deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-43866
Published: 2022-12-02
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2021. Notes: none.
CVE: CVE-2021-43867
Published: 2022-12-02
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2021. Notes: none.
CVE: CVE-2021-43868
Published: 2022-12-02
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2021. Notes: none.
CVE: CVE-2021-43869
Published: 2022-12-02
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2021. Notes: none.
CVE: CVE-2021-43870
Published: 2022-12-02
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2021. Notes: none.
CVE: CVE-2021-43871
Published: 2022-12-02
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2021. Notes: none.
CVE: CVE-2021-43872
Published: 2022-12-02
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2021. Notes: none.
CVE: CVE-2021-43873
Published: 2022-12-02
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2021. Notes: none.
CVE: CVE-2021-43874
Published: 2022-12-02
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2021. Notes: none.
CVE: CVE-2022-23465
Published: 2022-12-02
Description: SwiftTerm is a Xterm/VT100 Terminal emulator. Prior to commit a94e6b24d24ce9680ad79884992e1dff8e150a31, an attacker could modify the window title via a certain character escape sequence and then insert it back to the command line in the user's terminal, e.g. when the user views a file containing the malicious sequence, which could allow the attacker to execute arbitrary commands. Version a94e6b24d24ce9680ad79884992e1dff8e150a31 contains a patch for this issue. There are no known workarounds available.
CVSS Score: 7.1 (HIGH)
CWE: CWE-94
References: https://github.com/migueldeicaza/SwiftTerm/commit/a94e6b24d24ce9680ad79884992e1dff8e150a31; https://github.com/migueldeicaza/SwiftTerm/security/advisories/GHSA-jq43-q8mx-r7mq; https://github.com/migueldeicaza/SwiftTerm/commit/a94e6b24d24ce9680ad79884992e1dff8e150a31
CVE: CVE-2022-4272
Published: 2022-12-03
Description: A vulnerability, which was classified as critical, has been found in FeMiner wms. Affected by this issue is some unknown functionality of the file /product/savenewproduct.php?flag=1. The manipulation of the argument upfile leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-214760.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-266, CWE-434
References: http://www.openwall.com/lists/oss-security/2023/04/26/1; https://github.com/FeMiner/wms/issues/14; https://vuldb.com/?id.214760
CVE: CVE-2022-4273
Published: 2022-12-03
Description: A vulnerability, which was classified as critical, has been found in SourceCodester Human Resource Management System 1.0. This issue affects some unknown processing of the file /hrm/controller/employee.php of the component Content-Type Handler. The manipulation of the argument pfimg leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-214769 was assigned to this vulnerability.
CVSS Score: 7.3 (HIGH)
CWE: CWE-266, CWE-434
References: https://github.com/leecybersec/bug-report/tree/main/sourcecodester/oretnom23/hrm/bypass-fileupload-rce; https://vuldb.com/?id.214769; https://github.com/leecybersec/bug-report/tree/main/sourcecodester/oretnom23/hrm/bypass-fileupload-rce
CVE: CVE-2022-3491
Published: 2022-12-03
Description: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0742.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: https://github.com/vim/vim/commit/3558afe9e9e904cabb8475392d859f2d2fc21041; https://huntr.dev/bounties/6e6e05c2-2cf7-4aa5-a817-a62007bf92cb; https://security.gentoo.org/glsa/202305-16
CVE: CVE-2021-37533
Published: 2022-12-03
Description: Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use a different host, but the user has to connect to the malicious server in the first place. This may lead to leakage of information about services running on the private network of the client. The default in version 3.9.0 is now false to ignore such hosts, as cURL does. See https://issues.apache.org/jira/browse/NET-711.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://www.openwall.com/lists/oss-security/2022/12/03/1; https://lists.apache.org/thread/o6yn9r9x6s94v97264hmgol1sf48mvx7; https://lists.debian.org/debian-lts-announce/2022/12/msg00038.html
CVE: CVE-2022-4274
Published: 2022-12-03
Description: A vulnerability, which was classified as critical, was found in House Rental System. Affected is an unknown function of the file /view-property.php. The manipulation of the argument property_id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-214770 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-707, CWE-89
References: https://github.com/nikeshtiwari1/House-Rental-System/issues/6; https://vuldb.com/?id.214770; https://github.com/nikeshtiwari1/House-Rental-System/issues/6
CVE: CVE-2022-4275
Published: 2022-12-03
