deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-2480
Published: 2022-07-28
Description: Use after free in Service Worker API in Google Chrome prior to 103.0.5060.134 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://packetstormsecurity.com/files/168115/Chrome-content-ServiceWorkerVersion-MaybeTimeoutRequest-Heap-Use-After-Free.html; https://chromereleases.googleblog.com/2022/07/stable-channel-update-for-desktop_19.html; https://crbug.com/1339844
CVE: CVE-2022-2481
Published: 2022-07-28
Description: Use after free in Views in Google Chrome prior to 103.0.5060.134 allowed a remote attacker who convinced a user to engage in specific user interactions to potentially exploit heap corruption via UI interaction.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2022/07/stable-channel-update-for-desktop_19.html; https://crbug.com/1341603; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PQKT7EGDD2P3L7S3NXEDDRCPK4NNZNWJ/
CVE: CVE-2022-27615
Published: 2022-07-28
Description: Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in cgi component in Synology DNS Server before 2.2.2-5027 allows remote authenticated users to delete arbitrary files via unspecified vectors.
CVSS Score: 7.7 (HIGH)
CWE: CWE-22
References: https://www.synology.com/security/advisory/Synology_SA_20_27; https://www.synology.com/security/advisory/Synology_SA_20_27
CVE: CVE-2022-31627
Published: 2022-07-28
Description: In PHP versions 8.1.x below 8.1.8, when fileinfo functions, such as finfo_buffer, due to incorrect patch applied to the third party code from libmagic, incorrect function may be used to free allocated memory, which may lead to heap corruption.
CVSS Score: 7.7 (HIGH)
CWE: CWE-590, CWE-787
References: https://bugs.php.net/bug.php?id=81723; https://security.gentoo.org/glsa/202209-20; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2022-22683
Published: 2022-07-28
Description: Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in cgi component in Synology Media Server before 1.8.1-2876 allows remote attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-120
References: https://www.synology.com/security/advisory/Synology_SA_20_24; https://www.synology.com/security/advisory/Synology_SA_20_24
CVE: CVE-2022-22684
Published: 2022-07-28
Description: Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in task management component in Synology DiskStation Manager (DSM) before 6.2.4-25553 allows remote authenticated users to execute arbitrary commands via unspecified vectors.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://www.synology.com/security/advisory/Synology_SA_21_03; https://www.synology.com/security/advisory/Synology_SA_21_03
CVE: CVE-2022-22685
Published: 2022-07-28
Description: Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology WebDAV Server before 2.4.0-0062 allows remote authenticated users to delete arbitrary files via unspecified vectors.
CVSS Score: 8.7 (HIGH)
CWE: CWE-22
References: https://www.synology.com/security/advisory/Synology_SA_21_09; https://www.synology.com/security/advisory/Synology_SA_21_09
CVE: CVE-2022-27612
Published: 2022-07-28
Description: Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in cgi component in Synology Audio Station before 6.5.4-3367 allows remote attackers to execute arbitrary commands via unspecified vectors.
CVSS Score: 7.3 (HIGH)
CWE: CWE-120, CWE-120
References: https://www.synology.com/security/advisory/Synology_SA_21_21; https://www.synology.com/security/advisory/Synology_SA_21_21
CVE: CVE-2022-27613
Published: 2022-07-28
Description: Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in webapi component in Synology CardDAV Server before 6.0.10-0153 allows remote authenticated users to inject SQL commands via unspecified vectors.
CVSS Score: 8.3 (HIGH)
CWE: CWE-89
References: https://www.synology.com/security/advisory/Synology_SA_21_06; https://www.synology.com/security/advisory/Synology_SA_21_06
CVE: CVE-2022-27614
Published: 2022-07-28
Description: Exposure of sensitive information to an unauthorized actor vulnerability in web server in Synology Media Server before 1.8.1-2876 allows remote attackers to obtain sensitive information via unspecified vectors.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://www.synology.com/security/advisory/Synology_SA_20_24; https://www.synology.com/security/advisory/Synology_SA_20_24
CVE: CVE-2022-27611
Published: 2022-07-28
Description: Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology Audio Station before 6.5.4-3367 allows remote authenticated users to delete arbitrary files via unspecified vectors.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-22
References: https://www.synology.com/security/advisory/Synology_SA_21_21; https://www.synology.com/security/advisory/Synology_SA_21_21
CVE: CVE-2022-36364
Published: 2022-07-28
Description: Apache Calcite Avatica JDBC driver creates HTTP client instances based on class names provided via `httpclient_impl` connection property; however, the driver does not verify if the class implements the expected interface before instantiating it, which can lead to code execution loaded via arbitrary classes and in rare cases remote code execution. To exploit the vulnerability: 1) the attacker needs to have privileges to control JDBC connection parameters; 2) and there should be a vulnerable class (constructor with URL parameter and ability to execute code) in the classpath. From Apache Calcite Avatica 1.22.0 onwards, it will be verified that the class implements the expected interface before invoking its constructor.
