alirezaaminzadeh/cve-riskrank huggingface dataset:
CVE-2022-29875 (published 2022-06-01)
A vulnerability has been identified in Biograph Horizon PET/CT Systems (All VJ30 versions < VJ30C-UD01), MAGNETOM Family (NUMARIS X: VA12M, VA12S, VA10B, VA20A, VA30A, VA31A), MAMMOMAT Revelation (All VC20 versions < VC20D), NAEOTOM Alpha (All VA40 versions < VA40 SP2), SOMATOM X.cite (All versions < VA30 SP5 or VA40 SP2), SOMATOM X.creed (All versions < VA30 SP5 or VA40 SP2), SOMATOM go.All (All versions < VA30 SP5 or VA40 SP2), SOMATOM go.Now (All versions < VA30 SP5 or VA40 SP2), SOMATOM go.Open Pro (All versions < VA30 SP5 or VA40 SP2), SOMATOM go.Sim (All versions < VA30 SP5 or VA40 SP2), SOMATOM go.Top (All versions < VA30 SP5 or VA40 SP2), SOMATOM go.Up (All versions < VA30 SP5 or VA40 SP2), Symbia E/S (All VB22 versions < VB22A-UD03), Symbia Evo (All VB22 versions < VB22A-UD03), Symbia Intevo (All VB22 versions < VB22A-UD03), Symbia T (All VB22 versions < VB22A-UD03), Symbia.net (All VB22 versions < VB22A-UD03), syngo.via VB10 (All versions), syngo.via VB20 (All versions), syngo.via VB30 (All versions), syngo.via VB40 (All versions < VB40B HF06), syngo.via VB50 (All versions), syngo.via VB60 (All versions < VB60B HF02). The application deserialises untrusted data without sufficient validations that could result in an arbitrary deserialization. This could allow an unauthenticated attacker to execute code in the affected system if ports 32912/tcp or 32914/tcp are reachable.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-502
Affected vendors: siemens
Affected products: biograph_horizon_pet\/ct_systems, biograph_horizon_pet\/ct_systems_firmware, magnetom_numaris_x, magnetom_numaris_x_firmware, mammomat_revelation, mammomat_revelation_firmware, naeotom_alpha, naeotom_alpha_firmware, somatom_go.all, somatom_go.all_firmware, somatom_go.now, somatom_go.now_firmware, somatom_go.open_pro, somatom_go.open_pro_firmware, somatom_go.sim, somatom_go.sim_firmware, somatom_go.up, somatom_go.up_firmware, somatom_x.cite, somatom_x.cite_firmware, somatom_x.creed, somatom_x.creed_firmware, symbia.net, symbia_e, symbia_e_firmware
CVE-2022-29876 (published 2022-05-20)
A vulnerability has been identified in SICAM T (All versions < V3.0). Affected devices do not properly handle the input of a GET request parameter. The provided argument is directly reflected in the web server response. This could allow an unauthenticated attacker to perform reflected XSS attacks.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L)
Weakness: CWE-79
Affected vendors: siemens
Affected products: 7kg8500-0aa00-0aa0, 7kg8500-0aa00-0aa0_firmware, 7kg8500-0aa00-2aa0, 7kg8500-0aa00-2aa0_firmware, 7kg8500-0aa10-0aa0, 7kg8500-0aa10-0aa0_firmware, 7kg8500-0aa10-2aa0, 7kg8500-0aa10-2aa0_firmware, 7kg8500-0aa30-0aa0, 7kg8500-0aa30-0aa0_firmware, 7kg8500-0aa30-2aa0, 7kg8500-0aa30-2aa0_firmware, 7kg8501-0aa01-0aa0, 7kg8501-0aa01-0aa0_firmware, 7kg8501-0aa01-2aa0, 7kg8501-0aa01-2aa0_firmware, 7kg8501-0aa02-0aa0, 7kg8501-0aa02-0aa0_firmware, 7kg8501-0aa02-2aa0, 7kg8501-0aa02-2aa0_firmware, 7kg8501-0aa11-0aa0, 7kg8501-0aa11-0aa0_firmware, 7kg8501-0aa11-2aa0, 7kg8501-0aa11-2aa0_firmware, 7kg8501-0aa12-0aa0
CVE-2022-29877 (published 2022-05-20)
A vulnerability has been identified in SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00). Affected devices allow unauthenticated access to the web interface configuration area. This could allow an attacker to extract internal configuration details or to reconfigure network settings. However, the reconfigured settings cannot be activated unless the role of an authenticated administrator user.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
Weakness: CWE-306
Affected vendors: siemens
Affected products: 7kg8500-0aa00-0aa0, 7kg8500-0aa00-0aa0_firmware, 7kg8500-0aa00-2aa0, 7kg8500-0aa00-2aa0_firmware, 7kg8500-0aa10-0aa0, 7kg8500-0aa10-0aa0_firmware, 7kg8500-0aa10-2aa0, 7kg8500-0aa10-2aa0_firmware, 7kg8500-0aa30-0aa0, 7kg8500-0aa30-0aa0_firmware, 7kg8500-0aa30-2aa0, 7kg8500-0aa30-2aa0_firmware, 7kg8501-0aa01-0aa0, 7kg8501-0aa01-0aa0_firmware, 7kg8501-0aa01-2aa0, 7kg8501-0aa01-2aa0_firmware, 7kg8501-0aa02-0aa0, 7kg8501-0aa02-0aa0_firmware, 7kg8501-0aa02-2aa0, 7kg8501-0aa02-2aa0_firmware, 7kg8501-0aa11-0aa0, 7kg8501-0aa11-0aa0_firmware, 7kg8501-0aa11-2aa0, 7kg8501-0aa11-2aa0_firmware, 7kg8501-0aa12-0aa0
CVE-2022-29878 (published 2022-05-20)
A vulnerability has been identified in SICAM T (All versions < V3.0). Affected devices use a limited range for challenges that are sent during the unencrypted challenge-response communication. An unauthenticated attacker could capture a valid challenge-response pair generated by a legitimate user, and request the webpage repeatedly to wait for the same challenge to reappear for which the correct response is known. This could allow the attacker to access the management interface of the device.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-294
Affected vendors: siemens
Affected products: 7kg8500-0aa00-0aa0, 7kg8500-0aa00-0aa0_firmware, 7kg8500-0aa00-2aa0, 7kg8500-0aa00-2aa0_firmware, 7kg8500-0aa10-0aa0, 7kg8500-0aa10-0aa0_firmware, 7kg8500-0aa10-2aa0, 7kg8500-0aa10-2aa0_firmware, 7kg8500-0aa30-0aa0, 7kg8500-0aa30-0aa0_firmware, 7kg8500-0aa30-2aa0, 7kg8500-0aa30-2aa0_firmware, 7kg8501-0aa01-0aa0, 7kg8501-0aa01-0aa0_firmware, 7kg8501-0aa01-2aa0, 7kg8501-0aa01-2aa0_firmware, 7kg8501-0aa02-0aa0, 7kg8501-0aa02-0aa0_firmware, 7kg8501-0aa02-2aa0, 7kg8501-0aa02-2aa0_firmware, 7kg8501-0aa11-0aa0, 7kg8501-0aa11-0aa0_firmware, 7kg8501-0aa11-2aa0, 7kg8501-0aa11-2aa0_firmware, 7kg8501-0aa12-0aa0
