deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-44321
Published: 2022-03-04
Description: Mini-Inventory-and-Sales-Management-System is affected by Cross Site Request Forgery (CSRF), where an attacker can update/delete items in the inventory. The attacker must be logged into the application create a malicious file for updating the inventory details and items.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-352
References: https://1410inc.xyz/mini-inventory-and-sales-management-system/; https://huntr.dev/bounties/1d84931c-ee10-4944-9764-d96612cdbc71/; https://1410inc.xyz/mini-inventory-and-sales-management-system/
CVE: CVE-2021-46393
Published: 2022-03-04
Description: There is a stack buffer overflow vulnerability in the formSetPPTPServer function of Tenda-AX3 router V16.03.12.10_CN. The v10 variable is directly retrieved from the http request parameter startIp. Then v10 will be splice to stack by function sscanf without any security check,which causes stack overflow. By POSTing the page /goform/SetPptpServerCfg with proper startIp, the attacker can easily perform remote code execution with carefully crafted overflow data.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/sec-bin/IoT-CVE/tree/main/Tenda/AX3/3; https://github.com/sec-bin/IoT-CVE/tree/main/Tenda/AX3/3
CVE: CVE-2021-46394
Published: 2022-03-04
Description: There is a stack buffer overflow vulnerability in the formSetPPTPServer function of Tenda-AX3 router V16.03.12.10_CN. The v13 variable is directly retrieved from the http request parameter startIp. Then v13 will be splice to stack by function sscanf without any security check, which causes stack overflow. By POSTing the page /goform/SetPptpServerCfg with proper startIp, the attacker can easily perform remote code execution with carefully crafted overflow data.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/sec-bin/IoT-CVE/tree/main/Tenda/AX3/4; https://github.com/sec-bin/IoT-CVE/tree/main/Tenda/AX3/4
CVE: CVE-2022-0831
Published: 2022-03-04
Description: Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.3.3.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/pimcore/pimcore/commit/e786fd44aac46febdbf916ed6c328fbe645d80bf; https://huntr.dev/bounties/4152e3a7-27a1-49eb-a6eb-a57506af104f; https://github.com/pimcore/pimcore/commit/e786fd44aac46febdbf916ed6c328fbe645d80bf
CVE: CVE-2022-0832
Published: 2022-03-04
Description: Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.3.3.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/pimcore/pimcore/commit/8ab06bfbb5a05a1b190731d9c7476ec45f5ee878; https://huntr.dev/bounties/be450b60-bc8f-4585-96a5-3c4069f1186a; https://github.com/pimcore/pimcore/commit/8ab06bfbb5a05a1b190731d9c7476ec45f5ee878
CVE: CVE-2022-26201
Published: 2022-03-04
Description: Victor CMS v1.0 was discovered to contain a SQL injection vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/truonghuuphuc/CVE; https://github.com/truonghuuphuc/CVE/blob/main/CVE-2022-26201.pdf; https://github.com/truonghuuphuc/CVE
CVE: CVE-2020-18324
Published: 2022-03-04
Description: Cross Site Scripting (XSS) vulnerability exists in Subrion CMS 4.2.1 via the q parameter in the Kickstart template.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://intelliants.com; http://subrion.com; https://github.com/hamm0nz/CVE-2020-18324
CVE: CVE-2020-18325
Published: 2022-03-04
Description: Multilple Cross Site Scripting (XSS) vulnerability exists in Intelliants Subrion CMS v4.2.1 in the Configuration panel.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://intelliants.com; http://subrion.com; https://github.com/hamm0nz/CVE-2020-18325
CVE: CVE-2020-18326
Published: 2022-03-04
Description: Cross Site Request Forgery (CSRF) vulnerability exists in Intelliants Subrion CMS v4.2.1 via the Members administrator function, which could let a remote unauthenticated malicious user send an authorised request to victim and successfully create an arbitrary administrator user.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://intelliants.com; http://subrion.com; https://github.com/hamm0nz/CVE-2020-18326
CVE: CVE-2020-18327
Published: 2022-03-04
Description: Cross Site Scripting (XSS) vulnerability exists in Alfresco Alfresco Community Edition v5.2.0 via the action parameter in the alfresco/s/admin/admin-nodebrowser API. Fixed in v6.2
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/paatui/a3c7ca8cf12594b437d3854f13d76cb8; https://www.cvedetails.com/vulnerability-list/vendor_id-13372/product_id-27784/opxss-1/Alfresco-Alfresco.html; https://gist.github.com/paatui/a3c7ca8cf12594b437d3854f13d76cb8
CVE: CVE-2021-46378
Published: 2022-03-04
Description: DLink DIR850 ET850-1.08TRb03 is affected by an incorrect access control vulnerability through an unauthenticated remote configuration download.
