deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-36609
Published: 2022-12-08
Description: A vulnerability was found in annyshow DuxCMS 2.1. It has been classified as problematic. This affects an unknown part of the file admin.php&r=article/AdminContent/edit of the component Article Handler. The manipulation of the argument content leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-215115.
CVSS Score: 2.4 (LOW)
CWE: CWE-707
References: https://gitee.com/annyshow/DuxCMS2.1/issues/I183GG; https://vuldb.com/?id.215115; https://gitee.com/annyshow/DuxCMS2.1/issues/I183GG
CVE: CVE-2020-36610
Published: 2022-12-08
Description: A vulnerability was found in annyshow DuxCMS 2.1. It has been declared as problematic. This vulnerability affects unknown code. The manipulation leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-215116.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863
References: https://gitee.com/annyshow/DuxCMS2.1/issues/I183GG; https://vuldb.com/?id.215116; https://gitee.com/annyshow/DuxCMS2.1/issues/I183GG
CVE: CVE-2022-4350
Published: 2022-12-08
Description: A vulnerability, which was classified as problematic, was found in Mingsoft MCMS 5.2.8. Affected is an unknown function of the file search.do. The manipulation of the argument content_title leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-215112.
CVSS Score: 3.5 (LOW)
CWE: CWE-707
References: https://gitee.com/mingSoft/MCMS/issues/I5MT8Y; https://vuldb.com/?id.215112; https://gitee.com/mingSoft/MCMS/issues/I5MT8Y
CVE: CVE-2022-4353
Published: 2022-12-08
Description: A vulnerability has been found in LinZhaoguan pb-cms 2.0 and classified as problematic. Affected by this vulnerability is the function IpUtil.getIpAddr. The manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-215113 was assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-707, CWE-79
References: https://gitee.com/LinZhaoguan/pb-cms/issues/I52422; https://vuldb.com/?id.215113; https://gitee.com/LinZhaoguan/pb-cms/issues/I52422
CVE: CVE-2022-4354
Published: 2022-12-08
Description: A vulnerability was found in LinZhaoguan pb-cms 2.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /blog/comment of the component Message Board. The manipulation leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-215114 is the identifier assigned to this vulnerability.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-707, CWE-79
References: https://gitee.com/LinZhaoguan/pb-cms/issues/I4XWJ7; https://vuldb.com/?id.215114; https://gitee.com/LinZhaoguan/pb-cms/issues/I4XWJ7
CVE: CVE-2022-4364
Published: 2022-12-08
Description: A vulnerability has been found in Teledyne FLIR AX8 up to 1.46.16. Affected by this issue is some unknown functionality of the file palette.php of the component Web Service Handler. The manipulation of the argument palette leads to command injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.49.16 can resolve this issue. Upgrading the affected component is advised. The vendor points out: "FLIR AX8 internal web site has been refactored to be able to handle the reported vulnerabilities."
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-77, CWE-78
References: https://github.com/siriuswhiter/VulnHub/blob/main/Flir/02-FLIR-AX8%20palette.php%20%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E/FLIR-AX8%20palette.php%20%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E1.md; https://vuldb.com/?ctiid.215118; https://vuldb.com/?id.215118
CVE: CVE-2022-37916
Published: 2022-12-08
Description: Vulnerabilities in the AirWave Management Platform web-based management interface exist which expose some URLs to a lack of proper access controls. These vulnerabilities could allow a remote attacker with limited privileges to gain access to sensitive information and/or change network configurations with privileges at a higher effective level in Aruba AirWave Management Platform version(s): 8.2.15.0 and below.


CVSS Score: 8.1 (HIGH)
CWE: CWE-284
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-019.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-019.txt
CVE: CVE-2022-37917
Published: 2022-12-08
Description: Vulnerabilities in the AirWave Management Platform web-based management interface exist which expose some URLs to a lack of proper access controls. These vulnerabilities could allow a remote attacker with limited privileges to gain access to sensitive information and/or change network configurations with privileges at a higher effective level in Aruba AirWave Management Platform version(s): 8.2.15.0 and below.