CVE-2022-29879 (published 2022-05-20)
A vulnerability has been identified in SICAM T (All versions < V3.0). The web based management interface of affected devices does not employ special access protection for certain internal developer views. This could allow authenticated users to access critical device information.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-306
Affected vendors: siemens
Affected products: 7kg8500-0aa00-0aa0, 7kg8500-0aa00-0aa0_firmware, 7kg8500-0aa00-2aa0, 7kg8500-0aa00-2aa0_firmware, 7kg8500-0aa10-0aa0, 7kg8500-0aa10-0aa0_firmware, 7kg8500-0aa10-2aa0, 7kg8500-0aa10-2aa0_firmware, 7kg8500-0aa30-0aa0, 7kg8500-0aa30-0aa0_firmware, 7kg8500-0aa30-2aa0, 7kg8500-0aa30-2aa0_firmware, 7kg8501-0aa01-0aa0, 7kg8501-0aa01-0aa0_firmware, 7kg8501-0aa01-2aa0, 7kg8501-0aa01-2aa0_firmware, 7kg8501-0aa02-0aa0, 7kg8501-0aa02-0aa0_firmware, 7kg8501-0aa02-2aa0, 7kg8501-0aa02-2aa0_firmware, 7kg8501-0aa11-0aa0, 7kg8501-0aa11-0aa0_firmware, 7kg8501-0aa11-2aa0, 7kg8501-0aa11-2aa0_firmware, 7kg8501-0aa12-0aa0
CVE-2022-2988 (published 2023-01-30)
A CWE-787: Out-of-bounds Write vulnerability exists that could cause sensitive information leakage when accessing a malicious web page from the commissioning software. Affected Products: SoMachine HVAC (Versions prior to V2.1.0), EcoStruxure Machine Expert – HVAC (Versions prior to V1.4.0)
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-787
Affected vendors: schneider-electric
Affected products: ecostruxure_machine_expert_-_hvac, somachine_hvac
CVE-2022-29880 (published 2022-05-20)
A vulnerability has been identified in SICAM T (All versions < V3.0). Affected devices do not properly validate input in the configuration interface. This could allow an authenticated attacker to place persistent XSS attacks to perform arbitrary actions in the name of a logged user which accesses the affected views.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L)
Weakness: CWE-79
Affected vendors: siemens
Affected products: 7kg8500-0aa00-0aa0, 7kg8500-0aa00-0aa0_firmware, 7kg8500-0aa00-2aa0, 7kg8500-0aa00-2aa0_firmware, 7kg8500-0aa10-0aa0, 7kg8500-0aa10-0aa0_firmware, 7kg8500-0aa10-2aa0, 7kg8500-0aa10-2aa0_firmware, 7kg8500-0aa30-0aa0, 7kg8500-0aa30-0aa0_firmware, 7kg8500-0aa30-2aa0, 7kg8500-0aa30-2aa0_firmware, 7kg8501-0aa01-0aa0, 7kg8501-0aa01-0aa0_firmware, 7kg8501-0aa01-2aa0, 7kg8501-0aa01-2aa0_firmware, 7kg8501-0aa02-0aa0, 7kg8501-0aa02-0aa0_firmware, 7kg8501-0aa02-2aa0, 7kg8501-0aa02-2aa0_firmware, 7kg8501-0aa11-0aa0, 7kg8501-0aa11-0aa0_firmware, 7kg8501-0aa11-2aa0, 7kg8501-0aa11-2aa0_firmware, 7kg8501-0aa12-0aa0
CVE-2022-29881 (published 2022-05-20)
A vulnerability has been identified in SICAM T (All versions < V3.0). The web based management interface of affected devices does not employ special access protection for certain internal developer views. This could allow unauthenticated users to extract internal configuration details.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-306
Affected vendors: siemens
Affected products: 7kg8500-0aa00-0aa0, 7kg8500-0aa00-0aa0_firmware, 7kg8500-0aa00-2aa0, 7kg8500-0aa00-2aa0_firmware, 7kg8500-0aa10-0aa0, 7kg8500-0aa10-0aa0_firmware, 7kg8500-0aa10-2aa0, 7kg8500-0aa10-2aa0_firmware, 7kg8500-0aa30-0aa0, 7kg8500-0aa30-0aa0_firmware, 7kg8500-0aa30-2aa0, 7kg8500-0aa30-2aa0_firmware, 7kg8501-0aa01-0aa0, 7kg8501-0aa01-0aa0_firmware, 7kg8501-0aa01-2aa0, 7kg8501-0aa01-2aa0_firmware, 7kg8501-0aa02-0aa0, 7kg8501-0aa02-0aa0_firmware, 7kg8501-0aa02-2aa0, 7kg8501-0aa02-2aa0_firmware, 7kg8501-0aa11-0aa0, 7kg8501-0aa11-0aa0_firmware, 7kg8501-0aa11-2aa0, 7kg8501-0aa11-2aa0_firmware, 7kg8501-0aa12-0aa0
CVE-2022-29882 (published 2022-05-20)
A vulnerability has been identified in SICAM T (All versions < V3.0). Affected devices do not handle uploaded files correctly. An unauthenticated attacker could take advantage of this situation to store an XSS attack, which could - when a legitimate user accesses the error logs - perform arbitrary actions in the name of the user.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L)
Weakness: CWE-79
Affected vendors: siemens
Affected products: 7kg8500-0aa00-0aa0, 7kg8500-0aa00-0aa0_firmware, 7kg8500-0aa00-2aa0, 7kg8500-0aa00-2aa0_firmware, 7kg8500-0aa10-0aa0, 7kg8500-0aa10-0aa0_firmware, 7kg8500-0aa10-2aa0, 7kg8500-0aa10-2aa0_firmware, 7kg8500-0aa30-0aa0, 7kg8500-0aa30-0aa0_firmware, 7kg8500-0aa30-2aa0, 7kg8500-0aa30-2aa0_firmware, 7kg8501-0aa01-0aa0, 7kg8501-0aa01-0aa0_firmware, 7kg8501-0aa01-2aa0, 7kg8501-0aa01-2aa0_firmware, 7kg8501-0aa02-0aa0, 7kg8501-0aa02-0aa0_firmware, 7kg8501-0aa02-2aa0, 7kg8501-0aa02-2aa0_firmware, 7kg8501-0aa11-0aa0, 7kg8501-0aa11-0aa0_firmware, 7kg8501-0aa11-2aa0, 7kg8501-0aa11-2aa0_firmware, 7kg8501-0aa12-0aa0
CVE-2022-29883 (published 2022-05-20)
A vulnerability has been identified in SICAM T (All versions < V3.0). Affected devices do not restrict unauthenticated access to certain pages of the web interface. This could allow an attacker to delete log files without authentication.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Weakness: CWE-287
Affected vendors: siemens