CVSS Score: 8.8 (HIGH)
CWE: CWE-665, CWE-665
References: http://www.openwall.com/lists/oss-security/2022/07/28/1; https://lists.apache.org/thread/5csdj8bv4h3hfgw27okm84jh1j2fyw0c; http://www.openwall.com/lists/oss-security/2022/07/28/1
CVE: CVE-2022-37009
Published: 2022-07-28
Description: In JetBrains IntelliJ IDEA before 2022.2 local code execution via a Vagrant executable was possible
CVSS Score: 3.9 (LOW)
CWE: CWE-94, CWE-94
References: https://www.jetbrains.com/privacy-security/issues-fixed/; https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2022-37010
Published: 2022-07-28
Description: In JetBrains IntelliJ IDEA before 2022.2 email address validation in the "Git User Name Is Not Defined" dialog was missed
CVSS Score: 3.6 (LOW)
CWE: CWE-20, CWE-20
References: https://www.jetbrains.com/privacy-security/issues-fixed/; https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2022-27509
Published: 2022-07-28
Description: Unauthenticated redirection to a malicious website
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://support.citrix.com/article/CTX457836; https://support.citrix.com/article/CTX457836
CVE: CVE-2016-2138
Published: 2022-07-28
Description: In kippo-graph before version 1.5.1, there is a cross-site scripting vulnerability in xss_clean() in class/KippoInput.class.php.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/ikoniaris/kippo-graph/commit/e6587ec[PII_REDACTED]10b70c8bd0a72f7951b4997; https://github.com/ikoniaris/kippo-graph/issues/35; https://github.com/ikoniaris/kippo-graph/commit/e6587ec[PII_REDACTED]10b70c8bd0a72f7951b4997
CVE: CVE-2016-2139
Published: 2022-07-28
Description: In kippo-graph before version 1.5.1, there is a cross-site scripting vulnerability in $file_link in class/KippoInput.class.php.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/ikoniaris/kippo-graph/commit/e6587ec[PII_REDACTED]10b70c8bd0a72f7951b4997; https://github.com/ikoniaris/kippo-graph/issues/35; https://github.com/ikoniaris/kippo-graph/commit/e6587ec[PII_REDACTED]10b70c8bd0a72f7951b4997
CVE: CVE-2021-22640
Published: 2022-07-28
Description: An attacker can decrypt the Ovarro TBox login password by communication capture and brute force attacks.
CVSS Score: 7.5 (HIGH)
CWE: CWE-294, CWE-307, CWE-522
References: https://www.cisa.gov/uscert/ics/advisories/icsa-21-054-04; https://www.cisa.gov/uscert/ics/advisories/icsa-21-054-04
CVE: CVE-2021-22642
Published: 2022-07-28
Description: An attacker could use specially crafted invalid Modbus frames to crash the Ovarro TBox system.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-400
References: https://www.cisa.gov/uscert/ics/advisories/icsa-21-054-04; https://www.cisa.gov/uscert/ics/advisories/icsa-21-054-04
CVE: CVE-2021-22644
Published: 2022-07-28
Description: Ovarro TBox TWinSoft uses the custom hardcoded user “TWinSoft” with a hardcoded key.
