deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-36869
Published: 2022-09-09
Description: Improper access control vulnerability in ContactsDumpActivity of?Contacts Provider prior to version 12.7.59 allows attacker to access the file without permission.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-284
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=09; https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=09
CVE: CVE-2022-36870
Published: 2022-09-09
Description: Pending Intent hijacking vulnerability in MTransferNotificationManager in Samsung Pay prior to version 5.0.63 for KR and 5.1.47 for Global allows attackers to access files without permission via implicit Intent.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-285
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=09; https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=09
CVE: CVE-2022-36871
Published: 2022-09-09
Description: Pending Intent hijacking vulnerability in NotiCenterUtils in Samsung Pay prior to version 5.0.63 for KR and 5.1.47 for Global allows attackers to access files without permission via implicit Intent.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-285
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=09; https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=09
CVE: CVE-2022-36872
Published: 2022-09-09
Description: Pending Intent hijacking vulnerability in SpayNotification in Samsung Pay prior to version 5.0.63 for KR and 5.1.47 for Global allows attackers to access files without permission via implicit Intent.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-285
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=09; https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=09
CVE: CVE-2022-36873
Published: 2022-09-09
Description: Improper restriction of broadcasting Intent in GalaxyStoreBridgePageLinker of?Waterplugin prior to version 2.2.11.22081151 leaks MAC address of the connected Bluetooth device.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-20
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=09; https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=09
CVE: CVE-2022-36874
Published: 2022-09-09
Description: Improper Handling of Insufficient Permissions or Privileges vulnerability in Waterplugin prior to 2.2.11.22040751 allows attacker to access device IMEI and Serial number.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-280, CWE-755
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=09; https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=09
CVE: CVE-2022-36875
Published: 2022-09-09
Description: Improper restriction of broadcasting Intent in SaWebViewRelayActivity of?Waterplugin prior to version 2.2.11.22081151 allows attacker to access the file without permission.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-284
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=09; https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=09
CVE: CVE-2022-36876
Published: 2022-09-09
Description: Improper authorization in UPI payment in Samsung Pass prior to version 4.0.04.10 allows physical attackers to access account list without authentication.
CVSS Score: 1.8 (LOW)
CWE: CWE-285
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=09; https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=09
CVE: CVE-2022-36877
Published: 2022-09-09
Description: Exposure of Sensitive Information in FaqSymptomCardViewModel in Samsung Members prior to versions 4.3.00.11 in Global and 14.0.02.4 in China allows local attackers to access device identification via log.
CVSS Score: 2.8 (LOW)
CWE: CWE-200, CWE-532
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=09; https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=09
CVE: CVE-2022-36878
Published: 2022-09-09
Description: Exposure of Sensitive Information in Find My Mobile prior to version 7.2.25.14 allows local attacker to access IMEI via log.
CVSS Score: 3.3 (LOW)
CWE: CWE-200, CWE-200
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=09; https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=09
CVE: CVE-2022-37299
Published: 2022-09-09
Description: An issue was discovered in Shirne CMS 1.2.0. There is a Path Traversal vulnerability which could cause arbitrary file read via /static/ueditor/php/controller.php
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://gitee.com/shirnecn/ShirneCMS/issues/I5JRHJ?from=project-issue; https://gitee.com/shirnecn/ShirneCMS/issues/I5JRHJ?from=project-issue