CVSS Score: 7.5 (HIGH)
CWE: CWE-425
References: http://packetstormsecurity.com/files/167042/DLINK-DIR850-Insecure-Direct-Object-Reference.html; https://drive.google.com/file/d/1S69wOovVa8NRVUXcB0PkVvZHFxREcD4Y/view?usp=sharing; https://www.dlink.com/en/security-bulletin/
CVE: CVE-2022-0839
Published: 2022-03-04
Description: Improper Restriction of XML External Entity Reference in GitHub repository liquibase/liquibase prior to 4.8.0.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-611, CWE-611
References: https://github.com/liquibase/liquibase/commit/33d9d925082097fb1a3d2fc8e44423d964cd9381; https://huntr.dev/bounties/f1ae5779-b406-4594-a8a3-d089c68d6e70; https://www.oracle.com/security-alerts/cpujul2022.html
CVE: CVE-2022-23397
Published: 2022-03-04
Description: The Cedar Gate EZ-NET portal 6.5.5 6.8.0 Internet portal has a call to display messages to users which does not properly sanitize data sent in through a URL parameter. This leads to a Reflected Cross-Site Scripting vulnerability. NOTE: the vendor disputes this because the ado.im reference has "no clear steps of reproduction."
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://ado.im/cedar-gate-ez-net; https://ado.im/cedar-gate-ez-net
CVE: CVE-2021-23214
Published: 2022-03-04
Description: When the server is configured to use trust authentication with a clientcert requirement or to use cert authentication, a man-in-the-middle attacker can inject arbitrary SQL queries when a connection is first established, despite the use of SSL certificate verification and encryption.
CVSS Score: 8.1 (HIGH)
CWE: CWE-89, CWE-89
References: https://bugzilla.redhat.com/show_bug.cgi?id=2022666; https://git.postgresql.org/gitweb/?p=postgresql.git%3Ba=commit%3Bh=28e[PII_REDACTED][PII_REDACTED]efae9bca603441951; https://github.com/postgres/postgres/commit/28e[PII_REDACTED][PII_REDACTED]efae9bca603441951
CVE: CVE-2021-3743
Published: 2022-03-04
Description: An out-of-bounds (OOB) memory read flaw was found in the Qualcomm IPC router protocol in the Linux kernel. A missing sanity check allows a local attacker to gain access to out-of-bounds memory, leading to a system crash or a leak of internal kernel information. The highest threat from this vulnerability is to system availability.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125, CWE-125
References: https://bugzilla.redhat.com/show_bug.cgi?id=1997961; https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=7e78c597c3eb; https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=7e78c597c3ebfd0cb329aa09a838734147e4f117
CVE: CVE-2021-3744
Published: 2022-03-04
Description: A memory leak flaw was found in the Linux kernel in the ccp_run_aes_gcm_cmd() function in drivers/crypto/ccp/ccp-ops.c, which allows attackers to cause a denial of service (memory consumption). This vulnerability is similar with the older CVE-2019-18808.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401, CWE-401
References: http://www.openwall.com/lists/oss-security/2021/09/14/1; https://bugzilla.redhat.com/show_bug.cgi?id=2000627; https://github.com/torvalds/linux/commit/505d9dcb0f7ddf9d075e729523a33d38642ae680
CVE: CVE-2021-46379
Published: 2022-03-04
Description: DLink DIR850 ET850-1.08TRb03 is affected by an incorrect access control vulnerability through URL redirection to untrusted site.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: http://packetstormsecurity.com/files/167041/DLINK-DIR850-Open-Redirection.html; https://drive.google.com/file/d/1rrlwnIxSHEoO4SMAHRPKZSRzK5MwZQRf/view?usp=sharing; https://www.dlink.com/en/security-bulletin/
CVE: CVE-2021-46380
Published: 2022-03-04
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: Reason: This is a duplicate to CVE-2022-22511 Notes
CVE: CVE-2021-46381
Published: 2022-03-04
Description: Local File Inclusion due to path traversal in D-Link DAP-1620 leads to unauthorized internal files reading [/etc/passwd] and [/etc/shadow].
