deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-23989
Published: 2022-03-15
Description: In Stormshield Network Security (SNS) before 3.7.25, 3.8.x through 3.11.x before 3.11.13, 4.x before 4.2.10, and 4.3.x before 4.3.5, a flood of connections to the SSLVPN service might lead to saturation of the loopback interface. This could result in the blocking of almost all network traffic, making the firewall unreachable. An attacker could exploit this via forged and properly timed traffic to cause a denial of service.
CVSS Score: 7.5 (HIGH)
References: https://advisories.stormshield.eu/2022-003; https://advisories.stormshield.eu/2022-003
CVE: CVE-2022-26206
Published: 2022-03-15
Description: Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU V5.9c.5185_B20201128, and A810R V4.1.2cu.5182_B20201026 were discovered to contain a command injection vulnerability in the function setLanguageCfg, via the langType parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/pjqwudi1/my_vuln/blob/main/totolink/vuln_27/27.md; https://github.com/pjqwudi1/my_vuln/blob/main/totolink/vuln_27/27.md
CVE: CVE-2022-26207
Published: 2022-03-15
Description: Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU V5.9c.5185_B20201128, and A810R V4.1.2cu.5182_B20201026 were discovered to contain a command injection vulnerability in the function setDiagnosisCfg, via the ipDoamin parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/pjqwudi1/my_vuln/blob/main/totolink/vuln_28/28.md; https://github.com/pjqwudi1/my_vuln/blob/main/totolink/vuln_28/28.md
CVE: CVE-2022-26208
Published: 2022-03-15
Description: Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU V5.9c.5185_B20201128, and A810R V4.1.2cu.5182_B20201026 were discovered to contain a command injection vulnerability in the function setWebWlanIdx, via the webWlanIdx parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/pjqwudi1/my_vuln/blob/main/totolink/vuln_22/22.md; https://github.com/pjqwudi1/my_vuln/blob/main/totolink/vuln_22/22.md
CVE: CVE-2022-26209
Published: 2022-03-15
Description: Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU V5.9c.5185_B20201128, and A810R V4.1.2cu.5182_B20201026 were discovered to contain a command injection vulnerability in the function setUploadSetting, via the FileName parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/pjqwudi1/my_vuln/blob/main/totolink/vuln_24/24.md; https://github.com/pjqwudi1/my_vuln/blob/main/totolink/vuln_24/24.md
CVE: CVE-2022-26210
Published: 2022-03-15
Description: Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU V5.9c.5185_B20201128, and A810R V4.1.2cu.5182_B20201026 were discovered to contain a command injection vulnerability in the function setUpgradeFW, via the FileName parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/pjqwudi1/my_vuln/blob/main/totolink/vuln_23/23.md; https://github.com/pjqwudi1/my_vuln/blob/main/totolink/vuln_23/23.md
CVE: CVE-2022-26211
Published: 2022-03-15
Description: Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU V5.9c.5185_B20201128, and A810R V4.1.2cu.5182_B20201026 were discovered to contain a command injection vulnerability in the function CloudACMunualUpdate, via the deviceMac and deviceName parameters. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/pjqwudi1/my_vuln/blob/main/totolink/vuln_25/25.md; https://github.com/pjqwudi1/my_vuln/blob/main/totolink/vuln_25/25.md
CVE: CVE-2022-26212
Published: 2022-03-15
Description: Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU V5.9c.5185_B20201128, and A810R V4.1.2cu.5182_B20201026 were discovered to contain a command injection vulnerability in the function setDeviceName, via the deviceMac and deviceName parameters. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/pjqwudi1/my_vuln/blob/main/totolink/vuln_26/26.md; https://github.com/pjqwudi1/my_vuln/blob/main/totolink/vuln_26/26.md
CVE: CVE-2022-26213
Published: 2022-03-15