CVE: CVE-2022-37335
Published: 2022-09-09
Description: Authenticated (author+) Stored Cross-Site Scripting (XSS) vulnerability in WHA's Word Search Puzzles game plugin <= 2.0.1 at WordPress.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/wha-wordsearch/wordpress-word-search-puzzles-game-plugin-2-0-1-authenticated-stored-cross-site-scripting-xss-vulnerability/_s_id=cve; https://wordpress.org/plugins/wha-wordsearch/; https://patchstack.com/database/vulnerability/wha-wordsearch/wordpress-word-search-puzzles-game-plugin-2-0-1-authenticated-stored-cross-site-scripting-xss-vulnerability/_s_id=cve
CVE: CVE-2022-37403
Published: 2022-09-09
Description: Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Nikhil Vaghela's Add User Role plugin <= 0.0.1 at WordPress.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/add-user-role/wordpress-add-user-role-plugin-0-0-1-authenticated-stored-cross-site-scripting-xss-vulnerability/_s_id=cve; https://wordpress.org/plugins/add-user-role/; https://patchstack.com/database/vulnerability/add-user-role/wordpress-add-user-role-plugin-0-0-1-authenticated-stored-cross-site-scripting-xss-vulnerability/_s_id=cve
CVE: CVE-2022-37404
Published: 2022-09-09
Description: Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Christian Salazar's add2fav plugin <= 1.0 at WordPress.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/add2fav/wordpress-add2fav-plugin-1-0-authenticated-stored-cross-site-scripting-xss-vulnerability/_s_id=cve; https://wordpress.org/plugins/add2fav/; https://patchstack.com/database/vulnerability/add2fav/wordpress-add2fav-plugin-1-0-authenticated-stored-cross-site-scripting-xss-vulnerability/_s_id=cve
CVE: CVE-2022-37405
Published: 2022-09-09
Description: Cross-Site Request Forgery (CSRF) vulnerability in Mickey Kay's Better Font Awesome plugin <= 2.0.1 at WordPress.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/better-font-awesome/wordpress-better-font-awesome-plugin-2-0-1-cross-site-request-forgery-csrf-vulnerability/_s_id=cve; https://wordpress.org/plugins/better-font-awesome/#developers; https://patchstack.com/database/vulnerability/better-font-awesome/wordpress-better-font-awesome-plugin-2-0-1-cross-site-request-forgery-csrf-vulnerability/_s_id=cve
CVE: CVE-2022-37407
Published: 2022-09-09
Description: Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities in WPChill Gallery PhotoBlocks plugin <= 1.2.6 at WordPress.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/photoblocks-grid-gallery/wordpress-gallery-photoblocks-plugin-1-2-6-multiple-authenticated-stored-cross-site-scripting-xss-vulnerabilities/_s_id=cve; https://wordpress.org/plugins/photoblocks-grid-gallery/; https://patchstack.com/database/vulnerability/photoblocks-grid-gallery/wordpress-gallery-photoblocks-plugin-1-2-6-multiple-authenticated-stored-cross-site-scripting-xss-vulnerabilities/_s_id=cve
CVE: CVE-2022-37411
Published: 2022-09-09
Description: Cross-Site Request Forgery (CSRF) vulnerability in Vinoj Cardoza's Captcha Code plugin <= 2.7 at WordPress.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/captcha-code-authentication/wordpress-captcha-code-plugin-2-7-cross-site-request-forgery-csrf-vulnerability-leading-to-plugin-settings-update/_s_id=cve; https://wordpress.org/plugins/captcha-code-authentication/; https://patchstack.com/database/vulnerability/captcha-code-authentication/wordpress-captcha-code-plugin-2-7-cross-site-request-forgery-csrf-vulnerability-leading-to-plugin-settings-update/_s_id=cve
CVE: CVE-2022-37412
Published: 2022-09-09
Description: Authenticated (admin+) Reflected Cross-Site Scripting (XSS) vulnerability in Galerio & Urda's Better Delete Revision plugin <= 1.6.1 at WordPress.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/better-delete-revision/wordpress-better-delete-revision-plugin-1-6-1-authenticated-reflected-cross-site-scripting-xss-vulnerability/_s_id=cve; https://wordpress.org/plugins/better-delete-revision/; https://patchstack.com/database/vulnerability/better-delete-revision/wordpress-better-delete-revision-plugin-1-6-1-authenticated-reflected-cross-site-scripting-xss-vulnerability/_s_id=cve
CVE: CVE-2022-38058
Published: 2022-09-09
Description: Authenticated (subscriber+) Plugin Setting change vulnerability in WP Shamsi plugin <= 4.1.1 at WordPress.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: https://patchstack.com/database/vulnerability/wp-shamsi/wordpress-wp-shamsi-plugin-4-1-1-authenticated-plugin-setting-change-vulnerability/_s_id=cve; https://wordpress.org/plugins/wp-shamsi/#developers; https://patchstack.com/database/vulnerability/wp-shamsi/wordpress-wp-shamsi-plugin-4-1-1-authenticated-plugin-setting-change-vulnerability/_s_id=cve
