deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-44399
Published: 2022-11-28
Description: Poultry Farm Management System v1.0 contains a SQL injection vulnerability via the del parameter at /Redcock-Farm/farm/category.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/tavenli/bug_report/blob/main/vendors/Nikhil_B/Poultry%20Farm%20Management%20System/SQLi-1.md; https://github.com/tavenli/bug_report/blob/main/vendors/Nikhil_B/Poultry%20Farm%20Management%20System/SQLi-1.md
CVE: CVE-2022-41732
Published: 2022-11-28
Description: 
IBM Maximo Mobile 8.7 and 8.8 stores user credentials in plain clear text which can be read by a local user. IBM X-Force ID: 237407.


CVSS Score: 6.2 (MEDIUM)
CWE: CWE-256, CWE-522
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/237407; https://www.ibm.com/support/pages/node/6841617; https://exchange.xforce.ibmcloud.com/vulnerabilities/237407
CVE: CVE-2022-4169
Published: 2022-11-28
Description: The Theme and plugin translation for Polylang is vulnerable to authorization bypass in versions up to, and including, 3.2.16 due to missing capability checks in the process_polylang_theme_translation_wp_loaded() function. This makes it possible for unauthenticated attackers to update plugin and theme translation settings and to import translation strings.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2814605%40theme-translation-for-polylang%2Ftrunk&old=2812254%40theme-translation-for-polylang%2Ftrunk&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/9f6a358a-333c-4eb7-9149-348bf3713943?source=cve; https://www.wordfence.com/vulnerability-advisories-continued/#CVE-2022-4169
CVE: CVE-2022-4104
Published: 2022-11-28
Description: A loop with an unreachable exit condition can be triggered by passing a crafted JPEG file to the Lepton image compression tool, resulting in a denial-of-service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-835, CWE-835
References: https://tenable.com/security/research/TRA-2022-35; https://tenable.com/security/research/TRA-2022-35
CVE: CVE-2022-34654
Published: 2022-11-28
Description: Cross-Site Request Forgery (CSRF) in Virgial Berveling's Manage Notification E-mails plugin <= 1.8.2 on WordPress.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/manage-notification-emails/wordpress-manage-notification-e-mails-plugin-1-8-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/manage-notification-emails/wordpress-manage-notification-e-mails-plugin-1-8-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2022-38140
Published: 2022-11-28
Description: Auth. (contributor+) Arbitrary File Upload in SEO Plugin by Squirrly SEO plugin <= 12.1.10 on WordPress.
CVSS Score: 7.6 (HIGH)
CWE: CWE-434
References: https://patchstack.com/database/vulnerability/squirrly-seo/wordpress-seo-plugin-by-squirrly-seo-plugin-12-1-10-auth-arbitrary-file-upload-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/squirrly-seo/wordpress-seo-plugin-by-squirrly-seo-plugin-12-1-10-auth-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2022-41965
Published: 2022-11-28
Description: Opencast is a free, open-source platform to support the management of educational audio and video content. Prior to Opencast 12.5, Opencast's Paella authentication page could be used to redirect to an arbitrary URL for authenticated users. The vulnerability allows attackers to redirect users to sites outside of one's Opencast install, potentially facilitating phishing attacks or other security issues. This issue is fixed in Opencast 12.5 and newer.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-601
References: https://github.com/opencast/opencast/commit/d2ce2321590f86b066a67e8c231cf68219aea017; https://github.com/opencast/opencast/security/advisories/GHSA-r3qr-vwvg-43f7; https://github.com/opencast/opencast/commit/d2ce2321590f86b066a67e8c231cf68219aea017
CVE: CVE-2022-44937
Published: 2022-11-28
Description: Bosscms v2.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the Add function under the Administrator List module.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://github.com/5497lvren/Zhenhao/issues/1; https://github.com/5497lvren/Zhenhao/issues/1
CVE: CVE-2022-45442
Published: 2022-11-28
Description: Sinatra is a domain-specific language for creating web applications in Ruby. An issue was discovered in Sinatra 2.0 before 2.2.3 and 3.0 before 3.0.4. An application is vulnerable to a reflected file download (RFD) attack that sets the Content-Disposition header of a response when the filename is derived from user-supplied input. Version 2.2.3 and 3.0.4 contain patches for this issue.
