deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-39142
Published: 2022-09-13
Description: A vulnerability has been identified in Parasolid V33.1 (All versions < V33.1.262), Parasolid V33.1 (All versions >= V33.1.262 < V33.1.263), Parasolid V34.0 (All versions < V34.0.252), Parasolid V34.1 (All versions < V34.1.242), Parasolid V35.0 (All versions < V35.0.161), Parasolid V35.0 (All versions >= V35.0.161 < V35.0.164), Simcenter Femap V2022.1 (All versions < V2022.1.3), Simcenter Femap V2022.2 (All versions < V2022.2.2). The affected application contains an out of bounds write past the end of an allocated buffer while parsing specially crafted X_T files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-17485)
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://cert-portal.siemens.com/productcert/pdf/ssa-518824.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-518824.pdf
CVE: CVE-2022-39143
Published: 2022-09-13
Description: A vulnerability has been identified in Parasolid V33.1 (All versions < V33.1.262), Parasolid V33.1 (All versions >= V33.1.262 < V33.1.263), Parasolid V34.0 (All versions < V34.0.252), Parasolid V34.1 (All versions < V34.1.242), Parasolid V35.0 (All versions < V35.0.161), Parasolid V35.0 (All versions >= V35.0.161 < V35.0.164), Simcenter Femap V2022.1 (All versions < V2022.1.3), Simcenter Femap V2022.2 (All versions < V2022.2.2). The affected application contains an out of bounds write past the end of an allocated buffer while parsing specially crafted X_T files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-17493)
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://cert-portal.siemens.com/productcert/pdf/ssa-518824.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-518824.pdf
CVE: CVE-2022-39144
Published: 2022-09-13
Description: A vulnerability has been identified in Parasolid V33.1 (All versions < V33.1.262), Parasolid V33.1 (All versions >= V33.1.262 < V33.1.263), Parasolid V34.0 (All versions < V34.0.252), Parasolid V34.1 (All versions < V34.1.242), Parasolid V35.0 (All versions < V35.0.161), Parasolid V35.0 (All versions >= V35.0.161 < V35.0.164), Simcenter Femap V2022.1 (All versions < V2022.1.3), Simcenter Femap V2022.2 (All versions < V2022.2.2). The affected application contains an out of bounds write past the end of an allocated buffer while parsing specially crafted X_T files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-17494)
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://cert-portal.siemens.com/productcert/pdf/ssa-518824.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-518824.pdf
CVE: CVE-2022-39145
Published: 2022-09-13
Description: A vulnerability has been identified in Parasolid V33.1 (All versions < V33.1.262), Parasolid V33.1 (All versions >= V33.1.262 < V33.1.263), Parasolid V34.0 (All versions < V34.0.252), Parasolid V34.1 (All versions < V34.1.242), Parasolid V35.0 (All versions < V35.0.161), Parasolid V35.0 (All versions >= V35.0.161 < V35.0.164), Simcenter Femap V2022.1 (All versions < V2022.1.3), Simcenter Femap V2022.2 (All versions < V2022.2.2). The affected application is vulnerable to out of bounds read past the end of an allocated buffer when parsing X_T files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-17496)
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://cert-portal.siemens.com/productcert/pdf/ssa-518824.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-518824.pdf
CVE: CVE-2022-39146
Published: 2022-09-13
Description: A vulnerability has been identified in Parasolid V33.1 (All versions < V33.1.262), Parasolid V33.1 (All versions >= V33.1.262 < V33.1.263), Parasolid V34.0 (All versions < V34.0.252), Parasolid V34.1 (All versions < V34.1.242), Parasolid V35.0 (All versions < V35.0.161), Parasolid V35.0 (All versions >= V35.0.161 < V35.0.164), Simcenter Femap V2022.1 (All versions < V2022.1.3), Simcenter Femap V2022.2 (All versions < V2022.2.2). The affected application is vulnerable to uninitialized pointer access while parsing specially crafted X_T files. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-17502)
CVSS Score: 7.8 (HIGH)
CWE: CWE-824
References: https://cert-portal.siemens.com/productcert/pdf/ssa-518824.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-518824.pdf
CVE: CVE-2022-39147