Description: Totolink X5000R_Firmware v9.1.0u.6118_B20201102 was discovered to contain a command injection vulnerability in the function setNtpCfg, via the tz parameters. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/pjqwudi1/my_vuln/blob/main/totolink/vuln_21/21.md; https://github.com/pjqwudi1/my_vuln/blob/main/totolink/vuln_21/21.md
CVE: CVE-2022-26214
Published: 2022-03-15
Description: Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU V5.9c.5185_B20201128, and A810R V4.1.2cu.5182_B20201026 were discovered to contain a command injection vulnerability in the function NTPSyncWithHost. This vulnerability allows attackers to execute arbitrary commands via the host_time parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/pjqwudi1/my_vuln/blob/main/totolink/vuln_29/29.md; https://github.com/pjqwudi1/my_vuln/blob/main/totolink/vuln_29/29.md
CVE: CVE-2022-26990
Published: 2022-03-15
Description: Arris routers SBR-AC1900P 1.0.7-B05, SBR-AC3200P 1.0.7-B05 and SBR-AC1200P 1.0.5-B05 were discovered to contain a command injection vulnerability in the firewall-local log function via the EmailAddress, SmtpServerName, SmtpUsername, and SmtpPassword parameters. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/wudipjq/my_vuln/blob/main/ARRIS/vuln_2/2.md; https://github.com/wudipjq/my_vuln/blob/main/ARRIS/vuln_2/2.md
CVE: CVE-2022-26991
Published: 2022-03-15
Description: Arris routers SBR-AC1900P 1.0.7-B05, SBR-AC3200P 1.0.7-B05 and SBR-AC1200P 1.0.5-B05 were discovered to contain a command injection vulnerability in the ntp function via the TimeZone parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/wudipjq/my_vuln/blob/main/ARRIS/vuln_6/6.md; https://github.com/wudipjq/my_vuln/blob/main/ARRIS/vuln_6/6.md
CVE: CVE-2022-26992
Published: 2022-03-15
Description: Arris routers SBR-AC1900P 1.0.7-B05, SBR-AC3200P 1.0.7-B05 and SBR-AC1200P 1.0.5-B05 were discovered to contain a command injection vulnerability in the ddns function via the DdnsUserName, DdnsHostName, and DdnsPassword parameters. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/wudipjq/my_vuln/blob/main/ARRIS/vuln_3/3.md; https://github.com/wudipjq/my_vuln/blob/main/ARRIS/vuln_3/3.md
CVE: CVE-2022-26993
Published: 2022-03-15
Description: Arris routers SBR-AC1900P 1.0.7-B05, SBR-AC3200P 1.0.7-B05 and SBR-AC1200P 1.0.5-B05 were discovered to contain a command injection vulnerability in the pppoe function via the pppoeUserName, pppoePassword, and pppoe_Service parameters. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/wudipjq/my_vuln/blob/main/ARRIS/vuln_4/4.md; https://github.com/wudipjq/my_vuln/blob/main/ARRIS/vuln_4/4.md
CVE: CVE-2022-26994
Published: 2022-03-15
Description: Arris routers SBR-AC1900P 1.0.7-B05, SBR-AC3200P 1.0.7-B05 and SBR-AC1200P 1.0.5-B05 were discovered to contain a command injection vulnerability in the pptp function via the pptpUserName and pptpPassword parameters. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/wudipjq/my_vuln/blob/main/ARRIS/vuln_5/5.md; https://github.com/wudipjq/my_vuln/blob/main/ARRIS/vuln_5/5.md
CVE: CVE-2022-26995
Published: 2022-03-15
Description: Arris TR3300 v1.0.13 was discovered to contain a command injection vulnerability in the pptp (wan_pptp.html) function via the pptp_fix_ip, pptp_fix_mask, pptp_fix_gw, and wan_dns1_stat parameters. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://github.com/wudipjq/my_vuln/blob/main/ARRIS/vuln_14/14.md; https://github.com/wudipjq/my_vuln/blob/main/ARRIS/vuln_14/14.md
CVE: CVE-2022-26996
Published: 2022-03-15
Description: Arris TR3300 v1.0.13 was discovered to contain a command injection vulnerability in the pppoe function via the pppoe_username, pppoe_passwd, and pppoe_servicename parameters. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://github.com/wudipjq/my_vuln/blob/main/ARRIS/vuln_13/13.md; https://github.com/wudipjq/my_vuln/blob/main/ARRIS/vuln_13/13.md
CVE: CVE-2022-26997
Published: 2022-03-15
Description: Arris TR3300 v1.0.13 was discovered to contain a command injection vulnerability in the upnp function via the upnp_ttl parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://github.com/wudipjq/my_vuln/blob/main/ARRIS/vuln_9/9.md; https://github.com/wudipjq/my_vuln/blob/main/ARRIS/vuln_9/9.md
