deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-47700
Published: 2023-01-31
Description: COMFAST (Shenzhen Sihai Zhonglian Network Technology Co., Ltd) CF-WR623N Router firmware V2.3.0.1 and before is vulnerable to Incorrect Access Control. Improper authentication allows requests to be made to back-end scripts without a valid session or authentication.
CVSS Score: 7.5 (HIGH)
CWE: CWE-425, CWE-425
References: https://github.com/OlivierLaflamme/cve/blob/main/COMFAST/CF-WR623N/auth_bypass.md; https://github.com/OlivierLaflamme/cve/blob/main/COMFAST/CF-WR623N/auth_bypass.md
CVE: CVE-2022-47701
Published: 2023-01-31
Description: COMFAST (Shenzhen Sihai Zhonglian Network Technology Co., Ltd) CF-WR623N Router firmware V2.3.0.1 is vulnerable to Cross Site Scripting (XSS).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/OlivierLaflamme/cve/blob/main/COMFAST/CF-WR623N/SSID_RXXS; https://github.com/OlivierLaflamme/cve/blob/main/COMFAST/CF-WR623N/SSID_RXXS
CVE: CVE-2022-47854
Published: 2023-01-31
Description: i-librarian 4.10 is vulnerable to Arbitrary file upload in ajaxsupplement.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434, CWE-434
References: https://github.com/mkucej/i-librarian/issues/155; https://github.com/mkucej/i-librarian/issues/155#issue[PII_REDACTED]; https://github.com/mkucej/i-librarian/issues/155
CVE: CVE-2016-15023
Published: 2023-01-31
Description: A vulnerability, which was classified as problematic, was found in SiteFusion Application Server up to 6.6.6. This affects an unknown part of the file getextension.php of the component Extension Handler. The manipulation leads to path traversal. Upgrading to version 6.6.7 is able to address this issue. The identifier of the patch is 49fff155c303d6cd06ce8f97bba56c9084bf08ac. It is recommended to upgrade the affected component. The identifier VDB-219765 was assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-22
References: https://github.com/sitefusion/server/commit/49fff155c303d6cd06ce8f97bba56c9084bf08ac; https://github.com/sitefusion/server/pull/67; https://github.com/sitefusion/server/releases/tag/v6.6.7
CVE: CVE-2022-32984
Published: 2023-01-31
Description: BTCPay Server 1.3.0 through 1.5.3 allows a remote attacker to obtain sensitive information when a public Point of Sale app is exposed. The sensitive information, found in the HTML source code, includes the xpub of the store. Also, if the store isn't using the internal lightning node, the credentials of a lightning node are exposed.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://blog.btcpayserver.org/btcpay-server-cve-2022-32984/; https://blog.btcpayserver.org/btcpay-server-cve-2022-32984/
CVE: CVE-2022-37708
Published: 2023-01-31
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2022-45297
Published: 2023-01-31
Description: EQ v1.5.31 to v2.2.0 was discovered to contain a SQL injection vulnerability via the UserPwd parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: http://packetstormsecurity.com/files/171615/EQ-Enterprise-Management-System-2.2.0-SQL-Injection.html; https://github.com/tlfyyds/EQ; http://packetstormsecurity.com/files/171615/EQ-Enterprise-Management-System-2.2.0-SQL-Injection.html
CVE: CVE-2022-45494
Published: 2023-01-31
Description: Buffer overflow vulnerability in function json_parse_object in sheredom json.h before commit 0825301a07cbf51653882bf2b153cc81fdadf41 (November 14, 2022) allows attackers to code arbitrary code and gain escalated privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://github.com/hyrathon/trophies/security/advisories/GHSA-wvpq-p7pp-cj6m; https://github.com/sheredom/json.h; https://github.com/sheredom/json.h/issues/93
CVE: CVE-2022-47873
Published: 2023-01-31
