deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-23293
Published: 2022-03-09
Description: Windows Fast FAT File System Driver Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23293; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23293
CVE: CVE-2022-23294
Published: 2022-03-09
Description: Windows Event Tracing Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23294; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23294
CVE: CVE-2022-23295
Published: 2022-03-09
Description: Raw Image Extension Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23295; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23295
CVE: CVE-2022-23296
Published: 2022-03-09
Description: Windows Installer Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23296; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23296
CVE: CVE-2022-23297
Published: 2022-03-09
Description: Windows NT Lan Manager Datagram Receiver Driver Information Disclosure Vulnerability
CVSS Score: 5.5 (MEDIUM)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23297; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23297
CVE: CVE-2022-23298
Published: 2022-03-09
Description: Windows NT OS Kernel Elevation of Privilege Vulnerability
CVSS Score: 7.0 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23298; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23298
CVE: CVE-2022-23299
Published: 2022-03-09
Description: Windows PDEV Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23299; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23299
CVE: CVE-2022-23300
Published: 2022-03-09
Description: Raw Image Extension Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23300; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23300
CVE: CVE-2022-23301
Published: 2022-03-09
Description: HEVC Video Extensions Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23301; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23301
CVE: CVE-2022-24451
Published: 2022-03-09
Description: VP9 Video Extensions Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24451; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24451
CVE: CVE-2022-24452
Published: 2022-03-09
Description: HEVC Video Extensions Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24452; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24452
CVE: CVE-2022-24453
Published: 2022-03-09
Description: HEVC Video Extensions Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24453; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24453
CVE: CVE-2022-24454
Published: 2022-03-09
Description: Windows Security Support Provider Interface Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24454; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24454
CVE: CVE-2022-24455
Published: 2022-03-09
Description: Windows CD-ROM Driver Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24455; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24455
CVE: CVE-2022-24456
Published: 2022-03-09
Description: HEVC Video Extensions Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24456; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24456
CVE: CVE-2022-24457
Published: 2022-03-09
Description: HEIF Image Extensions Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24457; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24457
CVE: CVE-2022-24459
Published: 2022-03-09
Description: Windows Fax and Scan Service Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24459; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24459
CVE: CVE-2022-24460
Published: 2022-03-09
Description: Tablet Windows User Interface Application Elevation of Privilege Vulnerability
CVSS Score: 7.0 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24460; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24460
CVE: CVE-2022-24461
Published: 2022-03-09
Description: Microsoft Office Visio Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24461; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24461
CVE: CVE-2022-24462
Published: 2022-03-09
Description: Microsoft Word Security Feature Bypass Vulnerability
CVSS Score: 5.5 (MEDIUM)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24462; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24462
CVE: CVE-2022-24463
Published: 2022-03-09
Description: Microsoft Exchange Server Spoofing Vulnerability
CVSS Score: 6.5 (MEDIUM)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24463; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24463
CVE: CVE-2022-24464
Published: 2022-03-09
Description: .NET and Visual Studio Denial of Service Vulnerability
CVSS Score: 7.5 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24464; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24464
CVE: CVE-2022-24465
Published: 2022-03-09
Description: Microsoft Intune Portal for iOS Security Feature Bypass Vulnerability
CVSS Score: 3.3 (LOW)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24465; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24465
CVE: CVE-2022-24467
Published: 2022-03-09
Description: Azure Site Recovery Remote Code Execution Vulnerability
CVSS Score: 7.2 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24467; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24467
CVE: CVE-2022-24468
Published: 2022-03-09
