deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-16334
Published: 2023-01-11
Description: Multiple exploitable buffer overflow vulnerabilities exist in the PubNub message handler for the "cc" channel of Insteon Hub running firmware version 1012. Specially crafted commands sent through the PubNub service can cause a stack-based buffer overflow overwriting arbitrary data. An attacker should send an authenticated HTTP request to trigger this vulnerability. In cmd s_event, at 0x9d01edb8, the value for the `s_raw` key is copied using `strcpy` to the buffer at `$sp+0x10`.This buffer is 244 bytes large, sending anything longer will cause a buffer overflow.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-121
References: https://talosintelligence.com/vulnerability_reports/TALOS-2017-0483; https://talosintelligence.com/vulnerability_reports/TALOS-2017-0483
CVE: CVE-2017-16335
Published: 2023-01-11
Description: Multiple exploitable buffer overflow vulnerabilities exist in the PubNub message handler for the "cc" channel of Insteon Hub running firmware version 1012. Specially crafted commands sent through the PubNub service can cause a stack-based buffer overflow overwriting arbitrary data. An attacker should send an authenticated HTTP request to trigger this vulnerability. In cmd s_event_var, at 0x9d01ee70, the value for the `s_offset` key is copied using `strcpy` to the buffer at `$sp+0x2b0`.This buffer is 32 bytes large, sending anything longer will cause a buffer overflow.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-121
References: https://talosintelligence.com/vulnerability_reports/TALOS-2017-0483; https://talosintelligence.com/vulnerability_reports/TALOS-2017-0483
CVE: CVE-2017-16336
Published: 2023-01-11
Description: Multiple exploitable buffer overflow vulnerabilities exist in the PubNub message handler for the "cc" channel of Insteon Hub running firmware version 1012. Specially crafted commands sent through the PubNub service can cause a stack-based buffer overflow overwriting arbitrary data. An attacker should send an authenticated HTTP request to trigger this vulnerability. In cmd s_event_var, at 0x9d01eeb0, the value for the `s_value` key is copied using `strcpy` to the buffer at `$sp+0x10`.This buffer is 244 bytes large, sending anything longer will cause a buffer overflow.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-121
References: https://talosintelligence.com/vulnerability_reports/TALOS-2017-0483; https://talosintelligence.com/vulnerability_reports/TALOS-2017-0483
CVE: CVE-2017-14454
Published: 2023-01-12
Description: Multiple exploitable buffer overflow vulnerabilities exists in the PubNub message handler for the "control" channel of Insteon Hub running firmware version 1012. Specially crafted replies received from the PubNub service can cause buffer overflows on a global section overwriting arbitrary data. An attacker should impersonate PubNub and answer an HTTPS GET request to trigger this vulnerability. The `strcpy` at [18] overflows the buffer `insteon_pubnub.channel_al`, which has a size of 16 bytes.