CVSS Score: 8.8 (HIGH)
CWE: CWE-494
References: https://github.com/advisories/GHSA-8x94-hmjh-97hq; https://github.com/sinatra/sinatra/commit/ea8fc9495a350f7551b39e3025bfcd06f49f363b; https://github.com/sinatra/sinatra/security/advisories/GHSA-2x8x-jmrp-phxw
CVE: CVE-2022-45921
Published: 2022-11-28
Description: FusionAuth before 1.41.3 allows a file outside of the application root to be viewed or retrieved using an HTTP request. To be specific, an attacker may be able to view or retrieve any file readable by the user running the FusionAuth process.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://fusionauth.io/docs/v1/tech/release-notes; https://github.com/FusionAuth/fusionauth-issues/issues/1983; https://fusionauth.io/docs/v1/tech/release-notes
CVE: CVE-2022-46147
Published: 2022-11-28
Description: Drag and Drop XBlock v2 implements a drag-and-drop style problem, where a learner has to drag items to zones on a target image. Versions prior to 3.0.0 are vulnerable to cross-site scripting in multiple XBlock Fields. Any platform that has deployed the XBlock may be impacted. Version 3.0.0 contains a patch for this issue. There are no known workarounds.
CVSS Score: 8.4 (HIGH)
CWE: CWE-79
References: https://github.com/openedx/xblock-drag-and-drop-v2/commit/68887d1b4a44325d2de7573d450e41129ba98b1a; https://github.com/openedx/xblock-drag-and-drop-v2/pull/295#issuecomment[PII_REDACTED]; https://github.com/openedx/xblock-drag-and-drop-v2/releases/tag/v3.0.0
CVE: CVE-2022-24187
Published: 2022-11-28
Description: The user_id and device_id on the Ourphoto App version 1.4.1 /device/* end-points both suffer from insecure direct object reference vulnerabilities. Other end-users user_id and device_id values can be enumerated by incrementing or decrementing id numbers. The impact of this vulnerability allows an attacker to discover sensitive information such as end-user email addresses, and their unique frame_token value of all other Ourphoto App end-users.
CVSS Score: 7.5 (HIGH)
CWE: CWE-639, CWE-639
References: https://apps.apple.com/us/app/ourphoto-keep-our-memories/id[PII_REDACTED]; https://www.scrawledsecurityblog.com/2022/11/automating-unsolicited-richard-pics.html; https://apps.apple.com/us/app/ourphoto-keep-our-memories/id[PII_REDACTED]
CVE: CVE-2022-24188
Published: 2022-11-28
Description: The /device/signin end-point for the Ourphoto App version 1.4.1 discloses clear-text password information for functionality within the picture frame devices. The deviceVideoCallPassword and mqttPassword are returned in clear-text. The lack of sessions management and presence of insecure direct object references allows to return password information for other end-users devices. Many of the picture frame devices offer video calling, and it is likely this information can be used to abuse that functionality.