Description: Azure Site Recovery Remote Code Execution Vulnerability
CVSS Score: 7.2 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24468; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24468
CVE: CVE-2022-24469
Published: 2022-03-09
Description: Azure Site Recovery Elevation of Privilege Vulnerability
CVSS Score: 8.1 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24469; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24469
CVE: CVE-2022-24470
Published: 2022-03-09
Description: Azure Site Recovery Remote Code Execution Vulnerability
CVSS Score: 7.2 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24470; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24470
CVE: CVE-2022-24471
Published: 2022-03-09
Description: Azure Site Recovery Remote Code Execution Vulnerability
CVSS Score: 7.2 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24471; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24471
CVE: CVE-2022-24501
Published: 2022-03-09
Description: VP9 Video Extensions Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24501; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24501
CVE: CVE-2022-24502
Published: 2022-03-09
Description: Windows HTML Platforms Security Feature Bypass Vulnerability
CVSS Score: 4.3 (MEDIUM)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24502; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24502
CVE: CVE-2022-24503
Published: 2022-03-09
Description: Remote Desktop Protocol Client Information Disclosure Vulnerability
CVSS Score: 5.4 (MEDIUM)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24503; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24503
CVE: CVE-2022-24505
Published: 2022-03-09
Description: Windows ALPC Elevation of Privilege Vulnerability
CVSS Score: 7.0 (HIGH)
CWE: CWE-362
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24505; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24505
CVE: CVE-2022-24506
Published: 2022-03-09
Description: Azure Site Recovery Elevation of Privilege Vulnerability
CVSS Score: 6.5 (MEDIUM)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24506; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24506
CVE: CVE-2022-24507
Published: 2022-03-09
Description: Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24507; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24507
CVE: CVE-2022-24508
Published: 2022-03-09
Description: Win32 File Enumeration Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24508; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24508
CVE: CVE-2022-24509
Published: 2022-03-09
Description: Microsoft Office Visio Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24509; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24509
CVE: CVE-2022-24510
Published: 2022-03-09
Description: Microsoft Office Visio Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24510; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24510
CVE: CVE-2022-24511
Published: 2022-03-09
Description: Microsoft Office Word Tampering Vulnerability
CVSS Score: 5.5 (MEDIUM)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24511; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24511
CVE: CVE-2022-24512
Published: 2022-03-09
Description: .NET and Visual Studio Remote Code Execution Vulnerability
CVSS Score: 6.3 (MEDIUM)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24512; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24512
CVE: CVE-2022-24515
Published: 2022-03-09
Description: Azure Site Recovery Elevation of Privilege Vulnerability
CVSS Score: 6.5 (MEDIUM)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24515; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24515
CVE: CVE-2022-24517
Published: 2022-03-09
Description: Azure Site Recovery Remote Code Execution Vulnerability
CVSS Score: 7.2 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24517; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24517
CVE: CVE-2022-24518
Published: 2022-03-09
Description: Azure Site Recovery Elevation of Privilege Vulnerability
CVSS Score: 6.5 (MEDIUM)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24518; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24518
CVE: CVE-2022-24519
Published: 2022-03-09
Description: Azure Site Recovery Elevation of Privilege Vulnerability
CVSS Score: 6.5 (MEDIUM)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24519; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24519
CVE: CVE-2022-24520
Published: 2022-03-09
Description: Azure Site Recovery Remote Code Execution Vulnerability
CVSS Score: 7.2 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24520; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24520
CVE: CVE-2022-24522
Published: 2022-03-09
Description: Skype Extension for Chrome Information Disclosure Vulnerability
CVSS Score: 6.5 (MEDIUM)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24522; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24522
CVE: CVE-2022-24525
Published: 2022-03-09
Description: Windows Update Stack Elevation of Privilege Vulnerability
CVSS Score: 7.0 (HIGH)
CWE: CWE-362
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24525; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24525
CVE: CVE-2022-24526
Published: 2022-03-09
