deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-33325
Published: 2022-06-30
Description: Multiple command injection vulnerabilities exist in the web_server ajax endpoints functionalities of Robustel R1510 3.3.0. A specially-crafted network packets can lead to arbitrary command execution. An attacker can send a sequence of requests to trigger these vulnerabilities.The `/ajax/clear_tools_log/` API is affected by command injection vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://talosintelligence.com/vulnerability_reports/TALOS-2022-1573; https://talosintelligence.com/vulnerability_reports/TALOS-2022-1573
CVE: CVE-2022-33326
Published: 2022-06-30
Description: Multiple command injection vulnerabilities exist in the web_server ajax endpoints functionalities of Robustel R1510 3.3.0. A specially-crafted network packets can lead to arbitrary command execution. An attacker can send a sequence of requests to trigger these vulnerabilities.The `/ajax/config_rollback/` API is affected by a command injection vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://talosintelligence.com/vulnerability_reports/TALOS-2022-1573; https://talosintelligence.com/vulnerability_reports/TALOS-2022-1573
CVE: CVE-2022-33327
Published: 2022-06-30
Description: Multiple command injection vulnerabilities exist in the web_server ajax endpoints functionalities of Robustel R1510 3.3.0. A specially-crafted network packets can lead to arbitrary command execution. An attacker can send a sequence of requests to trigger these vulnerabilities.The `/ajax/remove_sniffer_raw_log/` API is affected by a command injection vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://talosintelligence.com/vulnerability_reports/TALOS-2022-1573; https://talosintelligence.com/vulnerability_reports/TALOS-2022-1573
CVE: CVE-2022-33328
Published: 2022-06-30
Description: Multiple command injection vulnerabilities exist in the web_server ajax endpoints functionalities of Robustel R1510 3.3.0. A specially-crafted network packets can lead to arbitrary command execution. An attacker can send a sequence of requests to trigger these vulnerabilities.The `/ajax/remove/` API is affected by a command injection vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://talosintelligence.com/vulnerability_reports/TALOS-2022-1573; https://talosintelligence.com/vulnerability_reports/TALOS-2022-1573
CVE: CVE-2022-33329
Published: 2022-06-30
Description: Multiple command injection vulnerabilities exist in the web_server ajax endpoints functionalities of Robustel R1510 3.3.0. A specially-crafted network packets can lead to arbitrary command execution. An attacker can send a sequence of requests to trigger these vulnerabilities.The `/ajax/set_sys_time/` API is affected by a command injection vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://talosintelligence.com/vulnerability_reports/TALOS-2022-1573; https://talosintelligence.com/vulnerability_reports/TALOS-2022-1573
CVE: CVE-2021-41995
Published: 2022-06-30
Description: A misconfiguration of RSA in PingID Mac Login prior to 1.1 is vulnerable to pre-computed dictionary attacks, leading to an offline MFA bypass.
CVSS Score: 7.7 (HIGH)
CWE: CWE-288, CWE-310, CWE-287
References: https://docs.pingidentity.com/bundle/pingid/page/hnh[PII_REDACTED]49.html; https://www.pingidentity.com/en/resources/downloads/pingid.html; https://docs.pingidentity.com/bundle/pingid/page/hnh[PII_REDACTED]49.html
CVE: CVE-2022-23717
Published: 2022-06-30
Description: PingID Windows Login prior to 2.8 is vulnerable to a denial of service condition on local machines when combined with using offline security keys as part of authentication.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-404, CWE-404
References: https://docs.pingidentity.com/bundle/pingid/page/zhy[PII_REDACTED]45.html; https://www.pingidentity.com/en/resources/downloads/pingid.html; https://docs.pingidentity.com/bundle/pingid/page/zhy[PII_REDACTED]45.html
CVE: CVE-2022-23718
Published: 2022-06-30
Description: PingID Windows Login prior to 2.8 uses known vulnerable components that can lead to remote code execution. An attacker capable of achieving a sophisticated man-in-the-middle position, or to compromise Ping Identity web servers, could deliver malicious code that would be executed as SYSTEM by the PingID Windows Login application.
CVSS Score: 7.6 (HIGH)
CWE: CWE-1352
References: https://docs.pingidentity.com/bundle/pingid/page/zhy[PII_REDACTED]45.html; https://www.pingidentity.com/en/resources/downloads/pingid.html; https://docs.pingidentity.com/bundle/pingid/page/zhy[PII_REDACTED]45.html
CVE: CVE-2022-23719
Published: 2022-06-30
Description: PingID Windows Login prior to 2.8 does not authenticate communication with a local Java service used to capture security key requests. An attacker with the ability to execute code on the target machine maybe able to exploit and spoof the local Java service using multiple attack vectors. A successful attack can lead to code executed as SYSTEM by the PingID Windows Login application, or even a denial of service for offline security key authentication.