Published: 2022-09-13
Description: A vulnerability has been identified in Parasolid V33.1 (All versions < V33.1.262), Parasolid V33.1 (All versions >= V33.1.262 < V33.1.263), Parasolid V34.0 (All versions < V34.0.252), Parasolid V34.1 (All versions < V34.1.242), Parasolid V35.0 (All versions < V35.0.161), Parasolid V35.0 (All versions >= V35.0.161 < V35.0.164), Simcenter Femap V2022.1 (All versions < V2022.1.3), Simcenter Femap V2022.2 (All versions < V2022.2.2). The affected application is vulnerable to uninitialized pointer access while parsing specially crafted X_T files. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-17506)
CVSS Score: 7.8 (HIGH)
CWE: CWE-824
References: https://cert-portal.siemens.com/productcert/pdf/ssa-518824.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-518824.pdf
CVE: CVE-2022-39148
Published: 2022-09-13
Description: A vulnerability has been identified in Parasolid V33.1 (All versions < V33.1.262), Parasolid V33.1 (All versions >= V33.1.262 < V33.1.263), Parasolid V34.0 (All versions < V34.0.252), Parasolid V34.1 (All versions < V34.1.242), Parasolid V35.0 (All versions < V35.0.161), Parasolid V35.0 (All versions >= V35.0.161 < V35.0.164), Simcenter Femap V2022.1 (All versions < V2022.1.3), Simcenter Femap V2022.2 (All versions < V2022.2.2). The affected application contains an out of bounds write past the end of an allocated buffer while parsing specially crafted X_T files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-17513)
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://cert-portal.siemens.com/productcert/pdf/ssa-518824.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-518824.pdf
CVE: CVE-2022-39149
Published: 2022-09-13
Description: A vulnerability has been identified in Parasolid V33.1 (All versions < V33.1.262), Parasolid V33.1 (All versions >= V33.1.262 < V33.1.263), Parasolid V34.0 (All versions < V34.0.252), Parasolid V34.1 (All versions < V34.1.242), Parasolid V35.0 (All versions < V35.0.161), Parasolid V35.0 (All versions >= V35.0.161 < V35.0.164), Simcenter Femap V2022.1 (All versions < V2022.1.3), Simcenter Femap V2022.2 (All versions < V2022.2.2). The affected application contains an out of bounds write past the end of an allocated buffer while parsing specially crafted X_T files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-17733)
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://cert-portal.siemens.com/productcert/pdf/ssa-518824.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-518824.pdf
CVE: CVE-2022-39150
Published: 2022-09-13
Description: A vulnerability has been identified in Parasolid V33.1 (All versions < V33.1.262), Parasolid V33.1 (All versions >= V33.1.262 < V33.1.263), Parasolid V34.0 (All versions < V34.0.252), Parasolid V34.1 (All versions < V34.1.242), Parasolid V35.0 (All versions < V35.0.161), Parasolid V35.0 (All versions >= V35.0.161 < V35.0.164), Simcenter Femap V2022.1 (All versions < V2022.1.3), Simcenter Femap V2022.2 (All versions < V2022.2.2). The affected application contains an out of bounds write past the end of an allocated buffer while parsing specially crafted X_T files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-17735)
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://cert-portal.siemens.com/productcert/pdf/ssa-518824.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-518824.pdf
CVE: CVE-2022-39151
Published: 2022-09-13
Description: A vulnerability has been identified in Parasolid V33.1 (All versions < V33.1.262), Parasolid V33.1 (All versions >= V33.1.262 < V33.1.263), Parasolid V34.0 (All versions < V34.0.252), Parasolid V34.1 (All versions < V34.1.242), Parasolid V35.0 (All versions < V35.0.161), Parasolid V35.0 (All versions >= V35.0.161 < V35.0.164), Simcenter Femap V2022.1 (All versions < V2022.1.3), Simcenter Femap V2022.2 (All versions < V2022.2.2). The affected application contains an out of bounds write past the end of an allocated buffer while parsing specially crafted X_T files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-17736)
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://cert-portal.siemens.com/productcert/pdf/ssa-518824.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-518824.pdf
CVE: CVE-2022-39152
Published: 2022-09-13