Description: A vulnerability has been found in House Rental System and classified as critical. Affected by this vulnerability is an unknown functionality of the file search-property.php of the component POST Request Handler. The manipulation of the argument search_property leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-214771.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-707, CWE-89
References: https://github.com/nikeshtiwari1/House-Rental-System/issues/7; https://vuldb.com/?id.214771; https://github.com/nikeshtiwari1/House-Rental-System/issues/7
CVE: CVE-2022-4276
Published: 2022-12-03
Description: A vulnerability was found in House Rental System and classified as critical. Affected by this issue is some unknown functionality of the file tenant-engine.php of the component POST Request Handler. The manipulation of the argument id_photo leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-214772.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-266, CWE-434
References: https://github.com/nikeshtiwari1/House-Rental-System/issues/8; https://vuldb.com/?id.214772; https://github.com/nikeshtiwari1/House-Rental-System/issues/8
CVE: CVE-2022-4277
Published: 2022-12-03
Description: A vulnerability was found in Shaoxing Background Management System. It has been declared as critical. This vulnerability affects unknown code of the file /Default/Bd. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-214774 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-707, CWE-89
References: https://github.com/Peanut886/Vulnerability/blob/main/SQL%20injection%20exists%20in%20the%20background%20management%20system%20Default%20of%20Shaoxing%20Punctuation%20Electronic%20Technology%20Co.%2C%20LTD.md; https://vuldb.com/?id.214774; https://github.com/Peanut886/Vulnerability/blob/main/SQL%20injection%20exists%20in%20the%20background%20management%20system%20Default%20of%20Shaoxing%20Punctuation%20Electronic%20Technology%20Co.%2C%20LTD.md
CVE: CVE-2022-4278
Published: 2022-12-03
Description: A vulnerability was found in SourceCodester Human Resource Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /hrm/employeeadd.php. The manipulation of the argument empid leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-214775.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-707, CWE-89
References: https://github.com/leecybersec/bug-report/tree/main/sourcecodester/oretnom23/hrm/employeeadd-sqli; https://vuldb.com/?id.214775; https://github.com/leecybersec/bug-report/tree/main/sourcecodester/oretnom23/hrm/employeeadd-sqli
CVE: CVE-2022-4279
Published: 2022-12-03
Description: A vulnerability classified as problematic has been found in SourceCodester Human Resource Management System 1.0. Affected is an unknown function of the file /hrm/employeeview.php. The manipulation of the argument search leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-214776.
CVSS Score: 3.5 (LOW)
CWE: CWE-707, CWE-79
References: https://github.com/leecybersec/bug-report/tree/main/sourcecodester/oretnom23/hrm/employee-view-xss; https://vuldb.com/?id.214776; https://github.com/leecybersec/bug-report/tree/main/sourcecodester/oretnom23/hrm/employee-view-xss
CVE: CVE-2022-4280
Published: 2022-12-03
Description: A vulnerability, which was classified as problematic, has been found in Dot Tech Smart Campus System. Affected by this issue is some unknown functionality of the file /services/Card/findUser. The manipulation leads to information disclosure. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-214778 is the identifier assigned to this vulnerability.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-266
References: https://github.com/Peanut886/Vulnerability/blob/main/Information%20leakage%20vulnerability%20exists%20in%20findUser%2C%20a%20smart%20campus%20system%20developed%20by%20Dot%20Tech.md; https://vuldb.com/?id.214778; https://github.com/Peanut886/Vulnerability/blob/main/Information%20leakage%20vulnerability%20exists%20in%20findUser%2C%20a%20smart%20campus%20system%20developed%20by%20Dot%20Tech.md
CVE: CVE-2022-46391
Published: 2022-12-04
Description: AWStats 7.x through 7.8 allows XSS in the hostinfo plugin due to printing a response from Net::XWhois without proper checks.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/eldy/AWStats/pull/226; https://lists.debian.org/debian-lts-announce/2022/12/msg00010.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GRFYH4DE3COMI3LJCOQQXA4FWOABU6Z2/
CVE: CVE-2022-46405
Published: 2022-12-04
Description: Mastodon through 4.0.2 allows attackers to cause a denial of service (large Sidekiq pull queue) by creating bot accounts that follow attacker-controlled accounts on certain other servers associated with a wildcard DNS A record, such that there is uncontrolled recursion of attacker-generated messages.