Affected products: 7kg8500-0aa00-0aa0, 7kg8500-0aa00-0aa0_firmware, 7kg8500-0aa00-2aa0, 7kg8500-0aa00-2aa0_firmware, 7kg8500-0aa10-0aa0, 7kg8500-0aa10-0aa0_firmware, 7kg8500-0aa10-2aa0, 7kg8500-0aa10-2aa0_firmware, 7kg8500-0aa30-0aa0, 7kg8500-0aa30-0aa0_firmware, 7kg8500-0aa30-2aa0, 7kg8500-0aa30-2aa0_firmware, 7kg8501-0aa01-0aa0, 7kg8501-0aa01-0aa0_firmware, 7kg8501-0aa01-2aa0, 7kg8501-0aa01-2aa0_firmware, 7kg8501-0aa02-0aa0, 7kg8501-0aa02-0aa0_firmware, 7kg8501-0aa02-2aa0, 7kg8501-0aa02-2aa0_firmware, 7kg8501-0aa11-0aa0, 7kg8501-0aa11-0aa0_firmware, 7kg8501-0aa11-2aa0, 7kg8501-0aa11-2aa0_firmware, 7kg8501-0aa12-0aa0
CVE-2022-29884 (published 2022-07-12)
A vulnerability has been identified in CP-8000 MASTER MODULE WITH I/O -25/+70°C (All versions < CPC80 V16.30), CP-8000 MASTER MODULE WITH I/O -40/+70°C (All versions < CPC80 V16.30), CP-8021 MASTER MODULE (All versions < CPC80 V16.30), CP-8022 MASTER MODULE WITH GPRS (All versions < CPC80 V16.30). When using the HTTPS server under specific conditions, affected devices do not properly free resources. This could allow an unauthenticated remote attacker to put the device into a denial of service condition.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-772
Affected vendors: siemens
Affected products: sicam_a8000_cp-8000, sicam_a8000_cp-8000_firmware, sicam_a8000_cp-8021, sicam_a8000_cp-8021_firmware, sicam_a8000_cp-8022, sicam_a8000_cp-8022_firmware
CVE-2022-29885 (published 2022-05-12)
The documentation of Apache Tomcat 10.1.0-M1 to 10.1.0-M14, 10.0.0-M1 to 10.0.20, 9.0.13 to 9.0.62 and 8.5.38 to 8.5.78 for the EncryptInterceptor incorrectly stated it enabled Tomcat clustering to run over an untrusted network. This was not correct. While the EncryptInterceptor does provide confidentiality and integrity protection, it does not protect against all risks associated with running over any untrusted network, particularly DoS risks.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-400
Affected vendors: apache, debian, oracle
Affected products: debian_linux, hospitality_cruise_shipboard_property_management_system, tomcat
CVE-2022-29886 (published 2022-08-05)
An integer overflow vulnerability exists in the way ESTsoft Alyac 2.5.8.544 parses OLE files. A specially-crafted OLE file can lead to a heap buffer overflow, which can result in arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-680
Affected vendors: estsoft
Affected products: alyac
CVE-2022-29887 (published 2023-08-11)
Cross-site Scripting (XSS) in some Intel(R) Manageability Commander software before version 2.3 may allow an unauthenticated user to potentially enable escalation of privilege via network access.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H)
Weakness: CWE-79
Affected vendors: intel
Affected products: manageability_commander
CVE-2022-29888 (published 2022-11-09)
A leftover debug code vulnerability exists in the httpd port 4444 upload.cgi functionality of InHand Networks InRouter302 V3.5.45. A specially-crafted HTTP request can lead to arbitrary file deletion. An attacker can send an HTTP request to trigger this vulnerability.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
Weakness: CWE-489
Affected vendors: inhandnetworks
Affected products: ir302, ir302_firmware
CVE-2022-29889 (published 2022-10-25)
A hard-coded password vulnerability exists in the telnet functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9Z. Use of a hard-coded root password can lead to arbitrary command execution. An attacker can authenticate with hard-coded credentials to trigger this vulnerability.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-798
Affected vendors: goabode
Affected products: iota_all-in-one_security_kit, iota_all-in-one_security_kit_firmware
CVE-2022-2989 (published 2022-09-13)
An incorrect handling of the supplementary groups in the Podman container engine might lead to the sensitive information disclosure or possible data modification if an attacker has direct access to the affected container where supplementary groups are used to set access permissions and is able to execute a binary code in that container.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N)
Weakness: CWE-842
Affected vendors: podman_project, redhat
Affected products: enterprise_linux, openshift_container_platform, podman
CVE-2022-29890 (published 2022-07-15)
In affected versions of Octopus Server the help sidebar can be customized to include a Cross-Site Scripting payload in the support link.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: octopus
Affected products: octopus_server
CVE-2022-29891 (published 2022-08-18)
Browse restriction bypass vulnerability in Custom Ap of Cybozu Office 10.0.0 to 10.8.5 allows a remote authenticated attacker to obtain the data of Custom App via unspecified vectors.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
Affected vendors: cybozu
Affected products: office
CVE-2022-29892 (published 2022-07-04)
Improper input validation vulnerability in Space of Cybozu Garoon 4.0.0 to 5.5.1 allows a remote authenticated attacker to repeatedly display errors in certain functions and cause a denial-of-service (DoS).
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-20
Affected vendors: cybozu
Affected products: garoon
CVE-2022-29893 (published 2022-11-11)
