deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-34943
Published: 2022-01-13
Description: This vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley View 10.15.0.75. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JT files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-15051.
CVSS Score: 3.3 (LOW)
CWE: CWE-125, CWE-125
References: https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0005; https://www.zerodayinitiative.com/advisories/ZDI-21-1531/; https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0005
CVE: CVE-2021-34944
Published: 2022-01-13
Description: This vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley View 10.15.0.75. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JT files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-15052.
CVSS Score: 3.3 (LOW)
CWE: CWE-125, CWE-125
References: https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0005; https://www.zerodayinitiative.com/advisories/ZDI-21-1532/; https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0005
CVE: CVE-2021-34945
Published: 2022-01-13
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.75. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JT files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15054.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0005; https://www.zerodayinitiative.com/advisories/ZDI-21-1533/; https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0005
CVE: CVE-2021-34946
Published: 2022-01-13
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.75. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JT files. Crafted data in a JT file can trigger a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15055.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125, CWE-125
References: https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0005; https://www.zerodayinitiative.com/advisories/ZDI-21-1534/; https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0005
CVE: CVE-2021-34977
Published: 2022-01-13
Description: This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R7000 1.0.11.116_10.2.100 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of SOAP requests. The issue results from the lack of proper authentication verification before performing a password reset. An attacker can leverage this vulnerability to reset the admin password. Was ZDI-CAN-13483.
CVSS Score: 8.8 (HIGH)
CWE: CWE-288, CWE-287
References: https://kb.netgear.com/000064046/Security-Advisory-for-Authentication-Bypass-on-Some-Routers-and-DSL-Modem-Routers-PSV-2021-0134; https://www.zerodayinitiative.com/advisories/ZDI-21-1239/; https://kb.netgear.com/000064046/Security-Advisory-for-Authentication-Bypass-on-Some-Routers-and-DSL-Modem-Routers-PSV-2021-0134
CVE: CVE-2021-34978
Published: 2022-01-13
Description: This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6260 1.1.0.78_1.0.1 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the setupwizard.cgi page. A crafted SOAP request can trigger an overflow of a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-13511.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://kb.netgear.com/000064258/Security-Advisory-for-Vertical-Privilege-Escalation-on-Some-Routers-DSL-Modem-Routers-and-Access-Points-PSV-2021-0151-and-PSV-2021-0170?article=000064258; https://www.zerodayinitiative.com/advisories/ZDI-21-1240/; https://kb.netgear.com/000064258/Security-Advisory-for-Vertical-Privilege-Escalation-on-Some-Routers-DSL-Modem-Routers-and-Access-Points-PSV-2021-0151-and-PSV-2021-0170?article=000064258
CVE: CVE-2021-34979
Published: 2022-01-13
Description: This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6260 1.1.0.78_1.0.1 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of SOAP requests. When parsing the SOAPAction header, the process does not properly validate the length of user-supplied data prior to copying it to a fixed-length buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-13512.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120, CWE-120
References: https://kb.netgear.com/000064261/Security-Advisory-for-Vertical-Privilege-Escalation-on-Some-Routers-PSV-2021-0152?article=000064261; https://www.zerodayinitiative.com/advisories/ZDI-21-1241/; https://kb.netgear.com/000064261/Security-Advisory-for-Vertical-Privilege-Escalation-on-Some-Routers-PSV-2021-0152?article=000064261
CVE: CVE-2021-34980
Published: 2022-01-13
Description: This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6260 1.1.0.78_1.0.1 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the setupwizard.cgi page. When parsing the SOAP_LOGIN_TOKEN environment variable, the process does not properly validate the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-14107.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://kb.netgear.com/000064262/Security-Advisory-for-Vertical-Privilege-Escalation-on-Some-Routers-PSV-2021-0150?article=000064262; https://www.zerodayinitiative.com/advisories/ZDI-21-1242/; https://kb.netgear.com/000064262/Security-Advisory-for-Vertical-Privilege-Escalation-on-Some-Routers-PSV-2021-0150?article=000064262