CVSS Score: 7.5 (HIGH)
CWE: CWE-312, CWE-312
References: https://www.scrawledsecurityblog.com/2022/11/automating-unsolicited-richard-pics.html; https://www.scrawledsecurityblog.com/2022/11/automating-unsolicited-richard-pics.html
CVE: CVE-2022-24189
Published: 2022-11-28
Description: The user_token authorization header on the Ourphoto App version 1.4.1 /apiv1/* end-points is not implemented properly. Removing the value causes all requests to succeed, bypassing authorization and session management. The impact of this vulnerability allows an attacker POST api calls with other users unique identifiers and enumerate information of all other end-users.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-863, CWE-863
References: https://www.scrawledsecurityblog.com/2022/11/automating-unsolicited-richard-pics.html; https://www.scrawledsecurityblog.com/2022/11/automating-unsolicited-richard-pics.html
CVE: CVE-2022-24190
Published: 2022-11-28
Description: The /device/acceptBind end-point for Ourphoto App version 1.4.1 does not require authentication or authorization. The user_token header is not implemented or present on this end-point. An attacker can send a request to bind their account to any users picture frame, then send a POST request to accept their own bind request, without the end-users approval or interaction.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306, CWE-862, CWE-306, CWE-862
References: https://www.scrawledsecurityblog.com/2022/11/automating-unsolicited-richard-pics.html; https://www.scrawledsecurityblog.com/2022/11/automating-unsolicited-richard-pics.html
CVE: CVE-2022-38753
Published: 2022-11-28
Description: This update resolves a multi-factor authentication bypass attack
CVSS Score: 6.3 (MEDIUM)
References: https://www.netiq.com/documentation/advanced-authentication-64/advanced-authentication-releasenotes-641/data/advanced-authentication-releasenotes-641.html#t4g4mvd1yivo; https://www.netiq.com/documentation/advanced-authentication-64/advanced-authentication-releasenotes-641/data/advanced-authentication-releasenotes-641.html#t4g4mvd1yivo
CVE: CVE-2022-3088
Published: 2022-11-28
Description: UC-8100A-ME-T System Image: Versions v1.0 to v1.6, UC-2100 System Image: Versions v1.0 to v1.12, UC-2100-W System Image: Versions v1.0 to v 1.12,&nbsp;UC-3100 System Image: Versions v1.0 to v1.6,&nbsp;UC-5100 System Image: Versions v1.0 to v1.4, UC-8100 System Image: Versions v3.0 to v3.5, UC-8100-ME-T System Image: Versions v3.0 and v3.1, UC-8200 System Image: v1.0 to v1.5, AIG-300 System Image: v1.0 to v1.4, UC-8410A with Debian 9 System Image: Versions v4.0.2 and v4.1.2, UC-8580 with Debian 9 System Image: Versions v2.0 and v2.1, UC-8540 with Debian 9 System Image: Versions v2.0 and v2.1, and DA-662C-16-LX (GLB) System Image: Versions v1.0.2 to v1.1.2 of Moxa's ARM-based computers have an execution with unnecessary privileges vulnerability, which could allow an attacker with user-level privileges to gain root privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-250, CWE-269
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-326-05; https://www.cisa.gov/uscert/ics/advisories/icsa-22-326-05
CVE: CVE-2022-45214
Published: 2022-11-28
Description: A cross-site scripting (XSS) vulnerability in Sanitization Management System v1.0.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the username parameter at /php-sms/classes/Login.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/Rajeshwar40/CVE/blob/main/CVE-2022-45214.txt; https://github.com/Rajeshwar40/CVE/blob/main/CVE-2022-45214.txt
CVE: CVE-2022-45221
Published: 2022-11-28
Description: Web-Based Student Clearance System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability in changepassword.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the txtnew_password parameter.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://medium.com/%40just0rg/web-based-student-clearance-system-in-php-free-source-code-v1-0-unrestricted-input-leads-to-xss-5802ead12124; https://medium.com/%40just0rg/web-based-student-clearance-system-in-php-free-source-code-v1-0-unrestricted-input-leads-to-xss-5802ead12124