Improper authentication in firmware for Intel(R) AMT before versions 11.8.93, 11.22.93, 11.12.93, 12.0.92, 14.1.67, 15.0.42, 16.1.25 may allow an authenticated user to potentially enable escalation of privilege via network access.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-287
Affected vendors: intel
Affected products: active_management_technology_firmware
CVE-2022-29894 (published 2022-06-13)
Strapi v3.x.x versions and earlier contain a stored cross-site scripting vulnerability in file upload function. By exploiting this vulnerability, an arbitrary script may be executed on the web browser of the user who is logging in to the product with the administrative privilege.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: strapi
Affected products: strapi
CVE-2022-29897 (published 2022-05-11)
On various RAD-ISM-900-EN-* devices by PHOENIX CONTACT an admin user could use the traceroute utility integrated in the WebUI to execute arbitrary code with root privileges on the OS due to an improper input validation in all versions of the firmware.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H)
Weakness: CWE-20
Affected vendors: phoenixcontact
Affected products: rad-ism-900-en-bd, rad-ism-900-en-bd-bus, rad-ism-900-en-bd-bus_firmware, rad-ism-900-en-bd\/b, rad-ism-900-en-bd\/b_firmware, rad-ism-900-en-bd_firmware
CVE-2022-29898 (published 2022-05-11)
On various RAD-ISM-900-EN-* devices by PHOENIX CONTACT an admin user could use the configuration file uploader in the WebUI to execute arbitrary code with root privileges on the OS due to an improper validation of an integrity check value in all versions of the firmware.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H)
Weakness: CWE-354
Affected vendors: phoenixcontact
Affected products: rad-ism-900-en-bd, rad-ism-900-en-bd-bus, rad-ism-900-en-bd-bus_firmware, rad-ism-900-en-bd\/b, rad-ism-900-en-bd\/b_firmware, rad-ism-900-en-bd_firmware
CVE-2022-2990 (published 2022-09-13)
An incorrect handling of the supplementary groups in the Buildah container engine might lead to the sensitive information disclosure or possible data modification if an attacker has direct access to the affected container where supplementary groups are used to set access permissions and is able to execute a binary code in that container.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N)
Weakness: CWE-842
Affected vendors: buildah_project, redhat
Affected products: buildah, enterprise_linux, openshift_container_platform
CVE-2022-29900 (published 2022-07-12)
Mis-trained branch predictions for return instructions may allow arbitrary speculative code execution under certain microarchitecture-dependent conditions.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N)
Weakness: CWE-212
Affected vendors: amd, debian, fedoraproject, xen
Affected products: a10-9600p, a10-9600p_firmware, a10-9630p, a10-9630p_firmware, a12-9700p, a12-9700p_firmware, a12-9730p, a12-9730p_firmware, a4-9120, a4-9120_firmware, a6-9210, a6-9210_firmware, a6-9220, a6-9220_firmware, a6-9220c, a6-9220c_firmware, a9-9410, a9-9410_firmware, a9-9420, a9-9420_firmware, athlon_gold_3150u, athlon_gold_3150u_firmware, athlon_silver_3050u, athlon_silver_3050u_firmware, athlon_x4_750
CVE-2022-29901 (published 2022-07-12)
Intel microprocessor generations 6 to 8 are affected by a new Spectre variant that is able to bypass their retpoline mitigation in the kernel to leak arbitrary data. An attacker with unprivileged user access can hijack return instructions to achieve arbitrary speculative code execution under certain microarchitecture-dependent conditions.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N)
Weakness: CWE-200
Affected vendors: debian, fedoraproject, intel, vmware, xen
Affected products: core_i3-6100, core_i3-6100_firmware, core_i3-6100e, core_i3-6100e_firmware, core_i3-6100h, core_i3-6100h_firmware, core_i3-6100t, core_i3-6100t_firmware, core_i3-6100te, core_i3-6100te_firmware, core_i3-6100u, core_i3-6100u_firmware, core_i3-6102e, core_i3-6102e_firmware, core_i3-6110u, core_i3-6110u_firmware, core_i3-6120, core_i3-6120_firmware, core_i3-6120t, core_i3-6120t_firmware, core_i3-6167u, core_i3-6167u_firmware, core_i3-6300, core_i3-6300_firmware, core_i3-6300t
CVE-2022-29903 (published 2022-04-29)
The Private Domains extension for MediaWiki through 1.37.2 (before 1ad65d4c1c199b375ea80988d99ab51ae068f766) allows CSRF for editing pages that store the extension's configuration. The attacker must trigger a POST request to Special:PrivateDomains.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)
Weakness: CWE-352
Affected vendors: mediawiki
Affected products: mediawiki
CVE-2022-29904 (published 2022-04-29)
The SemanticDrilldown extension for MediaWiki through 1.37.2 (before e688bdba6434591b5dff689a45e4d53459954773) allows SQL injection with certain '-' and '_' constraints.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: mediawiki
Affected products: mediawiki
CVE-2022-29905 (published 2022-04-29)
The FanBoxes extension for MediaWiki through 1.37.2 (before 027ffb0b9d6fe0d823810cf03f5b562a212162d4) allows Special:UserBoxes CSRF.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)
Weakness: CWE-352
Affected vendors: mediawiki
Affected products: mediawiki
CVE-2022-29906 (published 2022-04-29)
The admin API module in the QuizGame extension for MediaWiki through 1.37.2 (before 665e33a68f6fa1167df99c0aa18ed0157cdf9f66) omits a check for the quizadmin user.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-862