CVSS Score: 7.5 (HIGH)
CWE: CWE-674, CWE-674
References: https://borg.social/notes/98bcoo2t1n; https://hackmd.io/rD9nsTz1QeuPT-erxqjY-A; https://borg.social/notes/98bcoo2t1n
CVE: CVE-2022-44721
Published: 2022-12-04
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2022-2841. Reason: This issue was MERGED into CVE-2022-2841 in accordance with CVE content decisions, because it is the same type of vulnerability and affects the same versions. Notes: All CVE users should reference CVE-2022-2841 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2022-46410
Published: 2022-12-04
Description: An issue was discovered in Veritas NetBackup Flex Scale through 3.0. An attacker with non-root privileges may escalate privileges to root by using specific commands.
CVSS Score: 8.8 (HIGH)
CWE: CWE-269
References: https://www.veritas.com/content/support/en_US/security/VTS22-019#issue5; https://www.veritas.com/content/support/en_US/security/VTS22-019#issue5
CVE: CVE-2022-46411
Published: 2022-12-04
Description: An issue was discovered in Veritas NetBackup Flex Scale through 3.0 and Access Appliance through 8.0.100. A default password is persisted after installation and may be discovered and used to escalate privileges.
CVSS Score: 8.8 (HIGH)
CWE: CWE-287, CWE-287
References: https://www.veritas.com/content/support/en_US/security/VTS22-019#issue3; https://www.veritas.com/content/support/en_US/security/VTS22-019#issue3
CVE: CVE-2022-46412
Published: 2022-12-04
Description: An issue was discovered in Veritas NetBackup Flex Scale through 3.0. A non-privileged user may escape a restricted shell and execute privileged commands.
CVSS Score: 8.8 (HIGH)
References: https://www.veritas.com/content/support/en_US/security/VTS22-019#issue4; https://www.veritas.com/content/support/en_US/security/VTS22-019#issue4
CVE: CVE-2022-46413
Published: 2022-12-04
Description: An issue was discovered in Veritas NetBackup Flex Scale through 3.0 and Access Appliance through 8.0.100. Authenticated remote command execution can occur via the management portal.
CVSS Score: 8.8 (HIGH)
References: https://www.veritas.com/content/support/en_US/security/VTS22-019#issue2; https://www.veritas.com/content/support/en_US/security/VTS22-019#issue2
CVE: CVE-2022-46414
Published: 2022-12-04
Description: An issue was discovered in Veritas NetBackup Flex Scale through 3.0 and Access Appliance through 8.0.100. Unauthenticated remote command execution can occur via the management portal.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://www.veritas.com/content/support/en_US/security/VTS22-019#issue1; https://www.veritas.com/content/support/en_US/security/VTS22-019#issue1
CVE: CVE-2022-35507
Published: 2022-12-04
Description: A response-header CRLF injection vulnerability in the Proxmox Virtual Environment (PVE) and Proxmox Mail Gateway (PMG) web interface allows a remote attacker to set cookies for a victim's browser that are longer than the server expects, causing a client-side DoS. This affects Chromium-based browsers because they allow injection of response headers with %0d. This is fixed in pve-http-server 4.1-3.