Description: A vulnerability has been identified in Parasolid V33.1 (All versions < V33.1.262), Parasolid V33.1 (All versions >= V33.1.262 < V33.1.263), Parasolid V34.0 (All versions < V34.0.252), Parasolid V34.1 (All versions < V34.1.242), Parasolid V35.0 (All versions < V35.0.161), Parasolid V35.0 (All versions >= V35.0.161 < V35.0.164), Simcenter Femap V2022.1 (All versions < V2022.1.3), Simcenter Femap V2022.2 (All versions < V2022.2.2). The affected application contains an out of bounds write past the end of an allocated buffer while parsing specially crafted X_T files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-17740)
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://cert-portal.siemens.com/productcert/pdf/ssa-518824.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-518824.pdf
CVE: CVE-2022-39153
Published: 2022-09-13
Description: A vulnerability has been identified in Parasolid V33.1 (All versions < V33.1.262), Parasolid V33.1 (All versions >= V33.1.262 < V33.1.263), Parasolid V34.0 (All versions < V34.0.252), Parasolid V34.1 (All versions < V34.1.242), Parasolid V35.0 (All versions < V35.0.161), Parasolid V35.0 (All versions >= V35.0.161 < V35.0.164), Simcenter Femap V2022.1 (All versions < V2022.1.3), Simcenter Femap V2022.2 (All versions < V2022.2.2). The affected application is vulnerable to out of bounds read past the end of an allocated buffer when parsing X_T files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-18187)
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://cert-portal.siemens.com/productcert/pdf/ssa-518824.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-518824.pdf
CVE: CVE-2022-39154
Published: 2022-09-13
Description: A vulnerability has been identified in Parasolid V33.1 (All versions < V33.1.262), Parasolid V33.1 (All versions >= V33.1.262 < V33.1.263), Parasolid V34.0 (All versions < V34.0.252), Parasolid V34.1 (All versions < V34.1.242), Parasolid V35.0 (All versions < V35.0.161), Parasolid V35.0 (All versions >= V35.0.161 < V35.0.164), Simcenter Femap V2022.1 (All versions < V2022.1.3), Simcenter Femap V2022.2 (All versions < V2022.2.2). The affected application contains an out of bounds write past the end of an allocated buffer while parsing specially crafted X_T files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-18188)
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://cert-portal.siemens.com/productcert/pdf/ssa-518824.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-518824.pdf
CVE: CVE-2022-39155
Published: 2022-09-13
Description: A vulnerability has been identified in Parasolid V33.1 (All versions < V33.1.262), Parasolid V33.1 (All versions >= V33.1.262 < V33.1.263), Parasolid V34.0 (All versions < V34.0.252), Parasolid V34.1 (All versions < V34.1.242), Parasolid V35.0 (All versions < V35.0.161), Parasolid V35.0 (All versions >= V35.0.161 < V35.0.164), Simcenter Femap V2022.1 (All versions < V2022.1.3), Simcenter Femap V2022.2 (All versions < V2022.2.2). The affected application contains an out of bounds write past the end of an allocated buffer while parsing specially crafted X_T files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-18192)
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://cert-portal.siemens.com/productcert/pdf/ssa-518824.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-518824.pdf
CVE: CVE-2022-39156
Published: 2022-09-13
Description: A vulnerability has been identified in Parasolid V33.1 (All versions < V33.1.262), Parasolid V33.1 (All versions >= V33.1.262 < V33.1.263), Parasolid V34.0 (All versions < V34.0.252), Parasolid V34.1 (All versions < V34.1.242), Parasolid V35.0 (All versions < V35.0.161), Parasolid V35.0 (All versions >= V35.0.161 < V35.0.164), Simcenter Femap V2022.1 (All versions < V2022.1.3), Simcenter Femap V2022.2 (All versions < V2022.2.2). The affected application is vulnerable to out of bounds read past the end of an allocated buffer when parsing X_T files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-18196)
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://cert-portal.siemens.com/productcert/pdf/ssa-518824.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-518824.pdf
CVE: CVE-2022-3174
Published: 2022-09-13
Description: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository ikus060/rdiffweb prior to 2.4.2.