CVSS Score: 8.5 (HIGH)
CWE: CWE-120, CWE-120
References: https://talosintelligence.com/vulnerability_reports/TALOS-2017-0502; https://talosintelligence.com/vulnerability_reports/TALOS-2017-0502
CVE: CVE-2022-4344
Published: 2023-01-12
Description: Memory exhaustion in the Kafka protocol dissector in Wireshark 4.0.0 to 4.0.1 and 3.6.0 to 3.6.9 allows denial of service via packet injection or crafted capture file
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-400, CWE-400
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-4344.json; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RDZMWIKH3L5JQZC6GSVOJ3N5UXNQPJGQ/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SGWIW6K64PKC375YAONYXKIVT2FDEDV3/
CVE: CVE-2023-0227
Published: 2023-01-12
Description: Insufficient Session Expiration in GitHub repository pyload/pyload prior to 0.5.0b3.dev36.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-613
References: https://github.com/pyload/pyload/commit/c035714c0596b704b11af0f8a669352f128ad2d9; https://huntr.dev/bounties/af3101d7-fea6-463a-b7e4-a48be219e31b; https://github.com/pyload/pyload/commit/c035714c0596b704b11af0f8a669352f128ad2d9
CVE: CVE-2022-3514
Published: 2023-01-12
Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 6.6 before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. An attacker may cause Denial of Service on a GitLab instance by exploiting a regex issue in the submodule URL parser.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-1333, CWE-1333
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3514.json; https://gitlab.com/gitlab-org/gitlab/-/issues/377978; https://hackerone.com/reports/1727201
CVE: CVE-2022-3573
Published: 2023-01-12
Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. Due to the improper filtering of query parameters in the wiki changes page, an attacker can execute arbitrary JavaScript on the self-hosted instances running without strict CSP.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3573.json; https://gitlab.com/gitlab-org/gitlab/-/issues/378216; https://hackerone.com/reports/1730461
CVE: CVE-2022-3613
Published: 2023-01-12
Description: An issue has been discovered in GitLab CE/EE affecting all versions before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. A crafted Prometheus Server query can cause high resource consumption and may lead to Denial of Service.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-400
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3613.json; https://gitlab.com/gitlab-org/gitlab/-/issues/378456; https://hackerone.com/reports/1723106
CVE: CVE-2022-3870
Published: 2023-01-12
Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.0 before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. GitLab allows unauthenticated users to download user avatars using the victim's user ID, on private instances that restrict public level visibility.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3870.json; https://gitlab.com/gitlab-org/gitlab/-/issues/381647; https://hackerone.com/reports/1753423
CVE: CVE-2022-4037
Published: 2023-01-12
Description: An issue has been discovered in GitLab CE/EE affecting all versions before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. A race condition can lead to verified email forgery and takeover of third-party accounts when using GitLab as an OAuth provider.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-362, CWE-362
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-4037.json; https://gitlab.com/gitlab-org/gitlab/-/issues/382957; https://hackerone.com/reports/1772543
CVE: CVE-2022-4131
Published: 2023-01-12
Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.8 before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. An attacker may cause Denial of Service on a GitLab instance by exploiting a regex issue in how the application parses user agents.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-1333, CWE-1333
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-4131.json; https://gitlab.com/gitlab-org/gitlab/-/issues/383598; https://hackerone.com/reports/1772063
CVE: CVE-2022-4167
Published: 2023-01-12
Description: Incorrect Authorization check affecting all versions of GitLab EE from 13.11 prior to 15.5.7, 15.6 prior to 15.6.4, and 15.7 prior to 15.7.2 allows group access tokens to continue working even after the group owner loses the ability to revoke them.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-863, CWE-863
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-4167.json; https://gitlab.com/gitlab-org/gitlab/-/issues/367740; https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-4167.json
CVE: CVE-2022-4342
Published: 2023-01-12
Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.1 before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. A malicious Maintainer can leak masked webhook secrets by changing target URL of the webhook.