Description: Netcad KEOS 1.0 is vulnerable to XML External Entity (XXE) resulting in SSRF with XXE (remote).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-611, CWE-611
References: https://fordefence.com/cve-2022-47873-keos-software-xx/; https://fordefence.com/cve-2022-47873-keos-software-xx/
CVE: CVE-2022-48161
Published: 2023-02-01
Description: Easy Images v2.0 was discovered to contain an arbitrary file download vulnerability via the component /application/down.php. This vulnerability is exploited via a crafted GET request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-552, CWE-552
References: https://github.com/sunset-move/EasyImages2.0-arbitrary-file-download-vulnerability; https://github.com/sunset-move/EasyImages2.0-arbitrary-file-download-vulnerability
CVE: CVE-2023-0341
Published: 2023-02-01
Description: A stack buffer overflow exists in the ec_glob function of editorconfig-core-c before v0.12.6 which allowed an attacker to arbitrarily write to the stack and possibly allows remote code execution. editorconfig-core-c v0.12.6 resolved this vulnerability by bound checking all write operations over the p_pcre buffer.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://github.com/editorconfig/editorconfig-core-c/commit/41281ea82fbf24b060a9f69b9c5369350fb0529e; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZCFE7DXWAAKDJPRKMXHCACKGKNV37IYZ/; https://litios.github.io/2023/01/14/CVE-2023-0341.html
CVE: CVE-2023-23924
Published: 2023-02-01
Description: Dompdf is an HTML to PDF converter. The URI validation on dompdf 2.0.1 can be bypassed on SVG parsing by passing `<image>` tags with uppercase letters. This may lead to arbitrary object unserialize on PHP < 8, through the `phar` URL wrapper. An attacker can exploit the vulnerability to call arbitrary URL with arbitrary protocols, if they can provide a SVG file to dompdf. In PHP versions before 8.0.0, it leads to arbitrary unserialize, that will lead to the very least to an arbitrary file deletion and even remote code execution, depending on classes that are available.

CVSS Score: 10.0 (CRITICAL)
CWE: CWE-551, CWE-863
References: https://github.com/dompdf/dompdf/commit/7558f07f693b2ac3266089f21051e6b78c6a0c85; https://github.com/dompdf/dompdf/releases/tag/v2.0.2; https://github.com/dompdf/dompdf/security/advisories/GHSA-3cw5-7cxw-v5qg
CVE: CVE-2023-24241
Published: 2023-02-01
Description: Forget Heart Message Box v1.1 was discovered to contain a SQL injection vulnerability via the name parameter at /admin/loginpost.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/Mortalwangxin/lives/issues/1; https://github.com/Mortalwangxin/lives/issues/1
CVE: CVE-2023-24956
Published: 2023-02-01
Description: Forget Heart Message Box v1.1 was discovered to contain a SQL injection vulnerability via the name parameter at /cha.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/Mortalwangxin/lives/issues/1; https://github.com/Mortalwangxin/lives/issues/1
CVE: CVE-2023-0606
Published: 2023-02-01
Description: Cross-site Scripting (XSS) - Reflected in GitHub repository ampache/ampache prior to 5.5.7.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/ampache/ampache/commit/d3191503ca856dfe0b33d7cb17717ffd480046cb; https://huntr.dev/bounties/0bfed46d-ac96-43c4-93fb-13f68b4e711b; https://github.com/ampache/ampache/commit/d3191503ca856dfe0b33d7cb17717ffd480046cb
CVE: CVE-2023-23630
Published: 2023-02-01
Description: Eta is an embedded JS templating engine that works inside Node, Deno, and the browser. XSS attack - anyone using the Express API is impacted. The problem has been resolved. Users should upgrade to version 2.0.0. As a workaround, don't pass user supplied things directly to `res.render`. 