CVSS Score: 8.1 (HIGH)
CWE: CWE-284
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-019.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-019.txt
CVE: CVE-2022-37918
Published: 2022-12-08
Description: Vulnerabilities in the AirWave Management Platform web-based management interface exist which expose some URLs to a lack of proper access controls. These vulnerabilities could allow a remote attacker with limited privileges to gain access to sensitive information and/or change network configurations with privileges at a higher effective level in Aruba AirWave Management Platform version(s): 8.2.15.0 and below.


CVSS Score: 8.1 (HIGH)
CWE: CWE-284
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-019.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-019.txt
CVE: CVE-2022-38754
Published: 2022-12-08
Description: A potential vulnerability has been identified in Micro Focus Operations Bridge - Containerized. The vulnerability could be exploited by a malicious authenticated OBM (Operations Bridge Manager) user to run Java Scripts in the browser context of another OBM user. Please note: The vulnerability is only applicable if the Operations Bridge Manager capability is deployed. A potential vulnerability has been identified in Micro Focus Operations Bridge Manager (OBM). The vulnerability could be exploited by a malicious authenticated OBM user to run Java Scripts in the browser context of another OBM user. This issue affects: Micro Focus Micro Focus Operations Bridge Manager versions prior to 2022.11. Micro Focus Micro Focus Operations Bridge- Containerized versions prior to 2022.11.
CVSS Score: 8.0 (HIGH)
CWE: CWE-79, CWE-79
References: https://marketplace.microfocus.com/itom/content/operations-bridge-manager-obm-2022-05-hotfixes; https://portal.microfocus.com/s/article/KM000012517?language=en_US; https://portal.microfocus.com/s/article/KM000012518?language=en_US
CVE: CVE-2022-39894
Published: 2022-12-08
Description: Improper access control vulnerability in ContactListStartActivityHelper in Phone prior to SMR Dec-2022 Release 1 allows to access sensitive information via implicit intent.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-284
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=12; https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=12
CVE: CVE-2022-39895
Published: 2022-12-08
Description: Improper access control vulnerability in ContactListUtils in Phone prior to SMR Dec-2022 Release 1 allows to access contact group information via implicit intent.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-284
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=12; https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=12
CVE: CVE-2022-39896
Published: 2022-12-08
Description: Improper access control vulnerabilities in Contacts prior to SMR Dec-2022 Release 1 allows to access sensitive information via implicit intent.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-284
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=12; https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=12
CVE: CVE-2022-39897
Published: 2022-12-08
Description: Exposure of Sensitive Information vulnerability in kernel prior to SMR Dec-2022 Release 1 allows attackers to access the kernel address information via log.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-200, CWE-532
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=12; https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=12
CVE: CVE-2022-39898
Published: 2022-12-08
Description: Improper access control vulnerability in IIccPhoneBook prior to SMR Dec-2022 Release 1 allows attackers to access some information of usim.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-284
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=12; https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=12
CVE: CVE-2022-39899
Published: 2022-12-08
Description: Improper authentication vulnerability in Samsung WindowManagerService prior to SMR Dec-2022 Release 1 allows attacker to send the input event using S Pen gesture.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-287, CWE-287
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=12; https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=12
CVE: CVE-2022-39900
Published: 2022-12-08
Description: Improper access control vulnerability in Nice Catch prior to SMR Dec-2022 Release 1 allows physical attackers to access contents of all toast generated in the application installed in Secure Folder through Nice Catch.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-284
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=12; https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=12
CVE: CVE-2022-39901
Published: 2022-12-08
Description: Improper authentication in Exynos baseband prior to SMR DEC-2022 Release 1 allows remote attacker to disable the network traffic encryption between UE and gNodeB.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-287, CWE-287
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=12; https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=12
CVE: CVE-2022-39902
Published: 2022-12-08
Description: Improper authorization in Exynos baseband prior to SMR DEC-2022 Release 1 allows remote attacker to get sensitive information including IMEI via emergency call.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-285
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=12; https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=12
CVE: CVE-2022-39903
Published: 2022-12-08
Description: Improper access control vulnerability in RCS call prior to SMR Dec-2022 Release 1 allows local attackers to access RCS incoming call number.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200, CWE-863
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=12; https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=12
CVE: CVE-2022-39904
Published: 2022-12-08
Description: Exposure of Sensitive Information vulnerability in Samsung Settings prior to SMR Dec-2022 Release 1 allows local attackers to access the Network Access Identifier via log.
