deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-3937
Published: 2022-02-24
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2021. Notes: none
CVE: CVE-2021-3940
Published: 2022-02-24
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2021. Notes: none
CVE: CVE-2021-43724
Published: 2022-02-24
Description: A Cross Site Scripting (XSS) vulnerability exits in Subrion CMS through 4.2.1 in the Create Page functionality of the admin Account via a SGV file.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/intelliants/subrion/issues/890; https://github.com/intelliants/subrion/issues/890
CVE: CVE-2021-44550
Published: 2022-02-24
Description: An Incorrect Access Control vulnerability exists in CoreNLP 4.3.2 via the classifier in NERServlet.java (lines 158 and 159).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-74
References: https://github.com/stanfordnlp/CoreNLP/issues/1222; https://github.com/stanfordnlp/CoreNLP/issues/1222
CVE: CVE-2021-44565
Published: 2022-02-24
Description: A Cross Site Scripting (XSS) vulnerability exists in RosarioSIS before 7.6.1 via the xss_clean function in classes/Security.php, which allows remote malicious users to inject arbitrary JavaScript or HTML. An example of affected components are all Markdown input fields.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://gitlab.com/francoisjacquet/rosariosis/-/blob/mobile/CHANGES.md#changes-in-761; https://gitlab.com/francoisjacquet/rosariosis/-/commit/0f5d1f1d193bc6b711d1644f172579d498ec1636; https://gitlab.com/francoisjacquet/rosariosis/-/issues/307
CVE: CVE-2021-44566
Published: 2022-02-24
Description: A Cross Site Scripting (XSS) vulnerability exists in RosarioSIS before 4.3 via the SanitizeMarkDown function in ProgramFunctions/MarkDownHTML.fnc.php.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://gitlab.com/francoisjacquet/rosariosis/-/blob/mobile/CHANGES_V3_4.md#changes-in-43; https://gitlab.com/francoisjacquet/rosariosis/-/commit/81886abb45a32e802151660de674f084afaef3aa; https://gitlab.com/francoisjacquet/rosariosis/-/issues/259
CVE: CVE-2021-44567
Published: 2022-02-24
Description: An unauthenticated SQL Injection vulnerability exists in RosarioSIS before 7.6.1 via the votes parameter in ProgramFunctions/PortalPollsNotes.fnc.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://gitlab.com/francoisjacquet/rosariosis/-/blob/mobile/CHANGES.md#changes-in-761; https://gitlab.com/francoisjacquet/rosariosis/-/commit/519af055a4fdc1362657d75bca76f9c95a081eaa; https://gitlab.com/francoisjacquet/rosariosis/-/commit/e001430aa9fb53d2502fb6f036f6c51c578d2016
CVE: CVE-2021-44607
Published: 2022-02-24
Description: A Cross Site Scripting (XSS) vulnerability exists in FUEL-CMS 1.5.1 in the Assets page via an SVG file.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/daylightstudio/FUEL-CMS/issues/589; https://github.com/daylightstudio/FUEL-CMS/issues/589
CVE: CVE-2021-44608
Published: 2022-02-24
Description: Multiple Cross Site Scripting (XSS) vulnerabilities exists in bloofoxCMS 0.5.2.1 - 0.5.1 via the (1) file parameter and (2) type parameter in an edit action in index.php.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/alexlang24/bloofoxCMS/issues/12; https://github.com/alexlang24/bloofoxCMS/issues/12
CVE: CVE-2021-44610
Published: 2022-02-24
Description: Multiple SQL Injection vulnerabilities exist in bloofoxCMS 0.5.2.1 - 0.5.1 via the (1) URLs, (2) lang_id, (3) tmpl_id, (4) mod_rewrite (5) eta_doctype. (6) meta_charset, (7) default_group, and (8) page group parameters in the settings mode in admin/index.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/alexlang24/bloofoxCMS/issues/13; https://github.com/alexlang24/bloofoxCMS/issues/13
CVE: CVE-2021-44967
Published: 2022-02-24