CVE: CVE-2022-38059
Published: 2022-09-09
Description: Cross-Site Request Forgery (CSRF) vulnerability in Alexey Trofimov's Access Code Feeder plugin <= 1.0.3 at WordPress.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/access-code-feeder/wordpress-access-code-feeder-plugin-1-0-3-cross-site-request-forgery-csrf-vulnerability/_s_id=cve; https://wordpress.org/plugins/access-code-feeder/; https://patchstack.com/database/vulnerability/access-code-feeder/wordpress-access-code-feeder-plugin-1-0-3-cross-site-request-forgery-csrf-vulnerability/_s_id=cve
CVE: CVE-2022-38064
Published: 2022-09-09
Description: OpenHarmony-v3.1.2 and prior versions have a permission bypass vulnerability. Local attackers can bypass permission control and get sensitive information.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-305, CWE-287
References: https://gitee.com/openharmony/security/blob/master/en/security-disclosure/2022/2022-09.md; https://gitee.com/openharmony/security/blob/master/en/security-disclosure/2022/2022-09.md
CVE: CVE-2022-38067
Published: 2022-09-09
Description: Unauthenticated Event Deletion vulnerability in Totalsoft Event Calendar – Calendar plugin <= 1.4.6 at WordPress.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264
References: https://patchstack.com/database/vulnerability/calendar-event/wordpress-event-calendar-calendar-plugin-1-4-6-unauthenticated-event-deletion-vulnerability/_s_id=cve; https://wordpress.org/plugins/calendar-event/; https://patchstack.com/database/vulnerability/calendar-event/wordpress-event-calendar-calendar-plugin-1-4-6-unauthenticated-event-deletion-vulnerability/_s_id=cve
CVE: CVE-2022-38068
Published: 2022-09-09
Description: Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Apasionados Export Post Info plugin <= 1.1.0 at WordPress.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/export-post-info/wordpress-export-post-info-plugin-1-1-0-authenticated-stored-cross-site-scripting-xss-vulnerability/_s_id=cve; https://wordpress.org/plugins/export-post-info/#developers; https://patchstack.com/database/vulnerability/export-post-info/wordpress-export-post-info-plugin-1-1-0-authenticated-stored-cross-site-scripting-xss-vulnerability/_s_id=cve
CVE: CVE-2022-38070
Published: 2022-09-09
Description: Privilege Escalation (subscriber+) vulnerability in Pop-up plugin <= 1.1.5 at WordPress.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-264
References: https://patchstack.com/database/vulnerability/pop-up-pop-up/wordpress-pop-up-plugin-1-1-5-privilege-escalation-vulnerability/_s_id=cve; https://wordpress.org/plugins/pop-up-pop-up/#developers; https://patchstack.com/database/vulnerability/pop-up-pop-up/wordpress-pop-up-plugin-1-1-5-privilege-escalation-vulnerability/_s_id=cve
CVE: CVE-2022-38081
Published: 2022-09-09
Description: OpenHarmony-v3.1.2 and prior versions have a permission bypass vulnerability. LAN attackers can bypass the distributed permission control.To take advantage of this weakness, attackers need another vulnerability to obtain system.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-305, CWE-287
References: https://gitee.com/openharmony/security/blob/master/en/security-disclosure/2022/2022-09.md; https://gitee.com/openharmony/security/blob/master/en/security-disclosure/2022/2022-09.md
CVE: CVE-2022-38093
Published: 2022-09-09
Description: Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in All in One SEO plugin <= 4.2.3.1 at WordPress.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://patchstack.com/database/vulnerability/all-in-one-seo-pack/wordpress-all-in-one-seo-plugin-4-2-3-1-multiple-cross-site-request-forgery-csrf-vulnerabilities?_s_id=cve; https://patchstack.com/database/vulnerability/all-in-one-seo-pack/wordpress-all-in-one-seo-plugin-4-2-3-1-multiple-cross-site-request-forgery-csrf-vulnerabilities?_s_id=cve
CVE: CVE-2022-38096
Published: 2022-09-09
Description: A NULL pointer dereference vulnerability was found in vmwgfx driver in drivers/gpu/vmxgfx/vmxgfx_execbuf.c in GPU component of Linux kernel with device file '/dev/dri/renderD128 (or Dxxx)'. This flaw allows a local attacker with a user account on the system to gain privilege, causing a denial of service(DoS).