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://packetstormsecurity.com/files/167070/DLINK-DAP-1620-A1-1.01-Directory-Traversal.html; https://drive.google.com/drive/folders/19OP09msw8l7CJ622nkvnvnt7EKun1eCG?usp=sharing; https://www.dlink.com/en/security-bulletin/
CVE: CVE-2021-46382
Published: 2022-03-04
Description: Unauthenticated cross-site scripting (XSS) in Netgear WAC120 AC Access Point may lead to mulitple attacks like session hijacking even clipboard hijacking.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://drive.google.com/drive/folders/1NOIoT8yE_HDoLVYhchml5E2Za3Oo6V9Y?usp=sharing; https://www.netgear.com/about/security/; https://drive.google.com/drive/folders/1NOIoT8yE_HDoLVYhchml5E2Za3Oo6V9Y?usp=sharing
CVE: CVE-2022-22946
Published: 2022-03-04
Description: In spring cloud gateway versions prior to 3.1.1+ , applications that are configured to enable HTTP2 and no key store or trusted certificates are set will be configured to use an insecure TrustManager. This makes the gateway able to connect to remote services with invalid or custom certificates.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-295
References: https://tanzu.vmware.com/security/cve-2022-22946; https://www.oracle.com/security-alerts/cpujul2022.html; https://tanzu.vmware.com/security/cve-2022-22946
CVE: CVE-2022-23729
Published: 2022-03-04
Description: When the device is in factory state, it can be access the shell without adb authentication process. The LG ID is LVE-SMP-210010.
CVSS Score: 7.8 (HIGH)
CWE: CWE-305, CWE-287
References: https://lgsecurity.lge.com/bulletins/mobile; https://lgsecurity.lge.com/bulletins/mobile
CVE: CVE-2022-26336
Published: 2022-03-04
Description: A shortcoming in the HMEF package of poi-scratchpad (Apache POI) allows an attacker to cause an Out of Memory exception. This package is used to read TNEF files (Microsoft Outlook and Microsoft Exchange Server). If an application uses poi-scratchpad to parse TNEF files and the application allows untrusted users to supply them, then a carefully crafted file can cause an Out of Memory exception. This issue affects poi-scratchpad version 5.2.0 and prior versions. Users are recommended to upgrade to poi-scratchpad 5.2.1.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20, CWE-770, CWE-770
References: https://lists.apache.org/thread/sprg0kq986pc2271dc3v2oxb1f9qx09j; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://lists.apache.org/thread/sprg0kq986pc2271dc3v2oxb1f9qx09j
CVE: CVE-2022-21828
Published: 2022-03-04
Description: A user with high privilege access to the Incapptic Connect web console can remotely execute code on the Incapptic Connect server using a unspecified attack vector in Incapptic Connect version 1.40.0, 1.39.1, 1.39.0, 1.38.1, 1.38.0, 1.37.1, 1.37.0, 1.36.0, 1.35.5, 1.35.4 and 1.35.3.
