deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-41404
Published: 2022-10-11
Description: An issue in the fetch() method in the BasicProfile class of org.ini4j through version v0.5.4 allows attackers to cause a Denial of Service (DoS) via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://github.com/Checkmarx/Vulnerabilities-Proofs-of-Concept/tree/main/2022/CVE-2022-41404; https://lists.debian.org/debian-lts-announce/2022/11/msg00037.html; https://sourceforge.net/p/ini4j/bugs/56/
CVE: CVE-2022-42717
Published: 2022-10-11
Description: An issue was discovered in Hashicorp Packer before 2.3.1. The recommended sudoers configuration for Vagrant on Linux is insecure. If the host has been configured according to this documentation, non-privileged users on the host can leverage a wildcard in the sudoers configuration to execute arbitrary commands as root.
CVSS Score: 7.8 (HIGH)
CWE: CWE-284
References: https://discuss.hashicorp.com/t/hcsec-2022-23-vagrant-nfs-sudoers-configuration-allows-for-local-privilege-escalation/45423; https://github.com/hashicorp/vagrant/pull/12910; https://www.vagrantup.com/docs/synced-folders/nfs
CVE: CVE-2022-28866
Published: 2022-10-12
Description: Multiple Improper Access Control was discovered in Nokia AirFrame BMC Web GUI < R18 Firmware v4.13.00. It does not properly validate requests for access to (or editing of) data and functionality in all endpoints under /#settings/* and /api/settings/*. By not verifying the permissions for access to resources, it allows a potential attacker to view pages, with sensitive data, that are not allowed, and modify system configurations also causing DoS, which should be accessed only by user with administration profile, bypassing all controls (without checking for user identity).
CVSS Score: 8.8 (HIGH)
CWE: CWE-862
References: https://www.gruppotim.it/it/footer/red-team.html; https://www.telecomitalia.com/tit/it/innovazione/cybersecurity/red-team.html; https://www.gruppotim.it/it/footer/red-team.html
CVE: CVE-2022-40440
Published: 2022-10-12
Description: mxGraph v4.2.2 was discovered to contain a cross-site scripting (XSS) vulnerability via the setTooltips() function.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://mxgraph.com; https://github.com/SxB64/mxgraph-xss-vul/wiki; https://github.com/jgraph/mxgraph
CVE: CVE-2022-40921
Published: 2022-10-12
Description: DedeCMS V5.7.99 was discovered to contain an arbitrary file upload vulnerability via the component /dede/file_manage_control.php.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: https://github.com/T4nGg/DedeCMS-V5.7.99-File-Upload/; https://github.com/T4nGg/DedeCMS-V5.7.99-File-Upload/
CVE: CVE-2022-41406
Published: 2022-10-12
Description: An arbitrary file upload vulnerability in the /admin/admin_pic.php component of Church Management System v1.0 allows attackers to execute arbitrary code via a crafted PHP file.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434, CWE-434
References: https://github.com/CokuTau-CH/Bug_report/blob/main/vendors/Godfrey%20De%20Blessed/church-management-system/RCE-1.md; https://github.com/CokuTau-CH/Bug_report/blob/main/vendors/Godfrey%20De%20Blessed/church-management-system/RCE-1.md
CVE: CVE-2022-41407
Published: 2022-10-12
Description: Online Pet Shop We App v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/?page=orders/view_order.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/CokuTau-CH/Bug_report/blob/main/vendors/oretnom23/online-pet-shop-we-app/SQLi-2.md; https://github.com/CokuTau-CH/Bug_report/blob/main/vendors/oretnom23/online-pet-shop-we-app/SQLi-2.md
CVE: CVE-2022-41408
Published: 2022-10-12
Description: Online Pet Shop We App v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/?page=orders/view_order.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://www.github.com; https://www.github.com
CVE: CVE-2022-41530
Published: 2022-10-12
Description: Open Source SACCO Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /sacco_shield/ajax.php?action=delete_borrower.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/yueleve/bug_report/blob/main/vendots/mayuri_k/open-source-sacco-management-system/SQLi-2.md; https://github.com/yueleve/bug_report/blob/main/vendots/mayuri_k/open-source-sacco-management-system/SQLi-2.md
CVE: CVE-2022-41532
Published: 2022-10-12
Description: Open Source SACCO Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /sacco_shield/ajax.php?action=delete_plan.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/yueleve/bug_report/blob/main/vendots/mayuri_k/open-source-sacco-management-system/SQLi-1.md; https://github.com/yueleve/bug_report/blob/main/vendots/mayuri_k/open-source-sacco-management-system/SQLi-1.md; https://github.com/yueleve/bug_report/blob/main/vendots/mayuri_k/open-source-sacco-management-system/SQLi-1.md
CVE: CVE-2022-41606
Published: 2022-10-12
Description: HashiCorp Nomad and Nomad Enterprise 1.0.2 up to 1.2.12, and 1.3.5 jobs submitted with an artifact stanza using invalid S3 or GCS URLs can be used to crash client agents. Fixed in 1.2.13, 1.3.6, and 1.4.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://discuss.hashicorp.com; https://discuss.hashicorp.com/t/hcsec-2022-22-nomad-panics-on-job-submission-with-bad-artifact-stanza-source-url/45420; https://discuss.hashicorp.com
CVE: CVE-2022-37611
Published: 2022-10-12
Description: Prototype pollution vulnerability in tschaub gh-pages 3.1.0 via the partial variable in util.js.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1321, CWE-1321
References: https://github.com/tschaub/gh-pages/blob/e363b144defe8e555f5a54251a6f7f1297c0e3f6/lib/util.js#L11; https://github.com/tschaub/gh-pages/blob/e363b144defe8e555f5a54251a6f7f1297c0e3f6/lib/util.js#L16; https://github.com/tschaub/gh-pages/issues/446
CVE: CVE-2022-40469
Published: 2022-10-12
Description: iKuai OS v3.6.7 was discovered to contain an authenticated remote code execution (RCE) vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: https://github.com/yikesoftware/exp_and_poc_archive/tree/main/CVE/CVE-2022-40469; https://www.ikuai8.com/component/download; https://www.ikuai8.com/download.php?n=/3.x/iso/iKuai8_x64_3.6.7_Build[PII_REDACTED]57.iso
CVE: CVE-2022-42711
Published: 2022-10-12
Description: In Progress WhatsUp Gold before 22.1.0, an SNMP MIB Walker application endpoint failed to adequately sanitize malicious input. This could allow an unauthenticated attacker to execute arbitrary code in a victim's browser.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-79, CWE-79
References: https://community.progress.com/s/article/Product-Alert-Bulletin-October-2022; https://www.progress.com/; https://www.progress.com/network-monitoring
CVE: CVE-2022-2720
Published: 2022-10-12
Description: In affected versions of Octopus Server it was identified that when a sensitive value is a substring of another value, sensitive value masking will only partially work.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-359
References: https://advisories.octopus.com/post/2022/sa2022-18/; https://advisories.octopus.com/post/2022/sa2022-18/
CVE: CVE-2022-3458
Published: 2022-10-12
Description: A vulnerability has been found in SourceCodester Human Resource Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /employeeview.php of the component Image File Handler. The manipulation leads to unrestricted upload. The attack can be launched remotely. The associated identifier of this vulnerability is VDB-210559.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-266, CWE-434
References: https://vuldb.com/?id.210559; https://vuldb.com/?id.210559
CVE: CVE-2022-40664
Published: 2022-10-12
Description: Apache Shiro before 1.10.0, Authentication Bypass Vulnerability in Shiro when forwarding or including via RequestDispatcher.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: http://www.openwall.com/lists/oss-security/2022/10/12/1; http://www.openwall.com/lists/oss-security/2022/10/12/2; http://www.openwall.com/lists/oss-security/2022/10/13/1
CVE: CVE-2022-3464
Published: 2022-10-12
Description: A vulnerability classified as problematic has been found in puppyCMS up to 5.1. This affects an unknown part of the file /admin/settings.php. The manipulation of the argument site_name leads to cross site scripting. It is possible to initiate the attack remotely. The associated identifier of this vulnerability is VDB-210699.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-707, CWE-79
References: https://vuldb.com/?id.210699; https://vuldb.com/?id.210699
CVE: CVE-2022-3465
Published: 2022-10-12
Description: A vulnerability classified as critical was found in Mediabridge Medialink. This vulnerability affects unknown code of the file /index.asp. The manipulation leads to improper authentication. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-210700.
CVSS Score: 7.3 (HIGH)
CWE: CWE-287
References: https://github.com/Peanut886/Vulnerability/blob/main/MediaLink%20Unauthorized%20access.md; https://vuldb.com/?id.210700; https://github.com/Peanut886/Vulnerability/blob/main/MediaLink%20Unauthorized%20access.md
CVE: CVE-2022-37614
Published: 2022-10-12
Description: Prototype pollution vulnerability in function enable in mockery.js in mfncooper mockery commit 822f0566fd6d72af8c943ae5ca2aa92e516aa2cf via the key variable in mockery.js.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1321, CWE-1321
References: https://github.com/mfncooper/mockery/blob/822f0566fd6d72af8c943ae5ca2aa92e516aa2cf/mockery.js#L119; https://github.com/mfncooper/mockery/blob/822f0566fd6d72af8c943ae5ca2aa92e516aa2cf/mockery.js#L62; https://github.com/mfncooper/mockery/issues/77
CVE: CVE-2022-40871
Published: 2022-10-12
Description: Dolibarr ERP & CRM <=15.0.3 is vulnerable to Eval injection. By default, any administrator can be added to the installation page of dolibarr, and if successfully added, malicious code can be inserted into the database and then execute it by eval.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94, CWE-94
References: https://github.com/youncyb/dolibarr-rce; https://github.com/youncyb/dolibarr-rce
CVE: CVE-2022-42715
Published: 2022-10-12
Description: A reflected XSS vulnerability exists in REDCap before 12.04.18 in the Alerts & Notifications upload feature. A crafted CSV file will, when uploaded, trigger arbitrary JavaScript code execution.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/uclahs-secops/security-research/tree/main/reports/20221011-recap-xss; https://redcap.med.usc.edu/_shib/assets/ChangeLog_Standard.pdf; https://www.evms.edu/research/resources_services/redcap/redcap_change_log/
CVE: CVE-2022-33106
Published: 2022-10-12
Description: WiJungle NGFW Version U250 was discovered to be vulnerable to No Rate Limit attack, allowing the attacker to brute force the admin password leading to Account Take Over.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-307, CWE-307
References: http://wijungle.com; https://hexisanoob.gitbook.io/hexisanoob/cves/cve-2022-33106; http://wijungle.com
CVE: CVE-2022-3467
Published: 2022-10-12
Description: A vulnerability classified as critical was found in Jiusi OA. Affected by this vulnerability is an unknown functionality of the file /jsoa/hntdCustomDesktopActionContent. The manipulation of the argument inforid leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier VDB-210709 was assigned to this vulnerability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-707
References: https://vuldb.com/?id.210709; https://www.cnblogs.com/J0o1ey/p/16785375.html; https://vuldb.com/?id.210709
CVE: CVE-2022-0030
Published: 2022-10-12
Description: An authentication bypass vulnerability in the Palo Alto Networks PAN-OS 8.1 web interface allows a network-based attacker with specific knowledge of the target firewall or Panorama appliance to impersonate an existing PAN-OS administrator and perform privileged actions.
CVSS Score: 8.1 (HIGH)
CWE: CWE-290, CWE-290
References: https://security.paloaltonetworks.com/CVE-2022-0030; https://security.paloaltonetworks.com/CVE-2022-0030
CVE: CVE-2022-28887
Published: 2022-10-12
Description: Multiple Denial-of-Service (DoS) vulnerability was discovered in F-Secure & WithSecure products whereby the aerdl.dll unpacker handler function crashes. This can lead to a possible scanning engine crash.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-404
References: https://www.f-secure.com/en/business/support-and-downloads/security-advisories; https://www.withsecure.com/en/support/security-advisories; https://www.f-secure.com/en/business/support-and-downloads/security-advisories
CVE: CVE-2022-41403
Published: 2022-10-12
Description: OpenCart 3.x Newsletter Custom Popup was discovered to contain a SQL injection vulnerability via the email parameter at index.php?route=extension/module/so_newletter_custom_popup/newsletter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://packetstormsecurity.com/files/168412/OpenCart-3.x-Newsletter-Custom-Popup-4.0-SQL-Injection.html; https://packetstormsecurity.com/files/168412/OpenCart-3.x-Newsletter-Custom-Popup-4.0-SQL-Injection.html
CVE: CVE-2022-2249
Published: 2022-10-12
Description: Privilege escalation related vulnerabilities were discovered in Avaya Aura Communication Manager that may allow local administrative users to escalate their privileges. This issue affects Communication Manager versions 8.0.0.0 through 8.1.3.3 and 10.1.0.0.
CVSS Score: 7.7 (HIGH)
CWE: CWE-269, CWE-269
References: https://download.avaya.com/css/public/documents/101083760; https://download.avaya.com/css/public/documents/101083760
CVE: CVE-2022-42077
Published: 2022-10-12
Description: Tenda AC1206 US_AC1206V1.0RTL_V15.03.06.23_multi_TD01 is vulnerable to Cross Site Request Forgery (CSRF) via function fromSysToolReboot.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://github.com/tianhui999/myCVE/blob/main/AC1206/AC1206-1.md; https://github.com/tianhui999/myCVE/blob/main/AC1206/AC1206-1.md
CVE: CVE-2022-42078
Published: 2022-10-12
Description: Tenda AC1206 US_AC1206V1.0RTL_V15.03.06.23_multi_TD01 is vulnerable to Cross Site Request Forgery (CSRF) via function fromSysToolRestoreSet.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://github.com/tianhui999/myCVE/blob/main/AC1206/AC1206-2.md; https://github.com/tianhui999/myCVE/blob/main/AC1206/AC1206-2.md
CVE: CVE-2022-42079
Published: 2022-10-12
Description: Tenda AC1206 US_AC1206V1.0RTL_V15.03.06.23_multi_TD01 was discovered to contain a stack overflow via the function formWifiBasicSet.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-787
References: https://github.com/tianhui999/myCVE/blob/main/AC1206/AC1206-3.md; https://github.com/tianhui999/myCVE/blob/main/AC1206/AC1206-3.md
CVE: CVE-2022-42080
Published: 2022-10-12
Description: Tenda AC1206 US_AC1206V1.0RTL_V15.03.06.23_multi_TD01 was discovered to contain a heap overflow via sched_start_time parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-787
References: https://github.com/tianhui999/myCVE/blob/main/AC1206/AC1206-4.md; https://github.com/tianhui999/myCVE/blob/main/AC1206/AC1206-4.md
CVE: CVE-2022-42081
Published: 2022-10-12
Description: Tenda AC1206 US_AC1206V1.0RTL_V15.03.06.23_multi_TD01 was discovered to contain a stack overflow via sched_end_time parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-787
References: https://github.com/tianhui999/myCVE/blob/main/AC1206/AC1206-5.md; https://github.com/tianhui999/myCVE/blob/main/AC1206/AC1206-5.md
CVE: CVE-2022-42086
Published: 2022-10-12
Description: Tenda AX1803 US_AX1803v2.0br_v1.0.0.1_2994_CN_ZGYD01_4 is vulnerable to Cross Site Request Forgery (CSRF) via function TendaAteMode.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://github.com/tianhui999/myCVE/blob/main/AX1803/AX1803-2.md; https://github.com/tianhui999/myCVE/blob/main/AX1803/AX1803-2.md
CVE: CVE-2022-42087
Published: 2022-10-12
Description: Tenda AX1803 US_AX1803v2.0br_v1.0.0.1_2994_CN_ZGYD01_4 is vulnerable to Cross Site Request Forgery (CSRF) via function fromSysToolReboot.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://github.com/tianhui999/myCVE/blob/main/AX1803/AX1803-1.md; https://github.com/tianhui999/myCVE/blob/main/AX1803/AX1803-1.md
CVE: CVE-2022-31228
Published: 2022-10-12
Description: Dell EMC XtremIO versions prior to X2 6.4.0-22 contain a bruteforce vulnerability. A remote unauthenticated attacker can potentially exploit this vulnerability and gain access to an admin account.
CVSS Score: 8.1 (HIGH)
CWE: CWE-307, CWE-307
References: https://www.dell.com/support/kbdoc/en-us/000204112/dsa-2022-145-dell-emc-xtremeio-for-ssh-and-web-ui-vulnerability; https://www.dell.com/support/kbdoc/en-us/000204112/dsa-2022-145-dell-emc-xtremeio-for-ssh-and-web-ui-vulnerability
CVE: CVE-2022-32483
Published: 2022-10-12
Description: Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with admin privileges may potentially exploit this vulnerability in order to modify a UEFI variable.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-20, CWE-20
References: https://www.dell.com/support/kbdoc/000203758; https://www.dell.com/support/kbdoc/000203758
CVE: CVE-2022-32484
Published: 2022-10-12
Description: Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with admin privileges may potentially exploit this vulnerability in order to modify a UEFI variable.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-20, CWE-20
References: https://www.dell.com/support/kbdoc/000203758; https://www.dell.com/support/kbdoc/000203758
CVE: CVE-2022-32485
Published: 2022-10-12
Description: Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution in SMRAM.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-20
References: https://www.dell.com/support/kbdoc/000203758; https://www.dell.com/support/kbdoc/000203758
CVE: CVE-2022-32487
Published: 2022-10-12
Description: Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution in SMRAM.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-20
References: https://www.dell.com/support/kbdoc/000203758; https://www.dell.com/support/kbdoc/000203758
CVE: CVE-2022-32488
Published: 2022-10-12
Description: Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution in SMRAM.
CVSS Score: 8.2 (HIGH)
CWE: CWE-20, CWE-20
References: https://www.dell.com/support/kbdoc/000203758; https://www.dell.com/support/kbdoc/000203758
CVE: CVE-2022-32489
Published: 2022-10-12
Description: Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution in SMRAM.
CVSS Score: 8.2 (HIGH)
CWE: CWE-20, CWE-20
References: https://www.dell.com/support/kbdoc/000203758; https://www.dell.com/support/kbdoc/000203758
CVE: CVE-2022-32491
Published: 2022-10-12
Description: Dell Client BIOS contains a Buffer Overflow vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by manipulating an SMI to cause an arbitrary write during SMM.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-119, CWE-120
References: https://www.dell.com/support/kbdoc/000203758; https://www.dell.com/support/kbdoc/000203758
CVE: CVE-2022-32493
Published: 2022-10-12
Description: Dell BIOS contains an Stack-Based Buffer Overflow vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution in SMRAM.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-121, CWE-787
References: https://www.dell.com/support/kbdoc/000203758; https://www.dell.com/support/kbdoc/000203758
CVE: CVE-2022-33918
Published: 2022-10-12
Description: Dell GeoDrive, Versions 2.1 - 2.2, contains an information disclosure vulnerability. An authenticated non-admin user could potentially exploit this vulnerability and gain access to sensitive information.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-316, CWE-312
References: https://www.dell.com/support/kbdoc/000203632; https://www.dell.com/support/kbdoc/000203632
CVE: CVE-2022-33919
Published: 2022-10-12
Description: Dell GeoDrive, versions 2.1 - 2.2, contains an information disclosure vulnerability in GUI. An authenticated non-admin user could potentially exploit this vulnerability and view sensitive information.