Affected vendors: mediawiki
Affected products: mediawiki
CVE-2022-29907 (published 2022-04-29)
The Nimbus skin for MediaWiki through 1.37.2 (before 6f9c8fb868345701d9544a54d9752515aace39df) allows XSS in Advertise link messages.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: mediawiki
Affected products: mediawiki
CVE-2022-29908 (published 2022-09-19)
The folioupdate service in Fabasoft Cloud Enterprise Client 22.4.0043 allows Local Privilege Escalation.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-295
Affected vendors: fabasoft
Affected products: fabasoft_cloud_enterprise_client
CVE-2022-29909 (published 2022-12-22)
Documents in deeply-nested cross-origin browsing contexts could have obtained permissions granted to the top-level origin, bypassing the existing prompt and wrongfully inheriting the top-level permissions. This vulnerability affects Thunderbird < 91.9, Firefox ESR < 91.9, and Firefox < 100.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-276
Affected vendors: mozilla
Affected products: firefox, firefox_esr, thunderbird
CVE-2022-2991 (published 2022-08-25)
A heap-based buffer overflow was found in the Linux kernel's LightNVM subsystem. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. This vulnerability allows a local attacker to escalate privileges and execute arbitrary code in the context of the kernel. The attacker must first obtain the ability to execute high-privileged code on the target system to exploit this vulnerability.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-122
Affected vendors: linux
Affected products: linux_kernel
CVE-2022-29910 (published 2022-12-22)
When closed or sent to the background, Firefox for Android would not properly record and persist HSTS settings.<br>*Note: This issue only affected Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 100.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-601
Affected vendors: google, mozilla
Affected products: android, firefox
CVE-2022-29911 (published 2022-12-22)
An improper implementation of the new iframe sandbox keyword <code>allow-top-navigation-by-user-activation</code> could lead to script execution without <code>allow-scripts</code> being present. This vulnerability affects Thunderbird < 91.9, Firefox ESR < 91.9, and Firefox < 100.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-1021
Affected vendors: mozilla
Affected products: firefox, firefox_esr, thunderbird
CVE-2022-29912 (published 2022-12-22)
Requests initiated through reader mode did not properly omit cookies with a SameSite attribute. This vulnerability affects Thunderbird < 91.9, Firefox ESR < 91.9, and Firefox < 100.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-601
Affected vendors: mozilla
Affected products: firefox, firefox_esr, thunderbird
CVE-2022-29913 (published 2022-12-22)
The parent process would not properly check whether the Speech Synthesis feature is enabled, when receiving instructions from a child process. This vulnerability affects Thunderbird < 91.9.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
Weakness: CWE-285
Affected vendors: mozilla
Affected products: thunderbird
CVE-2022-29914 (published 2022-12-22)
When reusing existing popups Firefox would have allowed them to cover the fullscreen notification UI, which could have enabled browser spoofing attacks. This vulnerability affects Thunderbird < 91.9, Firefox ESR < 91.9, and Firefox < 100.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
Weakness: CWE-1021
Affected vendors: mozilla
Affected products: firefox, firefox_esr, thunderbird
CVE-2022-29915 (published 2022-12-22)
The Performance API did not properly hide the fact whether a request cross-origin resource has observed redirects. This vulnerability affects Firefox < 100.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N)
Weakness: CWE-346
Affected vendors: mozilla
Affected products: firefox
CVE-2022-29916 (published 2022-12-22)
Firefox behaved slightly differently for already known resources when loading CSS resources involving CSS variables. This could have been used to probe the browser history. This vulnerability affects Thunderbird < 91.9, Firefox ESR < 91.9, and Firefox < 100.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)
Weakness: CWE-200
Affected vendors: mozilla
Affected products: firefox, firefox_esr, thunderbird
CVE-2022-29917 (published 2022-12-22)
Mozilla developers Andrew McCreight, Gabriele Svelto, Tom Ritter and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 99 and Firefox ESR 91.8. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 91.9, Firefox ESR < 91.9, and Firefox < 100.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: mozilla
Affected products: firefox, firefox_esr, thunderbird
CVE-2022-29918 (published 2022-12-22)
Mozilla developers Gabriele Svelto, Randell Jesup and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 99. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 100.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: mozilla
Affected products: firefox
CVE-2022-29919 (published 2023-05-10)
Use after free in the Intel(R) VROC software before version 7.7.6.1003 may allow an authenticated user to potentially enable escalation of privilege via local access.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-416