CVSS Score: 7.2 (HIGH)
CWE: CWE-288, CWE-310, CWE-306
References: https://docs.pingidentity.com/bundle/pingid/page/zhy[PII_REDACTED]45.html; https://www.pingidentity.com/en/resources/downloads/pingid.html; https://docs.pingidentity.com/bundle/pingid/page/zhy[PII_REDACTED]45.html
CVE: CVE-2022-23720
Published: 2022-06-30
Description: PingID Windows Login prior to 2.8 does not alert or halt operation if it has been provisioned with the full permissions PingID properties file. An IT administrator could mistakenly deploy administrator privileged PingID API credentials, such as those typically used by PingFederate, into PingID Windows Login user endpoints. Using sensitive full permissions properties file outside of a privileged trust boundary leads to an increased risk of exposure or discovery, and an attacker could leverage these credentials to perform administrative actions against PingID APIs or endpoints.
CVSS Score: 7.5 (HIGH)
CWE: CWE-288, CWE-648, CWE-269
References: https://docs.pingidentity.com/bundle/pingid/page/zhy[PII_REDACTED]45.html; https://www.pingidentity.com/en/resources/downloads/pingid.html; https://docs.pingidentity.com/bundle/pingid/page/zhy[PII_REDACTED]45.html
CVE: CVE-2022-23725
Published: 2022-06-30
Description: PingID Windows Login prior to 2.8 does not properly set permissions on the Windows Registry entries used to store sensitive API keys under some circumstances.
CVSS Score: 7.7 (HIGH)
CWE: CWE-288, CWE-522, CWE-732
References: https://docs.pingidentity.com/bundle/pingid/page/zhy[PII_REDACTED]45.html; https://www.pingidentity.com/en/resources/downloads/pingid.html; https://docs.pingidentity.com/bundle/pingid/page/zhy[PII_REDACTED]45.html
CVE: CVE-2013-4323
Published: 2022-06-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2013-4456
Published: 2022-06-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2013. Notes: none
CVE: CVE-2013-4464
Published: 2022-06-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during CVE-2013-4464. Notes: none
CVE: CVE-2013-4493
Published: 2022-06-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2013. Notes: none
CVE: CVE-2013-4506
Published: 2022-06-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2013. Notes: none
CVE: CVE-2013-4585
Published: 2022-06-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2013. Notes: none
CVE: CVE-2013-4586
Published: 2022-06-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2013. Notes: none
CVE: CVE-2013-5683
Published: 2022-06-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2013. Notes: none
CVE: CVE-2013-6390
Published: 2022-06-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2013. Notes: none
CVE: CVE-2013-6423
Published: 2022-06-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2013. Notes: none
CVE: CVE-2013-6464
Published: 2022-06-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2013. Notes: none
CVE: CVE-2013-6471
Published: 2022-06-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2013. Notes: none
CVE: CVE-2013-6498
Published: 2022-06-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2013. Notes: none
CVE: CVE-2013-7253
Published: 2022-06-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2013. Notes: none
CVE: CVE-2014-0068
Published: 2022-06-30
Description: It was reported that watchman in openshift node-utils creates /var/run/watchman.pid and /var/log/watchman.ouput with world writable permission.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-732, CWE-732
References: https://bugzilla.redhat.com/show_bug.cgi?id=1064100; https://bugzilla.redhat.com/show_bug.cgi?id=1064100
CVE: CVE-2014-0156
Published: 2022-06-30
Description: Awesome spawn contains OS command injection vulnerability, which allows execution of additional commands passed to Awesome spawn as arguments. If untrusted input was included in command arguments, attacker could use this flaw to execute arbitrary command.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://github.com/ManageIQ/awesome_spawn/commit/e524f85f1c6e292ef7d117d[PII_REDACTED]ac269ff; https://rubysec.com/advisories/CVE-2014-0156/; https://github.com/ManageIQ/awesome_spawn/commit/e524f85f1c6e292ef7d117d[PII_REDACTED]ac269ff
CVE: CVE-2022-2257
Published: 2022-06-30
Description: Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://github.com/vim/vim/commit/083692d598139228e101b8c521aaef7bcf256e9a; https://huntr.dev/bounties/ca581f80-03ba-472a-b820-78f7fd05fe89; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/43Y3VJPOTTY3NTREDIFUPITM2POG4ZLP/
CVE: CVE-2022-31115
Published: 2022-06-30
Description: opensearch-ruby is a community-driven, open source fork of elasticsearch-ruby. In versions prior to 2.0.1 the ruby `YAML.load` function was used instead of `YAML.safe_load`. As a result opensearch-ruby 2.0.0 and prior can lead to unsafe deserialization using YAML.load if the response is of type YAML. An attacker must be in control of an opensearch server and convince the victim to connect to it in order to exploit this vulnerability. The problem has been patched in opensearch-ruby gem version 2.0.1. Users are advised to upgrade. There are no known workarounds for this issue.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502
References: https://github.com/opensearch-project/opensearch-ruby/pull/77; https://github.com/opensearch-project/opensearch-ruby/security/advisories/GHSA-977c-63xq-cgw3; https://staaldraad.github.io/post/2021-01-09-universal-rce-ruby-yaml-load-updated/
CVE: CVE-2022-33082
Published: 2022-06-30
Description: An issue in the AST parser (ast/compile.go) of Open Policy Agent v0.10.2 allows attackers to cause a Denial of Service (DoS) via a crafted input.
