deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-1670
Published: 2022-05-19
Description: When generating a user invitation code in Octopus Server, the validity of this code can be set for a specific number of users. It was possible to bypass this restriction of validity to create extra user accounts above the initial number of invited users.
CVSS Score: 7.5 (HIGH)
References: https://advisories.octopus.com/post/2022/sa2022-04/; https://advisories.octopus.com/post/2022/sa2022-04/
CVE: CVE-2022-1183
Published: 2022-05-19
Description: On vulnerable configurations, the named daemon may, in some circumstances, terminate with an assertion failure. Vulnerable configurations are those that include a reference to http within the listen-on statements in their named.conf. TLS is used by both DNS over TLS (DoT) and DNS over HTTPS (DoH), but configurations using DoT alone are unaffected. Affects BIND 9.18.0 -> 9.18.2 and version 9.19.0 of the BIND 9.19 development branch.
CVSS Score: 7.5 (HIGH)
CWE: CWE-617
References: https://kb.isc.org/docs/cve-2022-1183; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://kb.isc.org/docs/cve-2022-1183
CVE: CVE-2022-1785
Published: 2022-05-19
Description: Out-of-bounds Write in GitHub repository vim/vim prior to 8.2.4977.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://github.com/vim/vim/commit/e2bd8600b873d2cd1f9d667c28cba8b1dba18839; https://huntr.dev/bounties/8c969cba-eef2-4943-b44a-4e[PII_REDACTED]; https://lists.debian.org/debian-lts-announce/2022/11/msg00032.html
CVE: CVE-2021-41938
Published: 2022-05-19
Description: An issue was discovered in ShopXO CMS 2.2.0. After entering the management page, there is an arbitrary file upload vulnerability in three locations.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: https://github.com/gongfuxiang/shopxo/issues/64; https://github.com/gongfuxiang/shopxo/issues/64
CVE: CVE-2022-1730
Published: 2022-05-19
Description: Cross-site Scripting (XSS) - Stored in GitHub repository jgraph/drawio prior to 18.0.4.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/jgraph/drawio/commit/4deecee18191f67e242422abf3ca304e19e49687; https://huntr.dev/bounties/fded4835-bd49-4533-8311-1d71e0ed7c00; https://github.com/jgraph/drawio/commit/4deecee18191f67e242422abf3ca304e19e49687
CVE: CVE-2022-30018
Published: 2022-05-19
Description: Mobotix Control Center (MxCC) through 2.5.4.5 has Insufficiently Protected Credentials, Storing Passwords in a Recoverable Format via the MxCC.ini config file. The credential storage method in this software enables an attacker/user of the machine to gain admin access to the software and gain access to recordings/recording locations.
CVSS Score: 8.8 (HIGH)
CWE: CWE-522
References: https://github.com/PurplePetrus/MxCC_Credential-Storage_issue/blob/main/MxCC_improper_credential_storage; https://github.com/PurplePetrus/MxCC_Credential-Storage_issue/blob/main/MxCC_improper_credential_storage
CVE: CVE-2021-26630
Published: 2022-05-19
Description: Improper input validation vulnerability in HANDY Groupware’s ActiveX moudle allows attackers to download or execute arbitrary files. This vulnerability can be exploited by using the file download or execution path as the parameter value of the vulnerable function.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20, CWE-20
References: https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=66723; https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=66723
CVE: CVE-2021-26631
Published: 2022-05-19
Description: Improper input validation vulnerability in Mangboard commerce package could lead to occur for abnormal request. A remote attacker can exploit this vulnerability to manipulate the total order amount into a negative number and then pay for the order.