CVE: CVE-2022-26998
Published: 2022-03-15
Description: Arris TR3300 v1.0.13 was discovered to contain a command injection vulnerability in the wps setting function via the wps_enrolee_pin parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://github.com/wudipjq/my_vuln/blob/main/ARRIS/vuln_11/11.md; https://github.com/wudipjq/my_vuln/blob/main/ARRIS/vuln_11/11.md
CVE: CVE-2022-26999
Published: 2022-03-15
Description: Arris TR3300 v1.0.13 was discovered to contain a command injection vulnerability in the static ip settings function via the wan_ip_stat, wan_mask_stat, wan_gw_stat, and wan_dns1_stat parameters. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://github.com/wudipjq/my_vuln/blob/main/ARRIS/vuln_8/8.md; https://github.com/wudipjq/my_vuln/blob/main/ARRIS/vuln_8/8.md
CVE: CVE-2022-27000
Published: 2022-03-15
Description: Arris TR3300 v1.0.13 was discovered to contain a command injection vulnerability in the time and time zone function via the h_primary_ntp_server, h_backup_ntp_server, and h_time_zone parameters. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://github.com/wudipjq/my_vuln/blob/main/ARRIS/vuln_12/12.md; https://github.com/wudipjq/my_vuln/blob/main/ARRIS/vuln_12/12.md
CVE: CVE-2022-27001
Published: 2022-03-15
Description: Arris TR3300 v1.0.13 were discovered to contain a command injection vulnerability in the dhcp function via the hostname parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://github.com/wudipjq/my_vuln/blob/main/ARRIS/vuln_7/7.md; https://github.com/wudipjq/my_vuln/blob/main/ARRIS/vuln_7/7.md
CVE: CVE-2022-27002
Published: 2022-03-15
Description: Arris TR3300 v1.0.13 were discovered to contain a command injection vulnerability in the ddns function via the ddns_name, ddns_pwd, h_ddns、ddns_host parameters. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://github.com/wudipjq/my_vuln/blob/main/ARRIS/vuln_10/10.md; https://github.com/wudipjq/my_vuln/blob/main/ARRIS/vuln_10/10.md
CVE: CVE-2022-27003
Published: 2022-03-15
Description: Totolink routers s X5000R V9.1.0u.6118_B20201102 and A7000R V9.1.0u.6115_B20201022 were discovered to contain a command injection vulnerability in the Tunnel 6rd function via the relay6rd parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://github.com/wudipjq/my_vuln/blob/main/totolink/vuln_32/32.md; https://github.com/wudipjq/my_vuln/blob/main/totolink/vuln_32/32.md
CVE: CVE-2022-27004
Published: 2022-03-15
Description: Totolink routers s X5000R V9.1.0u.6118_B20201102 and A7000R V9.1.0u.6115_B20201022 were discovered to contain a command injection vulnerability in the Tunnel 6in4 function via the remote6in4 parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://github.com/wudipjq/my_vuln/blob/main/totolink/vuln_31/31.md; https://github.com/wudipjq/my_vuln/blob/main/totolink/vuln_31/31.md
CVE: CVE-2022-27005
Published: 2022-03-15
Description: Totolink routers s X5000R V9.1.0u.6118_B20201102 and A7000R V9.1.0u.6115_B20201022 were discovered to contain a command injection vulnerability in the setWanCfg function via the hostName parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://github.com/wudipjq/my_vuln/blob/main/totolink/vuln_30/30.md; https://github.com/wudipjq/my_vuln/blob/main/totolink/vuln_30/30.md
CVE: CVE-2020-36519
Published: 2022-03-16
Description: Mimecast Email Security before 2020-01-10 allows any admin to spoof any domain, and pass DMARC alignment via SPF. This occurs through misuse of the address rewrite feature. (The domain being spoofed must be a customer in the Mimecast grid from which the spoofing occurs.)
CVSS Score: 4.9 (MEDIUM)
References: https://wesleyk.me/2020/01/10/my-first-vulnerability-mimecast-sender-address-verification/; https://wesleyk.me/2020/01/10/my-first-vulnerability-mimecast-sender-address-verification/
CVE: CVE-2022-27223
Published: 2022-03-16
Description: In drivers/usb/gadget/udc/udc-xilinx.c in the Linux kernel before 5.16.12, the endpoint index is not validated and might be manipulated by the host for out-of-array access.