CVSS Score: 7.1 (HIGH)
CWE: CWE-74, CWE-74
References: https://git.proxmox.com/?p=pve-http-server.git%3Ba=commitdiff%3Bh=936007ae[PII_REDACTED]155000486da171379c23c2; https://starlabs.sg/blog/2022/12-multiple-vulnerabilites-in-proxmox-ve--proxmox-mail-gateway/; https://git.proxmox.com/?p=pve-http-server.git%3Ba=commitdiff%3Bh=936007ae[PII_REDACTED]155000486da171379c23c2
CVE: CVE-2022-35508
Published: 2022-12-04
Description: Proxmox Virtual Environment (PVE) and Proxmox Mail Gateway (PMG) are vulnerable to SSRF when proxying HTTP requests between pve(pmg)proxy and pve(pmg)daemon. An attacker with an unprivileged account can craft an HTTP request to achieve SSRF and file disclosure of any files on the server. Also, in Proxmox Mail Gateway, privilege escalation to the root@pam account is possible if the backup feature has ever been used, because backup files such as pmg-backup_YYYY_MM_DD_*.tgz have 0644 permissions and contain an authkey value. This is fixed in pve-http-server 4.1-3.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-918, CWE-918
References: https://git.proxmox.com/?p=pve-http-server.git%3Ba=commitdiff%3Bh=580d540ea907ba15f64379c5bb69ecf1a49a875f; https://git.proxmox.com/?p=pve-http-server.git%3Ba=commitdiff%3Bh=c2bd69c7b5e9c775f96021cf8ae53da3dbd9029d; https://git.proxmox.com/?p=pve-http-server.git%3Ba=commitdiff%3Bh=e9df8a6e76b2a18f89295a5d92a62177bbf0f762
CVE: CVE-2022-35730
Published: 2022-12-04
Description: Cross-Site Request Forgery (CSRF) vulnerability in Oceanwp sticky header plugin <= 1.0.8 on WordPress.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/sticky-header-oceanwp/wordpress-oceanwp-sticky-header-plugin-1-0-8-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/sticky-header-oceanwp/wordpress-oceanwp-sticky-header-plugin-1-0-8-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2022-40968
Published: 2022-12-04
Description: Reflected Cross-Site Scripting (XSS) vulnerability in 2kb Amazon Affiliates Store plugin <=2.1.5 on WordPress.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/2kb-amazon-affiliates-store/wordpress-2kb-amazon-affiliates-store-plugin-2-1-5-auth-stored-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/2kb-amazon-affiliates-store/wordpress-2kb-amazon-affiliates-store-plugin-2-1-5-auth-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2022-41642
Published: 2022-12-05
Description: OS command injection vulnerability in Nadesiko3 (PC Version) v3.3.61 and earlier allows a remote attacker to execute an arbitrary OS command when processing compression and decompression on the product.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://github.com/kujirahand/nadesiko3/issues/1325; https://github.com/kujirahand/nadesiko3/issues/1347; https://jvn.jp/en/jp/JVN56968681/index.html
CVE: CVE-2022-41777
Published: 2022-12-05
Description: Improper check or handling of exceptional conditions vulnerability in Nako3edit, editor component of nadesiko3 (PC Version) v3.3.74 and earlier allows a remote attacker to inject an invalid value to decodeURIComponent of nako3edit, which may lead the server to crash.
CVSS Score: 7.5 (HIGH)
CWE: CWE-703
References: https://github.com/kujirahand/nadesiko3/issues/1325; https://github.com/kujirahand/nadesiko3/issues/1347; https://jvn.jp/en/jp/JVN56968681/index.html
CVE: CVE-2022-41798
Published: 2022-12-05
Description: Session information easily guessable vulnerability exists in Kyocera Document Solutions MFPs and printers, which may allow a network-adjacent attacker to log in to the product by spoofing a user with guessed session information. Affected products/versions are as follows: TASKalfa 7550ci/6550ci, TASKalfa 5550ci/4550ci/3550ci/3050ci, TASKalfa 255c/205c, TASKalfa 256ci/206ci, ECOSYS M6526cdn/M6526cidn, FS-C2126MFP/C2126MFP+/C2026MFP/C2026MFP+, TASKalfa 8000i/6500i, TASKalfa 5500i/4500i/3500i, TASKalfa 305/255, TASKalfa 306i/256i, LS-3140MFP/3140MFP+/3640MFP, ECOSYS M2535dn, LS-1135MFP/1035MFP, LS-C8650DN/C8600DN, ECOSYS P6026cdn, FS-C5250DN, LS-4300DN/4200DN/2100DN, ECOSYS P4040dn, ECOSYS P2135dn, and FS-1370DN.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-290, CWE-290
References: https://jvn.jp/en/jp/JVN46345126/index.html; https://www.kyoceradocumentsolutions.co.jp/support/information/info_20221101.html; https://www.kyoceradocumentsolutions.com/en/our-business/security/information/2022-11-01.html