CVSS Score: 3.3 (LOW)
CWE: CWE-200, CWE-200
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=12; https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=12
CVE: CVE-2022-39905
Published: 2022-12-08
Description: Implicit intent hijacking vulnerability in Telecom application prior to SMR Dec-2022 Release 1 allows attacker to access sensitive information via implicit intent.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-285
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=12; https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=12
CVE: CVE-2022-39906
Published: 2022-12-08
Description: Improper access control vulnerability in SecTelephonyProvider prior to SMR Dec-2022 Release 1 allows attackers to access message information.
CVSS Score: 2.3 (LOW)
CWE: CWE-284
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=12; https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=12
CVE: CVE-2022-39907
Published: 2022-12-08
Description: Integer overflow vulnerability in Samsung decoding library for video thumbnails prior to SMR Dec-2022 Release 1 allows local attacker to perform Out-Of-Bounds Write.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-190, CWE-190
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=12; https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=12
CVE: CVE-2022-39908
Published: 2022-12-08
Description: TOCTOU vulnerability in Samsung decoding library for video thumbnails prior to SMR Dec-2022 Release 1 allows local attacker to perform Out-Of-Bounds Write.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-367, CWE-367
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=12; https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=12
CVE: CVE-2022-39909
Published: 2022-12-08
Description: Insufficient verification of data authenticity vulnerability in Samsung Gear IconX PC Manager prior to version 2.1.221019.51 allows local attackers to create arbitrary file using symbolic link.
CVSS Score: 7.1 (HIGH)
CWE: CWE-345, CWE-345
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=12; https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=12
CVE: CVE-2022-39910
Published: 2022-12-08
Description: Improper access control vulnerability in Samsung Pass prior to version 4.0.06.7 allow physical attackers to access data of Samsung Pass on a certain state of an unlocked device using pop-up view.
CVSS Score: 3.9 (LOW)
CWE: CWE-284
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=12; https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=12
CVE: CVE-2022-39911
Published: 2022-12-08
Description: Improper check or handling of exceptional conditions vulnerability in Samsung Pass prior to version 4.0.06.1 allows attacker to access Samsung Pass.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-703
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=12; https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=12
CVE: CVE-2022-39912
Published: 2022-12-08
Description: Improper handling of insufficient permissions vulnerability in setSecureFolderPolicy in PersonaManagerService prior to Android T(13) allows local attackers to set some setting value in Secure folder.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-280, CWE-755
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=12; https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=12
CVE: CVE-2022-39913
Published: 2022-12-08
Description: Exposure of Sensitive Information to an Unauthorized Actor in Persona Manager prior to Android T(13) allows local attacker to access user profiles information.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-200, CWE-863
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=12; https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=12
CVE: CVE-2022-39914
Published: 2022-12-08
Description: Exposure of Sensitive Information from an Unauthorized Actor vulnerability in Samsung DisplayManagerService prior to Android T(13) allows local attacker to access connected DLNA device information.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200, CWE-863
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=12; https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=12
CVE: CVE-2022-39915
Published: 2022-12-08
Description: Improper access control vulnerability in Calendar prior to versions 11.6.08.0 in Android Q(10), 12.2.11.3000 in Android R(11), 12.3.07.2000 in Android S(12), and 12.4.02.0 in Android T(13) allows attackers to access sensitive information via implicit intent.