CVSS Score: 7.2 (HIGH)
CWE: CWE-502
References: https://forums.ivanti.com/s/article/SA-2022-02-23?language=en_US; https://forums.ivanti.com/s/article/SA-2022-02-23?language=en_US
CVE: CVE-2022-24727
Published: 2022-03-04
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2022-23915. Reason: This candidate is a reservation duplicate of CVE-2022-23915. Notes: All CVE users should reference CVE-2022-23915 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2022-25623
Published: 2022-03-04
Description: The Symantec Management Agent is susceptible to a privilege escalation vulnerability. A low privilege local account can be elevated to the SYSTEM level through registry manipulations.
CVSS Score: 7.8 (HIGH)
References: https://support.broadcom.com/external/content/SecurityAdvisories/0/20366; https://support.broadcom.com/external/content/SecurityAdvisories/0/20366
CVE: CVE-2021-20300
Published: 2022-03-04
Description: A flaw was found in OpenEXR's hufUncompress functionality in OpenEXR/IlmImf/ImfHuf.cpp. This flaw allows an attacker who can submit a crafted file that is processed by OpenEXR, to trigger an integer overflow. The highest threat from this vulnerability is to system availability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-190, CWE-190
References: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25562; https://bugzilla.redhat.com/show_bug.cgi?id=1939153; https://github.com/AcademySoftwareFoundation/openexr/pull/836
CVE: CVE-2021-20302
Published: 2022-03-04
Description: A flaw was found in OpenEXR's TiledInputFile functionality. This flaw allows an attacker who can submit a crafted single-part non-image to be processed by OpenEXR, to trigger a floating-point exception error. The highest threat from this vulnerability is to system availability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25894; https://bugzilla.redhat.com/show_bug.cgi?id=1939161; https://github.com/AcademySoftwareFoundation/openexr/pull/842
CVE: CVE-2021-20303
Published: 2022-03-04
Description: A flaw found in function dataWindowForTile() of IlmImf/ImfTiledMisc.cpp. An attacker who is able to submit a crafted file to be processed by OpenEXR could trigger an integer overflow, leading to an out-of-bounds write on the heap. The greatest impact of this flaw is to application availability, with some potential impact to data integrity as well.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-190, CWE-190
References: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25505; https://bugzilla.redhat.com/show_bug.cgi?id=1939151; https://github.com/AcademySoftwareFoundation/openexr/pull/831
CVE: CVE-2021-20319
Published: 2022-03-04
Description: An improper signature verification vulnerability was found in coreos-installer. A specially crafted gzip installation image can bypass the image signature verification and as a consequence can lead to the installation of unsigned content. An attacker able to modify the original installation image can write arbitrary data, and achieve full access to the node being installed.
CVSS Score: 7.8 (HIGH)
CWE: CWE-347, CWE-347
References: https://bugzilla.redhat.com/show_bug.cgi?id=2011862; https://github.com/coreos/coreos-installer/pull/659/commits/ad243c6f0eff2835b2da56ca5f7f33af76253c89; https://github.com/coreos/coreos-installer/security/advisories/GHSA-3r3g-g73x-g593
CVE: CVE-2021-3428
Published: 2022-03-04
Description: A flaw was found in the Linux kernel. A denial of service problem is identified if an extent tree is corrupted in a crafted ext4 filesystem in fs/ext4/extents.c in ext4_es_cache_extent. Fabricating an integer overflow, A local attacker with a special user privilege may cause a system crash problem which can lead to an availability threat.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-190, CWE-190
References: https://bugzilla.redhat.com/show_bug.cgi?id=1972621; https://ubuntu.com/security/CVE-2021-3428; https://www.openwall.com/lists/oss-security/2021/03/17/1
CVE: CVE-2021-3575
Published: 2022-03-04
Description: A heap-based buffer overflow was found in openjpeg in color.c:379:42 in sycc420_to_rgb when decompressing a crafted .j2k file. An attacker could use this to execute arbitrary code with the permissions of the application compiled against openjpeg.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://bugzilla.redhat.com/show_bug.cgi?id=1957616; https://github.com/uclouvain/openjpeg/issues/1347; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EZ54FGM2IGAP4AWSJ22JKHOPHCR3FGYU/
CVE: CVE-2022-23232
Published: 2022-03-04
Description: StorageGRID (formerly StorageGRID Webscale) versions prior to 11.6.0 are susceptible to a vulnerability which when successfully exploited could allow disabled, expired, or locked external user accounts to access S3 data to which they previously had access. StorageGRID 11.6.0 obtains the user account status from Active Directory or Azure and will block S3 access for disabled user accounts during the subsequent background synchronization. User accounts that are expired or locked for Active Directory or Azure, or user accounts that are disabled, expired, or locked in identity sources other than Active Directory or Azure must be manually removed from group memberships or have their S3 keys manually removed from Tenant Manager in all versions of StorageGRID (formerly StorageGRID Webscale).