CVE: CVE-2021-34984
Published: 2022-01-13
Description: This vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley ContextCapture 10.18.0.232. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of OBJ files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-14784.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://www.bentley.com/en/common-vulnerability-exposure/be-2021-0001; https://www.zerodayinitiative.com/advisories/ZDI-21-1367/; https://www.bentley.com/en/common-vulnerability-exposure/be-2021-0001
CVE: CVE-2021-34985
Published: 2022-01-13
Description: This vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley ContextCapture 10.18.0.232. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of OBJ files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-14785.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://www.bentley.com/en/common-vulnerability-exposure/be-2021-0001; https://www.zerodayinitiative.com/advisories/ZDI-21-1359/; https://www.bentley.com/en/common-vulnerability-exposure/be-2021-0001
CVE: CVE-2021-34993
Published: 2022-01-13
Description: This vulnerability allows remote attackers to bypass authentication on affected installations of Commvault CommCell 11.22.22. Authentication is not required to exploit this vulnerability. The specific flaw exists within the CVSearchService service. The issue results from the lack of proper validation prior to authentication. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-13706.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287, CWE-287
References: https://www.zerodayinitiative.com/advisories/ZDI-21-1328/; https://www.zerodayinitiative.com/advisories/ZDI-21-1328/
CVE: CVE-2021-34994
Published: 2022-01-13
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Commvault CommCell 11.22.22. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the DataProvider class. The issue results from the lack of proper validation of a user-supplied string before executing it as JavaScript code. An attacker can leverage this vulnerability to escape the JavaScript sandbox and execute Java code in the context of NETWORK SERVICE. Was ZDI-CAN-13755.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20, CWE-94
References: https://www.zerodayinitiative.com/advisories/ZDI-21-1329/; https://www.zerodayinitiative.com/advisories/ZDI-21-1329/
CVE: CVE-2021-34995
Published: 2022-01-13
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Commvault CommCell 11.22.22. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the DownloadCenterUploadHandler class. The issue results from the lack of proper validation of user-supplied data, which can allow the upload of arbitrary files. An attacker can leverage this vulnerability to execute code in the context of NETWORK SERVICE. Was ZDI-CAN-13756.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434, CWE-434
References: https://www.zerodayinitiative.com/advisories/ZDI-21-1330/; https://www.zerodayinitiative.com/advisories/ZDI-21-1330/
CVE: CVE-2021-34996
Published: 2022-01-13
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Commvault CommCell 11.22.22. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the Demo_ExecuteProcessOnGroup workflow. By creating a workflow, an attacker can specify an arbitrary command to be executed. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-13889.
CVSS Score: 8.8 (HIGH)
CWE: CWE-749
References: https://www.zerodayinitiative.com/advisories/ZDI-21-1331/; https://www.zerodayinitiative.com/advisories/ZDI-21-1331/
CVE: CVE-2021-34997
Published: 2022-01-13
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Commvault CommCell 11.22.22. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the AppStudioUploadHandler class. The issue results from the lack of proper validation of user-supplied data, which can allow the upload of arbitrary files. An attacker can leverage this vulnerability to execute code in the context of NETWORK SERVICE. Was ZDI-CAN-13894.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434, CWE-434
References: https://www.zerodayinitiative.com/advisories/ZDI-21-1332/; https://www.zerodayinitiative.com/advisories/ZDI-21-1332/
CVE: CVE-2021-34998
Published: 2022-01-13
Description: This vulnerability allows local attackers to escalate privileges on affected installations of Panda Security Free Antivirus 20.2.0.0. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the use of named pipes. The issue results from allowing an untrusted process to impersonate the client of a pipe. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-14208.