CVSS Score: 8.6 (HIGH)
CWE: CWE-79
References: https://github.com/eta-dev/eta/commit/[PII_REDACTED]ee0ff19d77c8481081a99e5b9138dd; https://github.com/eta-dev/eta/releases/tag/v2.0.0; https://github.com/eta-dev/eta/security/advisories/GHSA-xrh7-m5pp-39r6
CVE: CVE-2023-23928
Published: 2023-02-01
Description: reason-jose is a JOSE implementation in ReasonML and OCaml.`Jose.Jws.validate` does not check HS256 signatures. This allows tampering of JWS header and payload data if the service does not perform additional checks. Such tampering could expose applications using reason-jose to authorization bypass. Applications relying on JWS claims assertion to enforce security boundaries may be vulnerable to privilege escalation. This issue has been patched in version 0.8.2.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-347
References: https://github.com/ulrikstrid/reason-jose/commit/36cd724db3cbec121757624da49072386bd869e5; https://github.com/ulrikstrid/reason-jose/releases/tag/v0.8.2; https://github.com/ulrikstrid/reason-jose/security/advisories/GHSA-7jj9-6qwv-wpm7
CVE: CVE-2022-31902
Published: 2023-02-01
Description: Notepad++ v8.4.1 was discovered to contain a stack overflow via the component Finder::add().
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787, CWE-787
References: http://notepad.com; https://github.com/CDACesec/CVE-2022-31902; http://notepad.com
CVE: CVE-2022-47768
Published: 2023-02-01
Description: Serenissima Informatica Fast Checkin 1.0 is vulnerable to Directory Traversal.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: http://serenissima.com; https://www.swascan.com/it/security-advisory-serenissima-informatica-fastcheckin/; http://serenissima.com
CVE: CVE-2022-47769
Published: 2023-02-01
Description: An arbitrary file write vulnerability in Serenissima Informatica Fast Checkin v1.0 allows unauthenticated attackers to upload malicious files in the web root of the application to gain access to the server via the web shell.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434, CWE-434
References: http://serenissima.com; https://www.swascan.com/it/security-advisory-serenissima-informatica-fastcheckin/; http://serenissima.com
CVE: CVE-2022-47770
Published: 2023-02-01
Description: Serenissima Informatica Fast Checkin version v1.0 is vulnerable to Unauthenticated SQL Injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: http://serenissima.com; https://www.swascan.com/it/security-advisory-serenissima-informatica-fastcheckin/; http://serenissima.com
CVE: CVE-2022-4206
Published: 2023-02-01
Description: A sensitive information leak issue has been discovered in all versions of DAST API scanner from 1.6.50 prior to 2.0.102, exposing the Authorization header in the vulnerability report
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-4206.json; https://gitlab.com/gitlab-org/gitlab/-/issues/383083; https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-4206.json
CVE: CVE-2023-0454
Published: 2023-02-01
Description: OrangeScrum version 2.0.11 allows an authenticated external attacker to delete arbitrary local files from the server. This is possible because the application uses an unsanitized attacker-controlled parameter to construct an internal path.
CVSS Score: 8.1 (HIGH)
CWE: CWE-22, CWE-22
References: https://fluidattacks.com/advisories/slushii/; https://github.com/Orangescrum/orangescrum/; https://fluidattacks.com/advisories/slushii/
CVE: CVE-2023-0524
Published: 2023-02-01
Description: As part of our Security Development Lifecycle, a potential privilege escalation issue was identified internally. This could allow a malicious actor with sufficient permissions to modify environment variables and abuse an impacted plugin in order to escalate privileges. We have resolved the issue and also made several defense-in-depth fixes alongside. While the probability of successful exploitation is low, Tenable is committed to securing our customers’ environments and our products. The updates have been distributed via the Tenable plugin feed in feed serial numbers equal to or greater than #[PII_REDACTED]55.
