
CVSS Score-9.1||CRITICAL
EPSS-0.00% / 0.03%
||
7 Day CHG~0.00%
Published-31 May, 2023 | 13:03
Updated-09 Jan, 2025 | 20:54
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

In JetBrains TeamCity before 2023.05 bypass of permission checks allowing to perform admin actions was possible

Action-Not Available
Vendor-JetBrains s.r.o.
Product-teamcityTeamCity
CWE ID-CWE-863
Incorrect Authorization
CVE-2024-6592
Matching Score-4
Assigner-WatchGuard Technologies, Inc.
ShareView Details
Matching Score-4
Assigner-WatchGuard Technologies, Inc.
CVSS Score-9.1||CRITICAL
EPSS-1.53% / 80.56%
||
7 Day CHG~0.00%
Published-25 Sep, 2024 | 11:16
Updated-01 Oct, 2024 | 16:06
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WatchGuard Firebox Single Sign-On Agent Protocol Authorization Bypass

Incorrect Authorization vulnerability in the protocol communication between the WatchGuard Authentication Gateway (aka Single Sign-On Agent) on Windows and the WatchGuard Single Sign-On Client on Windows and MacOS allows Authentication Bypass.This issue affects the Authentication Gateway: through 12.10.2; Windows Single Sign-On Client: through 12.7; MacOS Single Sign-On Client: through 12.5.4.

Action-Not Available
Vendor-WatchGuard Technologies, Inc.
Product-single_sign-on_clientauthentication_gatewayAuthentication GatewaySingle Sign-On Clientsingle_sign-on_clientauthentication_gateway
CWE ID-CWE-863
Incorrect Authorization
CVE-2022-39322
Matching Score-4
Assigner-GitHub, Inc.
ShareView Details
Matching Score-4
Assigner-GitHub, Inc.
CVSS Score-9.1||CRITICAL
EPSS-0.61% / 68.91%
||
7 Day CHG+0.04%
Published-25 Oct, 2022 | 00:00
Updated-22 Apr, 2025 | 17:17
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
@keystone-6/core vulnerable to field-level access-control bypass for multiselect field

@keystone-6/core is a core package for Keystone 6, a content management system for Node.js. Starting with version 2.2.0 and prior to version 2.3.1, users who expected their `multiselect` fields to use the field-level access control - if configured - are vulnerable to their field-level access control not being used. List-level access control is not affected. Field-level access control for fields other than `multiselect` are not affected. Version 2.3.1 contains a fix for this issue. As a workaround, stop using the `multiselect` field.

Action-Not Available
Vendor-keystonejskeystonejs
Product-keystonekeystone
CWE ID-CWE-285
Improper Authorization
CWE ID-CWE-863
Incorrect Authorization
CVE-2024-54662
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-9.1||CRITICAL
EPSS-0.09% / 26.65%
||
7 Day CHG+0.01%
Published-17 Dec, 2024 | 00:00
Updated-18 Dec, 2024 | 16:15
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Dante 1.4.0 through 1.4.3 (fixed in 1.4.4) has incorrect access control for some sockd.conf configurations involving socksmethod.

Action-Not Available
Vendor-n/a
Product-n/a
CWE ID-CWE-863
Incorrect Authorization
CVE-2024-49765
Matching Score-4
Assigner-GitHub, Inc.
ShareView Details
Matching Score-4
Assigner-GitHub, Inc.
CVSS Score-5.3||MEDIUM
EPSS-0.09% / 27.02%
||
7 Day CHG+0.02%
Published-19 Dec, 2024 | 19:15
Updated-26 Aug, 2025 | 02:19
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Bypass of Discourse Connect using other login paths if enabled in Discourse

Discourse is an open source platform for community discussion. Sites that are using discourse connect but still have local logins enabled could allow attackers to bypass discourse connect to create accounts and login. This problem is patched in the latest version of Discourse. Users unable to upgrade who are using discourse connect may disable all other login methods as a workaround.