CVSS Score: 7.8 (HIGH)
CWE: CWE-250, CWE-269
References: https://www.pandasecurity.com/en/support/card?id=100077; https://www.zerodayinitiative.com/advisories/ZDI-21-1336/; https://www.pandasecurity.com/en/support/card?id=100077
CVE: CVE-2022-0178
Published: 2022-01-13
Description: Missing Authorization vulnerability in snipe snipe/snipe-it.This issue affects snipe/snipe-i before 5.3.8.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://github.com/snipe/snipe-it/commit/0e5ef53c352754de2778ffa20c85da15fd6f7ae0; https://huntr.dev/bounties/81c6b974-d0b3-410b-a902-8324a55b1368; https://github.com/snipe/snipe-it/commit/0e5ef53c352754de2778ffa20c85da15fd6f7ae0
CVE: CVE-2021-45760
Published: 2022-01-14
Description: GPAC v1.1.0 was discovered to contain an invalid memory address dereference via the function gf_list_last(). This vulnerability allows attackers to cause a Denial of Service (DoS).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119
References: https://github.com/gpac/gpac/issues/1966; https://www.debian.org/security/2023/dsa-5411; https://github.com/gpac/gpac/issues/1966
CVE: CVE-2021-38677
Published: 2022-01-14
Description: A cross-site scripting (XSS) vulnerability has been reported to affect QNAP device running QcalAgent. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of QcalAgent: QcalAgent 1.1.7 and later
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.qnap.com/en/security-advisory/qsa-21-60; https://www.qnap.com/en/security-advisory/qsa-21-60
CVE: CVE-2021-38678
Published: 2022-01-14
Description: An open redirect vulnerability has been reported to affect QNAP device running QcalAgent. If exploited, this vulnerability allows attackers to redirect users to an untrusted page that contains malware. We have already fixed this vulnerability in the following versions of QcalAgent: QcalAgent 1.1.7 and later
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601, CWE-601
References: https://www.qnap.com/en/security-advisory/qsa-21-60; https://www.qnap.com/en/security-advisory/qsa-21-60
CVE: CVE-2021-38682
Published: 2022-01-14
Description: A stack buffer overflow vulnerability has been reported to affect QNAP device running QVR Elite, QVR Pro, QVR Guard. If exploited, this vulnerability allows attackers to execute arbitrary code. We have already fixed this vulnerability in the following versions of QVR Elite, QVR Pro, QVR Guard: QuTS hero h5.0.0: QVR Elite 2.1.4.0 (2021/12/06) and later QuTS hero h4.5.4: QVR Elite 2.1.4.0 (2021/12/06) and later QTS 5.0.0: QVR Elite 2.1.4.0 (2021/12/06) and later QTS 4.5.4: QVR Elite 2.1.4.0 (2021/12/06) and later QTS 4.5.4: QVR Pro 2.1.3.0 (2021/12/06) and later QTS 5.0.0: QVR Pro 2.1.3.0 (2021/12/06) and later QTS 4.5.4: QVR Guard 2.1.3.0 and later QTS 5.0.0: QVR Guard 2.1.3.0 and later
CVSS Score: 8.1 (HIGH)
CWE: CWE-120, CWE-787
References: https://www.qnap.com/en/security-advisory/qsa-21-59; https://www.qnap.com/en/security-advisory/qsa-21-59
CVE: CVE-2021-38689
Published: 2022-01-14
Description: A stack buffer overflow vulnerability has been reported to affect QNAP device running QVR Elite, QVR Pro, QVR Guard. If exploited, this vulnerability allows attackers to execute arbitrary code. We have already fixed this vulnerability in the following versions of QVR Elite, QVR Pro, QVR Guard: QuTS hero h5.0.0: QVR Elite 2.1.4.0 (2021/12/06) and later QuTS hero h4.5.4: QVR Elite 2.1.4.0 (2021/12/06) and later QTS 5.0.0: QVR Elite 2.1.4.0 (2021/12/06) and later QTS 4.5.4: QVR Elite 2.1.4.0 (2021/12/06) and later QTS 4.5.4: QVR Pro 2.1.3.0 (2021/12/06) and later QTS 5.0.0: QVR Pro 2.1.3.0 (2021/12/06) and later QTS 4.5.4: QVR Guard 2.1.3.0 (2021/12/06) and later QTS 5.0.0: QVR Guard 2.1.3.0 (2021/12/06) and later
CVSS Score: 8.1 (HIGH)
CWE: CWE-120, CWE-787
References: https://www.qnap.com/en/security-advisory/qsa-21-59; https://www.qnap.com/en/security-advisory/qsa-21-59
CVE: CVE-2021-38690
Published: 2022-01-14
Description: A stack buffer overflow vulnerability has been reported to affect QNAP device running QVR Elite, QVR Pro, QVR Guard. If exploited, this vulnerability allows attackers to execute arbitrary code. We have already fixed this vulnerability in the following versions of QVR Elite, QVR Pro, QVR Guard: QuTS hero h5.0.0: QVR Elite 2.1.4.0 (2021/12/06) and later QuTS hero h4.5.4: QVR Elite 2.1.4.0 (2021/12/06) and later QTS 5.0.0: QVR Elite 2.1.4.0 (2021/12/06) and later QTS 4.5.4: QVR Elite 2.1.4.0 (2021/12/06) and later QTS 4.5.4: QVR Pro 2.1.3.0 (2021/12/06) and later QTS 5.0.0: QVR Pro 2.1.3.0 (2021/12/06) and later QTS 4.5.4: QVR Guard 2.1.3.0 (2021/12/06) and later QTS 5.0.0: QVR Guard 2.1.3.0 (2021/12/06) and later
CVSS Score: 8.1 (HIGH)
CWE: CWE-120, CWE-787