CVSS Score: 7.5 (HIGH)
References: https://github.com/open-policy-agent/opa/blob/598176de[PII_REDACTED]25225aca53e85708d5f1db/ast/compile.go#L1224; https://github.com/open-policy-agent/opa/blob/598176de[PII_REDACTED]25225aca53e85708d5f1db/ast/compile.go#L1224
CVE: CVE-2022-33085
Published: 2022-06-30
Description: ESPCMS P8 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the fetch_filename function at \espcms_public\espcms_templates\ESPCMS_Templates.
CVSS Score: 7.2 (HIGH)
References: https://github.com/JeakinsCheung/ESPCMS-P8/blob/66fcc7f0fcc4d2325c0e31c9668f4c3362f0c06f/Arbitrary%20code%20execution%20vulnerability%20exists%20in%20ESPCMS%20management%20system.md; https://github.com/JeakinsCheung/ESPCMS-P8/blob/66fcc7f0fcc4d2325c0e31c9668f4c3362f0c06f/Arbitrary%20code%20execution%20vulnerability%20exists%20in%20ESPCMS%20management%20system.md
CVE: CVE-2022-33087
Published: 2022-06-30
Description: A stack overflow in the function DM_ In fillobjbystr() of TP-Link Archer C50&A5(US)_V5_200407 allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://github.com/cilan2/iot/blob/main/4.md; https://github.com/cilan2/iot/blob/main/4.md
CVE: CVE-2021-32428
Published: 2022-07-01
Description: SQL Injection vulnerability in viaviwebtech Android EBook App (Books App, PDF, ePub, Online Book Reading, Download Books) 10 via the author_id parameter to api.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://codecanyon.net/item/android-ebook-app-with-material-design/21680614; https://codecanyon.net/user/viaviwebtech; https://owasp.org/www-community/attacks/Blind_SQL_Injection
CVE: CVE-2022-27904
Published: 2022-07-01
Description: Automox Agent for macOS before version 39 was vulnerable to a time-of-check/time-of-use (TOCTOU) race-condition attack during the agent install process.
CVSS Score: 7.0 (HIGH)
CWE: CWE-367
References: https://automox.com; https://www.automox.com/security/security-bulletin; https://automox.com
CVE: CVE-2022-32295
Published: 2022-07-01
Description: On Ampere Altra and AltraMax devices before SRP 1.09, the Altra reference design of UEFI accesses allows insecure access to SPI-NOR by the OS/hypervisor component.
