{"vulnerability": "CVE-2022-4544", "sightings": [{"uuid": "57bde661-741d-41fa-9020-3f0d0a4f37c6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2022-45449", "type": "seen", "source": "https://t.me/cvedetector/972", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2022-45449 - Acronis Cyber Protect Privilege Escalation\", \n  \"Content\": \"CVE ID : CVE-2022-45449 \nPublished : July 16, 2024, 3:15 p.m. | 35\u00a0minutes ago \nDescription : Sensitive information disclosure due to excessive privileges assigned to Acronis Agent. The following products are affected: Acronis Cyber Protect 15 (Windows, Linux) before build 30984. \nSeverity: 7.7 | HIGH \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"16 Jul 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-07-16T17:57:37.000000Z"}, {"uuid": "193c75d8-092c-4df4-8bee-df518ea81e8b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2022-45442", "type": "seen", "source": "https://t.me/DarkWebInformer_CVEAlerts/12881", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2022-45442\n\ud83d\udd25 CVSS Score: 8.8 (cvssV3_1, Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)\n\ud83d\udd39 Description: Sinatra is a domain-specific language for creating web applications in Ruby. An issue was discovered in Sinatra 2.0 before 2.2.3 and 3.0 before 3.0.4. An application is vulnerable to a reflected file download (RFD) attack that sets the Content-Disposition header of a response when the filename is derived from user-supplied input. Version 2.2.3 and 3.0.4 contain patches for this issue.\n\ud83d\udccf Published: 2022-11-28T00:00:00.000Z\n\ud83d\udccf Modified: 2025-04-22T15:59:32.565Z\n\ud83d\udd17 References:\n1. https://github.com/sinatra/sinatra/security/advisories/GHSA-2x8x-jmrp-phxw\n2. https://github.com/sinatra/sinatra/commit/ea8fc9495a350f7551b39e3025bfcd06f49f363b\n3. https://github.com/advisories/GHSA-8x94-hmjh-97hq\n4. https://www.blackhat.com/docs/eu-14/materials/eu-14-Hafif-Reflected-File-Download-A-New-Web-Attack-Vector.pdf\n5. https://lists.debian.org/debian-lts-announce/2023/01/msg00005.html", "creation_timestamp": "2025-04-22T16:03:22.000000Z"}, {"uuid": "ad50f5d2-5ebd-46d2-ba55-34a318e20e18", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2022-45442", "type": "seen", "source": "https://gist.github.com/saburi-pp/237b36513b29209ae31133136478b20e", "content": "", "creation_timestamp": "2025-03-04T05:49:27.000000Z"}, {"uuid": "5701cf24-90af-434c-8189-5d47943ca408", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2022-45448", "type": "seen", "source": "https://t.me/cibsecurity/70800", "content": "\u203c CVE-2022-45448 \u203c\n\nM4 PDF plugin for Prestashop sites, in its 3.2.3 version and before, is vulnerable to an arbitrary HTML Document crafting vulnerability. The resource /m4pdf/pdf.php uses templates to dynamically create documents. In the case that the template does not exist, the application will return a fixed document with a message in mpdf format. An attacker could exploit this vulnerability by inputting a valid HTML/CSS document as the value of the parameter.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-10-02T11:04:12.000000Z"}, {"uuid": "a447dace-ae97-4653-942b-6a28fba18c53", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2022-45447", "type": "seen", "source": "https://t.me/cibsecurity/70792", "content": "\u203c CVE-2022-45447 \u203c\n\nM4 PDF plugin for Prestashop sites, in its 3.2.3 version and before, is vulnerable to a directory traversal vulnerability. The \u00e2\u20ac\u0153f\u00e2\u20ac\ufffd parameter is not properly checked in the resource /m4pdf/pdf.php, returning any file given its relative path. An attacker that exploits this vulnerability could download /etc/passwd from the server if the file exists.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-09-20T14:30:07.000000Z"}, {"uuid": "9cadebf4-e8ad-4f1c-a7c0-7fbc1d5407aa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2022-45442", "type": "seen", "source": "https://t.me/cibsecurity/53614", "content": "\u203c CVE-2022-45442 \u203c\n\nSinatra is a domain-specific language for creating web applications in Ruby. An issue was discovered in Sinatra 2.0 before 2.2.3 and 3.0 before 3.0.4. An application is vulnerable to a reflected file download (RFD) attack that sets the Content-Disposition header of a response when the filename is derived from user-supplied input. Version 2.2.3 and 3.0.4 contain patches for this issue.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-11-29T00:28:30.000000Z"}]}