CVSS Score: 3.3 (LOW)
CWE: CWE-284
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=12; https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=12
CVE: CVE-2022-3260
Published: 2022-12-08
Description: The response header has not enabled X-FRAME-OPTIONS, Which helps prevents against Clickjacking attack.. Some browsers would interpret these results incorrectly, allowing clickjacking attacks.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-1021, CWE-1021, CWE-1021
References: https://bugzilla.redhat.com/show_bug.cgi?id=2106780; https://bugzilla.redhat.com/show_bug.cgi?id=2106780
CVE: CVE-2022-3262
Published: 2022-12-08
Description: A flaw was found in Openshift. A pod with a DNSPolicy of "ClusterFirst" may incorrectly resolve the hostname based on a service provided. This flaw allows an attacker to supply an incorrect name with the DNS search policy, affecting confidentiality and availability.
CVSS Score: 8.1 (HIGH)
CWE: CWE-453, CWE-1188, CWE-1188
References: https://bugzilla.redhat.com/show_bug.cgi?id=2128858; https://bugzilla.redhat.com/show_bug.cgi?id=2128858
CVE: CVE-2022-41802
Published: 2022-12-08
Description: Kernel subsystem within OpenHarmony-v3.1.4 and prior versions in kernel_liteos_a has a kernel stack overflow vulnerability when call SysClockGetres. 4 bytes padding data from kernel stack are copied to user space incorrectly and leaked.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-120, CWE-787
References: https://gitee.com/openharmony/security/blob/master/en/security-disclosure/2022/2022-12.md; https://gitee.com/openharmony/security/blob/master/en/security-disclosure/2022/2022-12.md
CVE: CVE-2022-44455
Published: 2022-12-08
Description: The appspawn and nwebspawn services within OpenHarmony-v3.1.2 and prior versions were found to be vulnerable to buffer overflow vulnerability due to insufficient input validation. An unprivileged malicious application would be able to gain code execution within any application installed on the device or cause application crash.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-120, CWE-120
References: https://gitee.com/openharmony/security/blob/master/en/security-disclosure/2022/2022-12.md; https://gitee.com/openharmony/security/blob/master/en/security-disclosure/2022/2022-12.md
CVE: CVE-2022-44931
Published: 2022-12-08
Description: Tenda A18 v15.13.07.09 was discovered to contain a stack overflow via the security_5g parameter at /goform/WifiBasicSet.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-787
References: https://github.com/z1r00/IOT_Vul/blob/main/Tenda/A18/formWifiBasicSet/readme.md; https://github.com/z1r00/IOT_Vul/blob/main/Tenda/A18/formWifiBasicSet/readme.md
CVE: CVE-2022-44932
Published: 2022-12-08
Description: An access control issue in Tenda A18 v15.13.07.09 allows unauthenticated attackers to access the Telnet service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://github.com/z1r00/IOT_Vul/blob/main/Tenda/A18/TendaTelnet/readme.md; https://github.com/z1r00/IOT_Vul/blob/main/Tenda/A18/TendaTelnet/readme.md
CVE: CVE-2022-45118
Published: 2022-12-08
Description: OpenHarmony-v3.1.2 and prior versions had a vulnerability that telephony in communication subsystem sends public events with personal data, but the permission is not set. Malicious apps could listen to public events and obtain information such as mobile numbers and SMS data without permissions.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-287, CWE-276
References: https://gitee.com/openharmony/security/blob/master/en/security-disclosure/2022/2022-12.md; https://gitee.com/openharmony/security/blob/master/en/security-disclosure/2022/2022-12.md
CVE: CVE-2022-45497
Published: 2022-12-08
Description: Tenda W6-S v1.0.0.4(510) was discovered to contain a command injection vulnerability in the tpi_get_ping_output function at /goform/exeCommand.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://github.com/z1r00/IOT_Vul/blob/main/Tenda/W6-S/exeCommand/readme.md; https://github.com/z1r00/IOT_Vul/blob/main/Tenda/W6-S/exeCommand/readme.md