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://bugzilla.openanolis.cn/show_bug.cgi?id=2073; https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html; https://bugzilla.openanolis.cn/show_bug.cgi?id=2073
CVE: CVE-2022-38144
Published: 2022-09-09
Description: Cross-Site Request Forgery (CSRF) vulnerability in gVectors Team wpForo Forum plugin <= 2.0.5 at WordPress.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/wpforo/wordpress-wpforo-forum-plugin-2-0-5-cross-site-request-forgery-csrf-vulnerability/_s_id=cve; https://wordpress.org/plugins/wpforo/#developers; https://patchstack.com/database/vulnerability/wpforo/wordpress-wpforo-forum-plugin-2-0-5-cross-site-request-forgery-csrf-vulnerability/_s_id=cve
CVE: CVE-2022-38457
Published: 2022-09-09
Description: A use-after-free(UAF) vulnerability was found in function 'vmw_cmd_res_check' in drivers/gpu/vmxgfx/vmxgfx_execbuf.c in Linux kernel's vmwgfx driver with device file '/dev/dri/renderD128 (or Dxxx)'. This flaw allows a local attacker with a user account on the system to gain privilege, causing a denial of service(DoS).
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-416, CWE-416
References: https://bugzilla.openanolis.cn/show_bug.cgi?id=2074; https://bugzilla.openanolis.cn/show_bug.cgi?id=2074
CVE: CVE-2022-38700
Published: 2022-09-09
Description: OpenHarmony-v3.1.1 and prior versions have a permission bypass vulnerability. LAN attackers can bypass permission control and get control of camera service.
CVSS Score: 8.8 (HIGH)
CWE: CWE-305, CWE-287
References: https://gitee.com/openharmony/security/blob/master/en/security-disclosure/2022/2022-09.md; https://gitee.com/openharmony/security/blob/master/en/security-disclosure/2022/2022-09.md
CVE: CVE-2022-38701
Published: 2022-09-09
Description: OpenHarmony-v3.1.2 and prior versions have a heap overflow vulnerability. Local attackers can trigger a heap overflow and get network sensitive information.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-122, CWE-787
References: https://gitee.com/openharmony/security/blob/master/en/security-disclosure/2022/2022-09.md; https://gitee.com/openharmony/security/blob/master/en/security-disclosure/2022/2022-09.md
CVE: CVE-2022-39119
Published: 2022-09-09
Description: In network service, there is a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed
CVSS Score: 7.8 (HIGH)
CWE: CWE-862, CWE-862
References: https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]92349186; https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]92349186
CVE: CVE-2022-39844
Published: 2022-09-09
Description: Improper validation of integrity check vulnerability in Smart Switch PC prior to version 4.3.22083 allows local attackers to delete arbitrary directory using directory junction.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-354, CWE-354
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=09; https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=09
CVE: CVE-2022-39845
Published: 2022-09-09
Description: Improper validation of integrity check vulnerability in Samsung Kies prior to version 2.6.4.22074 allows local attackers to delete arbitrary directory using directory junction.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-354, CWE-354
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=09; https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=09
CVE: CVE-2022-39846
Published: 2022-09-09
Description: DLL hijacking vulnerability in Smart Switch PC prior to version 4.3.22083_3 allows attacker to execute arbitrary code.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-427, CWE-427
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=09; https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=09
CVE: CVE-2022-3077
Published: 2022-09-09
Description: A buffer overflow vulnerability was found in the Linux kernel Intel’s iSMT SMBus host controller driver in the way it handled the I2C_SMBUS_BLOCK_PROC_CALL case (via the ioctl I2C_SMBUS) with malicious input data. This flaw could allow a local user to crash the system.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-120, CWE-120
References: https://github.com/torvalds/linux/commit/690b2549b19563ec5ad53e5c82f6a944d910086e; https://github.com/torvalds/linux/commit/690b2549b19563ec5ad53e5c82f6a944d910086e
CVE: CVE-2022-3147
Published: 2022-09-09
Description: Mattermost version 7.0.x and earlier fails to sufficiently limit the in-memory sizes of concurrently uploaded JPEG images, which allows authenticated users to cause resource exhaustion on specific system configurations, resulting in server-side Denial of Service.
CVSS Score: 3.1 (LOW)
CWE: CWE-400, CWE-770
References: https://hackerone.com/reports/1549513; https://mattermost.com/security-updates/; https://hackerone.com/reports/1549513
CVE: CVE-2022-3169
Published: 2022-09-09
Description: A flaw was found in the Linux kernel. A denial of service flaw may occur if there is a consecutive request of the NVME_IOCTL_RESET and the NVME_IOCTL_SUBSYS_RESET through the device file of the driver, resulting in a PCIe link disconnect.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20, CWE-20
References: https://bugzilla.kernel.org/show_bug.cgi?id=214771; https://lists.debian.org/debian-lts-announce/2022/12/msg00031.html; https://bugzilla.kernel.org/show_bug.cgi?id=214771
CVE: CVE-2022-40133
Published: 2022-09-09
Description: A use-after-free(UAF) vulnerability was found in function 'vmw_execbuf_tie_context' in drivers/gpu/vmxgfx/vmxgfx_execbuf.c in Linux kernel's vmwgfx driver with device file '/dev/dri/renderD128 (or Dxxx)'. This flaw allows a local attacker with a user account on the system to gain privilege, causing a denial of service(DoS).