CVSS Score: 8.8 (HIGH)
CWE: CWE-269
References: https://www.tenable.com/security/tns-2023-04; https://www.tenable.com/security/tns-2023-04
CVE: CVE-2023-0587
Published: 2023-02-01
Description: A file upload vulnerability in exists in Trend Micro Apex One server build 11110. Using a malformed Content-Length header in an HTTP PUT message sent to URL /officescan/console/html/cgi/fcgiOfcDDA.exe, an unauthenticated remote attacker can upload arbitrary files to the SampleSubmission directory (i.e., \PCCSRV\TEMP\SampleSubmission) on the server. The attacker can upload a large number of large files to fill up the file system on which the Apex One server is installed.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-434, CWE-434
References: https://www.tenable.com/security/research/tra-2023-5; https://www.tenable.com/security/research/tra-2023-5; https://www.tenable.com/security/research/tra-2023-5
CVE: CVE-2023-20856
Published: 2023-02-01
Description: VMware vRealize Operations (vROps) contains a CSRF bypass vulnerability. A malicious user could execute actions on the vROps platform on behalf of the authenticated victim user.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://www.vmware.com/security/advisories/VMSA-2023-0002.html; https://www.vmware.com/security/advisories/VMSA-2023-0002.html
CVE: CVE-2023-23846
Published: 2023-02-01
Description: Due to insufficient length validation in the Open5GS GTP library versions prior to versions 2.4.13 and 2.5.7, when parsing extension headers in GPRS tunneling protocol (GPTv1-U) messages, a protocol payload with any extension header length set to zero causes an infinite loop. The affected process becomes immediately unresponsive, resulting in denial of service and excessive resource consumption. CVSS3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C
CVSS Score: 7.5 (HIGH)
CWE: CWE-770, CWE-770
References: https://www.synopsys.com/blogs/software-security/cyrc-advisory-open5gs-gtp-library/; https://www.synopsys.com/blogs/software-security/cyrc-advisory-open5gs-gtp-library/
CVE: CVE-2021-22786
Published: 2023-02-01
Description: A CWE-200: Information Exposure vulnerability exists that could cause the exposure of sensitive information stored on the memory of the controller when communicating over the Modbus TCP protocol. Affected Products: Modicon M340 CPU (part numbers BMXP34*) (Versions prior to V3.30), Modicon M580 CPU (part numbers BMEP* and BMEH*) (Versions prior to SV3.20), Modicon MC80 (BMKC80) (Versions prior to V1.6), Modicon M580 CPU Safety (part numbers BMEP58*S and BMEH58*S) (All Versions), Modicon Momentum MDI (171CBU*) (Versions prior to V2.3), Legacy Modicon Quantum (All Versions)
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-221-04&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2022-221-04-Modicon_Controllers_Ethernet_Modules_Security_Notification.pdf; https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-221-04&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2022-221-04-Modicon_Controllers_Ethernet_Modules_Security_Notification.pdf
CVE: CVE-2022-24324
Published: 2023-02-01
Description: A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could cause a stack-based buffer overflow potentially leading to remote code execution when an attacker sends a specially crafted message. Affected Products: IGSS Data Server - IGSSdataServer.exe (Versions prior to V15.0.0.22073)
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://download.schneider-electric.com/files?p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2022-102-01_IGSS_Security_Notification_V2.0.pdf; https://download.schneider-electric.com/files?p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2022-102-01_IGSS_Security_Notification_V2.0.pdf
CVE: CVE-2022-2329
Published: 2023-02-01
Description: A CWE-190: Integer Overflow or Wraparound vulnerability exists that could cause heap-based buffer overflow, leading to denial of service and potentially remote code execution when an attacker sends multiple specially crafted messages. Affected Products: IGSS Data Server - IGSSdataServer.exe (Versions prior to V15.0.0.22073)