CVSS Score: 7.5 (HIGH)
CWE: CWE-798, CWE-321
References: https://www.cisa.gov/uscert/ics/advisories/icsa-21-054-04; https://www.cisa.gov/uscert/ics/advisories/icsa-21-054-04
CVE: CVE-2021-22646
Published: 2022-07-28
Description: The “ipk” package containing the configuration created by TWinSoft can be uploaded, extracted, and executed in Ovarro TBox, allowing malicious code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: https://www.cisa.gov/uscert/ics/advisories/icsa-21-054-04; https://www.cisa.gov/uscert/ics/advisories/icsa-21-054-04
CVE: CVE-2021-22648
Published: 2022-07-28
Description: Ovarro TBox proprietary Modbus file access functions allow attackers to read, alter, or delete the configuration file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-732, CWE-732
References: https://www.cisa.gov/uscert/ics/advisories/icsa-21-054-04; https://www.cisa.gov/uscert/ics/advisories/icsa-21-054-04
CVE: CVE-2021-22650
Published: 2022-07-28
Description: An attacker may use TWinSoft and a malicious source project file (TPG) to extract files on machine executing Ovarro TWinSoft, which could lead to code execution.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-23
References: https://www.cisa.gov/uscert/ics/advisories/icsa-21-054-04; https://www.cisa.gov/uscert/ics/advisories/icsa-21-054-04
CVE: CVE-2022-1805
Published: 2022-07-28
Description: When connecting to Amazon Workspaces, the SHA256 presented by AWS connection provisioner is not fully verified by Zero Clients. The issue could be exploited by an adversary that places a MITM (Man in the Middle) between a zero client and AWS session provisioner in the network. This issue is only applicable when connecting to an Amazon Workspace from a PCoIP Zero Client.
CVSS Score: 8.1 (HIGH)
CWE: CWE-295
References: https://support.hp.com/us-en/document/ish_6[PII_REDACTED]930-16/hpsbhf03794; https://support.hp.com/us-en/document/ish_6[PII_REDACTED]930-16/hpsbhf03794
CVE: CVE-2022-1948
Published: 2022-07-28
Description: An issue has been discovered in GitLab affecting all versions starting from 15.0 before 15.0.1. Missing validation of input used in quick actions allowed an attacker to exploit XSS by injecting HTML in contact details.
CVSS Score: 8.7 (HIGH)
CWE: CWE-79
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1948.json; https://gitlab.com/gitlab-org/security/gitlab/-/issues/673; https://hackerone.com/reports/1578400
CVE: CVE-2022-2553
Published: 2022-07-28
Description: The authfile directive in the booth config file is ignored, preventing use of authentication in communications from node to node. As a result, nodes that do not have the correct authentication key are not prevented from communicating with other nodes in the cluster.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-287, CWE-287
References: https://github.com/ClusterLabs/booth/commit/35bf0b7b048d715f671eb68974fb6b4af6528c67; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J4T4TTXAABVUCMPUL7XQ2PH5EYYOOQZY/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OHDOFX7NQFH3UGZZA3SGW5SVMDDHIUVD/
CVE: CVE-2022-35882
Published: 2022-07-28
Description: Authenticated (author or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in GS Plugins GS Testimonial Slider plugin <= 1.9.5 at WordPress.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/gs-testimonial/wordpress-gs-testimonial-slider-plugin-1-9-1-authenticated-stored-cross-site-scripting-xss-vulnerability; https://wordpress.org/plugins/gs-testimonial/#developers; https://patchstack.com/database/vulnerability/gs-testimonial/wordpress-gs-testimonial-slider-plugin-1-9-1-authenticated-stored-cross-site-scripting-xss-vulnerability
CVE: CVE-2022-30313
Published: 2022-07-28
Description: Honeywell Experion PKS Safety Manager through 2022-05-06 has Missing Authentication for a Critical Function. According to FSCT-2022-0051, there is a Honeywell Experion PKS Safety Manager multiple proprietary protocols with unauthenticated functionality issue. The affected components are characterized as: Honeywell Experion TCP (51000/TCP), Safety Builder (51010/TCP). The potential impact is: Manipulate controller state, Manipulate controller configuration, Manipulate controller logic, Manipulate controller files, Manipulate IO. The Honeywell Experion PKS Distributed Control System (DCS) Safety Manager utilizes several proprietary protocols for a wide variety of functionality, including process data acquisition, controller steering and configuration management. These protocols include: Experion TCP (51000/TCP) and Safety Builder (51010/TCP). None of these protocols have any authentication features, allowing any attacker capable of communicating with the ports in question to invoke (a subset of) desired functionality. There is no authentication functionality on the protocols in question. An attacker capable of invoking the protocols' functionalities could achieve a wide range of adverse impacts, including (but not limited to), the following: for Experion TCP (51000/TCP): Issue IO manipulation commands, Issue file read/write commands; and for Safety Builder (51010/TCP): Issue controller start/stop commands, Issue logic download/upload commands, Issue file read commands, Issue system time change commands. A mitigating factor with regards to some, but not all, of the above functionality is that these require the Safety Manager physical keyswitch to be in the right position.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-207-02; https://www.forescout.com/blog/; https://www.cisa.gov/uscert/ics/advisories/icsa-22-207-02