Description: Visual Studio Code Spoofing Vulnerability
CVSS Score: 6.1 (MEDIUM)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24526; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24526
CVE: CVE-2022-0022
Published: 2022-03-09
Description: Usage of a weak cryptographic algorithm in Palo Alto Networks PAN-OS software where the password hashes of administrator and local user accounts are not created with a sufficient level of computational effort, which allows for password cracking attacks on accounts in normal (non-FIPS-CC) operational mode. An attacker must have access to the account password hashes to take advantage of this weakness and can acquire those hashes if they are able to gain access to the PAN-OS software configuration. Fixed versions of PAN-OS software use a secure cryptographic algorithm for account password hashes. This issue does not impact Prisma Access firewalls. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.21; All versions of PAN-OS 9.0; PAN-OS 9.1 versions earlier than PAN-OS 9.1.11; PAN-OS 10.0 versions earlier than PAN-OS 10.0.7.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-916, CWE-916
References: https://security.paloaltonetworks.com/CVE-2022-0022; https://security.paloaltonetworks.com/CVE-2022-0022
CVE: CVE-2022-0715
Published: 2022-03-09
Description: A CWE-287: Improper Authentication vulnerability exists that could cause an attacker to arbitrarily change the behavior of the UPS when a key is leaked and used to upload malicious firmware. Affected Product: APC Smart-UPS Family: SMT Series (SMT Series ID=18: UPS 09.8 and prior / SMT Series ID=1040: UPS 01.2 and prior / SMT Series ID=1031: UPS 03.1 and prior), SMC Series (SMC Series ID=1005: UPS 14.1 and prior / SMC Series ID=1007: UPS 11.0 and prior / SMC Series ID=1041: UPS 01.1 and prior), SCL Series (SCL Series ID=1030: UPS 02.5 and prior / SCL Series ID=1036: UPS 02.5 and prior), SMX Series (SMX Series ID=20: UPS 10.2 and prior / SMX Series ID=23: UPS 07.0 and prior), SRT Series (SRT Series ID=1010/1019/1025: UPS 08.3 and prior / SRT Series ID=1024: UPS 01.0 and prior / SRT Series ID=1020: UPS 10.4 and prior / SRT Series ID=1021: UPS 12.2 and prior / SRT Series ID=1001/1013: UPS 05.1 and prior / SRT Series ID=1002/1014: UPSa05.2 and prior), APC SmartConnect Family: SMT Series (SMT Series ID=1015: UPS 04.5 and prior), SMC Series (SMC Series ID=1018: UPS 04.2 and prior), SMTL Series (SMTL Series ID=1026: UPS 02.9 and prior), SCL Series (SCL Series ID=1029: UPS 02.5 and prior / SCL Series ID=1030: UPS 02.5 and prior / SCL Series ID=1036: UPS 02.5 and prior / SCL Series ID=1037: UPS 03.1 and prior), SMX Series (SMX Series ID=1031: UPS 03.1 and prior)
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-287, CWE-345
References: https://www.se.com/ww/en/download/document/SEVD-2022-067-02/; https://www.se.com/ww/en/download/document/SEVD-2022-067-02/
CVE: CVE-2022-22511
Published: 2022-03-09
Description: Various configuration pages of the device are vulnerable to reflected XSS (Cross-Site Scripting) attacks. An authorized attacker with user privileges may use this to gain access to confidential information on a PC that connects to the WBM after it has been compromised.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://cert.vde.com/en/advisories/VDE-2022-004/; https://cert.vde.com/en/advisories/VDE-2022-004/
CVE: CVE-2022-22805
Published: 2022-03-09
Description: A CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability exists that could cause remote code execution when an improperly handled TLS packet is reassembled. Affected Product: SmartConnect Family: SMT Series (SMT Series ID=1015: UPS 04.5 and prior), SMC Series (SMC Series ID=1018: UPS 04.2 and prior), SMTL Series (SMTL Series ID=1026: UPS 02.9 and prior), SCL Series (SCL Series ID=1029: UPS 02.5 and prior / SCL Series ID=1030: UPS 02.5 and prior / SCL Series ID=1036: UPS 02.5 and prior / SCL Series ID=1037: UPS 03.1 and prior), SMX Series (SMX Series ID=1031: UPS 03.1 and prior)
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120, CWE-120
References: https://www.se.com/ww/en/download/document/SEVD-2022-067-02/; https://www.se.com/ww/en/download/document/SEVD-2022-067-02/
CVE: CVE-2022-22806
Published: 2022-03-09
Description: A CWE-294: Authentication Bypass by Capture-replay vulnerability exists that could cause an unauthenticated connection to the UPS when a malformed connection is sent. Affected Product: SmartConnect Family: SMT Series (SMT Series ID=1015: UPS 04.5 and prior), SMC Series (SMC Series ID=1018: UPS 04.2 and prior), SMTL Series (SMTL Series ID=1026: UPS 02.9 and prior), SCL Series (SCL Series ID=1029: UPS 02.5 and prior / SCL Series ID=1030: UPS 02.5 and prior / SCL Series ID=1036: UPS 02.5 and prior / SCL Series ID=1037: UPS 03.1 and prior), SMX Series (SMX Series ID=1031: UPS 03.1 and prior)
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-294, CWE-294
References: https://www.se.com/ww/en/download/document/SEVD-2022-067-02/; https://www.se.com/ww/en/download/document/SEVD-2022-067-02/
CVE: CVE-2022-24349
Published: 2022-03-09