Description: A Remote Code Execution (RCE) vulnerabilty exists in LimeSurvey 5.2.4 via the upload and install plugins function, which could let a remote malicious user upload an arbitrary PHP code file. NOTE: the Supplier's position is that plugins intentionally can contain arbitrary PHP code, and can only be installed by a superadmin, and therefore the security model is not violated by this finding.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://github.com/Y1LD1R1M-1337/Limesurvey-RCE; https://www.exploit-db.com/exploits/50573; https://www.limesurvey.org/manual/Plugins_-_advanced
CVE: CVE-2021-45746
Published: 2022-02-24
Description: A Directory Traversal vulnerability exists in WeBankPartners wecube-platform 3.2.1 via the file variable in PluginPackageController.java.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://github.com/WeBankPartners/wecube-platform/issues/2297; https://github.com/WeBankPartners/wecube-platform/issues/2297
CVE: CVE-2021-4029
Published: 2022-02-24
Description: A command injection vulnerability in the CGI program of the Zyxel ARMOR Z1/Z2 firmware could allow an attacker to execute arbitrary OS commands via a LAN interface.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://www.zyxel.com/support/forgery-vulnerabilities-of-select-Armor-home-routers.shtml; https://www.zyxel.com/support/forgery-vulnerabilities-of-select-Armor-home-routers.shtml
CVE: CVE-2021-4030
Published: 2022-02-24
Description: A cross-site request forgery vulnerability in the HTTP daemon of the Zyxel ARMOR Z1/Z2 firmware could allow an attacker to execute arbitrary commands if they coerce or trick a local user to visit a compromised website with malicious scripts.
CVSS Score: 8.0 (HIGH)
CWE: CWE-352, CWE-352
References: https://www.zyxel.com/support/forgery-vulnerabilities-of-select-Armor-home-routers.shtml; https://www.zyxel.com/support/forgery-vulnerabilities-of-select-Armor-home-routers.shtml
CVE: CVE-2022-21142
Published: 2022-02-24
Description: Authentication bypass vulnerability in a-blog cms Ver.2.8.x series versions prior to Ver.2.8.74, Ver.2.9.x series versions prior to Ver.2.9.39, Ver.2.10.x series versions prior to Ver.2.10.43, and Ver.2.11.x series versions prior to Ver.2.11.41 allows a remote unauthenticated attacker to bypass authentication under the specific condition.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-290
References: https://developer.a-blogcms.jp/blog/news/security-202202.html; https://jvn.jp/en/jp/JVN14706307/index.html; https://developer.a-blogcms.jp/blog/news/security-202202.html
CVE: CVE-2022-21179
Published: 2022-02-24
Description: Cross-site request forgery (CSRF) vulnerability in EC-CUBE plugin 'Mail Magazine Management Plugin' ver4.0.0 to 4.1.1 (for EC-CUBE 4 series) and ver1.0.0 to 1.0.4 (for EC-CUBE 3 series) allows a remote unauthenticated attacker to hijack the authentication of an administrator via a specially crafted page, and Mail Magazine Templates and/or transmitted history information may be deleted unintendedly.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://jvn.jp/en/jp/JVN67108459/index.html; https://www.ec-cube.net/info/weakness/20220221/mail_magazine_plugin.php; https://jvn.jp/en/jp/JVN67108459/index.html
CVE: CVE-2022-23043
Published: 2022-02-24
Description: Zenario CMS 9.2 allows an authenticated admin user to bypass the file upload restriction by creating a new 'File/MIME Types' using the '.phar' extension. Then an attacker can upload a malicious file, intercept the request and change the extension to '.phar' in order to run commands on the server.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: https://fluidattacks.com/advisories/simone/; https://github.com/TribalSystems/Zenario/releases/tag/9.2.55826; https://fluidattacks.com/advisories/simone/
CVE: CVE-2022-23176
Published: 2022-02-24
Description: WatchGuard Firebox and XTM appliances allow a remote attacker with unprivileged credentials to access the system with a privileged management session via exposed management access. This vulnerability impacts Fireware OS before 12.7.2_U1, 12.x before 12.1.3_U3, and 12.2.x through 12.5.x before 12.5.7_U3.