CVSS Score: 5.5 (MEDIUM)
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-4342.json; https://gitlab.com/gitlab-org/gitlab/-/issues/385118; https://hackerone.com/reports/1791331
CVE: CVE-2022-4345
Published: 2023-01-12
Description: Infinite loops in the BPv6, OpenFlow, and Kafka protocol dissectors in Wireshark 4.0.0 to 4.0.1 and 3.6.0 to 3.6.9 allows denial of service via packet injection or crafted capture file
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-835, CWE-835
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-4345.json; https://lists.debian.org/debian-lts-announce/2023/02/msg00007.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RDZMWIKH3L5JQZC6GSVOJ3N5UXNQPJGQ/
CVE: CVE-2022-4365
Published: 2023-01-12
Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.8 before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. A malicious Maintainer can leak the sentry token by changing the configured URL in the Sentry error tracking settings page.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-732
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-4365.json; https://gitlab.com/gitlab-org/gitlab/-/issues/385193; https://hackerone.com/reports/1792626
CVE: CVE-2023-0042
Published: 2023-01-12
Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.4 prior to 15.5.7, 15.6 prior to 15.6.4, and 15.7 prior to 15.7.2. GitLab Pages allows redirection to arbitrary protocols.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601, CWE-601
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0042.json; https://gitlab.com/gitlab-org/gitlab-pages/-/issues/728; https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0042.json
CVE: CVE-2022-24913
Published: 2023-01-12
Description: Versions of the package com.fasterxml.util:java-merge-sort before 1.1.0 are vulnerable to Insecure Temporary File in the StdTempFileProvider() function in StdTempFileProvider.java, which uses the permissive File.createTempFile() function, exposing temporary file contents.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-377, CWE-668, CWE-668
References: https://github.com/cowtowncoder/java-merge-sort/commit/450fdee70b5f181c2afc5d817f293efa1a543902; https://github.com/cowtowncoder/java-merge-sort/pull/21; https://security.snyk.io/vuln/SNYK-JAVA-COMFASTERXMLUTIL-3227926
CVE: CVE-2022-47927
Published: 2023-01-12
Description: An issue was discovered in MediaWiki before 1.35.9, 1.36.x through 1.38.x before 1.38.5, and 1.39.x before 1.39.1. When installing with a pre-existing data directory that has weak permissions, the SQLite files are created with file mode 0644, i.e., world readable to local users. These files include credentials data.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-732, CWE-732
References: https://lists.debian.org/debian-lts-announce/2023/07/msg00011.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AP65YEN762IBNQPOYGUVLTQIDLM5XD2A/; https://lists.wikimedia.org/hyperkitty/list/mediawiki-announce%40lists.wikimedia.org/thread/UEMW64LVEH3BEXCJV43CVS6XPYURKWU3/
CVE: CVE-2023-23454
Published: 2023-01-12
Description: cbq_classify in net/sched/sch_cbq.c in the Linux kernel through 6.1.4 allows attackers to cause a denial of service (slab-out-of-bounds read) because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-843, CWE-843
References: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=caa4b35b4317d5147b3ab0fbdc9c075c7d2e9c12; https://lists.debian.org/debian-lts-announce/2023/03/msg00000.html; https://lists.debian.org/debian-lts-announce/2023/05/msg00006.html
CVE: CVE-2023-23455
Published: 2023-01-12
Description: atm_tc_enqueue in net/sched/sch_atm.c in the Linux kernel through 6.1.4 allows attackers to cause a denial of service because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-843, CWE-843
References: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a2965c7be0522eaa18808684b7b82b248515511b; https://lists.debian.org/debian-lts-announce/2023/03/msg00000.html; https://lists.debian.org/debian-lts-announce/2023/05/msg00006.html
CVE: CVE-2022-2155
Published: 2023-01-12
Description: 
A vulnerability exists in the affected versions of Lumada APM’s User Asset Group feature
due to a flaw in access control mechanism implementation on the “Limited Engineer” role, granting it access to the embedded Power BI reports
feature. An attacker that manages to exploit the vulnerability on a customer’s Lumada APM could access unauthorized information by gaining
unauthorized access to any Power BI reports installed by the customer. 

Furthermore, the vulnerability enables an attacker to manipulate asset issue comments on assets, which should not be available to the attacker.