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190
References: https://download.schneider-electric.com/files?p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2022-102-01_IGSS_Security_Notification_V2.0.pdf; https://download.schneider-electric.com/files?p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2022-102-01_IGSS_Security_Notification_V2.0.pdf
CVE: CVE-2022-42970
Published: 2023-02-01
Description: A CWE-306: Missing Authentication for Critical Function The software does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. Affected Products: APC Easy UPS Online Monitoring Software (Windows 7, 10, 11 & Windows Server 2016, 2019, 2022 - Versions prior to V2.5-GA), APC Easy UPS Online Monitoring Software (Windows 11, Windows Server 2019, 2022 - Versions prior to V2.5-GA-01-22261), Schneider Electric Easy UPS Online Monitoring Software (Windows 7, 10, 11 & Windows Server 2016, 2019, 2022 - Versions prior to V2.5-GS), Schneider Electric Easy UPS Online Monitoring Software (Windows 11, Windows Server 2019, 2022 - Versions prior to V2.5-GS-01-22261)
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://download.schneider-electric.com/files?p_Doc_SEVD-2022-347-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2022-347-01_Easy_UPS_Online_Monitoring_Software_Security_Notification.pdf; https://download.schneider-electric.com/files?p_Doc_SEVD-2022-347-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2022-347-01_Easy_UPS_Online_Monitoring_Software_Security_Notification.pdf
CVE: CVE-2022-42971
Published: 2023-02-01
Description: A CWE-434: Unrestricted Upload of File with Dangerous Type vulnerability exists that could cause remote code execution when the attacker uploads a malicious JSP file. Affected Products: APC Easy UPS Online Monitoring Software (Windows 7, 10, 11 & Windows Server 2016, 2019, 2022 - Versions prior to V2.5-GA), APC Easy UPS Online Monitoring Software (Windows 11, Windows Server 2019, 2022 - Versions prior to V2.5-GA-01-22261), Schneider Electric Easy UPS Online Monitoring Software (Windows 7, 10, 11 & Windows Server 2016, 2019, 2022 - Versions prior to V2.5-GS), Schneider Electric Easy UPS Online Monitoring Software (Windows 11, Windows Server 2019, 2022 - Versions prior to V2.5-GS-01-22261)
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434, CWE-434
References: https://download.schneider-electric.com/files?p_Doc_SEVD-2022-347-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2022-347-01_Easy_UPS_Online_Monitoring_Software_Security_Notification.pdf; https://download.schneider-electric.com/files?p_Doc_SEVD-2022-347-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2022-347-01_Easy_UPS_Online_Monitoring_Software_Security_Notification.pdf
CVE: CVE-2022-42972
Published: 2023-02-01
Description: A CWE-732: Incorrect Permission Assignment for Critical Resource vulnerability exists that could cause local privilege escalation when a local attacker modifies the webroot directory. Affected Products: APC Easy UPS Online Monitoring Software (Windows 7, 10, 11 & Windows Server 2016, 2019, 2022 - Versions prior to V2.5-GA), APC Easy UPS Online Monitoring Software (Windows 11, Windows Server 2019, 2022 - Versions prior to V2.5-GA-01-22261), Schneider Electric Easy UPS Online Monitoring Software (Windows 7, 10, 11 & Windows Server 2016, 2019, 2022 - Versions prior to V2.5-GS), Schneider Electric Easy UPS Online Monitoring Software (Windows 11, Windows Server 2019, 2022 - Versions prior to V2.5-GS-01-22261)
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: https://download.schneider-electric.com/files?p_Doc_SEVD-2022-347-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2022-347-01_Easy_UPS_Online_Monitoring_Software_Security_Notification.pdf; https://download.schneider-electric.com/files?p_Doc_SEVD-2022-347-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2022-347-01_Easy_UPS_Online_Monitoring_Software_Security_Notification.pdf
CVE: CVE-2022-42973
Published: 2023-02-01