CVSS Score: 4.9 (MEDIUM)
References: https://security.netapp.com/advisory/NTAP-20[PII_REDACTED]/; https://security.netapp.com/advisory/NTAP-20[PII_REDACTED]/
CVE: CVE-2022-23233
Published: 2022-03-04
Description: StorageGRID (formerly StorageGRID Webscale) versions prior to 11.6.0 are susceptible to a vulnerability which when successfully exploited could lead to Denial of Service (DoS) of the Local Distribution Router (LDR) service.
CVSS Score: 7.5 (HIGH)
References: https://security.netapp.com/advisory/NTAP-20[PII_REDACTED]/; https://security.netapp.com/advisory/NTAP-20[PII_REDACTED]/
CVE: CVE-2022-26318
Published: 2022-03-04
Description: On WatchGuard Firebox and XTM appliances, an unauthenticated user can execute arbitrary code, aka FBX-22786. This vulnerability impacts Fireware OS before 12.7.2_U2, 12.x before 12.1.3_U8, and 12.2.x through 12.5.x before 12.5.9_U2.
CVSS Score: 9.8 (CRITICAL)
References: https://www.watchguard.com/support/release-notes/fireware/12/en-US/EN_ReleaseNotes_Fireware_12_7_2/index.html#Fireware/en-US/resolved_issues.html; https://www.watchguard.com/support/release-notes/fireware/12/en-US/EN_ReleaseNotes_Fireware_12_7_2/index.html#Fireware/en-US/resolved_issues.html; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-26318
CVE: CVE-2021-27757
Published: 2022-03-04
Description: " Insecure password storage issue.The application stores sensitive information in cleartext within a resource that might be accessible to another control sphere.Since the information is stored in cleartext, attackers could potentially read it and gain access to sensitive information."
CVSS Score: 7.5 (HIGH)
CWE: CWE-312
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0095303; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0095303
CVE: CVE-2021-3656
Published: 2022-03-04
Description: A flaw was found in the KVM's AMD code for supporting SVM nested virtualization. The flaw occurs when processing the VMCB (virtual machine control block) provided by the L1 guest to spawn/handle a nested guest (L2). Due to improper validation of the "virt_ext" field, this issue could allow a malicious L1 to disable both VMLOAD/VMSAVE intercepts and VLS (Virtual VMLOAD/VMSAVE) for the L2 guest. As a result, the L2 guest would be allowed to read/write physical pages of the host, resulting in a crash of the entire system, leak of sensitive data or potential guest-to-host escape.