CVSS Score: 7.5 (HIGH)
CWE: CWE-614, CWE-311
References: https://github.com/ikus060/rdiffweb/commit/f2de2371c5e13ce1c6fd6f9a1ed3e5d46b93cd7e; https://huntr.dev/bounties/d8a32bd6-c76d-4140-a5ca-ef368a3058ce; https://github.com/ikus060/rdiffweb/commit/f2de2371c5e13ce1c6fd6f9a1ed3e5d46b93cd7e
CVE: CVE-2022-3175
Published: 2022-09-13
Description: Missing Custom Error Page in GitHub repository ikus060/rdiffweb prior to 2.4.2.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-756, CWE-755
References: https://github.com/ikus060/rdiffweb/commit/233befc33bdc45d4838c773d5aed[PII_REDACTED]c5; https://huntr.dev/bounties/c40badc3-c9e7-4b69-9e2e-2b9f05865159; https://github.com/ikus060/rdiffweb/commit/233befc33bdc45d4838c773d5aed[PII_REDACTED]c5
CVE: CVE-2022-38616
Published: 2022-09-13
Description: SmartVista SVFE2 v2.2.22 was discovered to contain a SQL injection vulnerability via the UserForm:j_id90 parameter at /feegroups/tgrt_group.jsf.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: http://bpcbt.com; http://smartvista.com; https://tf1t.gitbook.io/mycve/smartvista/smartvista-svfe2/sql-injection-in-terminal-tariff-group-feature-of-smartvista-svfe2-version-2.2.22-cve-2022-38616
CVE: CVE-2022-1278
Published: 2022-09-13
Description: A flaw was found in WildFly, where an attacker can see deployment names, endpoints, and any other data the trace payload may contain.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1188, CWE-1188
References: https://bugzilla.redhat.com/show_bug.cgi?id=2073401; https://bugzilla.redhat.com/show_bug.cgi?id=2073401
CVE: CVE-2022-2989
Published: 2022-09-13
Description: An incorrect handling of the supplementary groups in the Podman container engine might lead to the sensitive information disclosure or possible data modification if an attacker has direct access to the affected container where supplementary groups are used to set access permissions and is able to execute a binary code in that container.
CVSS Score: 7.1 (HIGH)
CWE: CWE-842, CWE-863
References: https://bugzilla.redhat.com/show_bug.cgi?id=2121445; https://www.benthamsgaze.org/2022/08/22/vulnerability-in-linux-containers-investigation-and-mitigation/; https://bugzilla.redhat.com/show_bug.cgi?id=2121445
CVE: CVE-2022-2990
Published: 2022-09-13
Description: An incorrect handling of the supplementary groups in the Buildah container engine might lead to the sensitive information disclosure or possible data modification if an attacker has direct access to the affected container where supplementary groups are used to set access permissions and is able to execute a binary code in that container.