Affected vendors: intel
Affected products: virtual_raid_on_cpu
CVE-2022-2992 (published 2022-10-17)
A vulnerability in GitLab CE/EE affecting all versions from 11.10 prior to 15.1.6, 15.2 to 15.2.4, 15.3 to 15.3.2 allows an authenticated user to achieve remote code execution via the Import from GitHub API endpoint.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
Weakness: CWE-74
Affected vendors: gitlab
Affected products: gitlab
CVE-2022-29922 (published 2022-09-14)
Improper Input Validation vulnerability in the handling of a specially crafted IEC 61850 packet with a valid data item but with incorrect data type in the IEC 61850 OPC Server in the Hitachi Energy MicroSCADA X SYS600, MicroSCADA Pro SYS600. The vulnerability may cause a denial-of-service on the IEC 61850 OPC Server part of the SYS600 product. This issue affects: Hitachi Energy MicroSCADA Pro SYS600 version 9.4 FP2 Hotfix 4 and earlier versions Hitachi Energy MicroSCADA X SYS600 version 10 to version 10.3.1. cpe:2.3:a:hitachienergy:microscada_pro_sys600:9.0:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:microscada_pro_sys600:9.1:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:microscada_pro_sys600:9.2:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:microscada_pro_sys600:9.3:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:microscada_pro_sys600:9.4:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:microscada_x_sys600:10:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:microscada_x_sys600:10.1:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:microscada_x_sys600:10.1.1:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:microscada_x_sys600:10.2:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:microscada_x_sys600:10.2.1:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:microscada_x_sys600:10.3:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:microscada_x_sys600:10.3.1:*:*:*:*:*:*:*
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-20
Affected vendors: hitachienergy
Affected products: microscada_x_sys600, sys600
CVE-2022-29923 (published 2022-07-20)
Cross-site Scripting (XSS) vulnerability in ThingsForRestaurants Quick Restaurant Reservations (WordPress plugin) allows Reflected XSS.This issue affects Quick Restaurant Reservations (WordPress plugin): from n/a through 1.4.1.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: thingsforrestaurants
Affected products: quick_restaurant_reservations
CVE-2022-29925 (published 2022-06-14)
Access of uninitialized pointer vulnerability exists in the simulator module contained in the graphic editor 'V-SFT' versions prior to v6.1.6.0, which may allow an attacker to obtain information and/or execute arbitrary code by having a user to open a specially crafted image file.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-824
Affected vendors: fujielectric
Affected products: v-sft
CVE-2022-29927 (published 2022-05-12)
In JetBrains TeamCity before 2022.04 reflected XSS on the Build Chain Status page was possible
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: jetbrains
Affected products: teamcity
CVE-2022-29928 (published 2022-05-12)
In JetBrains TeamCity before 2022.04 leak of secrets in TeamCity agent logs was possible
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-532
Affected vendors: jetbrains
Affected products: teamcity
CVE-2022-29929 (published 2022-05-12)
In JetBrains TeamCity before 2022.04 potential XSS via Referrer header was possible
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: jetbrains
Affected products: teamcity
CVE-2022-2993 (published 2022-12-09)
There is an error in the condition of the last if-statement in the function smp_check_keys. It was rejecting current keys if all requirements were unmet.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-670
Affected vendors: zephyrproject
Affected products: zephyr
CVE-2022-29930 (published 2022-05-12)
SHA1 implementation in JetBrains Ktor Native 2.0.0 was returning the same value. The issue was fixed in Ktor version 2.0.1.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-342
Affected vendors: jetbrains
Affected products: ktor
CVE-2022-29931 (published 2022-06-25)
The administration interface of the Raytion Custom Security Manager (Raytion CSM) in Version 7.2.0 allows reflected Cross-site Scripting (XSS).
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: raytion
Affected products: custom_security_manager
CVE-2022-29932 (published 2022-05-11)
The HTTP Server in PRIMEUR SPAZIO 2.5.1.954 (File Transfer) allows an unauthenticated attacker to obtain sensitive data (related to the content of transferred files) via a crafted HTTP request.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-401
Affected vendors: primeur
Affected products: spazio
CVE-2022-29933 (published 2022-05-09)
Craft CMS through 3.7.36 allows a remote unauthenticated attacker, who knows at least one valid username, to reset the account's password and take over the account by providing a crafted HTTP header to the application while using the password reset functionality. Specifically, the attacker must send X-Forwarded-Host to the /index.php?p=admin/actions/users/send-password-reset-email URI. NOTE: the vendor's position is that a customer can already work around this by adjusting the configuration (i.e., by not using the default configuration).