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-416, CWE-416
References: https://bugzilla.openanolis.cn/show_bug.cgi?id=2075; https://bugzilla.openanolis.cn/show_bug.cgi?id=2075
CVE: CVE-2022-40191
Published: 2022-09-09
Description: Authenticated (subscriber+) Stored Cross-Site Scripting (XSS) vulnerability in Ali Khallad's Contact Form By Mega Forms plugin <= 1.2.4 at WordPress.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/mega-forms/wordpress-contact-form-by-mega-forms-plugin-1-2-4-authenticated-stored-cross-site-scripting-xss-vulnerability/_s_id=cve; https://wordpress.org/plugins/mega-forms/#developers; https://patchstack.com/database/vulnerability/mega-forms/wordpress-contact-form-by-mega-forms-plugin-1-2-4-authenticated-stored-cross-site-scripting-xss-vulnerability/_s_id=cve
CVE: CVE-2022-28740
Published: 2022-09-09
Description: aEnrich eHRD Learning Management Key Performance Indicator System 5+ exposes Sensitive Information to an Unauthorized Actor.
CVSS Score: 7.5 (HIGH)
References: https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2022/MNDT-2022-0034/MNDT-2022-0034.md; https://www.aenrich.com.tw; https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2022/MNDT-2022-0034/MNDT-2022-0034.md
CVE: CVE-2022-28741
Published: 2022-09-09
Description: aEnrich a+HRD 5.x Learning Management Key Performance Indicator System has a local file inclusion (LFI) vulnerability that occurs due to missing input validation in v5.x
CVSS Score: 8.1 (HIGH)
CWE: CWE-22
References: https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2022/MNDT-2022-0035/MNDT-2022-0035.md; https://www.aenrich.com.tw; https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2022/MNDT-2022-0035/MNDT-2022-0035.md
CVE: CVE-2022-28742
Published: 2022-09-09
Description: aEnrich eHRD Learning Management Key Performance Indicator System 5+ has Improper Access Control. The web application does not validate user session when accessing many application pages. This can allow an attacker to gain unauthenticated access to sensitive functionalities in the application
CVSS Score: 7.5 (HIGH)
References: https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2022/MNDT-2022-0036/MNDT-2022-0036.md; https://www.aenrich.com.tw; https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2022/MNDT-2022-0036/MNDT-2022-0036.md
CVE: CVE-2022-34165
Published: 2022-09-09
Description: IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 22.0.0.9 are vulnerable to HTTP header injection, caused by improper validation. This could allow an attacker to conduct various attacks against the vulnerable system, including cache poisoning and cross-site scripting. IBM X-Force ID: 229429.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-74
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/229429; https://www.ibm.com/support/pages/node/6618747; https://exchange.xforce.ibmcloud.com/vulnerabilities/229429
CVE: CVE-2022-36617
Published: 2022-09-09
Description: Arq Backup 7.19.5.0 and below stores backup encryption passwords using reversible encryption. This issue allows attackers with administrative privileges to recover cleartext passwords.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-522
References: https://startrekdude.github.io/arqbackup.html; https://www.arqbackup.com/download/arqbackup/arq7windows_release_notes.html; https://startrekdude.github.io/arqbackup.html
CVE: CVE-2022-38613
Published: 2022-09-09
Description: A Path Traversal vulnerability in SmartVista Cardgen v3.28.0 allows authenticated attackers to read arbitrary files in the system.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: http://bpcbt.com; http://smartvista.com; https://tf1t.gitbook.io/mycve/smartvista/smartvista-cardgen/path-traversal-in-smartvista-cardgen-version-3.28.0-cve-2022-38613
CVE: CVE-2022-38614
Published: 2022-09-09
Description: An issue in the IGB Files and OutfileService features of SmartVista Cardgen v3.28.0 allows attackers to list and download arbitrary files via modifying the PATH parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://bpcbt.com; http://smartvista.com; https://tf1t.gitbook.io/mycve/smartvista/smartvista-cardgen/list-all-files-in-arbitrary-folder-in-smartvista-cardgen-version-3.28.0-cve-2022-38614