CVSS Score: 7.1 (HIGH)
CWE: CWE-842, CWE-863
References: https://bugzilla.redhat.com/show_bug.cgi?id=2121453; https://www.benthamsgaze.org/2022/08/22/vulnerability-in-linux-containers-investigation-and-mitigation/; https://bugzilla.redhat.com/show_bug.cgi?id=2121453
CVE: CVE-2022-38139
Published: 2022-09-13
Description: Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in RD Station plugin <= 5.2.0 at WordPress.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/integracao-rd-station/wordpress-rd-station-plugin-5-1-3-multiple-cross-site-request-forgery-csrf-vulnerabilities?_s_id=cve; https://patchstack.com/database/vulnerability/integracao-rd-station/wordpress-rd-station-plugin-5-1-3-multiple-cross-site-request-forgery-csrf-vulnerabilities?_s_id=cve
CVE: CVE-2022-1602
Published: 2022-09-13
Description: A potential security vulnerability has been identified in HP ThinPro 7.2 Service Pack 8 (SP8). The security vulnerability in SP8 is not remedied after upgrading from SP8 to Service Pack 9 (SP9). HP has released Service Pack 10 (SP10) to remediate the potential vulnerability introduced in SP8.
CVSS Score: 5.5 (MEDIUM)
References: https://support.hp.com/us-en/document/ish_6[PII_REDACTED]171-16/hpsbhf03789; https://support.hp.com/us-en/document/ish_6[PII_REDACTED]171-16/hpsbhf03789
CVE: CVE-2022-36385
Published: 2022-09-13
Description: A threat actor with momentary access to the device can plug in a USB drive and perform a malicious firmware update, resulting in permanent changes to device functionality. No authentication or controls are in place to prevent a threat actor from maliciously modifying firmware and performing a drive-by attack to load the firmware on any CMS8000 device.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-284
References: https://www.cisa.gov/uscert/ics/advisories/icsma-22-244-01; https://www.cisa.gov/uscert/ics/advisories/icsma-22-244-01
CVE: CVE-2022-36778
Published: 2022-09-13
Description: insert HTML / js code inside input how to get to the vulnerable input : Workers &gt; worker nickname &gt; inject in this input the code.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.gov.il/en/departments/faq/cve_advisories; https://www.gov.il/en/departments/faq/cve_advisories
CVE: CVE-2022-36779
Published: 2022-09-13
Description: PROSCEND - PROSCEND / ADVICE .Ltd - G/5G Industrial Cellular Router (with GPS)4 Unauthenticated OS Command Injection Proscend M330-w / M33-W5 / M350-5G / M350-W5G / M350-6 / M350-W6 / M301-G / M301-GW ADVICE ICR 111WG / https://www.proscend.com/en/category/industrial-Cellular-Router/industrial-Cellular-Router.html https://cdn.shopify.com/s/files/1/0036/9413/3297/files/ADVICE_Industrial_4G_LTE_Cellular_Router_ICR111WG.pdf?v=[PII_REDACTED]
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-78
References: https://www.gov.il/en/departments/faq/cve_advisories; https://www.gov.il/en/departments/faq/cve_advisories
CVE: CVE-2022-36780
Published: 2022-09-13
Description: Avdor CIS - crystal quality Credentials Management Errors. The product is phone call recorder, you can hear all the recorded calls without authenticate to the system. Attacker sends crafted URL to the system: ip:port//V=2;ChannellD=number;Ext=number;Command=startLM;Client=number;Request=number;R=number number - id of the recorded number.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-306
References: https://www.gov.il/en/Departments/faq/cve_advisories; https://www.gov.il/en/Departments/faq/cve_advisories
CVE: CVE-2022-36782
Published: 2022-09-13
Description: Pal Electronics Systems - Pal Gate Authorization Errors. The vulnerability is an authorization problem in PalGate device management android client app. Gates of bulidings and parking lots with a simple button in any smartphone. The API was found after a decompiling and static research using Jadx, and a dynamic analasys using Frida. The attacker can iterate over all the IOT devices to see every entry and exit, on every gate and device all over the world, he can also scrape the server and create a user's DB with full names and phone number of over 2.8 million users, and to see all of the users' movement in and out of gates, even in real time.