CVSS Score: 8.0 (HIGH)
CWE: CWE-20, CWE-20
References: https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=66724; https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=66724
CVE: CVE-2021-37413
Published: 2022-05-19
Description: GRANDCOM DynWEB before 4.2 contains a SQL Injection vulnerability in the admin login interface. A remote unauthenticated attacker can exploit this vulnerability to obtain administrative access to the webpage, access the user database, modify web content and upload custom files. The backend login script does not verify and sanitize user-provided strings.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/martinkubecka/CVE-References/blob/main/CVE-2021-37413.md; https://www.grandcom.sk; https://github.com/martinkubecka/CVE-References/blob/main/CVE-2021-37413.md
CVE: CVE-2021-45730
Published: 2022-05-19
Description: JFrog Artifactory prior to 7.31.10, is vulnerable to Broken Access Control where a Project Admin is able to create, edit and delete Repository Layouts while Repository Layouts configuration should only be available for Platform Administrators.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-284
References: https://www.jfrog.com/confluence/display/JFROG/CVE-2021-45730%3A+Artifactory+Broken+Access+Control+on+Repository+Layouts+Configuration; https://www.jfrog.com/confluence/display/JFROG/CVE-2021-45730%3A+Artifactory+Broken+Access+Control+on+Repository+Layouts+Configuration
CVE: CVE-2022-22976
Published: 2022-05-19
Description: Spring Security versions 5.5.x prior to 5.5.7, 5.6.x prior to 5.6.4, and earlier unsupported versions contain an integer overflow vulnerability. When using the BCrypt class with the maximum work factor (31), the encoder does not perform any salt rounds, due to an integer overflow error. The default settings are not affected by this CVE.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-190, CWE-190
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://tanzu.vmware.com/security/cve-2022-22976; https://www.oracle.com/security-alerts/cpujul2022.html
CVE: CVE-2022-22978
Published: 2022-05-19
Description: In spring security versions prior to 5.4.11+, 5.5.7+ , 5.6.4+ and older unsupported versions, RegexRequestMatcher can easily be misconfigured to be bypassed on some servlet containers. Applications using RegexRequestMatcher with `.` in the regular expression are possibly vulnerable to an authorization bypass.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-863, CWE-863
References: https://spring.io/security/cve-2022-22978; https://spring.io/security/cve-2022-22978
CVE: CVE-2020-4970
Published: 2022-05-19
Description: IBM Security Identity Governance and Intelligence 5.2.4, 5.2.5, and 5.2.6 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 192429.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-319
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/192429; https://www.ibm.com/support/pages/node/6587435; https://exchange.xforce.ibmcloud.com/vulnerabilities/192429
CVE: CVE-2022-1796
Published: 2022-05-19
Description: Use After Free in GitHub repository vim/vim prior to 8.2.4979.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://github.com/vim/vim/commit/28d032cc688ccfda18c5bbcab8b50aba6e18cde5; https://huntr.dev/bounties/f6739b58-49f9-4056-a843-bf76bbc1253e; https://security.gentoo.org/glsa/202208-32
CVE: CVE-2022-28927
Published: 2022-05-19
Description: A remote code execution (RCE) vulnerability in Subconverter v0.7.2 allows attackers to execute arbitrary code via crafted config and url parameters.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://gist.github.com/CwithW/01a726e5af709655d6ee0b2067cdae03; https://github.com/tindy2013/subconverter/commit/ce8d2bd0f13f05fcbd2ed90755d097f402393dd3; https://gist.github.com/CwithW/01a726e5af709655d6ee0b2067cdae03
CVE: CVE-2022-29446
Published: 2022-05-19
Description: Authenticated (administrator or higher role) Local File Inclusion (LFI) vulnerability in Wow-Company's Counter Box plugin <= 1.1.1 at WordPress.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-552, CWE-552
References: https://patchstack.com/database/vulnerability/counter-box/wordpress-counter-box-plugin-1-1-1-authenticated-local-file-inclusion-lfi-vulnerability; https://wordpress.org/plugins/counter-box/#developers; https://patchstack.com/database/vulnerability/counter-box/wordpress-counter-box-plugin-1-1-1-authenticated-local-file-inclusion-lfi-vulnerability
CVE: CVE-2022-29449
Published: 2022-05-19
Description: Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in Opal Hotel Room Booking plugin <= 1.2.7 at WordPress.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/opal-hotel-room-booking/wordpress-opal-hotel-room-booking-plugin-1-2-7-stored-cross-site-scripting-xss-vulnerability; https://wordpress.org/plugins/opal-hotel-room-booking/; https://patchstack.com/database/vulnerability/opal-hotel-room-booking/wordpress-opal-hotel-room-booking-plugin-1-2-7-stored-cross-site-scripting-xss-vulnerability
CVE: CVE-2020-14496
Published: 2022-05-19
Description: Successful exploitation of this vulnerability for multiple Mitsubishi Electric Factory Automation Engineering Software Products of various versions could allow an attacker to escalate privilege and execute malicious programs, which could cause a denial-of-service condition, and allow information to be disclosed, tampered with, and/or destroyed.
CVSS Score: 8.3 (HIGH)
CWE: CWE-275
References: https://www.cisa.gov/uscert/ics/advisories/icsa-20-212-02; https://www.cisa.gov/uscert/ics/advisories/icsa-20-212-02
CVE: CVE-2020-16209
Published: 2022-05-19
Description: A malicious attacker could exploit the interface of the Fieldcomm Group HART-IP (release 1.0.0.0) by constructing messages with sufficiently large payloads to overflow the internal buffer and crash the device, or obtain control of the device.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-121
References: https://www.cisa.gov/uscert/ics/advisories/icsa-20-287-04; https://www.cisa.gov/uscert/ics/advisories/icsa-20-287-04
CVE: CVE-2020-16231
Published: 2022-05-19
Description: The affected Bachmann Electronic M-Base Controllers of version MSYS v1.06.14 and later use weak cryptography to protect device passwords. Affected controllers that are actively supported include MX207, MX213, MX220, MC206, MC212, MC220, and MH230 hardware controllers, and affected end-of-life controller include MC205, MC210, MH212, ME203, CS200, MP213, MP226, MPC240, MPC265, MPC270, MPC293, MPE270, and CPC210 hardware controllers. Security Level 0 is set at default from the manufacturer, which could allow an unauthenticated remote attacker to gain access to the password hashes. Security Level 4 is susceptible if an authenticated remote attacker or an unauthenticated person with physical access to the device reads and decrypts the password to conduct further attacks.
CVSS Score: 7.2 (HIGH)
CWE: CWE-916, CWE-916
References: https://www.cisa.gov/uscert/ics/advisories/icsa-21-026-02; https://www.cisa.gov/uscert/ics/advisories/icsa-21-026-02
CVE: CVE-2020-16235
Published: 2022-05-19
Description: Inadequate encryption may allow the credentials used by Emerson OpenEnterprise, up through version 3.3.5, to access field devices and external systems to be obtained.
CVSS Score: 3.8 (LOW)
CWE: CWE-326, CWE-326
References: https://www.cisa.gov/uscert/ics/advisories/icsa-20-238-02; https://www.cisa.gov/uscert/ics/advisories/icsa-20-238-02
CVE: CVE-2021-32934
Published: 2022-05-19
Description: The affected ThroughTek P2P products (SDKs using versions before 3.1.5, any versions with nossl tag, device firmware not using AuthKey for IOTC conneciton, firmware using AVAPI module without enabling DTLS mechanism, and firmware using P2PTunnel or RDT module) do not sufficiently protect data transferred between the local device and ThroughTek servers. This can allow an attacker to access sensitive information, such as camera feeds.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-319
References: https://www.cisa.gov/uscert/ics/advisories/icsa-21-166-01; https://www.cisa.gov/uscert/ics/advisories/icsa-21-166-01
CVE: CVE-2022-1413
Published: 2022-05-19
Description: Missing input masking in GitLab CE/EE affecting all versions starting from 1.0.2 before 14.8.6, all versions from 14.9.0 before 14.9.4, and all versions from 14.10.0 before 14.10.1 causes potentially sensitive integration properties to be disclosed in the web interface
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-522
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1413.json; https://gitlab.com/gitlab-org/gitlab/-/issues/353720; https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1413.json
CVE: CVE-2022-1416
Published: 2022-05-19
Description: Missing sanitization of data in Pipeline error messages in GitLab CE/EE affecting all versions starting from 1.0.2 before 14.8.6, all versions from 14.9.0 before 14.9.4, and all versions from 14.10.0 before 14.10.1 allows for rendering of attacker controlled HTML tags and CSS styling
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1416.json; https://gitlab.com/gitlab-org/gitlab/-/issues/342988; https://hackerone.com/reports/1362405
CVE: CVE-2022-1423
Published: 2022-05-19
Description: Improper access control in the CI/CD cache mechanism in GitLab CE/EE affecting all versions starting from 1.0.2 before 14.8.6, all versions from 14.9.0 before 14.9.4, and all versions from 14.10.0 before 14.10.1 allows a malicious actor with Developer privileges to perform cache poisoning leading to arbitrary code execution in protected branches
CVSS Score: 7.1 (HIGH)
CWE: CWE-862
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1423.json; https://gitlab.com/gitlab-org/gitlab/-/issues/330047; https://hackerone.com/reports/1182375
CVE: CVE-2022-30617
Published: 2022-05-19
Description: An authenticated user with access to the Strapi admin panel can view private and sensitive data, such as email and password reset tokens, for other admin panel users that have a relationship (e.g., created by, updated by) with content accessible to the authenticated user. For example, a low-privileged “author” role account can view these details in the JSON response for an “editor” or “super admin” that has updated one of the author’s blog posts. There are also many other scenarios where such details from other users can leak in the JSON response, either through a direct or indirect relationship. Access to this information enables a user to compromise other users’ accounts by successfully invoking the password reset workflow. In a worst-case scenario, a low-privileged user could get access to a “super admin” account with full control over the Strapi instance, and could read and modify any data as well as block access to both the admin panel and API by revoking privileges for all other users.
CVSS Score: 8.8 (HIGH)
CWE: CWE-212, CWE-212
References: https://www.synopsys.com/blogs/software-security/cyrc-advisory-strapi; https://www.synopsys.com/blogs/software-security/cyrc-advisory-strapi
CVE: CVE-2022-30618
Published: 2022-05-19
Description: An authenticated user with access to the Strapi admin panel can view private and sensitive data, such as email and password reset tokens, for API users if content types accessible to the authenticated user contain relationships to API users (from:users-permissions). There are many scenarios in which such details from API users can leak in the JSON response within the admin panel, either through a direct or indirect relationship. Access to this information enables a user to compromise these users’ accounts if the password reset API endpoints have been enabled. In a worst-case scenario, a low-privileged user could get access to a high-privileged API account, and could read and modify any data as well as block access to both the admin panel and API by revoking privileges for all other users.
CVSS Score: 7.5 (HIGH)
CWE: CWE-212, CWE-212
References: https://www.synopsys.com/blogs/software-security/cyrc-advisory-strapi; https://www.synopsys.com/blogs/software-security/cyrc-advisory-strapi
CVE: CVE-2022-28946
Published: 2022-05-19
Description: An issue in the component ast/parser.go of Open Policy Agent v0.39.0 causes the application to incorrectly interpret every expression, causing a Denial of Service (DoS) via triggering out-of-range memory access.
CVSS Score: 7.5 (HIGH)
References: https://github.com/open-policy-agent/opa/commit/e9d3828db670cbe11129885f37f08cbf04935264; https://github.com/open-policy-agent/opa/commit/e9d3828db670cbe11129885f37f08cbf04935264
CVE: CVE-2022-28948
Published: 2022-05-19
Description: An issue in the Unmarshal function in Go-Yaml v3 causes the program to crash when attempting to deserialize invalid input.
CVSS Score: 7.5 (HIGH)
CWE: CWE-502
References: https://github.com/go-yaml/yaml/issues/666; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://github.com/go-yaml/yaml/issues/666
CVE: CVE-2022-28959
Published: 2022-05-19
Description: Multiple cross-site scripting (XSS) vulnerabilities in the component /spip.php of Spip Web Framework v3.1.13 and below allows attackers to execute arbitrary web scripts or HTML.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://blog.spip.net/Mise-a-jour-CRITIQUE-de-securite-SPIP-3-2-8-et-SPIP-3-1-13.html; https://github.com/spip/SPIP/commit/0394b44774555ae8331b6e65e35065dfa0bb41e4; https://github.com/spip/SPIP/commit/6c1650713fc948318852ace759aab8f1a84791cf
CVE: CVE-2022-28960
Published: 2022-05-19
Description: A PHP injection vulnerability in Spip before v3.2.8 allows attackers to execute arbitrary PHP code via the _oups parameter at /ecrire.
CVSS Score: 8.8 (HIGH)
CWE: CWE-116
References: https://blog.spip.net/Mise-a-jour-CRITIQUE-de-securite-SPIP-3-2-8-et-SPIP-3-1-13.html; https://github.com/spip/SPIP/commit/0394b44774555ae8331b6e65e35065dfa0bb41e4; https://github.com/spip/SPIP/commit/6c1650713fc948318852ace759aab8f1a84791cf
CVE: CVE-2022-28961
Published: 2022-05-19
Description: Spip Web Framework v3.1.13 and below was discovered to contain multiple SQL injection vulnerabilities at /ecrire via the lier_trad and where parameters.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://blog.spip.net/Mise-a-jour-CRITIQUE-de-securite-SPIP-3-2-8-et-SPIP-3-1-13.html; https://github.com/spip/SPIP/commit/0394b44774555ae8331b6e65e35065dfa0bb41e4; https://github.com/spip/SPIP/commit/6c1650713fc948318852ace759aab8f1a84791cf
CVE: CVE-2022-28962
Published: 2022-05-19
Description: Online Sports Complex Booking System 1.0 is vulnerable to SQL Injection via /scbs/classes/Users.php?f=delete_client.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/playZG/Exploit-/blob/main/Online%20Sports%20Complex%20Booking%20System/Online%20Sports%20Complex%20Booking%20System%201.0%20SQL%20Injection%28%E4%BA%8C%29.md; https://packetstormsecurity.com/files/166598/Online-Sports-Complex-Booking-System-1.0-SQL-Injection.html; https://github.com/playZG/Exploit-/blob/main/Online%20Sports%20Complex%20Booking%20System/Online%20Sports%20Complex%20Booking%20System%201.0%20SQL%20Injection%28%E4%BA%8C%29.md
CVE: CVE-2022-29304
Published: 2022-05-19
Description: Online Sports Complex Booking System 1.0 is vulnerable to SQL Injection via /classes/master.php?f=delete_ Facility.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/playZG/Exploit-/blob/main/Online%20Sports%20Complex%20Booking%20System/Online%20Sports%20Complex%20Booking%20System%201.0%20SQL%20Injection%28%E4%B8%89%29.md; https://github.com/playZG/Exploit-/blob/main/Online%20Sports%20Complex%20Booking%20System/Online%20Sports%20Complex%20Booking%20System%201.0%20SQL%20Injection%28%E4%B8%89%29.md
CVE: CVE-2022-29652
Published: 2022-05-19
Description: Online Sports Complex Booking System 1.0 is vulnerable to SQL Injection via /scbs/classes/Users.php?f=save_client.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-89
References: https://github.com/playZG/Exploit-/blob/main/Online%20Sports%20Complex%20Booking%20System/Online%20Sports%20Complex%20Booking%20System%201.0%20XSS%20loophole.md; https://packetstormsecurity.com/files/166641/Online-Sports-Complex-Booking-System-1.0-Cross-Site-Scripting.html; https://github.com/playZG/Exploit-/blob/main/Online%20Sports%20Complex%20Booking%20System/Online%20Sports%20Complex%20Booking%20System%201.0%20XSS%20loophole.md
CVE: CVE-2020-4107
Published: 2022-05-19
Description: HCL Domino is affected by an Insufficient Access Control vulnerability. An authenticated attacker with local access to the system could exploit this vulnerability to attain escalation of privileges, denial of service, or information disclosure.
CVSS Score: 8.8 (HIGH)
CWE: CWE-284
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0090221; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0090221
CVE: CVE-2022-21500
Published: 2022-05-20
Description: Vulnerability in Oracle E-Business Suite (component: Manage Proxies). The supported version that is affected is 12.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle E-Business Suite. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle E-Business Suite accessible data. Note: Authentication is required for successful attack, however the user may be self-registered. <br> <br>Oracle E-Business Suite 12.1 is not impacted by this vulnerability. Customers should refer to the Patch Availability Document for details. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
CVSS Score: 7.5 (HIGH)
References: https://www.oracle.com/security-alerts/alert-cve-2022-21500.html; https://www.oracle.com/security-alerts/cpujul2022.html; https://www.oracle.com/security-alerts/alert-cve-2022-21500.html
CVE: CVE-2022-28964
Published: 2022-05-20
Description: An arbitrary file write vulnerability in Avast Premium Security before v21.11.2500 (build 21.11.6809.528) allows attackers to cause a Denial of Service (DoS) via a crafted DLL file.
CVSS Score: 7.1 (HIGH)
CWE: CWE-426
References: https://forum.avast.com/index.php?topic=317641.0; https://github.com/netero1010/Vulnerability-Disclosure/tree/main/CVE-2022-AVAST1; https://forum.avast.com/index.php?topic=317641.0
CVE: CVE-2022-28965
Published: 2022-05-20
Description: Multiple DLL hijacking vulnerabilities via the components instup.exe and wsc_proxy.exe in Avast Premium Security before v21.11.2500 allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via a crafted DLL file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-427
References: https://forum.avast.com/index.php?topic=318305.0; https://github.com/netero1010/Vulnerability-Disclosure/tree/main/CVE-2022-AVAST2; https://forum.avast.com/index.php?topic=318305.0
CVE: CVE-2022-28985
Published: 2022-05-20
Description: A stored cross-site scripting (XSS) vulnerability in the addNewPost component of OrangeHRM v4.10.1 allows attackers to execute arbitrary web scripts or HTML via a crafted POST request.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-79
References: https://github.com/orangehrm/orangehrm/issues/1217; https://github.com/orangehrm/orangehrm/issues/1217
CVE: CVE-2021-34111
Published: 2022-05-20
Description: Thecus 4800Eco was discovered to contain a command injection vulnerability via the username parameter in /adm/setmain.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://docs.unsafe-inline.com/0day/thecus-n4800eco-nas-server-control-panel-comand-injection; https://docs.unsafe-inline.com/0day/thecus-n4800eco-nas-server-control-panel-comand-injection
CVE: CVE-2022-28987
Published: 2022-05-20
Description: Zoho ManageEngine ADSelfService Plus before 6202 allows attackers to perform username enumeration via a crafted POST request to /ServletAPI/accounts/login.
CVSS Score: 5.3 (MEDIUM)
References: https://github.com/passtheticket/vulnerability-research/blob/main/manage-engine-apps/adselfservice-userenum.md; https://github.com/passtheticket/vulnerability-research/blob/main/manage-engine-apps/adselfservice-userenum.py; https://www.manageengine.com/products/self-service-password/advisory/CVE-2022-28987.html