Affected versions 
  *  Lumada APM on-premises version 6.0.0.0 - 6.4.0.*



List of CPEs: 
  *  cpe:2.3:a:hitachienergy:lumada_apm:6.0.0.0:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:lumada_apm:6.1.0.0:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:lumada_apm:6.2.0.0:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:lumada_apm:6.3.0.0:*:*:*:*:*:*:*
  *  cpe:2.3:a:hitachienergy:lumada_apm:6.4.0.0:*:*:*:*:*:*:*



CVSS Score: 5.7 (MEDIUM)
CWE: CWE-863
References: https://search.abb.com/library/Download.aspx?DocumentID=8DBD000112&LanguageCode=en&DocumentPartId=&Action=Launch; https://search.abb.com/library/Download.aspx?DocumentID=8DBD000112&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2022-3341
Published: 2023-01-12
Description: A null pointer dereference issue was discovered in 'FFmpeg' in decode_main_header() function of libavformat/nutdec.c file. The flaw occurs because the function lacks check of the return value of avformat_new_stream() and triggers the null pointer dereference error, causing an application to crash.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://bugzilla.redhat.com/show_bug.cgi?id=2157054; https://github.com/FFmpeg/FFmpeg/commit/9cf652cef49d74afe3d454f27d49eb1a1394951e; https://lists.debian.org/debian-lts-announce/2023/06/msg00016.html
CVE: CVE-2022-3437
Published: 2023-01-12
Description: A heap-based buffer overflow vulnerability was found in Samba within the GSSAPI unwrap_des() and unwrap_des3() routines of Heimdal. The DES and Triple-DES decryption routines in the Heimdal GSSAPI library allow a length-limited write buffer overflow on malloc() allocated memory when presented with a maliciously small packet. This flaw allows a remote user to send specially crafted malicious data to the application, possibly resulting in a denial of service (DoS) attack.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-122
References: http://www.openwall.com/lists/oss-security/2023/02/08/1; https://access.redhat.com/security/cve/CVE-2022-3437; https://bugzilla.redhat.com/show_bug.cgi?id=2137774
CVE: CVE-2022-3515
Published: 2023-01-12
Description: A vulnerability was found in the Libksba library due to an integer overflow within the CRL parser. The vulnerability can be exploited remotely for code execution on the target system by passing specially crafted data to the application, for example, a malicious S/MIME attachment.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190, CWE-190
References: https://access.redhat.com/security/cve/CVE-2022-3515; https://bugzilla.redhat.com/show_bug.cgi?id=2135610; https://dev.gnupg.org/rK4b7d9cd4a018898d7714ce06f3faf2626c14582b
CVE: CVE-2022-3592
Published: 2023-01-12
Description: A symlink following vulnerability was found in Samba, where a user can create a symbolic link that will make 'smbd' escape the configured share path. This flaw allows a remote user with access to the exported part of the file system under a share via SMB1 unix extensions or NFS to create symlinks to files outside the 'smbd' configured share path and gain access to another restricted server's filesystem.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-61, CWE-59
References: https://access.redhat.com/security/cve/CVE-2022-3592; https://bugzilla.redhat.com/show_bug.cgi?id=2137776; https://security.gentoo.org/glsa/202309-06
CVE: CVE-2022-46503
Published: 2023-01-12
Description: A cross-site scripting (XSS) vulnerability in the component /admin/register.php of Online Student Enrollment System v1.0 allows attackers to execute arbitrary web scripts via a crafted payload injected into the name parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/mkwsj007/bug_report/blob/main/vendors/donbermoy/Online%20Student%20Enrollment%20System/XSS-1.md; https://github.com/mkwsj007/bug_report/blob/main/vendors/donbermoy/Online%20Student%20Enrollment%20System/XSS-1.md
CVE: CVE-2023-0243
Published: 2023-01-12
Description: A vulnerability classified as critical has been found in TuziCMS 2.0.6. This affects the function index of the file App\Manage\Controller\ArticleController.class.php of the component Article Module. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-218151.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/yeyinshi/tuzicms/issues/12; https://vuldb.com/?ctiid.218151; https://vuldb.com/?id.218151
CVE: CVE-2023-0244
Published: 2023-01-12
Description: A vulnerability classified as critical was found in TuziCMS 2.0.6. This vulnerability affects the function delall of the file \App\Manage\Controller\KefuController.class.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-218152.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/yeyinshi/tuzicms/issues/13; https://vuldb.com/?ctiid.218152; https://vuldb.com/?id.218152
CVE: CVE-2023-0245
Published: 2023-01-12