CVSS Score: 8.8 (HIGH)
CWE: CWE-862, CWE-862
References: https://bugzilla.redhat.com/show_bug.cgi?id=1983988; https://git.kernel.org/pub/scm/virt/kvm/kvm.git/commit/?id=c7dfa4009965a9b2d7b329ee970eb8da0d32f0bc; https://github.com/torvalds/linux/commit/c7dfa4009965a9b2d7b329ee970eb8da0d32f0bc
CVE: CVE-2021-3737
Published: 2022-03-04
Description: A flaw was found in python. An improperly handled HTTP response in the HTTP client code of python may allow a remote attacker, who controls the HTTP server, to make the client script enter an infinite loop, consuming CPU time. The highest threat from this vulnerability is to system availability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-835, CWE-400, CWE-835
References: https://bugs.python.org/issue44022; https://bugzilla.redhat.com/show_bug.cgi?id=1995162; https://github.com/python/cpython/pull/25916
CVE: CVE-2022-0855
Published: 2022-03-04
Description: Improper Resolution of Path Equivalence in GitHub repository microweber-dev/whmcs_plugin prior to 0.0.4.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-41, CWE-706
References: https://github.com/microweber-dev/whmcs_plugin/commit/2e7a11d332db79cc52ccda00455a15f4dc6147ff; https://huntr.dev/bounties/511879b0-cdaa-4c03-af92-deb54d46284a; https://github.com/microweber-dev/whmcs_plugin/commit/2e7a11d332db79cc52ccda00455a15f4dc6147ff
CVE: CVE-2022-26483
Published: 2022-03-04
Description: An issue was discovered in Veritas InfoScale Operations Manager (VIOM) before 7.4.2 Patch 600 and 8.x before 8.0.0 Patch 100. A reflected cross-site scripting (XSS) vulnerability in admin/cgi-bin/listdir.pl allows authenticated remote administrators to inject arbitrary web script or HTML into an HTTP GET parameter (which reflect the user input without sanitization).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://www.veritas.com/content/support/en_US/security/VTS22-002; https://www.veritas.com/content/support/en_US/security/VTS22-002
CVE: CVE-2022-26484
Published: 2022-03-04
Description: An issue was discovered in Veritas InfoScale Operations Manager (VIOM) before 7.4.2 Patch 600 and 8.x before 8.0.0 Patch 100. The web server fails to sanitize admin/cgi-bin/rulemgr.pl/getfile/ input data, allowing a remote authenticated administrator to read arbitrary files on the system via Directory Traversal. By manipulating the resource name in GET requests referring to files with absolute paths, it is possible to access arbitrary files stored on the filesystem, including application source code, configuration files, and critical system files.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-22
References: https://www.veritas.com/content/support/en_US/security/VTS22-002; https://www.veritas.com/content/support/en_US/security/VTS22-002
CVE: CVE-2022-23915
Published: 2022-03-04
Description: The package weblate from 0 and before 4.11.1 are vulnerable to Remote Code Execution (RCE) via argument injection when using git or mercurial repositories. Authenticated users, can change the behavior of the application in an unintended way, leading to command execution.
CVSS Score: 7.2 (HIGH)
CWE: CWE-88
References: https://github.com/WeblateOrg/weblate/pull/7337; https://github.com/WeblateOrg/weblate/pull/7338; https://github.com/WeblateOrg/weblate/releases/tag/weblate-4.11.1
CVE: CVE-2022-25106
Published: 2022-03-04
Description: D-Link DIR-859 v1.05 was discovered to contain a stack-based buffer overflow via the function genacgi_main. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted payload.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://github.com/chunklhit/cve/blob/master/dlink/DIR859/BufferOverflow.md; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10267; https://www.dlink.com/en/security-bulletin/
CVE: CVE-2021-43590
Published: 2022-03-04
Description: Dell EMC Enterprise Storage Analytics for vRealize Operations, versions 4.0.1 to 6.2.1, contain a Plain-text password storage vulnerability. A local high privileged malicious user may potentially exploit this vulnerability, leading to the disclosure of certain user credentials. The attacker may be able to use the exposed credentials to access the vulnerable application with privileges of the compromised account.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-256, CWE-312
References: https://www.dell.com/support/kbdoc/en-us/000196329/dsa-2021; https://www.dell.com/support/kbdoc/en-us/000196329/dsa-2021