CVSS Score: 8.8 (HIGH)
CWE: CWE-129
References: https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.16.12; https://github.com/torvalds/linux/commit/7f14c7227f342d9932f9b918893c8814f86d2a0d; https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html
CVE: CVE-2021-43955
Published: 2022-03-16
Description: The /rest-service-fecru/server-v1 resource in Fisheye and Crucible before version 4.8.9 allowed authenticated remote attackers to obtain information about installation directories via information disclosure vulnerability.
CVSS Score: 4.3 (MEDIUM)
References: https://jira.atlassian.com/browse/CRUC-8533; https://jira.atlassian.com/browse/FE-7397; https://jira.atlassian.com/browse/CRUC-8533
CVE: CVE-2021-43956
Published: 2022-03-16
Description: The jQuery deserialize library in Fisheye and Crucible before version 4.8.9 allowed remote attackers to to inject arbitrary HTML and/or JavaScript via a prototype pollution vulnerability.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-1321
References: https://jira.atlassian.com/browse/CRUC-8531; https://jira.atlassian.com/browse/FE-7395; https://jira.atlassian.com/browse/CRUC-8531
CVE: CVE-2021-43957
Published: 2022-03-16
Description: Affected versions of Atlassian Fisheye & Crucible allowed remote attackers to browse local files via an Insecure Direct Object References (IDOR) vulnerability in the WEB-INF directory and bypass the fix for CVE-2020-29446 due to a lack of url decoding. The affected versions are before version 4.8.9.
CVSS Score: 7.5 (HIGH)
CWE: CWE-639, CWE-639
References: https://jira.atlassian.com/browse/CRUC-8524; https://jira.atlassian.com/browse/FE-7388; https://jira.atlassian.com/browse/CRUC-8524
CVE: CVE-2021-43958
Published: 2022-03-16
Description: Various rest resources in Fisheye and Crucible before version 4.8.9 allowed remote attackers to brute force user login credentials as rest resources did not check if users were beyond their max failed login limits and therefore required solving a CAPTCHA in addition to providing user credentials for authentication via a improper restriction of excess authentication attempts vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-307, CWE-307
References: https://jira.atlassian.com/browse/CRUC-8523; https://jira.atlassian.com/browse/FE-7387; https://jira.atlassian.com/browse/CRUC-8523
CVE: CVE-2022-27225
Published: 2022-03-16
Description: Gradle Enterprise before 2021.4.3 relies on cleartext data transmission in some situations. It uses Keycloak for identity management services. During the sign-in process, Keycloak sets browser cookies that effectively provide remember-me functionality. For backwards compatibility with older Safari versions, Keycloak sets a duplicate of the cookie without the Secure attribute, which allows the cookie to be sent when accessing the location that cookie is set for via HTTP. This creates the potential for an attacker (with the ability to impersonate the Gradle Enterprise host) to capture the login session of a user by having them click an http:// link to the server, despite the real server requiring HTTPS.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-311
References: https://security.gradle.com/advisory/2022-03; https://security.gradle.com/advisory/2022-03
CVE: CVE-2022-0911
Published: 2022-03-16
Description: Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.4.0.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/pimcore/pimcore/commit/6e0922c5b2959ac1b48500ac508d8fc5a97286f9; https://huntr.dev/bounties/b242edb1-b036-4dca-9b53-891494dd7a77; https://github.com/pimcore/pimcore/commit/6e0922c5b2959ac1b48500ac508d8fc5a97286f9
CVE: CVE-2021-45851
Published: 2022-03-16
Description: A Server-Side Request Forgery (SSRF) attack in FUXA 1.1.3 can be carried out leading to the obtaining of sensitive information from the server's internal environment and services, often potentially leading to the attacker executing commands on the server.