Description: A vulnerability, which was classified as critical, has been found in SourceCodester Online Flight Booking Management System. This issue affects some unknown processing of the file add_contestant.php. The manipulation of the argument add_contestant leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-218153 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/f4cky0u/Security-vulnerabilities/blob/main/Online%20Flight%20Booking%20Management%20System%20add_contestant.php%20has%20SQLinject.md; https://vuldb.com/?ctiid.218153; https://vuldb.com/?id.218153
CVE: CVE-2023-0246
Published: 2023-01-12
Description: A vulnerability, which was classified as problematic, was found in earclink ESPCMS P8.21120101. Affected is an unknown function of the component Content Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-218154 is the identifier assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://gitee.com/earclink/espcms/issues/I6812Q; https://vuldb.com/?ctiid.218154; https://vuldb.com/?id.218154
CVE: CVE-2012-10005
Published: 2023-01-12
Description: A vulnerability has been found in manikandan170890 php-form-builder-class and classified as problematic. Affected by this vulnerability is an unknown functionality of the file PFBC/Element/Textarea.php of the component Textarea Handler. The manipulation of the argument value leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The patch is named[PII_REDACTED]8d826595fd5857038e6703456a594a. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-218155.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://code.google.com/archive/p/php-form-builder-class/issues/184; https://github.com/manikandan170890/php-form-builder-class/commit/[PII_REDACTED]8d826595fd5857038e6703456a594a; https://vuldb.com/?ctiid.218155
CVE: CVE-2013-10011
Published: 2023-01-12
Description: A vulnerability was found in aeharding classroom-engagement-system and classified as critical. Affected by this issue is some unknown functionality. The manipulation leads to sql injection. The attack may be launched remotely. The name of the patch is 096de5815c7b414e7339f3439522a446098fb73a. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-218156.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/aeharding/classroom-engagement-system/commit/096de5815c7b414e7339f3439522a446098fb73a; https://vuldb.com/?ctiid.218156; https://vuldb.com/?id.218156
CVE: CVE-2022-39182
Published: 2023-01-12
Description: H C Mingham-Smith Ltd - Tardis 2000 Privilege escalation.Version 1.6 is vulnerable to privilege escalation which may allow a malicious actor to gain system privileges.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-269
References: https://www.gov.il/en/Departments/faq/cve_advisories; https://www.gov.il/en/Departments/faq/cve_advisories
CVE: CVE-2022-39183
Published: 2023-01-12
Description: Moodle Plugin - SAML Auth may allow Open Redirect through unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-601, CWE-601
References: https://www.gov.il/en/Departments/faq/cve_advisories; https://www.gov.il/en/Departments/faq/cve_advisories
CVE: CVE-2022-39184
Published: 2023-01-12
Description: EXFO - BV-10 Performance Endpoint Unit authentication bypass User can manually manipulate access enabling authentication bypass.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://www.gov.il/en/Departments/faq/cve_advisories; https://www.gov.il/en/Departments/faq/cve_advisories
CVE: CVE-2022-39185
Published: 2023-01-12
Description: EXFO - BV-10 Performance Endpoint Unit Undocumented privileged user. Unit has an undocumented hard-coded privileged user.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798, CWE-798
References: https://www.gov.il/en/Departments/faq/cve_advisories; https://www.gov.il/en/Departments/faq/cve_advisories
CVE: CVE-2022-39186
Published: 2023-01-12
Description: EXFO - BV-10 Performance Endpoint Unit misconfiguration. System configuration file has misconfigured permissions
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-732, CWE-732
References: https://www.gov.il/en/Departments/faq/cve_advisories; https://www.gov.il/en/Departments/faq/cve_advisories
CVE: CVE-2022-39187
Published: 2023-01-12
Description: Rumpus - FTP server version 9.0.7.1 has a Reflected cross-site scripting (RXSS) vulnerability through unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.gov.il/en/Departments/faq/cve_advisories; https://www.gov.il/en/Departments/faq/cve_advisories
CVE: CVE-2022-46367
Published: 2023-01-12
Description: Rumpus - FTP server Cross-site request forgery (CSRF) – Privilege escalation vulnerability that may allow privilege escalation.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://www.gov.il/en/Departments/faq/cve_advisories; https://www.gov.il/en/Departments/faq/cve_advisories