Description: An authenticated user can create a link with reflected XSS payload for actions’ pages, and send it to other users. Malicious code has access to all the same objects as the rest of the web page and can make arbitrary modifications to the contents of the page being displayed to a victim. This attack can be implemented with the help of social engineering and expiration of a number of factors - an attacker should have authorized access to the Zabbix Frontend and allowed network connection between a malicious server and victim’s computer, understand attacked infrastructure, be recognized by the victim as a trustee and use trusted communication channel.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://lists.debian.org/debian-lts-announce/2022/04/msg00011.html; https://lists.debian.org/debian-lts-announce/2023/04/msg00013.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2V4N22R3QVTYAJMWFK2U2O6QXAZYM35Z/
CVE: CVE-2022-24732
Published: 2022-03-09
Description: Maddy Mail Server is an open source SMTP compatible email server. Versions of maddy prior to 0.5.4 do not implement password expiry or account expiry checking when authenticating using PAM. Users are advised to upgrade. Users unable to upgrade should manually remove expired accounts via existing filtering mechanisms.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-324, CWE-613
References: https://github.com/foxcpp/maddy/commit/7ee6a39c6a1939b376545f030a5efd6f90913583; https://github.com/foxcpp/maddy/security/advisories/GHSA-6cp7-g972-w9m9; https://github.com/foxcpp/maddy/commit/7ee6a39c6a1939b376545f030a5efd6f90913583
CVE: CVE-2022-24917
Published: 2022-03-09
Description: An authenticated user can create a link with reflected Javascript code inside it for services’ page and send it to other users. The payload can be executed only with a known CSRF token value of the victim, which is changed periodically and is difficult to predict. Malicious code has access to all the same objects as the rest of the web page and can make arbitrary modifications to the contents of the page being displayed to a victim during social engineering attacks.
CVSS Score: 3.7 (LOW)
CWE: CWE-79, CWE-79
References: https://lists.debian.org/debian-lts-announce/2022/04/msg00011.html; https://lists.debian.org/debian-lts-announce/2023/04/msg00013.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2V4N22R3QVTYAJMWFK2U2O6QXAZYM35Z/
CVE: CVE-2022-24918
Published: 2022-03-09
Description: An authenticated user can create a link with reflected Javascript code inside it for items’ page and send it to other users. The payload can be executed only with a known CSRF token value of the victim, which is changed periodically and is difficult to predict. Malicious code has access to all the same objects as the rest of the web page and can make arbitrary modifications to the contents of the page being displayed to a victim during social engineering attacks.
CVSS Score: 3.7 (LOW)
CWE: CWE-79, CWE-79
References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2V4N22R3QVTYAJMWFK2U2O6QXAZYM35Z/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QWP6UBFA5T6MOQPY2VDUG5YAJBFPYRFF/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SWDZONUHDYKBXTAIAGHSYQDEGORD2QT7/
CVE: CVE-2022-24919
Published: 2022-03-09
Description: An authenticated user can create a link with reflected Javascript code inside it for graphs’ page and send it to other users. The payload can be executed only with a known CSRF token value of the victim, which is changed periodically and is difficult to predict. Malicious code has access to all the same objects as the rest of the web page and can make arbitrary modifications to the contents of the page being displayed to a victim during social engineering attacks.
CVSS Score: 3.7 (LOW)
CWE: CWE-79, CWE-79
References: https://lists.debian.org/debian-lts-announce/2022/04/msg00011.html; https://lists.debian.org/debian-lts-announce/2023/04/msg00013.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2V4N22R3QVTYAJMWFK2U2O6QXAZYM35Z/
CVE: CVE-2022-24734
Published: 2022-03-09
Description: MyBB is a free and open source forum software. In affected versions the Admin CP's Settings management module does not validate setting types correctly on insertion and update, making it possible to add settings of supported type `php` with PHP code, executed on on _Change Settings_ pages. This results in a Remote Code Execution (RCE) vulnerability. The vulnerable module requires Admin CP access with the `Can manage settings?` permission. MyBB's Settings module, which allows administrators to add, edit, and delete non-default settings, stores setting data in an options code string ($options_code; mybb_settings.optionscode database column) that identifies the setting type and its options, separated by a new line character (\n). In MyBB 1.2.0, support for setting type php was added, for which the remaining part of the options code is PHP code executed on Change Settings pages (reserved for plugins and internal use). MyBB 1.8.30 resolves this issue. There are no known workarounds.
CVSS Score: 7.2 (HIGH)
CWE: CWE-94, CWE-94
References: http://packetstormsecurity.com/files/167082/MyBB-1.8.29-Remote-Code-Execution.html; http://packetstormsecurity.com/files/167333/MyBB-Admin-Control-Remote-Code-Execution.html; https://github.com/mybb/mybb/commit/92012b9831b330714b9f9b4646a[PII_REDACTED]9c1