CVE: CVE-2022-30314
Published: 2022-07-28
Description: Honeywell Experion PKS Safety Manager 5.02 uses Hard-coded Credentials. According to FSCT-2022-0052, there is a Honeywell Experion PKS Safety Manager hardcoded credentials issue. The affected components are characterized as: POLO bootloader. The potential impact is: Manipulate firmware. The Honeywell Experion PKS Safety Manager utilizes the DCOM-232/485 serial interface for firmware management purposes. When booting, the Safety Manager exposes the Enea POLO bootloader via this interface. Access to the boot configuration is controlled by means of credentials hardcoded in the Safety Manager firmware. The credentials for the bootloader are hardcoded in the firmware. An attacker with access to the serial interface (either through physical access, a compromised EWS or an exposed serial-to-ethernet gateway) can utilize these credentials to control the boot process and manipulate the unauthenticated firmware image (see FSCT-2022-0054).
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-798
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-207-02; https://www.forescout.com/blog/; https://www.cisa.gov/uscert/ics/advisories/icsa-22-207-02
CVE: CVE-2022-30315
Published: 2022-07-28
Description: Honeywell Experion PKS Safety Manager (SM and FSC) through 2022-05-06 has Insufficient Verification of Data Authenticity. According to FSCT-2022-0053, there is a Honeywell Experion PKS Safety Manager insufficient logic security controls issue. The affected components are characterized as: Honeywell FSC runtime (FSC-CPU, QPP), Honeywell Safety Builder. The potential impact is: Remote Code Execution, Denial of Service. The Honeywell Experion PKS Safety Manager family of safety controllers utilize the unauthenticated Safety Builder protocol (FSCT-2022-0051) for engineering purposes, including downloading projects and control logic to the controller. Control logic is downloaded to the controller on a block-by-block basis. The logic that is downloaded consists of FLD code compiled to native machine code for the CPU module (which applies to both the Safety Manager and FSC families). Since this logic does not seem to be cryptographically authenticated, it allows an attacker capable of triggering a logic download to execute arbitrary machine code on the controller's CPU module in the context of the runtime. While the researchers could not verify this in detail, the researchers believe that the microprocessor underpinning the FSC and Safety Manager CPU modules is incapable of offering memory protection or privilege separation capabilities which would give an attacker full control of the CPU module. There is no authentication on control logic downloaded to the controller. Memory protection and privilege separation capabilities for the runtime are possibly lacking. The researchers confirmed the issues in question on Safety Manager R145.1 and R152.2 but suspect the issue affects all FSC and SM controllers and associated Safety Builder versions regardless of software or firmware revision. An attacker who can communicate with a Safety Manager controller via the Safety Builder protocol can execute arbitrary code without restrictions on the CPU module, allowing for covert manipulation of control operations and implanting capabilities similar to the TRITON malware (MITRE ATT&CK software ID S1009). A mitigating factor with regards to some, but not all, of the above functionality is that these require the Safety Manager physical keyswitch to be in the right position.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-345
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-207-02; https://www.forescout.com/blog/; https://www.cisa.gov/uscert/ics/advisories/icsa-22-207-02
CVE: CVE-2022-30316
Published: 2022-07-28