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-640
Affected vendors: craftcms
Affected products: craft_cms
CVE-2022-29934 (published 2022-04-29)
USU Oracle Optimization before 5.17.5 lacks Polkit authentication, which allows smartcollector users to achieve root access via pkexec. NOTE: this is not an Oracle Corporation product.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-306
Affected vendors: usu
Affected products: oracle_optimization
CVE-2022-29935 (published 2022-04-29)
USU Oracle Optimization before 5.17.5 allows attackers to discover the quantum credentials via an agent-installer download. NOTE: this is not an Oracle Corporation product.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Affected vendors: usu
Affected products: oracle_optimization
CVE-2022-29936 (published 2022-04-29)
USU Oracle Optimization before 5.17 allows authenticated quantum users to achieve remote code execution because of /v2/quantum/save-data-upload-big-file Java deserialization. NOTE: this is not an Oracle Corporation product.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-502
Affected vendors: usu
Affected products: oracle_optimization
CVE-2022-29937 (published 2022-04-29)
USU Oracle Optimization before 5.17.5 allows authenticated DataCollection users to achieve agent root access because some common OS commands are blocked but (for example) an OS command for base64 decoding is not blocked. NOTE: this is not an Oracle Corporation product.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: usu
Affected products: oracle_optimization
CVE-2022-29938 (published 2022-05-05)
In LibreHealth EHR 2.0.0, lack of sanitization of the GET parameter payment_id in interface\billing\new_payment.php via interface\billing\payment_master.inc.php leads to SQL injection.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: librehealth
Affected products: librehealth_ehr
CVE-2022-29939 (published 2022-05-05)
In LibreHealth EHR 2.0.0, lack of sanitization of the GET parameters debug and InsId in interface\billing\sl_eob_process.php leads to multiple cross-site scripting (XSS) vulnerabilities.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: librehealth
Affected products: librehealth_ehr
CVE-2022-29940 (published 2022-05-05)
In LibreHealth EHR 2.0.0, lack of sanitization of the GET parameters formseq and formid in interface\orders\find_order_popup.php leads to multiple cross-site scripting (XSS) vulnerabilities.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: librehealth
Affected products: librehealth_ehr
CVE-2022-29942 (published 2022-05-04)
Talend Administration Center has a vulnerability that allows an authenticated user to use the Service Registry 'Add' functionality to perform SSRF HTTP GET requests on URLs in the internal network. The issue is fixed for versions 8.0.x in TPS-5189, versions 7.3.x in TPS-5175, and versions 7.2.x in TPS-5201. Earlier versions of Talend Administration Center may also be impacted; users are encouraged to update to a supported version.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-918
Affected vendors: talend
Affected products: administration_center
CVE-2022-29943 (published 2022-05-04)
Talend Administration Center has a vulnerability that allows an authenticated user to use XML External Entity (XXE) processing to achieve read access as root on the remote filesystem. The issue is fixed for versions 8.0.x in TPS-5189, versions 7.3.x in TPS-5175, and versions 7.2.x in TPS-5201. Earlier versions of Talend Administration Center may also be impacted; users are encouraged to update to a supported version.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-611
Affected vendors: talend
Affected products: administration_center
CVE-2022-29944 (published 2023-04-20)
An issue was discovered in ONOS 2.5.1. There is an incorrect comparison of paths installed by intents. An existing intents does not redirect to a new path, even if a new intent that shares the path with higher priority is installed.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Weakness: CWE-697
Affected vendors: opennetworking
Affected products: onos
CVE-2022-29945 (published 2022-04-29)
DJI drone devices sold in 2017 through 2022 broadcast unencrypted information about the drone operator's physical location via the AeroScope protocol.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-319
Affected vendors: dji
Affected products: air_2, air_2_firmware, air_2s, air_2s_firmware, fhantom_4_pro, fhantom_4_pro_firmware, fpv, fpv_firmware, inspire_2, inspire_2_firmware, mavic_3, mavic_3_firmware, mini_2, mini_2_firmware, mini_se, mini_se_firmware, rc_pro, rc_pro_firmware, zenmuse_x5s, zenmuse_x5s_firmware, zenmuse_x7, zenmuse_x7_firmware
CVE-2022-29946 (published 2024-07-11)
NATS.io NATS Server before 2.8.2 and Streaming Server before 0.24.6 could allow a remote attacker to bypass security restrictions, caused by the failure to enforce negative user permissions in one scenario. By using a queue subscription on the wildcard, an attacker could exploit this vulnerability to allow denied subjects.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L)
CVE-2022-29947 (published 2022-04-29)
Woodpecker before 0.15.1 allows XSS via build logs because web/src/components/repo/build/BuildLog.vue lacks escaping.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: woodpecker-ci
Affected products: woodpecker
CVE-2022-29948 (published 2022-06-10)
Due to an insecure design, the Lepin EP-KP001 flash drive through KP001_V19 is vulnerable to an authentication bypass attack that enables an attacker to gain access to the stored encrypted data. Normally, the encrypted disk partition with this data is unlocked by entering the correct passcode (6 to 14 digits) via the keypad and pressing the Unlock button. This authentication is performed by an unknown microcontroller. By replacing this microcontroller on a target device with one from an attacker-controlled Lepin EP-KP001 whose passcode is known, it is possible to successfully unlock the target device and read the stored data in cleartext.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Affected vendors: lepin_ep-kp001_project