CVSS Score: 5.9 (MEDIUM)
References: https://www.gov.il/en/Departments/faq/cve_advisories; https://www.gov.il/en/Departments/faq/cve_advisories
CVE: CVE-2022-38069
Published: 2022-09-13
Description: Multiple globally default credentials exist across all CMS8000 devices, that once exposed, allow a threat actor with momentary physical access to gain privileged access to any device. Privileged credential access enables the extraction of sensitive patient information or modification of device parameters
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-798, CWE-798
References: https://www.cisa.gov/uscert/ics/advisories/icsma-22-244-01; https://www.cisa.gov/uscert/ics/advisories/icsma-22-244-01
CVE: CVE-2022-38100
Published: 2022-09-13
Description: The CMS800 device fails while attempting to parse malformed network data sent by a threat actor. A threat actor with network access can remotely issue a specially formatted UDP request that will cause the entire device to crash and require a physical reboot. A UDP broadcast request could be sent that causes a mass denial-of-service attack on all CME8000 devices connected to the same network.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://www.cisa.gov/uscert/ics/advisories/icsma-22-244-01; https://www.cisa.gov/uscert/ics/advisories/icsma-22-244-01
CVE: CVE-2022-38453
Published: 2022-09-13
Description: Multiple binary application files on the CMS8000 device are compiled with 'not stripped' and 'debug_info' compilation settings. These compiler settings greatly decrease the level of effort for a threat actor to reverse engineer sensitive code and identify additional vulnerabilities.
CVSS Score: 3.0 (LOW)
CWE: CWE-489
References: https://www.cisa.gov/uscert/ics/advisories/icsma-22-244-01; https://www.cisa.gov/uscert/ics/advisories/icsma-22-244-01
CVE: CVE-2022-38537
Published: 2022-09-13
Description: Archery v1.4.5 to v1.8.5 was discovered to contain multiple SQL injection vulnerabilities via the start_file, end_file, start_time, and stop_time parameters in the binlog2sql interface.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://announcements.bybit.com/en-US/article/bybit-improves-the-security-of-the-open-source-community-blt626818c0ee8c48a6/; https://github.com/hhyo/Archery/blob/v1.8.5/sql/urls.py#L135; https://github.com/hhyo/Archery/issues/1842
CVE: CVE-2022-38538
Published: 2022-09-13
Description: Archery v1.7.0 to v1.8.5 was discovered to contain a SQL injection vulnerability via the checksum parameter in the report module.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://announcements.bybit.com/en-US/article/bybit-improves-the-security-of-the-open-source-community-blt626818c0ee8c48a6/; https://github.com/hhyo/Archery/blob/v1.8.5/sql/urls.py#L145; https://github.com/hhyo/Archery/issues/1841
CVE: CVE-2022-38539
Published: 2022-09-13
Description: Archery v1.7.5 to v1.8.5 was discovered to contain a SQL injection vulnerability via the where parameter at /archive/apply.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://announcements.bybit.com/en-US/article/bybit-improves-the-security-of-the-open-source-community-blt626818c0ee8c48a6/; https://github.com/hhyo/Archery/blob/v1.8.5/sql/urls.py#L155; https://github.com/hhyo/Archery/issues/1842
CVE: CVE-2022-38540
Published: 2022-09-13
Description: Archery v1.4.0 to v1.8.5 was discovered to contain a SQL injection vulnerability via the ThreadIDs parameter in the create_kill_session interface.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://announcements.bybit.com/en-US/article/bybit-improves-the-security-of-the-open-source-community-blt626818c0ee8c48a6/; https://github.com/hhyo/Archery/blob/v1.8.5/sql/urls.py#L148; https://github.com/hhyo/Archery/issues/1841