CVSS Score: 9.8 (CRITICAL)
References: https://amperecomputing.com; https://amperecomputing.com/products/security-bulletins/altra-spi-nor-smc-protection-for-ampere-website.html; https://amperecomputing.com/products/security-bulletins/altra-spi-nor-smc.html
CVE: CVE-2022-32988
Published: 2022-07-01
Description: Cross Site Scripting (XSS) vulnerability in router Asus DSL-N14U-B1 1.1.2.3_805 via the "*list" parameters (e.g. filter_lwlist, keyword_rulelist, etc) in every ".asp" page containing a list of stored strings. The following asp files are affected: (1) cgi-bin/APP_Installation.asp, (2) cgi-bin/Advanced_ACL_Content.asp, (3) cgi-bin/Advanced_ADSL_Content.asp, (4) cgi-bin/Advanced_ASUSDDNS_Content.asp, (5) cgi-bin/Advanced_AiDisk_ftp.asp, (6) cgi-bin/Advanced_AiDisk_samba.asp, (7) cgi-bin/Advanced_DSL_Content.asp, (8) cgi-bin/Advanced_Firewall_Content.asp, (9) cgi-bin/Advanced_FirmwareUpgrade_Content.asp, (10) cgi-bin/Advanced_GWStaticRoute_Content.asp, (11) cgi-bin/Advanced_IPTV_Content.asp, (12) cgi-bin/Advanced_IPv6_Content.asp, (13) cgi-bin/Advanced_KeywordFilter_Content.asp, (14) cgi-bin/Advanced_LAN_Content.asp, (15) cgi-bin/Advanced_Modem_Content.asp, (16) cgi-bin/Advanced_PortTrigger_Content.asp, (17) cgi-bin/Advanced_QOSUserPrio_Content.asp, (18) cgi-bin/Advanced_QOSUserRules_Content.asp, (19) cgi-bin/Advanced_SettingBackup_Content.asp, (20) cgi-bin/Advanced_System_Content.asp, (21) cgi-bin/Advanced_URLFilter_Content.asp, (22) cgi-bin/Advanced_VPN_PPTP.asp, (23) cgi-bin/Advanced_VirtualServer_Content.asp, (24) cgi-bin/Advanced_WANPort_Content.asp, (25) cgi-bin/Advanced_WAdvanced_Content.asp, (26) cgi-bin/Advanced_WMode_Content.asp, (27) cgi-bin/Advanced_WWPS_Content.asp, (28) cgi-bin/Advanced_Wireless_Content.asp, (29) cgi-bin/Bandwidth_Limiter.asp, (30) cgi-bin/Guest_network.asp, (31) cgi-bin/Main_AccessLog_Content.asp, (32) cgi-bin/Main_AdslStatus_Content.asp, (33) cgi-bin/Main_Spectrum_Content.asp, (34) cgi-bin/Main_WebHistory_Content.asp, (35) cgi-bin/ParentalControl.asp, (36) cgi-bin/QIS_wizard.asp, (37) cgi-bin/QoS_EZQoS.asp, (38) cgi-bin/aidisk.asp, (39) cgi-bin/aidisk/Aidisk-1.asp, (40) cgi-bin/aidisk/Aidisk-2.asp, (41) cgi-bin/aidisk/Aidisk-3.asp, (42) cgi-bin/aidisk/Aidisk-4.asp, (43) cgi-bin/blocking.asp, (44) cgi-bin/cloud_main.asp, (45) cgi-bin/cloud_router_sync.asp, (46) cgi-bin/cloud_settings.asp, (47) cgi-bin/cloud_sync.asp, (48) cgi-bin/device-map/DSL_dashboard.asp, (49) cgi-bin/device-map/clients.asp, (50) cgi-bin/device-map/disk.asp, (51) cgi-bin/device-map/internet.asp, (52) cgi-bin/error_page.asp, (53) cgi-bin/index.asp, (54) cgi-bin/index2.asp, (55) cgi-bin/qis/QIS_PTM_manual_setting.asp, (56) cgi-bin/qis/QIS_admin_pass.asp, (57) cgi-bin/qis/QIS_annex_setting.asp, (58) cgi-bin/qis/QIS_bridge_cfg_tmp.asp, (59) cgi-bin/qis/QIS_detect.asp, (60) cgi-bin/qis/QIS_finish.asp, (61) cgi-bin/qis/QIS_ipoa_cfg_tmp.asp, (62) cgi-bin/qis/QIS_manual_setting.asp, (63) cgi-bin/qis/QIS_mer_cfg.asp, (64) cgi-bin/qis/QIS_mer_cfg_tmp.asp, (65) cgi-bin/qis/QIS_ppp_cfg.asp, (66) cgi-bin/qis/QIS_ppp_cfg_tmp.asp, (67) cgi-bin/qis/QIS_wireless.asp, (68) cgi-bin/query_wan_status.asp, (69) cgi-bin/query_wan_status2.asp, and (70) cgi-bin/start_apply.asp.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/FedericoHeichou/CVE-2022-32988; https://github.com/FedericoHeichou/DSL-N14U-XSS; https://github.com/FedericoHeichou/CVE-2022-32988
CVE: CVE-2022-2274
Published: 2022-07-01
Description: The OpenSSL 3.0.4 release introduced a serious bug in the RSA implementation for X86_64 CPUs supporting the AVX512IFMA instructions. This issue makes the RSA implementation with 2048 bit private keys incorrect on such machines and memory corruption will happen during the computation. As a consequence of the memory corruption an attacker may be able to trigger a remote code execution on the machine performing the computation. SSL/TLS servers or other servers using 2048 bit RSA private keys running on machines supporting AVX512IFMA instructions of the X86_64 architecture are affected by this issue.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=4d8a88c134df634ba610ff8db1eb8478ac5fd345; https://github.com/openssl/openssl/issues/18625; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2022-2279
Published: 2022-07-01
Description: NULL Pointer Dereference in GitHub repository bfabiszewski/libmobi prior to 0.11.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/bfabiszewski/libmobi/commit/c0699c8693c47f14a2e57dec7292e862ac7adf9c; https://huntr.dev/bounties/68c249e2-779d-4871-b7e3-851f03aca2de; https://github.com/bfabiszewski/libmobi/commit/c0699c8693c47f14a2e57dec7292e862ac7adf9c