CVSS Score: 8.8 (HIGH)
References: https://arstechnica.com/information-technology/2022/04/watchguard-failed-to-disclose-critical-flaw-exploited-by-russian-hackers/; https://securityportal.watchguard.com; https://www.watchguard.com/support/release-notes/fireware/12/en-US/EN_ReleaseNotes_Fireware_12_1_3_U7/index.html#Fireware/en-US/resolved_issues.html
CVE: CVE-2022-23810
Published: 2022-02-24
Description: Template injection (Improper Neutralization of Special Elements Used in a Template Engine) vulnerability in a-blog cms Ver.2.8.x series versions prior to Ver.2.8.75, Ver.2.9.x series versions prior to Ver.2.9.40, Ver.2.10.x series versions prior to Ver.2.10.44, Ver.2.11.x series versions prior to Ver.2.11.42, and Ver.3.0.x series versions prior to Ver.3.0.1 allows a remote authenticated attacker to obtain an arbitrary file on the server via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-94
References: https://developer.a-blogcms.jp/blog/news/security-202202.html; https://jvn.jp/en/jp/JVN14706307/index.html; https://developer.a-blogcms.jp/blog/news/security-202202.html
CVE: CVE-2022-23916
Published: 2022-02-24
Description: Cross-site scripting vulnerability in a-blog cms Ver.2.8.x series versions prior to Ver.2.8.75, Ver.2.9.x series versions prior to Ver.2.9.40, Ver.2.10.x series versions prior to Ver.2.10.44, Ver.2.11.x series versions prior to Ver.2.11.42, and Ver.3.0.x series versions prior to Ver.3.0.1 allows a remote authenticated attacker to inject an arbitrary script via unspecified vectors. This vulnerability is different from CVE-2022-24374.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://developer.a-blogcms.jp/blog/news/security-202202.html; https://jvn.jp/en/jp/JVN14706307/index.html; https://developer.a-blogcms.jp/blog/news/security-202202.html
CVE: CVE-2022-23986
Published: 2022-02-24
Description: SQL injection vulnerability in the phpUploader v1.2 and earlier allows a remote unauthenticated attacker to obtain the information in the database via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://github.com/shimosyan/phpUploader/releases/tag/v1.2.1; https://jvn.jp/en/jp/JVN00095004/index.html; https://github.com/shimosyan/phpUploader/releases/tag/v1.2.1
CVE: CVE-2022-24374
Published: 2022-02-24
Description: Cross-site scripting vulnerability in a-blog cms Ver.2.8.x series versions prior to Ver.2.8.75, Ver.2.9.x series versions prior to Ver.2.9.40, Ver.2.10.x series versions prior to Ver.2.10.44, Ver.2.11.x series versions prior to Ver.2.11.42, and Ver.3.0.x series versions prior to Ver.3.0.1 allows a remote authenticated attacker to inject an arbitrary script via unspecified vectors. This vulnerability is different from CVE-2022-23916.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://developer.a-blogcms.jp/blog/news/security-202202.html; https://jvn.jp/en/jp/JVN14706307/index.html; https://developer.a-blogcms.jp/blog/news/security-202202.html
CVE: CVE-2022-24407
Published: 2022-02-24
Description: In Cyrus SASL 2.1.17 through 2.1.27 before 2.1.28, plugins/sql.c does not escape the password for a SQL INSERT or UPDATE statement.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: http://www.openwall.com/lists/oss-security/2022/02/23/4; https://github.com/cyrusimap/cyrus-sasl/blob/fdcd13ceaef8de684dc69008011fa865c5b4a3ac/docsrc/sasl/release-notes/2.1/index.rst; https://lists.debian.org/debian-lts-announce/2022/03/msg00002.html
CVE: CVE-2022-24435
Published: 2022-02-24
Description: Cross-site scripting vulnerability in phpUploader v1.2 and earlier allows a remote unauthenticated attacker to inject an arbitrary script via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/shimosyan/phpUploader/releases/tag/v1.2.1; https://jvn.jp/en/jp/JVN00095004/index.html; https://github.com/shimosyan/phpUploader/releases/tag/v1.2.1
CVE: CVE-2022-24565
Published: 2022-02-24