CVE: CVE-2022-45223
Published: 2022-11-28
Description: Web-Based Student Clearance System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability in /Admin/add-student.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the txtfullname parameter.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://medium.com/%40just0rg/web-based-student-clearance-system-in-php-free-source-code-v1-0-unrestricted-input-leads-to-xss-5802ead12124; https://medium.com/%40just0rg/web-based-student-clearance-system-in-php-free-source-code-v1-0-unrestricted-input-leads-to-xss-5802ead12124; https://medium.com/%40just0rg/web-based-student-clearance-system-in-php-free-source-code-v1-0-unrestricted-input-leads-to-xss-5802ead12124
CVE: CVE-2022-45224
Published: 2022-11-28
Description: Web-Based Student Clearance System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability in Admin/add-admin.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the txtfullname parameter.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://medium.com/%40just0rg/book-store-management-system-1-0-unrestricted-input-leads-to-xss-74506d42492e; https://medium.com/%40just0rg/book-store-management-system-1-0-unrestricted-input-leads-to-xss-74506d42492e; https://medium.com/%40just0rg/book-store-management-system-1-0-unrestricted-input-leads-to-xss-74506d42492e
CVE: CVE-2022-4127
Published: 2022-11-28
Description: A NULL pointer dereference issue was discovered in the Linux kernel in io_files_update_with_index_alloc. A local user could use this flaw to potentially crash the system causing a denial of service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/torvalds/linux/commit/d785a773bed966a75ca1f11d108ae[PII_REDACTED]b; https://lore.kernel.org/all/d5a19c1e-9968-e22e-5917-c3139c5e7e89%40kernel.dk/; https://github.com/torvalds/linux/commit/d785a773bed966a75ca1f11d108ae[PII_REDACTED]b
CVE: CVE-2022-4128
Published: 2022-11-28
Description: A NULL pointer dereference issue was discovered in the Linux kernel in the MPTCP protocol when traversing the subflow list at disconnect time. A local user could use this flaw to potentially crash the system causing a denial of service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/torvalds/linux/commit/5c835bb142d4; https://lore.kernel.org/netdev/[PII_REDACTED]3610.410786-2-mathew.j.martineau%40linux.intel.com/; https://github.com/torvalds/linux/commit/5c835bb142d4
CVE: CVE-2022-4129
Published: 2022-11-28
Description: A flaw was found in the Linux kernel's Layer 2 Tunneling Protocol (L2TP). A missing lock when clearing sk_user_data can lead to a race condition and NULL pointer dereference. A local user could use this flaw to potentially crash the system causing a denial of service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-667, CWE-667
References: https://lists.debian.org/debian-lts-announce/2023/05/msg00005.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7X5SPXMXXFANDASPCKER2JIQO2F3UHCP/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AM5KFIE6JNZXHBA5A2KYDZAT3MEX2B67/
CVE: CVE-2022-45301
Published: 2022-11-29
Description: Insecure permissions in Chocolatey Ruby package v3.1.2.1 and below grants all users in the Authenticated Users group write privileges for the path C:\tools\ruby31 and all files located in that folder.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-732, CWE-732
References: https://github.com/ycdxsb/Vuln/blob/main/ruby-weak-permission-vuln/ruby-weak-permission-vuln.md; https://github.com/ycdxsb/Vuln/blob/main/ruby-weak-permission-vuln/ruby-weak-permission-vuln.md
CVE: CVE-2022-45304
Published: 2022-11-29
Description: Insecure permissions in Chocolatey Cmder package v1.3.20 and below grants all users in the Authenticated Users group write privileges for the path C:\tools\Cmder and all files located in that folder.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-732, CWE-732