Description: A CWE-798: Use of Hard-coded Credentials vulnerability exists that could cause local privilege escalation when local attacker connects to the database. Affected Products: APC Easy UPS Online Monitoring Software (Windows 7, 10, 11 & Windows Server 2016, 2019, 2022 - Versions prior to V2.5-GA), APC Easy UPS Online Monitoring Software (Windows 11, Windows Server 2019, 2022 - Versions prior to V2.5-GA-01-22261), Schneider Electric Easy UPS Online Monitoring Software (Windows 7, 10, 11 & Windows Server 2016, 2019, 2022 - Versions prior to V2.5-GS), Schneider Electric Easy UPS Online Monitoring Software (Windows 11, Windows Server 2019, 2022 - Versions prior to V2.5-GS-01-22261)
CVSS Score: 7.8 (HIGH)
CWE: CWE-798
References: https://download.schneider-electric.com/files?p_Doc_SEVD-2022-347-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2022-347-01_Easy_UPS_Online_Monitoring_Software_Security_Notification.pdf; https://download.schneider-electric.com/files?p_Doc_SEVD-2022-347-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2022-347-01_Easy_UPS_Online_Monitoring_Software_Security_Notification.pdf
CVE: CVE-2022-4062
Published: 2023-02-01
Description: A CWE-285: Improper Authorization vulnerability exists that could cause unauthorized access to certain software functions when an attacker gets access to localhost interface of the EcoStruxure Power Commission application. Affected Products: EcoStruxure Power Commission (Versions prior to V2.25)
CVSS Score: 7.8 (HIGH)
CWE: CWE-285
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-347-03&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2022-347-03_EcoStruxure_Power_Commission_Security_Notification.pdf; https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-347-03&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2022-347-03_EcoStruxure_Power_Commission_Security_Notification.pdf
CVE: CVE-2023-0607
Published: 2023-02-01
Description: Cross-site Scripting (XSS) - Stored in GitHub repository projectsend/projectsend prior to r1606.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/projectsend/projectsend/commit/698be4ade1db6ae0eaf27c843a03ffc9683cca0a; https://huntr.dev/bounties/9294743d-7818-4264-b973-59de027d549b; https://github.com/projectsend/projectsend/commit/698be4ade1db6ae0eaf27c843a03ffc9683cca0a
CVE: CVE-2022-25906
Published: 2023-02-01
Description: All versions of the package is-http2 are vulnerable to Command Injection due to missing input sanitization or other checks, and sandboxes being employed to the isH2 function.
CVSS Score: 7.4 (HIGH)
CWE: CWE-78, CWE-78, CWE-78
References: https://github.com/stefanjudis/is-http2/blob/master/index.js%23L23; https://security.snyk.io/vuln/SNYK-JS-ISHTTP2-3153878; https://github.com/stefanjudis/is-http2/blob/master/index.js%23L23
CVE: CVE-2022-25916
Published: 2023-02-01
Description: Versions of the package mt7688-wiscan before 0.8.3 are vulnerable to Command Injection due to improper input sanitization in the 'wiscan.scan' function. 
CVSS Score: 7.4 (HIGH)
CWE: CWE-78, CWE-77
References: https://github.com/simenkid/mt7688-wiscan/blob/master/index.js%23L22; https://github.com/simenkid/mt7688-wiscan/commit/ff6d6567c65b4e972916a8fbc4533212f20a2fa5; https://security.snyk.io/vuln/SNYK-JS-MT7688WISCAN-3177394
CVE: CVE-2022-34400
Published: 2023-02-01
Description: 
Dell BIOS contains a heap buffer overflow vulnerability. A local attacker with admin privileges could potentially exploit this vulnerability to perform an arbitrary write to SMRAM during SMM.






CVSS Score: 7.1 (HIGH)
CWE: CWE-122, CWE-787
References: https://www.dell.com/support/kbdoc/en-us/000205716/dsa-2022-327; https://www.dell.com/support/kbdoc/en-us/000205716/dsa-2022-327
CVE: CVE-2022-34443
Published: 2023-02-01
Description: 
Dell Rugged Control Center, versions prior to 4.5, contain an Improper Input Validation in the Service EndPoint. A Local Low Privilege attacker could potentially exploit this vulnerability, leading to an Escalation of privileges.






CVSS Score: 7.8 (HIGH)
CWE: CWE-20, CWE-20
References: https://www.dell.com/support/kbdoc/en-us/000206103/dsa-2022-281-dell; https://www.dell.com/support/kbdoc/en-us/000206103/dsa-2022-281-dell