Description: Checkmk <=2.0.0p19 Fixed in 2.0.0p20 and Checkmk <=1.6.0p27 Fixed in 1.6.0p28 are affected by a Cross Site Scripting (XSS) vulnerability. The Alias of a site was not properly escaped when shown as condition for notifications.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://checkmk.com/werk/13716; https://checkmk.com/werk/13716
CVE: CVE-2022-24566
Published: 2022-02-24
Description: In Checkmk <=2.0.0p19 fixed in 2.0.0p20 and Checkmk <=1.6.0p27 fixed in 1.6.0p28, the title of a Predefined condition is not properly escaped when shown as condition, which can result in Cross Site Scripting (XSS).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://checkmk.com/werk/13717; https://checkmk.com/werk/13717
CVE: CVE-2022-24582
Published: 2022-02-24
Description: Accounting Journal Management 1.0 is vulnerable to XSS-PHPSESSID-Hijacking. The parameter manage_user from User lists is vulnerable to XSS-Stored and PHPSESSID attacks. The malicious user can attack the system by using the already session which he has from inside and outside of the network.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/2022/Accounting-Journal-Management; https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/2022/Accounting-Journal-Management
CVE: CVE-2022-24599
Published: 2022-02-24
Description: In autofile Audio File Library 0.3.6, there exists one memory leak vulnerability in printfileinfo, in printinfo.c, which allows an attacker to leak sensitive information via a crafted file. The printfileinfo function calls the copyrightstring function to get data, however, it dosn't use zero bytes to truncate the data.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-401
References: https://github.com/mpruett/audiofile/issues/60; https://lists.debian.org/debian-lts-announce/2023/11/msg00006.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N4JXZ6QAMA3TSRY6GUZRY3WTHR7P5TPH/
CVE: CVE-2022-24610
Published: 2022-02-24
Description: Settings/network settings/wireless settings on the Alecto DVC-215IP camera version 63.1.1.173 and below shows the Wi-Fi passphrase hidden, but by editing/removing the style of the password field the password becomes visible which grants access to an internal network connected to the camera.
CVSS Score: 8.6 (HIGH)
CWE: CWE-522
References: https://support.alecto.nl/nl/support/solutions/articles/[PII_REDACTED]1-kwetsbaarheid-vulnerability-firmware-below-version-63-1-1-173; https://support.alecto.nl/nl/support/solutions/articles/[PII_REDACTED]1-kwetsbaarheid-vulnerability-firmware-below-version-63-1-1-173
CVE: CVE-2022-24613
Published: 2022-02-24
Description: metadata-extractor up to 2.16.0 can throw various uncaught exceptions while parsing a specially crafted JPEG file, which could result in an application crash. This could be used to mount a denial of service attack against services that use metadata-extractor library.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-755
References: https://github.com/drewnoakes/metadata-extractor/issues/561; https://github.com/drewnoakes/metadata-extractor/issues/561
CVE: CVE-2022-24614
Published: 2022-02-24
Description: When reading a specially crafted JPEG file, metadata-extractor up to 2.16.0 can be made to allocate large amounts of memory that finally leads to an out-of-memory error even for very small inputs. This could be used to mount a denial of service attack against services that use metadata-extractor library.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-770
References: https://github.com/drewnoakes/metadata-extractor/issues/561; https://github.com/drewnoakes/metadata-extractor/issues/561
CVE: CVE-2022-24615
Published: 2022-02-24
Description: zip4j up to v2.10.0 can throw various uncaught exceptions while parsing a specially crafted ZIP file, which could result in an application crash. This could be used to mount a denial of service attack against services that use zip4j library.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-755