CVE: CVE-2022-2280
Published: 2022-07-01
Description: Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.2.19.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/microweber/microweber/commit/9ebbb4dd35da74025ab6965f722829a7f8f86566; https://huntr.dev/bounties/22561bfd-a28f-474e-9bfd-7263c1b71133; https://github.com/microweber/microweber/commit/9ebbb4dd35da74025ab6965f722829a7f8f86566
CVE: CVE-2022-34894
Published: 2022-07-01
Description: In JetBrains Hub before 2022.2.14799, insufficient access control allowed the hijacking of untrusted services
CVSS Score: 3.5 (LOW)
CWE: CWE-284
References: https://www.jetbrains.com/privacy-security/issues-fixed/; https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2022-2264
Published: 2022-07-01
Description: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122
References: https://github.com/vim/vim/commit/d25f003342aca9889067f2e839963dfeccf1fe05; https://huntr.dev/bounties/2241c773-02c9-4708-b63e-54aef99afa6c; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/43Y3VJPOTTY3NTREDIFUPITM2POG4ZLP/
CVE: CVE-2022-33099
Published: 2022-07-01
Description: An issue in the component luaG_runerror of Lua v5.4.4 and below leads to a heap-buffer overflow when a recursive error occurs.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://github.com/lua/lua/commit/42d40581dd919fb134c07027ca1ce0844c670daf; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RJNJ66IFDUKWJJZXHGOLRGIA3HWWC36R/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UHYZOEFDVLVAD6EEP4CDW6DNONIVVHPA/
CVE: CVE-2022-33103
Published: 2022-07-01
Description: Das U-Boot from v2020.10 to v2022.07-rc3 was discovered to contain an out-of-bounds write via the function sqfs_readdir().
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://lore.kernel.org/all/[PII_REDACTED]0206.297405-1-miquel.raynal%40bootlin.com/; https://lore.kernel.org/all/CALO=DHFB+yBoXxVr5KcsK0iFdg+e7ywko4-e+72kjbcS8JBfPw%40mail.gmail.com/; https://lists.debian.org/debian-lts-announce/2025/05/msg00001.html
CVE: CVE-2022-2282
Published: 2022-07-01
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. Reason: This CVE has been rejected as it was incorrectly assigned. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2014-3648
Published: 2022-07-01
Description: The simplepush server iterates through the application installations and pushes a notification to the server provided by deviceToken. But this is user controlled. If a bogus applications is registered with bad deviceTokens, one can generate endless exceptions when those endpoints can't be reached or can slow the server down by purposefully wasting it's time with slow endpoints. Similarly, one can provide whatever HTTP end point they want. This turns the server into a DDOS vector or an anonymizer for the posting of malware and so on.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-400
References: https://issues.redhat.com/browse/AEROGEAR-6091; https://issues.redhat.com/browse/AEROGEAR-6091
CVE: CVE-2014-3650
Published: 2022-07-01
Description: Multiple persistent cross-site scripting (XSS) flaws were found in the way Aerogear handled certain user-supplied content. A remote attacker could use these flaws to compromise the application with specially crafted input.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://bugzilla.redhat.com/show_bug.cgi?id=1144212; https://issues.redhat.com/browse/AEROGEAR-5978; https://bugzilla.redhat.com/show_bug.cgi?id=1144212
CVE: CVE-2022-2253
Published: 2022-07-01
Description: A user with administrative privileges in Distributed Data Systems WebHMI 4.1.1.7662 may send OS commands to execute on the host server.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-78
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-181-04; https://www.cisa.gov/uscert/ics/advisories/icsa-22-181-04
CVE: CVE-2022-1983
Published: 2022-07-01
Description: Incorrect authorization in GitLab EE affecting all versions from 10.7 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1, allowed an attacker already in possession of a valid Deploy Key or a Deploy Token to misuse it from any location to access Container Registries even when IP address restrictions were configured.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-863
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1983.json; https://gitlab.com/gitlab-org/gitlab/-/issues/363651; https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1983.json