CVSS Score: 7.5 (HIGH)
CWE: CWE-918
References: https://www.youtube.com/watch?v=JE1Kcq3iJpc; https://www.youtube.com/watch?v=JE1Kcq3iJpc
CVE: CVE-2021-45852
Published: 2022-03-16
Description: An issue was discovered in Projectworlds Hospital Management System v1.0. Unauthorized malicious attackers can add patients without restriction via add_patient.php.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-670
References: https://github.com/projectworldsofficial/hospital-management-system-in-php/issues/6; https://github.com/projectworldsofficial/hospital-management-system-in-php/issues/6
CVE: CVE-2021-46705
Published: 2022-03-16
Description: A Insecure Temporary File vulnerability in grub-once of grub2 in SUSE Linux Enterprise Server 15 SP4, openSUSE Factory allows local attackers to truncate arbitrary files. This issue affects: SUSE Linux Enterprise Server 15 SP4 grub2 versions prior to 2.06-150400.7.1. SUSE openSUSE Factory grub2 versions prior to 2.06-18.1.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-377
References: https://bugzilla.suse.com/show_bug.cgi?id=1190474; https://bugzilla.suse.com/show_bug.cgi?id=1190474
CVE: CVE-2022-0704
Published: 2022-03-16
Description: Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.4.0.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/pimcore/pimcore/commit/6e0922c5b2959ac1b48500ac508d8fc5a97286f9; https://huntr.dev/bounties/4142a8b4-b439-4328-aaa3-52f6fedfd0a6; https://github.com/pimcore/pimcore/commit/6e0922c5b2959ac1b48500ac508d8fc5a97286f9
CVE: CVE-2022-21945
Published: 2022-03-16
Description: A Insecure Temporary File vulnerability in cscreen of openSUSE Factory allows local attackers to cause DoS for cscreen and a system DoS for non-default systems. This issue affects: openSUSE Factory cscreen version 1.2-1.3 and prior versions.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-377
References: https://bugzilla.suse.com/show_bug.cgi?id=1196446; https://bugzilla.suse.com/show_bug.cgi?id=1196446
CVE: CVE-2022-21946
Published: 2022-03-16
Description: A Incorrect Permission Assignment for Critical Resource vulnerability in the sudoers configuration in cscreen of openSUSE Factory allows any local users to gain the privileges of the tty and dialout groups and access and manipulate any running cscreen seesion. This issue affects: openSUSE Factory cscreen version 1.2-1.3 and prior versions.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-732, CWE-732
References: https://bugzilla.suse.com/show_bug.cgi?id=1196451; https://bugzilla.suse.com/show_bug.cgi?id=1196451
CVE: CVE-2022-0705
Published: 2022-03-16
Description: Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.4.0.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/pimcore/pimcore/commit/6e0922c5b2959ac1b48500ac508d8fc5a97286f9; https://huntr.dev/bounties/0e1b6836-e5b5-4e47-b9ab-2f6a4790ee7b; https://github.com/pimcore/pimcore/commit/6e0922c5b2959ac1b48500ac508d8fc5a97286f9
CVE: CVE-2021-42552
Published: 2022-03-16
Description: Cross-site Scripting (XSS) vulnerability in ArchivistaBox webclient allows an attacker to craft a malicious link, executing JavaScript in the context of a victim's browser. This issue affects all ArchivistaBox versions prior to 2022/I.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://it-sec.de/schwachstelle-in-archivista-dms/; https://it-sec.de/schwachstelle-in-archivista-dms/
CVE: CVE-2021-45786
Published: 2022-03-16
Description: In maccms v10, an attacker can log in through /index.php/user/login in the "col" and "openid" parameters to gain privileges.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://github.com/magicblack/maccms10/issues/747; https://github.com/magicblack/maccms10/issues/747
CVE: CVE-2021-45787
Published: 2022-03-16
Description: There is a stored Cross Site Scripting (XSS) vulnerability in maccms v10 through adding videos. XSS code can be inserted at parameter positions including name and remarks.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/magicblack/maccms10/issues/746; https://github.com/magicblack/maccms10/issues/746
CVE: CVE-2022-0986
Published: 2022-03-16
Description: Reflected Cross-site Scripting (XSS) Vulnerability in GitHub repository hestiacp/hestiacp prior to 1.5.11.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/hestiacp/hestiacp/commit/fd42196718a6fa7fe17b37fab0933d3cbcb3db0d; https://huntr.dev/bounties/57635c78-303f-412f-b75a-623df9fa9edd; https://github.com/hestiacp/hestiacp/commit/fd42196718a6fa7fe17b37fab0933d3cbcb3db0d