References: https://github.com/srikanth-lingala/zip4j/issues/377; https://github.com/srikanth-lingala/zip4j/issues/418; https://github.com/srikanth-lingala/zip4j/issues/377
CVE: CVE-2022-24620
Published: 2022-02-24
Description: Piwigo version 12.2.0 is vulnerable to stored cross-site scripting (XSS), which can lead to privilege escalation. In this way, admin can steal webmaster's cookies to get the webmaster's access.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/Piwigo/Piwigo/issues/1605; https://github.com/Piwigo/Piwigo/issues/1605
CVE: CVE-2022-24633
Published: 2022-02-24
Description: All versions of FileCloud prior to 21.3 are vulnerable to user enumeration. The vulnerability exists in the parameter "path" passing "/SHARED/<username>". A malicious actor could identify the existence of users by requesting share information on specified share paths.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://www.filecloud.com/supportdocs/display/cloud/Advisory+2022-01-1+User+enumeration+vulnerability; https://www.filecloud.com/supportdocs/display/cloud/Advisory+2022-01-1+User+enumeration+vulnerability
CVE: CVE-2022-25072
Published: 2022-02-24
Description: TP-Link Archer A54 Archer A54(US)_V1_210111 routers were discovered to contain a stack overflow in the function DM_ Fillobjbystr(). This vulnerability allows unauthenticated attackers to execute arbitrary code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/EPhaha/IOT_vuln/tree/main/TP-Link/Archer%20A54; https://github.com/EPhaha/IOT_vuln/tree/main/TP-Link/Archer%20A54
CVE: CVE-2022-25073
Published: 2022-02-24
Description: TL-WR841Nv14_US_0.9.1_4.18 routers were discovered to contain a stack overflow in the function dm_fillObjByStr(). This vulnerability allows unauthenticated attackers to execute arbitrary code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/EPhaha/IOT_vuln/tree/main/TP-Link/TL-WR841N; https://github.com/EPhaha/IOT_vuln/tree/main/TP-Link/TL-WR841N
CVE: CVE-2022-25074
Published: 2022-02-24
Description: TP-Link TL-WR902AC(US)_V3_191209 routers were discovered to contain a stack overflow in the function DM_ Fillobjbystr(). This vulnerability allows unauthenticated attackers to execute arbitrary code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/EPhaha/IOT_vuln/tree/main/TP-Link/TL-WR902AC; https://github.com/EPhaha/IOT_vuln/tree/main/TP-Link/TL-WR902AC
CVE: CVE-2022-25075
Published: 2022-02-24
Description: TOTOLink A3000RU V5.9c.2280_B20180512 was discovered to contain a command injection vulnerability in the "Main" function. This vulnerability allows attackers to execute arbitrary commands via the QUERY_STRING parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/EPhaha/IOT_vuln/blob/main/TOTOLink/A3000RU/README.md; https://github.com/EPhaha/IOT_vuln/blob/main/TOTOLink/A3000RU/README.md
CVE: CVE-2022-25076
Published: 2022-02-24
Description: TOTOLink A800R V4.1.2cu.5137_B20200730 was discovered to contain a command injection vulnerability in the "Main" function. This vulnerability allows attackers to execute arbitrary commands via the QUERY_STRING parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/EPhaha/IOT_vuln/blob/main/TOTOLink/A800R/README.md; https://github.com/EPhaha/IOT_vuln/blob/main/TOTOLink/A800R/README.md
CVE: CVE-2022-25077
Published: 2022-02-24
Description: TOTOLink A3100R V4.1.2cu.5050_B20200504 was discovered to contain a command injection vulnerability in the "Main" function. This vulnerability allows attackers to execute arbitrary commands via the QUERY_STRING parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/EPhaha/IOT_vuln/blob/main/TOTOLink/A3100R/README.md; https://github.com/EPhaha/IOT_vuln/blob/main/TOTOLink/A3100R/README.md
CVE: CVE-2022-25078
Published: 2022-02-24
Description: TOTOLink A3600R V4.1.2cu.5182_B20201102 was discovered to contain a command injection vulnerability in the "Main" function. This vulnerability allows attackers to execute arbitrary commands via the QUERY_STRING parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/EPhaha/IOT_vuln/blob/main/TOTOLink/A3600R/README.md; https://github.com/EPhaha/IOT_vuln/blob/main/TOTOLink/A3600R/README.md