Affected products: lepin_ep-kp001, lepinep-kp001_firmware
CVE-2022-2995 (published 2022-09-19)
Incorrect handling of the supplementary groups in the CRI-O container engine might lead to sensitive information disclosure or possible data modification if an attacker has direct access to the affected container where supplementary groups are used to set access permissions and is able to execute a binary code in that container.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N)
Weakness: CWE-284
Affected vendors: kubernetes
Affected products: cri-o
CVE-2022-29950 (published 2022-05-04)
Experian Hunter 1.16 allows remote authenticated users to modify assumed-immutable elements via the (1) rule name parameter to the Rules page or the (2) subrule name or (3) categories name parameter to the Subrules page. NOTE: the vendor disputes this because version 1.16 has never existed
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
Affected vendors: experian
Affected products: hunter
CVE-2022-29951 (published 2022-07-26)
JTEKT TOYOPUC PLCs through 2022-04-29 mishandle authentication. They utilize the CMPLink/TCP protocol (configurable on ports 1024-65534 on either TCP or UDP) for a wide variety of engineering purposes such as starting and stopping the PLC, downloading and uploading projects, and changing configuration settings. This protocol does not have any authentication features, allowing any attacker capable of communicating with the port in question to invoke (a subset of) desired functionality.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H)
Weakness: CWE-306
Affected vendors: jtekt
Affected products: nano_10gx_tuc-1157, nano_10gx_tuc-1157_firmware, nano_cpu_tuc-6941, nano_cpu_tuc-6941_firmware, pc10b-p_tcc-6373, pc10b-p_tcc-6373_firmware, pc10b_tcc-1021, pc10b_tcc-1021_firmware, pc10e_tcc-4737, pc10e_tcc-4737_firmware, pc10el_tcc-4747, pc10el_tcc-4747_firmware, pc10g-cpu_tcc-6353, pc10g-cpu_tcc-6353_firmware, pc10ge_tcc-6464, pc10ge_tcc-6464_firmware, pc10p-dp-io_tcc-6752, pc10p-dp-io_tcc-6752_firmware, pc10p-dp_tcc-6726, pc10p-dp_tcc-6726_firmware, pc10p_tcc-6372, pc10p_tcc-6372_firmware, pc10pe-1616p_tcc-1102, pc10pe-1616p_tcc-1102_firmware, pc10pe_tcc-1101
CVE-2022-29952 (published 2022-07-26)
Bently Nevada condition monitoring equipment through 2022-04-29 mishandles authentication. It utilizes the TDI command and data protocols (60005/TCP, 60007/TCP) for communications between the monitoring controller and System 1 and/or Bently Nevada Monitor Configuration (BNMC) software. These protocols provide configuration management and historical data related functionality. Neither protocol has any authentication features, allowing any attacker capable of communicating with the ports in question to invoke (a subset of) desired functionality.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H)
Weakness: CWE-306
Affected vendors: bakerhughes
Affected products: bently_nevada_3701\/40, bently_nevada_3701\/40_firmware, bently_nevada_3701\/44, bently_nevada_3701\/44_firmware, bently_nevada_3701\/46, bently_nevada_3701\/46_firmware, bently_nevada_60m100, bently_nevada_60m100_firmware
CVE-2022-29953 (published 2022-07-26)
The Bently Nevada 3700 series of condition monitoring equipment through 2022-04-29 has a maintenance interface on port 4001/TCP with undocumented, hardcoded credentials. An attacker capable of connecting to this interface can thus trivially take over its functionality.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-798
Affected vendors: bakerhughes
Affected products: bently_nevada_3701\/40, bently_nevada_3701\/40_firmware, bently_nevada_3701\/44, bently_nevada_3701\/44_firmware, bently_nevada_3701\/46, bently_nevada_3701\/46_firmware, bently_nevada_60m100, bently_nevada_60m100_firmware
CVE-2022-29957 (published 2022-07-26)
The Emerson DeltaV Distributed Control System (DCS) through 2022-04-29 mishandles authentication. It utilizes several proprietary protocols for a wide variety of functionality. These protocols include Firmware upgrade (18508/TCP, 18518/TCP); Plug-and-Play (18510/UDP); Hawk services (18507/UDP); Management (18519/TCP); Cold restart (18512/UDP); SIS communications (12345/TCP); and Wireless Gateway Protocol (18515/UDP). None of these protocols have any authentication features, allowing any attacker capable of communicating with the ports in question to invoke (a subset of) desired functionality.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-306
Affected vendors: emerson
Affected products: deltav_distributed_control_system
CVE-2022-29958 (published 2022-07-26)
JTEKT TOYOPUC PLCs through 2022-04-29 do not ensure data integrity. They utilize the unauthenticated CMPLink/TCP protocol for engineering purposes, including downloading projects and control logic to the PLC. Control logic is downloaded to the PLC on a block-by-block basis with a given memory address and a blob of machine code. The logic that is downloaded to the PLC is not cryptographically authenticated, allowing an attacker to execute arbitrary machine code on the PLC's CPU module in the context of the runtime. In the case of the PC10G-CPU, and likely for other CPU modules of the TOYOPUC family, a processor without MPU or MMU is used and this no memory protection or privilege-separation capabilities are available, giving an attacker full control over the CPU.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-345
Affected vendors: jtekt
Affected products: nano_10gx_tuc-1157, nano_10gx_tuc-1157_firmware, nano_cpu_tuc-6941, nano_cpu_tuc-6941_firmware, pc10b-p_tcc-6373, pc10b-p_tcc-6373_firmware, pc10b_tcc-1021, pc10b_tcc-1021_firmware, pc10e_tcc-4737, pc10e_tcc-4737_firmware, pc10el_tcc-4747, pc10el_tcc-4747_firmware, pc10g-cpu_tcc-6353, pc10g-cpu_tcc-6353_firmware, pc10ge_tcc-6464, pc10ge_tcc-6464_firmware, pc10p-dp-io_tcc-6752, pc10p-dp-io_tcc-6752_firmware, pc10p-dp_tcc-6726, pc10p-dp_tcc-6726_firmware, pc10p_tcc-6372, pc10p_tcc-6372_firmware, pc10pe-1616p_tcc-1102, pc10pe-1616p_tcc-1102_firmware, pc10pe_tcc-1101