CVE: CVE-2022-41807
Published: 2022-12-05
Description: Missing authorization vulnerability exists in Kyocera Document Solutions MFPs and printers, which may allow a network-adjacent attacker to alter the product settings without authentication by sending a specially crafted request. Affected products/versions are as follows: TASKalfa 7550ci/6550ci, TASKalfa 5550ci/4550ci/3550ci/3050ci, TASKalfa 255c/205c, TASKalfa 256ci/206ci, ECOSYS M6526cdn/M6526cidn, FS-C2126MFP/C2126MFP+/C2026MFP/C2026MFP+, TASKalfa 8000i/6500i, TASKalfa 5500i/4500i/3500i, TASKalfa 305/255, TASKalfa 306i/256i, LS-3140MFP/3140MFP+/3640MFP, ECOSYS M2535dn, LS-1135MFP/1035MFP, LS-C8650DN/C8600DN, ECOSYS P6026cdn, FS-C5250DN, LS-4300DN/4200DN/2100DN, ECOSYS P4040dn, ECOSYS P2135dn, and FS-1370DN.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://jvn.jp/en/jp/JVN46345126/index.html; https://www.kyoceradocumentsolutions.co.jp/support/information/info_20221101.html; https://www.kyoceradocumentsolutions.com/en/our-business/security/information/2022-11-01.html
CVE: CVE-2022-41830
Published: 2022-12-05
Description: Stored cross-site scripting vulnerability in Kyocera Document Solutions MFPs and printers allows a remote authenticated attacker with an administrative privilege to inject arbitrary script. Affected products/versions are as follows: TASKalfa 7550ci/6550ci, TASKalfa 5550ci/4550ci/3550ci/3050ci, TASKalfa 255c/205c, TASKalfa 256ci/206ci, ECOSYS M6526cdn/M6526cidn, FS-C2126MFP/C2126MFP+/C2026MFP/C2026MFP+, TASKalfa 8000i/6500i, TASKalfa 5500i/4500i/3500i, TASKalfa 305/255, TASKalfa 306i/256i, LS-3140MFP/3140MFP+/3640MFP, ECOSYS M2535dn, LS-1135MFP/1035MFP, LS-C8650DN/C8600DN, ECOSYS P6026cdn, FS-C5250DN, LS-4300DN/4200DN/2100DN, ECOSYS P4040dn, ECOSYS P2135dn, and FS-1370DN.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://jvn.jp/en/jp/JVN46345126/index.html; https://www.kyoceradocumentsolutions.co.jp/support/information/info_20221101.html; https://www.kyoceradocumentsolutions.com/en/our-business/security/information/2022-11-01.html
CVE: CVE-2022-42496
Published: 2022-12-05
Description: OS command injection vulnerability in Nako3edit, editor component of nadesiko3 (PC Version) v3.3.74 and earlier allows a remote attacker to obtain appkey of the product and execute an arbitrary OS command on the product.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://github.com/kujirahand/nadesiko3/issues/1325; https://github.com/kujirahand/nadesiko3/issues/1347; https://jvn.jp/en/jp/JVN56968681/index.html
CVE: CVE-2022-43442
Published: 2022-12-05
Description: Plaintext storage of a password vulnerability exists in +F FS040U software versions v2.3.4 and earlier, which may allow an attacker to obtain the login password of +F FS040U and log in to the management console.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-522, CWE-522
References: https://jvn.jp/en/jp/JVN74285622/index.html; https://www.fsi.co.jp/mobile/plusF/news/22102801.html; https://www.fsi.co.jp/mobile/plusF/news/22102802.html
CVE: CVE-2022-43470
Published: 2022-12-05
Description: Cross-site request forgery (CSRF) vulnerability in +F FS040U software versions v2.3.4 and earlier, +F FS020W software versions v4.0.0 and earlier, +F FS030W software versions v3.3.5 and earlier, and +F FS040W software versions v1.4.1 and earlier allows an adjacent attacker to hijack the authentication of an administrator and user's unintended operations such as to reboot the product and/or reset the configuration to the initial set-up may be performed.
CVSS Score: 7.3 (HIGH)
CWE: CWE-352, CWE-352
References: https://jvn.jp/en/jp/JVN74285622/index.html; https://www.fsi.co.jp/mobile/plusF/news/22102801.html; https://www.fsi.co.jp/mobile/plusF/news/22102802.html
CVE: CVE-2022-43479
Published: 2022-12-05
Description: Open redirect vulnerability in SHIRASAGI v1.14.4 to v1.15.0 allows a remote unauthenticated attacker to redirect users to an arbitrary web site and conduct a phishing attack.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601, CWE-601
References: https://github.com/shirasagi/shirasagi; https://jvn.jp/en/jp/JVN86350682/index.html; https://www.ss-proj.org/