CVE: CVE-2022-25079
Published: 2022-02-24
Description: TOTOLink A810R V4.1.2cu.5182_B20201026 was discovered to contain a command injection vulnerability in the "Main" function. This vulnerability allows attackers to execute arbitrary commands via the QUERY_STRING parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/EPhaha/IOT_vuln/blob/main/TOTOLink/A810R/README.md; https://github.com/EPhaha/IOT_vuln/blob/main/TOTOLink/A810R/README.md
CVE: CVE-2022-25080
Published: 2022-02-24
Description: TOTOLink A830R V5.9c.4729_B20191112 was discovered to contain a command injection vulnerability in the "Main" function. This vulnerability allows attackers to execute arbitrary commands via the QUERY_STRING parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/EPhaha/IOT_vuln/blob/main/TOTOLink/A830R/README.md; https://github.com/EPhaha/IOT_vuln/blob/main/TOTOLink/A830R/README.md
CVE: CVE-2022-25081
Published: 2022-02-24
Description: TOTOLink T10 V5.9c.5061_B20200511 was discovered to contain a command injection vulnerability in the "Main" function. This vulnerability allows attackers to execute arbitrary commands via the QUERY_STRING parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/EPhaha/IOT_vuln/blob/main/TOTOLink/T10/README.md; https://github.com/EPhaha/IOT_vuln/blob/main/TOTOLink/T10/README.md
CVE: CVE-2022-25082
Published: 2022-02-24
Description: TOTOLink A950RG V5.9c.4050_B20190424 and V4.1.2cu.5204_B20210112 were discovered to contain a command injection vulnerability in the "Main" function. This vulnerability allows attackers to execute arbitrary commands via the QUERY_STRING parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/EPhaha/IOT_vuln/blob/main/TOTOLink/A950RG/README.md; https://github.com/EPhaha/IOT_vuln/blob/main/TOTOLink/A950RG/README.md
CVE: CVE-2022-25083
Published: 2022-02-24
Description: TOTOLink A860R V4.1.2cu.5182_B20201027 was discovered to contain a command injection vulnerability in the "Main" function. This vulnerability allows attackers to execute arbitrary commands via the QUERY_STRING parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/EPhaha/IOT_vuln/blob/main/TOTOLink/A860R/README.md; https://github.com/EPhaha/IOT_vuln/blob/main/TOTOLink/A860R/README.md
CVE: CVE-2022-25084
Published: 2022-02-24
Description: TOTOLink T6 V5.9c.4085_B20190428 was discovered to contain a command injection vulnerability in the "Main" function. This vulnerability allows attackers to execute arbitrary commands via the QUERY_STRING parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/EPhaha/IOT_vuln/blob/main/TOTOLink/T6/README.md; https://github.com/EPhaha/IOT_vuln/blob/main/TOTOLink/T6/README.md
CVE: CVE-2022-25098
Published: 2022-02-24
Description: ECTouch v2 suffers from arbitrary file deletion due to insufficient filtering of the filename parameter.
CVSS Score: 9.1 (CRITICAL)
References: https://github.com/dota-st/Vulnerability/blob/master/ECTouchV2.md; https://github.com/dota-st/Vulnerability/blob/master/ECTouchV2.md
CVE: CVE-2022-25099
Published: 2022-02-24
Description: A vulnerability in the component /languages/index.php of WBCE CMS v1.5.2 allows attackers to execute arbitrary code via a crafted PHP file.
CVSS Score: 7.8 (HIGH)
References: https://github.com/dota-st/Vulnerability/blob/master/WBCE_CMS.md; https://github.com/dota-st/Vulnerability/blob/master/WBCE_CMS.md
CVE: CVE-2022-25101
Published: 2022-02-24
Description: A vulnerability in the component /templates/install.php of WBCE CMS v1.5.2 allows attackers to execute arbitrary code via a crafted PHP file.
CVSS Score: 7.8 (HIGH)
References: https://github.com/dota-st/Vulnerability/blob/master/WBCE_CMS_second.md; https://github.com/dota-st/Vulnerability/blob/master/WBCE_CMS_second.md