CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2022-0074 – Privilege Escalation in OpenLiteSpeed Web Server
https://notcve.org/view.php?id=CVE-2022-0074
Untrusted Search Path vulnerability in LiteSpeed Technologies OpenLiteSpeed Web Server and LiteSpeed Web Server Container allows Privilege Escalation. This affects versions from 1.6.15 before 1.7.16.1. Vulnerabilidad de Untrusted Search Path en LiteSpeed ??Technologies OpenLiteSpeed ??Web Server y LiteSpeed ?? • https://github.com/litespeedtech/ols-dockerfiles/blob/master/template/Dockerfile#L29 • CWE-426: Untrusted Search Path •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 2CVE-2022-0073 – Authenticated Remote Code Execution in OpenLiteSpeed Web Server
https://notcve.org/view.php?id=CVE-2022-0073
Improper Input Validation vulnerability in LiteSpeed Technologies OpenLiteSpeed Web Server and LiteSpeed Web Server dashboards allows Command Injection. This affects 1.7.0 versions before 1.7.16.1. Vulnerabilidad de Improper Input Validation en los dashboards de LiteSpeed ??Technologies OpenLiteSpeed ??Web Server y LiteSpeed ?? • https://github.com/litespeedtech/openlitespeed/blob/v1.7.16.1/dist/admin/html.open/lib/CValidation.php#L565 https://github.com/litespeedtech/openlitespeed/blob/v1.7.16/dist/admin/html.open/lib/CValidation.php#L565 • CWE-20: Improper Input Validation •
CVSS: 5.8EPSS: 0%CPEs: 4EXPL: 2CVE-2022-0072 – Directory Traversal in OpenLiteSpeed Web Server
https://notcve.org/view.php?id=CVE-2022-0072
Directory Traversal vulnerability in LiteSpeed Technologies OpenLiteSpeed Web Server and LiteSpeed Web Server dashboards allows Path Traversal. This affects versions from 1.5.11 through 1.5.12, from 1.6.5 through 1.6.20.1, from 1.7.0 before 1.7.16.1 Vulnerabilidad de Directory Traversal en LiteSeep Technologies OpenLiteSpeed ??Web Server y LiteSpeed ??Web Server permite Path Traversal. Esto afecta a las versiones desde la 1.5.11 hasta la 1.5.12, desde la 1.6.5 hasta la 1.6.20.1, desde la 1.7.0 anterior a la 1.7.16.1. • https://github.com/litespeedtech/openlitespeed/blob/v1.7.16.1/src/main/httpserver.cpp#L2060-L2061 https://github.com/litespeedtech/openlitespeed/blob/v1.7.16/src/main/httpserver.cpp#L2060-L2061 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-30592
https://notcve.org/view.php?id=CVE-2022-30592
liblsquic/lsquic_qenc_hdl.c in LiteSpeed QUIC (aka LSQUIC) before 3.1.0 mishandles MAX_TABLE_CAPACITY. El archivo liblsquic/lsquic_qenc_hdl.c en LiteSpeed QUIC (también se conoce como LSQUIC) versiones anteriores a 3.1.0, maneja inapropiadamente MAX_TABLE_CAPACITY • https://github.com/litespeedtech/lsquic/commit/a74702c630e108125e71898398737baec8f02238#diff-73a138506faffe5f1efa8586346ab573c88e9dd2097774ecca5949a718a57cae https://github.com/litespeedtech/lsquic/releases/tag/v3.1.0 • CWE-476: NULL Pointer Dereference •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2021-24963 – LiteSpeed Cache < 4.4.4 - Admin+ Reflected Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2021-24963
The LiteSpeed Cache WordPress plugin before 4.4.4 does not escape the qc_res parameter before outputting it back in the JS code of an admin page, leading to a Reflected Cross-Site Scripting El plugin LiteSpeed Cache de WordPress versiones anteriores a 4.4.4, no escapa el parámetro qc_res antes de devolverlo al código JS de una página de administración, conllevando a un ataque de tipo Cross-Site Scripting Reflejado The LiteSpeed Cache plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'qc_res' parameter in versions up to, and including, 4.4.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. • https://plugins.trac.wordpress.org/changeset/2634373 https://wpscan.com/vulnerability/7f8b4275-7586-4e04-afd9-d12bdab6ba9b • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •