deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-31112
Published: 2022-06-30
Description: Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In affected versions parse Server LiveQuery does not remove protected fields in classes, passing them to the client. The LiveQueryController now removes protected fields from the client response. Users are advised to upgrade. Users unable t upgrade should use `Parse.Cloud.afterLiveQueryEvent` to manually remove protected fields.
CVSS Score: 8.2 (HIGH)
CWE: CWE-200, CWE-212
References: https://github.com/parse-community/parse-server/commit/309f64ced8700321df056fb3cc97f15007a00df1; https://github.com/parse-community/parse-server/commit/9fd4516cde5c742f9f29dd05468b4a43a85639a6; https://github.com/parse-community/parse-server/issues/8073
CVE: CVE-2013-4144
Published: 2022-06-30
Description: There is an object injection vulnerability in swfupload plugin for wordpress.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20, CWE-74
References: https://github.com/wordpress/secure-swfupload/issues/1; https://www.openwall.com/lists/oss-security/2013/07/18/10; https://github.com/wordpress/secure-swfupload/issues/1
CVE: CVE-2022-34777
Published: 2022-06-30
Description: Jenkins GitLab Plugin 1.5.34 and earlier does not escape multiple fields inserted into the description of webhook-triggered builds, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.jenkins.io/security/advisory/2022-06-30/#SECURITY-2316; https://www.jenkins.io/security/advisory/2022-06-30/#SECURITY-2316
CVE: CVE-2022-34778
Published: 2022-06-30
Description: Jenkins TestNG Results Plugin 554.va4a552116332 and earlier renders the unescaped test descriptions and exception messages provided in test results if certain job-level options are set, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers able to configure jobs or control test results.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.jenkins.io/security/advisory/2022-06-30/#SECURITY-2788; https://www.jenkins.io/security/advisory/2022-06-30/#SECURITY-2788
CVE: CVE-2022-34779
Published: 2022-06-30
Description: A missing permission check in Jenkins XebiaLabs XL Release Plugin 22.0.0 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://www.jenkins.io/security/advisory/2022-06-30/#SECURITY-2773%20%281%29; https://www.jenkins.io/security/advisory/2022-06-30/#SECURITY-2773%20%281%29
CVE: CVE-2022-34780
Published: 2022-06-30
Description: A cross-site request forgery (CSRF) vulnerability in Jenkins XebiaLabs XL Release Plugin 22.0.0 and earlier allows attackers to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://www.jenkins.io/security/advisory/2022-06-30/#SECURITY-2773%20%282%29; https://www.jenkins.io/security/advisory/2022-06-30/#SECURITY-2773%20%282%29
CVE: CVE-2022-34781
Published: 2022-06-30
Description: Missing permission checks in Jenkins XebiaLabs XL Release Plugin 22.0.0 and earlier allow attackers with Overall/Read permission to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://www.jenkins.io/security/advisory/2022-06-30/#SECURITY-2773%20%282%29; https://www.jenkins.io/security/advisory/2022-06-30/#SECURITY-2773%20%282%29
CVE: CVE-2022-34782
Published: 2022-06-30
Description: An incorrect permission check in Jenkins requests-plugin Plugin 2.2.16 and earlier allows attackers with Overall/Read permission to view the list of pending requests.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863
References: https://www.jenkins.io/security/advisory/2022-06-30/#SECURITY-2650; https://www.jenkins.io/security/advisory/2022-06-30/#SECURITY-2650
CVE: CVE-2022-34783
Published: 2022-06-30
Description: Jenkins Plot Plugin 2.1.10 and earlier does not escape plot descriptions, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.jenkins.io/security/advisory/2022-06-30/#SECURITY-2220; https://www.jenkins.io/security/advisory/2022-06-30/#SECURITY-2220
CVE: CVE-2022-34784
Published: 2022-06-30
Description: Jenkins build-metrics Plugin 1.3 does not escape the build description on one of its views, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Build/Update permission.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.jenkins.io/security/advisory/2022-06-30/#SECURITY-1118; https://www.jenkins.io/security/advisory/2022-06-30/#SECURITY-1118
CVE: CVE-2022-34785
Published: 2022-06-30
Description: Jenkins build-metrics Plugin 1.3 and earlier does not perform permission checks in multiple HTTP endpoints, allowing attackers with Overall/Read permission to obtain information about jobs otherwise inaccessible to them.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863
References: https://www.jenkins.io/security/advisory/2022-06-30/#SECURITY-2643; https://www.jenkins.io/security/advisory/2022-06-30/#SECURITY-2643
CVE: CVE-2022-34786
Published: 2022-06-30
Description: Jenkins Rich Text Publisher Plugin 1.4 and earlier does not escape the HTML message set by its post-build step, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to configure jobs.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.jenkins.io/security/advisory/2022-06-30/#SECURITY-2332; https://www.jenkins.io/security/advisory/2022-06-30/#SECURITY-2332
CVE: CVE-2022-34787
Published: 2022-06-30
Description: Jenkins Project Inheritance Plugin 21.04.03 and earlier does not escape the reason a build is blocked in tooltips, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers able to control the reason a queue item is blocked.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.jenkins.io/security/advisory/2022-06-30/#SECURITY-1919; https://www.jenkins.io/security/advisory/2022-06-30/#SECURITY-1919
CVE: CVE-2022-34788
Published: 2022-06-30
Description: Jenkins Matrix Reloaded Plugin 1.1.3 and earlier does not escape the agent name in tooltips, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Agent/Configure permission.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.jenkins.io/security/advisory/2022-06-30/#SECURITY-1926; https://www.jenkins.io/security/advisory/2022-06-30/#SECURITY-1926
CVE: CVE-2022-34789
Published: 2022-06-30
Description: A cross-site request forgery (CSRF) vulnerability in Jenkins Matrix Reloaded Plugin 1.1.3 and earlier allows attackers to rebuild previous matrix builds.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://www.jenkins.io/security/advisory/2022-06-30/#SECURITY-2016; https://www.jenkins.io/security/advisory/2022-06-30/#SECURITY-2016
CVE: CVE-2022-34790
Published: 2022-06-30
Description: Jenkins eXtreme Feedback Panel Plugin 2.0.1 and earlier does not escape the job names used in tooltips, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.jenkins.io/security/advisory/2022-06-30/#SECURITY-1939; https://www.jenkins.io/security/advisory/2022-06-30/#SECURITY-1939
CVE: CVE-2022-34791
Published: 2022-06-30
Description: Jenkins Validating Email Parameter Plugin 1.10 and earlier does not escape the name and description of its parameter type, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.jenkins.io/security/advisory/2022-06-30/#SECURITY-2165; https://www.jenkins.io/security/advisory/2022-06-30/#SECURITY-2165
CVE: CVE-2022-34792
Published: 2022-06-30
Description: A cross-site request forgery (CSRF) vulnerability in Jenkins Recipe Plugin 1.2 and earlier allows attackers to send an HTTP request to an attacker-specified URL and parse the response as XML.
CVSS Score: 8.0 (HIGH)
CWE: CWE-352
References: https://www.jenkins.io/security/advisory/2022-06-30/#SECURITY-2000; https://www.jenkins.io/security/advisory/2022-06-30/#SECURITY-2000
CVE: CVE-2022-34793
Published: 2022-06-30
Description: Jenkins Recipe Plugin 1.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVSS Score: 8.8 (HIGH)
CWE: CWE-611
References: https://www.jenkins.io/security/advisory/2022-06-30/#SECURITY-2000; https://www.jenkins.io/security/advisory/2022-06-30/#SECURITY-2000
CVE: CVE-2022-34794
Published: 2022-06-30
Description: Missing permission checks in Jenkins Recipe Plugin 1.2 and earlier allow attackers with Overall/Read permission to send an HTTP request to an attacker-specified URL and parse the response as XML.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://www.jenkins.io/security/advisory/2022-06-30/#SECURITY-2000; https://www.jenkins.io/security/advisory/2022-06-30/#SECURITY-2000
CVE: CVE-2022-34795
Published: 2022-06-30
Description: Jenkins Deployment Dashboard Plugin 1.0.10 and earlier does not escape environment names on its Deployment Dashboard view, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with View/Configure permission.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.jenkins.io/security/advisory/2022-06-30/#SECURITY-2799; https://www.jenkins.io/security/advisory/2022-06-30/#SECURITY-2799
CVE: CVE-2022-34796
Published: 2022-06-30
Description: A missing permission check in Jenkins Deployment Dashboard Plugin 1.0.10 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://www.jenkins.io/security/advisory/2022-06-30/#SECURITY-2798%20%281%29; https://www.jenkins.io/security/advisory/2022-06-30/#SECURITY-2798%20%281%29
CVE: CVE-2022-34797
Published: 2022-06-30
Description: A cross-site request forgery (CSRF) vulnerability in Jenkins Deployment Dashboard Plugin 1.0.10 and earlier allows attackers to connect to an attacker-specified HTTP URL using attacker-specified credentials.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://www.jenkins.io/security/advisory/2022-06-30/#SECURITY-2798%20%282%29; https://www.jenkins.io/security/advisory/2022-06-30/#SECURITY-2798%20%282%29
CVE: CVE-2022-34798
Published: 2022-06-30
Description: Jenkins Deployment Dashboard Plugin 1.0.10 and earlier does not perform a permission check in several HTTP endpoints, allowing attackers with Overall/Read permission to connect to an attacker-specified HTTP URL using attacker-specified credentials.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://www.jenkins.io/security/advisory/2022-06-30/#SECURITY-2798%20%282%29; https://www.jenkins.io/security/advisory/2022-06-30/#SECURITY-2798%20%282%29
CVE: CVE-2022-34799
Published: 2022-06-30
Description: Jenkins Deployment Dashboard Plugin 1.0.10 and earlier stores a password unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-522
References: https://www.jenkins.io/security/advisory/2022-06-30/#SECURITY-2070; https://www.jenkins.io/security/advisory/2022-06-30/#SECURITY-2070
CVE: CVE-2022-34800
Published: 2022-06-30
Description: Jenkins Build Notifications Plugin 1.5.0 and earlier stores tokens unencrypted in its global configuration files on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-522
References: https://www.jenkins.io/security/advisory/2022-06-30/#SECURITY-2056; https://www.jenkins.io/security/advisory/2022-06-30/#SECURITY-2056
CVE: CVE-2022-34801
Published: 2022-06-30
Description: Jenkins Build Notifications Plugin 1.5.0 and earlier transmits tokens in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-319
References: https://www.jenkins.io/security/advisory/2022-06-30/#SECURITY-2056; https://www.jenkins.io/security/advisory/2022-06-30/#SECURITY-2056
CVE: CVE-2022-34802
Published: 2022-06-30
Description: Jenkins RocketChat Notifier Plugin 1.5.2 and earlier stores the login password and webhook token unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-522
References: https://www.jenkins.io/security/advisory/2022-06-30/#SECURITY-2088; https://www.jenkins.io/security/advisory/2022-06-30/#SECURITY-2088
CVE: CVE-2022-34803
Published: 2022-06-30
Description: Jenkins OpsGenie Plugin 1.9 and earlier stores API keys unencrypted in its global configuration file and in job config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission (config.xml), or access to the Jenkins controller file system.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-522
References: https://www.jenkins.io/security/advisory/2022-06-30/#SECURITY-1877; https://www.jenkins.io/security/advisory/2022-06-30/#SECURITY-1877
CVE: CVE-2022-34804
Published: 2022-06-30
Description: Jenkins OpsGenie Plugin 1.9 and earlier transmits API keys in plain text as part of the global Jenkins configuration form and job configuration forms, potentially resulting in their exposure.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-319
References: https://www.jenkins.io/security/advisory/2022-06-30/#SECURITY-1877; https://www.jenkins.io/security/advisory/2022-06-30/#SECURITY-1877
CVE: CVE-2022-34805
Published: 2022-06-30
Description: Jenkins Skype notifier Plugin 1.1.0 and earlier stores a password unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-522
References: https://www.jenkins.io/security/advisory/2022-06-30/#SECURITY-2160; https://www.jenkins.io/security/advisory/2022-06-30/#SECURITY-2160
CVE: CVE-2022-34806
Published: 2022-06-30
Description: Jenkins Jigomerge Plugin 0.9 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission, or access to the Jenkins controller file system.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-522
References: https://www.jenkins.io/security/advisory/2022-06-30/#SECURITY-2083; https://www.jenkins.io/security/advisory/2022-06-30/#SECURITY-2083
CVE: CVE-2022-34807
Published: 2022-06-30
Description: Jenkins Elasticsearch Query Plugin 1.2 and earlier stores a password unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-522
References: https://www.jenkins.io/security/advisory/2022-06-30/#SECURITY-2073; https://www.jenkins.io/security/advisory/2022-06-30/#SECURITY-2073
CVE: CVE-2022-34808
Published: 2022-06-30
Description: Jenkins Cisco Spark Plugin 1.1.1 and earlier stores bearer tokens unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-522
References: https://www.jenkins.io/security/advisory/2022-06-30/#SECURITY-2055; https://www.jenkins.io/security/advisory/2022-06-30/#SECURITY-2055
CVE: CVE-2022-34809
Published: 2022-06-30
Description: Jenkins RQM Plugin 2.8 and earlier stores a password unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-522
References: https://www.jenkins.io/security/advisory/2022-06-30/#SECURITY-2155; https://www.jenkins.io/security/advisory/2022-06-30/#SECURITY-2155
CVE: CVE-2022-34810
Published: 2022-06-30
Description: A missing check in Jenkins RQM Plugin 2.8 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://www.jenkins.io/security/advisory/2022-06-30/#SECURITY-2806; https://www.jenkins.io/security/advisory/2022-06-30/#SECURITY-2806
CVE: CVE-2022-34811
Published: 2022-06-30
Description: A missing permission check in Jenkins XPath Configuration Viewer Plugin 1.1.1 and earlier allows attackers with Overall/Read permission to access the XPath Configuration Viewer page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://www.jenkins.io/security/advisory/2022-06-30/#SECURITY-2002; https://www.jenkins.io/security/advisory/2022-06-30/#SECURITY-2002
CVE: CVE-2022-34812
Published: 2022-06-30
Description: A cross-site request forgery (CSRF) vulnerability in Jenkins XPath Configuration Viewer Plugin 1.1.1 and earlier allows attackers to create and delete XPath expressions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://www.jenkins.io/security/advisory/2022-06-30/#SECURITY-2658; https://www.jenkins.io/security/advisory/2022-06-30/#SECURITY-2658
CVE: CVE-2022-34813
Published: 2022-06-30
Description: A missing permission check in Jenkins XPath Configuration Viewer Plugin 1.1.1 and earlier allows attackers with Overall/Read permission to create and delete XPath expressions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://www.jenkins.io/security/advisory/2022-06-30/#SECURITY-2658; https://www.jenkins.io/security/advisory/2022-06-30/#SECURITY-2658
CVE: CVE-2022-34814
Published: 2022-06-30
Description: Jenkins Request Rename Or Delete Plugin 1.1.0 and earlier does not correctly perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to view an administrative configuration page listing pending requests.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863
References: https://www.jenkins.io/security/advisory/2022-06-30/#SECURITY-1996; https://www.jenkins.io/security/advisory/2022-06-30/#SECURITY-1996
CVE: CVE-2022-34815
Published: 2022-06-30
Description: A cross-site request forgery (CSRF) vulnerability in Jenkins Request Rename Or Delete Plugin 1.1.0 and earlier allows attackers to accept pending requests, thereby renaming or deleting jobs.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://www.jenkins.io/security/advisory/2022-06-30/#SECURITY-2657; https://www.jenkins.io/security/advisory/2022-06-30/#SECURITY-2657
CVE: CVE-2022-34816
Published: 2022-06-30
Description: Jenkins HPE Network Virtualization Plugin 1.0 stores passwords unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-522
References: https://www.jenkins.io/security/advisory/2022-06-30/#SECURITY-2080; https://www.jenkins.io/security/advisory/2022-06-30/#SECURITY-2080
CVE: CVE-2022-34817
Published: 2022-06-30
Description: A cross-site request forgery (CSRF) vulnerability in Jenkins Failed Job Deactivator Plugin 1.2.1 and earlier allows attackers to disable jobs.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://www.jenkins.io/security/advisory/2022-06-30/#SECURITY-2061; https://www.jenkins.io/security/advisory/2022-06-30/#SECURITY-2061
CVE: CVE-2022-34818
Published: 2022-06-30
Description: Jenkins Failed Job Deactivator Plugin 1.2.1 and earlier does not perform permission checks in several views and HTTP endpoints, allowing attackers with Overall/Read permission to disable jobs.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://www.jenkins.io/security/advisory/2022-06-30/#SECURITY-2061; https://www.jenkins.io/security/advisory/2022-06-30/#SECURITY-2061
CVE: CVE-2013-4252
Published: 2022-06-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2013-4561
Published: 2022-06-30
Description: In a openshift node, there is a cron job to update mcollective facts that mishandles a temporary file. This may lead to loss of confidentiality and integrity.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-377, CWE-668
References: https://bugzilla.redhat.com/show_bug.cgi?id=1029652; https://github.com/openshift/origin-server/commit/f1abe972794e35a4bfba597694ce829990f14d39; https://bugzilla.redhat.com/show_bug.cgi?id=1029652
CVE: CVE-2022-28127
Published: 2022-06-30
Description: A data removal vulnerability exists in the web_server /action/remove/ API functionality of Robustel R1510 3.3.0. A specially-crafted network request can lead to arbitrary file deletion. An attacker can send a sequence of requests to trigger this vulnerability.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-20, CWE-22
References: https://talosintelligence.com/vulnerability_reports/TALOS-2022-1571; https://talosintelligence.com/vulnerability_reports/TALOS-2022-1571
CVE: CVE-2022-2197
Published: 2022-06-30
Description: By using a specific credential string, an attacker with network access to the device’s web interface could circumvent the authentication scheme and perform administrative operations.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-181-01; https://www.cisa.gov/uscert/ics/advisories/icsa-22-181-01
CVE: CVE-2022-32585
Published: 2022-06-30
Description: A command execution vulnerability exists in the clish art2 functionality of Robustel R1510 3.3.0. A specially-crafted network request can lead to arbitrary command execution. An attacker can send a sequence of requests to trigger this vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-489
References: https://talosintelligence.com/vulnerability_reports/TALOS-2022-1570; https://talosintelligence.com/vulnerability_reports/TALOS-2022-1570
CVE: CVE-2022-33312
Published: 2022-06-30
Description: Multiple command injection vulnerabilities exist in the web_server action endpoints functionalities of Robustel R1510 3.3.0. A specially-crafted network request can lead to arbitrary command execution. An attacker can send a sequence of requests to trigger these vulnerabilities.The `/action/import_cert_file/` API is affected by command injection vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://talosintelligence.com/vulnerability_reports/TALOS-2022-1572; https://talosintelligence.com/vulnerability_reports/TALOS-2022-1572
CVE: CVE-2022-33313
Published: 2022-06-30
Description: Multiple command injection vulnerabilities exist in the web_server action endpoints functionalities of Robustel R1510 3.3.0. A specially-crafted network request can lead to arbitrary command execution. An attacker can send a sequence of requests to trigger these vulnerabilities.The `/action/import_https_cert_file/` API is affected by command injection vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://talosintelligence.com/vulnerability_reports/TALOS-2022-1572; https://talosintelligence.com/vulnerability_reports/TALOS-2022-1572
CVE: CVE-2022-33314
Published: 2022-06-30
Description: Multiple command injection vulnerabilities exist in the web_server action endpoints functionalities of Robustel R1510 3.3.0. A specially-crafted network request can lead to arbitrary command execution. An attacker can send a sequence of requests to trigger these vulnerabilities.The `/action/import_sdk_file/` API is affected by command injection vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://talosintelligence.com/vulnerability_reports/TALOS-2022-1572; https://talosintelligence.com/vulnerability_reports/TALOS-2022-1572