CVSS Score: 7.8 (HIGH)
CWE: CWE-200
References: https://www.dell.com/support/kbdoc/000203632; https://www.dell.com/support/kbdoc/000203632
CVE: CVE-2022-33920
Published: 2022-10-12
Description: Dell GeoDrive, versions prior to 2.2, contains an Unquoted File Path vulnerability. A low privilege attacker could potentially exploit this vulnerability, leading to the execution of arbitrary code in the SYSTEM security context.
CVSS Score: 7.8 (HIGH)
CWE: CWE-428, CWE-428
References: https://www.dell.com/support/kbdoc/000203632; https://www.dell.com/support/kbdoc/000203632
CVE: CVE-2022-33921
Published: 2022-10-12
Description: Dell GeoDrive, versions prior to 2.2, contains Multiple DLL Hijacking Vulnerabilities. A low privilege attacker could potentially exploit this vulnerability, leading to the execution of arbitrary code in the SYSTEM security context.
CVSS Score: 7.0 (HIGH)
CWE: CWE-427, CWE-427
References: https://www.dell.com/support/kbdoc/000203632; https://www.dell.com/support/kbdoc/000203632
CVE: CVE-2022-33922
Published: 2022-10-12
Description: Dell GeoDrive, versions prior to 2.2, contains Insecure File and Folder Permissions vulnerabilities. A low privilege attacker could potentially exploit this vulnerability, leading to the execution of arbitrary code in the SYSTEM security context. Dell recommends customers to upgrade at the earliest opportunity.
CVSS Score: 7.0 (HIGH)
CWE: CWE-276, CWE-276
References: https://www.dell.com/support/kbdoc/000203632; https://www.dell.com/support/kbdoc/000203632
CVE: CVE-2022-33937
Published: 2022-10-12
Description: Dell GeoDrive, Versions 1.0 - 2.2, contain a Path Traversal Vulnerability in the reporting function. A local, low privileged attacker could potentially exploit this vulnerability, to gain unauthorized delete access to the files stored on the server filesystem, with the privileges of the GeoDrive service: NT AUTHORITY\SYSTEM.
CVSS Score: 7.1 (HIGH)
CWE: CWE-23, CWE-22
References: https://www.dell.com/support/kbdoc/000203632; https://www.dell.com/support/kbdoc/000203632
CVE: CVE-2022-34390
Published: 2022-10-12
Description: Dell BIOS contains a use of uninitialized variable vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution in SMRAM.
CVSS Score: 7.5 (HIGH)
CWE: CWE-457, CWE-908
References: https://www.dell.com/support/kbdoc/000203882; https://www.dell.com/support/kbdoc/000203882
CVE: CVE-2022-34391
Published: 2022-10-12
Description: Dell Client BIOS Versions prior to the remediated version contain an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution in SMRAM.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: https://www.dell.com/support/kbdoc/000203882; https://www.dell.com/support/kbdoc/000203882
CVE: CVE-2022-37601
Published: 2022-10-12
Description: Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils via the name variable in parseQuery.js. This affects all versions prior to 1.4.1 and 2.0.3.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1321
References: http://users.encs.concordia.ca/~mmannan/publications/JS-vulnerability-aisaccs2022.pdf; https://dl.acm.org/doi/abs/10.1145/3[PII_REDACTED]769; https://dl.acm.org/doi/pdf/10.1145/3[PII_REDACTED]769