References: https://github.com/ycdxsb/Vuln/blob/main/cmder-weak-permission-vuln/cmder-weak-permission-vuln.md; https://github.com/ycdxsb/Vuln/blob/main/cmder-weak-permission-vuln/cmder-weak-permission-vuln.md
CVE: CVE-2022-45305
Published: 2022-11-29
Description: Insecure permissions in Chocolatey Python3 package v3.11.0 and below grants all users in the Authenticated Users group write privileges for the subfolder C:\Python311 and all files located in that folder.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-732, CWE-732
References: https://github.com/ycdxsb/Vuln/blob/main/python3-weak-permission-vuln/python3-weak-permission-vuln.md; https://github.com/ycdxsb/Vuln/blob/main/python3-weak-permission-vuln/python3-weak-permission-vuln.md
CVE: CVE-2022-45306
Published: 2022-11-29
Description: Insecure permissions in Chocolatey Azure-Pipelines-Agent package v2.211.1 and below grants all users in the Authenticated Users group write privileges for the subfolder C:\agent and all files located in that folder.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-732, CWE-732
References: https://github.com/ycdxsb/Vuln/blob/main/azure-pipelines-agent-weak-permission-vuln/azure-pipelines-agent-weak-permission-vuln.md; https://github.com/ycdxsb/Vuln/blob/main/azure-pipelines-agent-weak-permission-vuln/azure-pipelines-agent-weak-permission-vuln.md
CVE: CVE-2022-45307
Published: 2022-11-29
Description: Insecure permissions in Chocolatey PHP package v8.1.12 and below grants all users in the Authenticated Users group write privileges for the subfolder C:\tools\php81 and all files located in that folder.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-732, CWE-732
References: https://github.com/ycdxsb/Vuln/blob/main/php-weak-permission-vuln/php-weak-permission-vuln.md; https://github.com/ycdxsb/Vuln/blob/main/php-weak-permission-vuln/php-weak-permission-vuln.md
CVE: CVE-2022-32966
Published: 2022-11-29
Description: RTL8168FP-CG Dash remote management function has missing authorization. An unauthenticated attacker within the adjacent network can connect to DASH service port to disrupt service.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://www.twcert.org.tw/tw/cp-132-6739-5098c-1.html; https://www.twcert.org.tw/tw/cp-132-6739-5098c-1.html
CVE: CVE-2022-32967
Published: 2022-11-29
Description: RTL8111EP-CG/RTL8111FP-CG DASH function has hard-coded password. An unauthenticated physical attacker can use the hard-coded default password during system reboot triggered by other user, to acquire partial system information such as serial number and server information.
CVSS Score: 2.1 (LOW)
CWE: CWE-798, CWE-798
References: https://www.twcert.org.tw/tw/cp-132-6740-ba9bd-1.html; https://www.twcert.org.tw/tw/cp-132-6740-ba9bd-1.html
CVE: CVE-2022-36136
Published: 2022-11-29
Description: ChurchCRM Version 4.4.5 has XSS vulnerabilities that allow attackers to store XSS via location input Deposit Comment.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/ChurchCRM/CRM/releases/tag/4.4.5; https://grimthereaperteam.medium.com/churchcrm-version-4-4-5-stored-xss-vulnerability-at-deposit-commend-839d2c587d6e; https://github.com/ChurchCRM/CRM/releases/tag/4.4.5
CVE: CVE-2022-36137
Published: 2022-11-29
Description: ChurchCRM Version 4.4.5 has XSS vulnerabilities that allow attackers to store XSS via location input sHeader.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/ChurchCRM/CRM/releases/tag/4.4.5; https://grimthereaperteam.medium.com/churchcrm-version-4-4-5-stored-xss-vulnerability-at-sheader-2ed4184030f7; https://github.com/ChurchCRM/CRM/releases/tag/4.4.5
CVE: CVE-2022-41675
Published: 2022-11-29
Description: A remote attacker with general user privilege can inject malicious code in the form content of Raiden MAILD Mail Server website. Other users export form content as CSV file can trigger arbitrary code execution and allow the attacker to perform arbitrary system operation or disrupt service on the user side.