CVE: CVE-2022-45498
Published: 2022-12-08
Description: An issue in the component tpi_systool_handle(0) (/goform/SysToolReboot) of Tenda W6-S v1.0.0.4(510) allows unauthenticated attackers to arbitrarily reboot the device.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306
References: https://github.com/z1r00/IOT_Vul/blob/main/Tenda/W6-S/SysToolReboot/readme.md; https://github.com/z1r00/IOT_Vul/blob/main/Tenda/W6-S/SysToolReboot/readme.md
CVE: CVE-2022-45499
Published: 2022-12-08
Description: Tenda W6-S v1.0.0.4(510) was discovered to contain a stack overflow via the wl_radio parameter at /goform/WifiMacFilterGet.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-787
References: https://github.com/z1r00/IOT_Vul/blob/main/Tenda/W6-S/WifiMacFilterGet/readme.md; https://github.com/z1r00/IOT_Vul/blob/main/Tenda/W6-S/WifiMacFilterGet/readme.md
CVE: CVE-2022-45501
Published: 2022-12-08
Description: Tenda W6-S v1.0.0.4(510) was discovered to contain a stack overflow via the wl_radio parameter at /goform/wifiSSIDset.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-787
References: https://github.com/z1r00/IOT_Vul/blob/main/Tenda/W6-S/wifiSSIDset/readme.md; https://github.com/z1r00/IOT_Vul/blob/main/Tenda/W6-S/wifiSSIDset/readme.md
CVE: CVE-2022-45503
Published: 2022-12-08
Description: Tenda W6-S v1.0.0.4(510) was discovered to contain a stack overflow via the linkEn parameter at /goform/setAutoPing.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-787
References: https://github.com/z1r00/IOT_Vul/blob/main/Tenda/W6-S/setAutoPing/readme.md; https://github.com/z1r00/IOT_Vul/blob/main/Tenda/W6-S/setAutoPing/readme.md
CVE: CVE-2022-45504
Published: 2022-12-08
Description: An issue in the component tpi_systool_handle(0) (/goform/SysToolRestoreSet) of Tenda W6-S v1.0.0.4(510) allows unauthenticated attackers to arbitrarily reboot the device.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306
References: https://github.com/z1r00/IOT_Vul/blob/main/Tenda/W6-S/SysToolRestoreSet/readme.md; https://github.com/z1r00/IOT_Vul/blob/main/Tenda/W6-S/SysToolRestoreSet/readme.md
CVE: CVE-2022-45505
Published: 2022-12-08
Description: Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the cmdinput parameter at /goform/exeCommand.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-787
References: https://github.com/z1r00/IOT_Vul/blob/main/Tenda/W30E/exeCommand/readme.md; https://github.com/z1r00/IOT_Vul/blob/main/Tenda/W30E/exeCommand/readme.md
CVE: CVE-2022-45506
Published: 2022-12-08
Description: Tenda W30E v1.0.1.25(633) was discovered to contain a command injection vulnerability via the fileNameMit parameter at /goform/delFileName.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://github.com/z1r00/IOT_Vul/blob/main/Tenda/W30E/delFileName/readme.md; https://github.com/z1r00/IOT_Vul/blob/main/Tenda/W30E/delFileName/readme.md
CVE: CVE-2022-45507
Published: 2022-12-08
Description: Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the editNameMit parameter at /goform/editFileName.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-787
References: https://github.com/z1r00/IOT_Vul/blob/main/Tenda/W30E/editFileName/readme.md; https://github.com/z1r00/IOT_Vul/blob/main/Tenda/W30E/editFileName/readme.md
CVE: CVE-2022-45508
Published: 2022-12-08
Description: Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the new_account parameter at /goform/editUserName.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-787
References: https://github.com/z1r00/IOT_Vul/blob/main/Tenda/W30E/editUserName/readme.md; https://github.com/z1r00/IOT_Vul/blob/main/Tenda/W30E/editUserName/readme.md
CVE: CVE-2022-45509
Published: 2022-12-08
Description: Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the account parameter at /goform/addUserName.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-787
References: https://github.com/z1r00/IOT_Vul/blob/main/Tenda/W30E/addUserName/readme.md; https://github.com/z1r00/IOT_Vul/blob/main/Tenda/W30E/addUserName/readme.md