Description: Honeywell Experion PKS Safety Manager 5.02 has Insufficient Verification of Data Authenticity. According to FSCT-2022-0054, there is a Honeywell Experion PKS Safety Manager unauthenticated firmware update issue. The affected components are characterized as: Firmware update functionality. The potential impact is: Firmware manipulation. The Honeywell Experion PKS Safety Manager utilizes the DCOM-232/485 communication FTA serial interface and Enea POLO bootloader for firmware management purposes. An engineering workstation running the Safety Builder software communicates via serial or serial-over-ethernet link with the DCOM-232/485 interface. Firmware images were found to have no authentication (in the form of firmware signing) and only relied on insecure checksums for regular integrity checks. Firmware images are unsigned. An attacker with access to the serial interface (either through physical access, a compromised EWS or an exposed serial-to-ethernet gateway) can utilize hardcoded credentials (see FSCT-2022-0052) for the POLO bootloader to control the boot process and push malicious firmware images to the controller allowing for firmware manipulation, remote code execution and denial of service impacts. A mitigating factor is that in order for a firmware update to be initiated, the Safety Manager has to be rebooted which is typically done by means of physical controls on the Safety Manager itself. As such, an attacker would have to either lay dormant until a legitimate reboot occurs or possibly attempt to force a reboot through a secondary vulnerability.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-354
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-207-02; https://www.forescout.com/blog/; https://www.cisa.gov/uscert/ics/advisories/icsa-22-207-02
CVE: CVE-2022-30319
Published: 2022-07-28
Description: Saia Burgess Controls (SBC) PCD through 2022-05-06 allows Authentication bypass. According to FSCT-2022-0062, there is a Saia Burgess Controls (SBC) PCD S-Bus authentication bypass issue. The affected components are characterized as: S-Bus (5050/UDP) authentication. The potential impact is: Authentication bypass. The Saia Burgess Controls (SBC) PCD controllers utilize the S-Bus protocol (5050/UDP) for a variety of engineering purposes. It is possible to configure a password in order to restrict access to sensitive engineering functionality. Authentication functions on the basis of a MAC/IP whitelist with inactivity timeout to which an authenticated client's MAC/IP is stored. UDP traffic can be spoofed to bypass the whitelist-based access control. Since UDP is stateless, an attacker capable of passively observing traffic can spoof arbitrary messages using the MAC/IP of an authenticated client. This allows the attacker access to sensitive engineering functionality such as uploading/downloading control logic and manipulating controller configuration.
CVSS Score: 8.1 (HIGH)
CWE: CWE-290
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-207-03; https://www.forescout.com/blog/; https://www.cisa.gov/uscert/ics/advisories/icsa-22-207-03
CVE: CVE-2022-30320
Published: 2022-07-28
Description: Saia Burgess Controls (SBC) PCD through 2022-05-06 uses a Broken or Risky Cryptographic Algorithm. According to FSCT-2022-0063, there is a Saia Burgess Controls (SBC) PCD S-Bus weak credential hashing scheme issue. The affected components are characterized as: S-Bus (5050/UDP) authentication. The potential impact is: Authentication bypass. The Saia Burgess Controls (SBC) PCD controllers utilize the S-Bus protocol (5050/UDP) for a variety of engineering purposes. It is possible to configure a password in order to restrict access to sensitive engineering functionality. Authentication is done by using the S-Bus 'write byte' message to a specific address and supplying a hashed version of the password. The hashing algorithm used is based on CRC-16 and as such not cryptographically secure. An insecure hashing algorithm is used. An attacker capable of passively observing traffic can intercept the hashed credentials and trivially find collisions allowing for authentication without having to bruteforce a keyspace defined by the actual strength of the password. This allows the attacker access to sensitive engineering functionality such as uploading/downloading control logic and manipulating controller configuration.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-327
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-207-03; https://www.forescout.com/blog/; https://www.cisa.gov/uscert/ics/advisories/icsa-22-207-03
CVE: CVE-2016-0786
Published: 2022-07-28
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2016. Notes: none
CVE: CVE-2016-0796
Published: 2022-07-28
Description: WordPress Plugin mb.miniAudioPlayer-an HTML5 audio player for your mp3 files is prone to multiple vulnerabilities, including open proxy and security bypass vulnerabilities because it fails to properly verify user-supplied input. An attacker may leverage these issues to hide attacks directed at a target site from behind vulnerable website or to perform otherwise restricted actions and subsequently download files with the extension mp3, mp4a, wav and ogg from anywhere the web server application has read access to the system. WordPress Plugin mb.miniAudioPlayer-an HTML5 audio player for your mp3 files version 1.7.6 is vulnerable; prior versions may also be affected.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287, CWE-610
References: http://www.vapidlabs.com/advisory.php?v=162; https://www.acunetix.com/vulnerabilities/web/wordpress-plugin-mb-miniaudioplayer-an-html5-audio-player-for-your-mp3-files-multiple-vulnerabilities-1-7-6/; http://www.vapidlabs.com/advisory.php?v=162