Action-Not Available
Vendor-Civilized Discourse Construction Kit, Inc.
Product-discoursediscourse
CWE ID-CWE-359
Exposure of Private Personal Information to an Unauthorized Actor
CVE-2021-39341
Matching Score-4
Assigner-Wordfence
ShareView Details
Matching Score-4
Assigner-Wordfence
CVSS Score-8.2||HIGH
EPSS-21.55% / 95.50%
||
7 Day CHG~0.00%
Published-01 Nov, 2021 | 21:01
Updated-31 Mar, 2025 | 17:45
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
OptinMonster <= 2.6.4 Unprotected REST-API Endpoints

The OptinMonster WordPress plugin is vulnerable to sensitive information disclosure and unauthorized setting updates due to insufficient authorization validation via the logged_in_or_has_api_key function in the ~/OMAPI/RestApi.php file that can used to exploit inject malicious web scripts on sites with the plugin installed. This affects versions up to, and including, 2.6.4.

Action-Not Available
Vendor-Retyp, LLC. (OptinMonster)
Product-optinmonsterOptinMonster
CWE ID-CWE-285
Improper Authorization
CWE ID-CWE-319
Cleartext Transmission of Sensitive Information
CWE ID-CWE-863
Incorrect Authorization
CVE-2024-48769
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-9.1||CRITICAL
EPSS-0.14% / 35.26%
||
7 Day CHG~0.00%
Published-11 Oct, 2024 | 00:00
Updated-15 Oct, 2024 | 19:35
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

An issue in BURG-WCHTER KG de.burgwachter.keyapp.app 4.5.0 allows a remote attacker to obtain sensitve information via the firmware update process.

Action-Not Available
Vendor-n/aburg-wchter_kg
Product-n/aburg-wchter_kg_firmware
CWE ID-CWE-863
Incorrect Authorization
CVE-2021-30925
Matching Score-4
Assigner-Apple Inc.
ShareView Details
Matching Score-4
Assigner-Apple Inc.
CVSS Score-9.1||CRITICAL
EPSS-0.23% / 45.96%
||
7 Day CHG~0.00%
Published-24 Aug, 2021 | 18:50
Updated-03 Aug, 2024 | 22:48
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

The issue was addressed with improved permissions logic. This issue is fixed in watchOS 8, macOS Big Sur 11.6, iOS 15 and iPadOS 15. A malicious application may be able to bypass Privacy preferences.

Action-Not Available
Vendor-Apple Inc.
Product-iphone_osmacosipadoswatchoswatchOSmacOS
CWE ID-CWE-863
Incorrect Authorization
CVE-2021-21276
Matching Score-4
Assigner-GitHub, Inc.
ShareView Details
Matching Score-4
Assigner-GitHub, Inc.
CVSS Score-9.3||CRITICAL
EPSS-18.53% / 95.00%
||
7 Day CHG~0.00%
Published-01 Feb, 2021 | 00:00
Updated-03 Aug, 2024 | 18:09
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Privilege escalation in Polr

Polr is an open source URL shortener. in Polr before version 2.3.0, a vulnerability in the setup process allows attackers to gain admin access to site instances, even if they do not possess an existing account. This vulnerability exists regardless of users' settings. If an attacker crafts a request with specific cookie headers to the /setup/finish endpoint, they may be able to obtain admin privileges on the instance. This is caused by a loose comparison (==) in SetupController that is susceptible to attack. The project has been patched to ensure that a strict comparison (===) is used to verify the setup key, and that /setup/finish verifies that no users table exists before performing any migrations or provisioning any new accounts. This is fixed in version 2.3.0. Users can patch this vulnerability without upgrading by adding abort(404) to the very first line of finishSetup in SetupController.php.

Action-Not Available
Vendor-polrprojectcydrobolt
Product-polrpolr
CWE ID-CWE-863
Incorrect Authorization
  • Previous
  • 1
  • 2
  • Next
Details not found