CVSS Score: 8.0 (HIGH)
CWE: CWE-1236, CWE-1236
References: https://www.twcert.org.tw/tw/cp-132-6738-b78f4-1.html; https://www.twcert.org.tw/tw/cp-132-6738-b78f4-1.html
CVE: CVE-2022-41676
Published: 2022-11-29
Description: Raiden MAILD Mail Server website mail field has insufficient filtering for user input. A remote attacker with general user privilege can send email using the website with malicious JavaScript in the input field, which triggers XSS (Reflected Cross-Site Scripting) attack to the mail recipient.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-85, CWE-79
References: https://www.twcert.org.tw/tw/cp-132-6743-0a2c4-1.html; https://www.twcert.org.tw/tw/cp-132-6743-0a2c4-1.html
CVE: CVE-2022-42099
Published: 2022-11-29
Description: KLiK SocialMediaWebsite Version 1.0.1 has XSS vulnerabilities that allow attackers to store XSS via location Forum Subject input.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/msaad1999/KLiK-SocialMediaWebsite/releases/tag/v1.0.1; https://grimthereaperteam.medium.com/klik-socialmediawebsite-version-1-0-1-stored-xss-vulnerability-at-forum-subject-a453789736f2; https://github.com/msaad1999/KLiK-SocialMediaWebsite/releases/tag/v1.0.1
CVE: CVE-2022-42100
Published: 2022-11-29
Description: KLiK SocialMediaWebsite Version 1.0.1 has XSS vulnerabilities that allow attackers to store XSS via location input reply-form.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/msaad1999/KLiK-SocialMediaWebsite/releases/tag/v1.0.1; https://grimthereaperteam.medium.com/klik-socialmediawebsite-version-1-0-1-stored-xss-vulnerability-at-reply-form-b189147c1f93; https://github.com/msaad1999/KLiK-SocialMediaWebsite/releases/tag/v1.0.1
CVE: CVE-2022-42109
Published: 2022-11-29
Description: Online-shopping-system-advanced 1.0 was discovered to contain a SQL injection vulnerability via the p parameter at /shopping/product.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/PuneethReddyHC/online-shopping-system-advanced; https://medium.com/%40grimthereaperteam/online-shopping-system-advanced-sql-injection-at-product-php-c55c435c35c2; https://github.com/PuneethReddyHC/online-shopping-system-advanced
CVE: CVE-2022-44037
Published: 2022-11-29
Description: An access control issue in APsystems ENERGY COMMUNICATION UNIT (ECU-C) Power Control Software V4.1NA, V3.11.4, W2.1NA, V4.1SAA, C1.2.2 allows attackers to access sensitive data and execute specific commands and functions with full admin rights without authenticating allows him to perform multiple attacks, such as attacking wireless network in the product's range.
CVSS Score: 8.8 (HIGH)
CWE: CWE-284
References: https://cyber-guy.gitbook.io/cyber-guys-blog/pocs/cve-2022-44037; https://cyber-guy.gitbook.io/cyber-guys-blog/pocs/cve-2022-44037
CVE: CVE-2022-44038
Published: 2022-11-29
Description: Russound XSourcePlayer 777D v06.08.03 was discovered to contain a remote code execution vulnerability via the scriptRunner.cgi component.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://cyber-guy.gitbook.io/cyber-guys-blog/pocs/cve-2022-44038; https://cyber-guy.gitbook.io/cyber-guys-blog/pocs/cve-2022-44038
CVE: CVE-2022-45202
Published: 2022-11-29
Description: GPAC v2.1-DEV-rev428-gcb8ae46c8-master was discovered to contain a stack overflow via the function dimC_box_read at isomedia/box_code_3gpp.c.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://github.com/gpac/gpac/issues/2296; https://www.debian.org/security/2023/dsa-5411; https://github.com/gpac/gpac/issues/2296
CVE: CVE-2022-45204
Published: 2022-11-29
Description: GPAC v2.1-DEV-rev428-gcb8ae46c8-master was discovered to contain a memory leak via the function dimC_box_read at isomedia/box_code_3gpp.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401, CWE-401
References: https://github.com/gpac/gpac/issues/2307; https://github.com/gpac/gpac/issues/2307
CVE: CVE-2022-40799
Published: 2022-11-29
Description: Data Integrity Failure in 'Backup Config' in D-Link DNR-322L <= 2.60B15 allows an authenticated attacker to execute OS level commands on the device.
CVSS Score: 8.8 (HIGH)
CWE: CWE-494, CWE-494
References: https://gitlab.com/lu-ka/cve-2022-40799; https://gitlab.com/lu-ka/cve-2022-40799; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-40799