References: https://www.qnap.com/en/security-advisory/qsa-21-59; https://www.qnap.com/en/security-advisory/qsa-21-59
CVE: CVE-2021-38691
Published: 2022-01-14
Description: A stack buffer overflow vulnerability has been reported to affect QNAP device running QVR Elite, QVR Pro, QVR Guard. If exploited, this vulnerability allows attackers to execute arbitrary code. We have already fixed this vulnerability in the following versions of QVR Elite, QVR Pro, QVR Guard: QuTS hero h5.0.0: QVR Elite 2.1.4.0 (2021/12/06) and later QuTS hero h4.5.4: QVR Elite 2.1.4.0 (2021/12/06) and later QTS 5.0.0: QVR Elite 2.1.4.0 (2021/12/06) and later QTS 4.5.4: QVR Elite 2.1.4.0 (2021/12/06) and later QTS 4.5.4: QVR Pro 2.1.3.0 (2021/12/06) and later QTS 5.0.0: QVR Pro 2.1.3.0 (2021/12/06) and later QTS 4.5.4: QVR Guard 2.1.3.0 (2021/12/06) and later QTS 5.0.0: QVR Guard 2.1.3.0 (2021/12/06) and later
CVSS Score: 8.1 (HIGH)
CWE: CWE-120, CWE-787
References: https://www.qnap.com/en/security-advisory/qsa-21-59; https://www.qnap.com/en/security-advisory/qsa-21-59
CVE: CVE-2021-38692
Published: 2022-01-14
Description: A stack buffer overflow vulnerability has been reported to affect QNAP device running QVR Elite, QVR Pro, QVR Guard. If exploited, this vulnerability allows attackers to execute arbitrary code. We have already fixed this vulnerability in the following versions of QVR Elite, QVR Pro, QVR Guard: QuTS hero h5.0.0: QVR Elite 2.1.4.0 (2021/12/06) and later QuTS hero h4.5.4: QVR Elite 2.1.4.0 (2021/12/06) and later QTS 5.0.0: QVR Elite 2.1.4.0 (2021/12/06) and later QTS 4.5.4: QVR Elite 2.1.4.0 (2021/12/06) and later QTS 4.5.4: QVR Pro 2.1.3.0 (2021/12/06) and later QTS 5.0.0: QVR Pro 2.1.3.0 (2021/12/06) and later QTS 4.5.4: QVR Guard 2.1.3.0 (2021/12/06) and later QTS 5.0.0: QVR Guard 2.1.3.0 (2021/12/06) and later
CVSS Score: 8.1 (HIGH)
CWE: CWE-120, CWE-787
References: https://www.qnap.com/en/security-advisory/qsa-21-59; https://www.qnap.com/en/security-advisory/qsa-21-59
CVE: CVE-2021-46255
Published: 2022-01-14
Description: eyouCMS V1.5.5-UTF8-SP3_1 suffers from Arbitrary file deletion due to insufficient filtering of the parameter filename.
CVSS Score: 8.1 (HIGH)
References: https://github.com/eyoucms/eyoucms/issues/21; https://github.com/eyoucms/eyoucms/issues/21
CVE: CVE-2022-20635
Published: 2022-01-14
Description: Multiple vulnerabilities in the web-based management interface of Cisco Security Manager could allow an unauthenticated, remote attacker to conduct cross-site scripting attacks against a user of the interface. These vulnerabilities are due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit these vulnerabilities by persuading a user to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive, browser-based information.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-csm-mult-xss-7hmOKQTt; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-csm-mult-xss-7hmOKQTt
CVE: CVE-2022-20636
Published: 2022-01-14
Description: Multiple vulnerabilities in the web-based management interface of Cisco Security Manager could allow an unauthenticated, remote attacker to conduct cross-site scripting attacks against a user of the interface. These vulnerabilities are due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit these vulnerabilities by persuading a user to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive, browser-based information.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-csm-mult-xss-7hmOKQTt; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-csm-mult-xss-7hmOKQTt
CVE: CVE-2022-20637
Published: 2022-01-14
Description: Multiple vulnerabilities in the web-based management interface of Cisco Security Manager could allow an unauthenticated, remote attacker to conduct cross-site scripting attacks against a user of the interface. These vulnerabilities are due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit these vulnerabilities by persuading a user to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive, browser-based information.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-csm-mult-xss-7hmOKQTt; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-csm-mult-xss-7hmOKQTt
CVE: CVE-2022-20638
Published: 2022-01-14
Description: Multiple vulnerabilities in the web-based management interface of Cisco Security Manager could allow an unauthenticated, remote attacker to conduct cross-site scripting attacks against a user of the interface. These vulnerabilities are due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit these vulnerabilities by persuading a user to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive, browser-based information.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-csm-mult-xss-7hmOKQTt; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-csm-mult-xss-7hmOKQTt