deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-22948
Published: 2022-03-29
Description: The vCenter Server contains an information disclosure vulnerability due to improper permission of files. A malicious actor with non-administrative access to the vCenter Server may exploit this issue to gain access to sensitive information.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-276, CWE-276
References: https://www.vmware.com/security/advisories/VMSA-2022-0009.html; https://www.vmware.com/security/advisories/VMSA-2022-0009.html; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-22948
CVE: CVE-2021-42911
Published: 2022-03-29
Description: A Format String vulnerability exists in DrayTek Vigor 2960 <= 1.5.1.3, DrayTek Vigor 3900 <= 1.5.1.3, and DrayTek Vigor 300B <= 1.5.1.3 in the mainfunction.cgi file via a crafted HTTP message containing malformed QUERY STRING, which could let a remote malicious user execute arbitrary code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-134
References: https://gist.github.com/Cossack9989/e9c1c2d2e69b773ca4251acdd77f2835; https://gist.github.com/Cossack9989/e9c1c2d2e69b773ca4251acdd77f2835
CVE: CVE-2021-43118
Published: 2022-03-29
Description: A Remote Command Injection vulnerability exists in DrayTek Vigor 2960 1.5.1.3, DrayTek Vigor 3900 1.5.1.3, and DrayTek Vigor 300B 1.5.1.3 via a crafted HTTP message containing malformed QUERY STRING in mainfunction.cgi, which could let a remote malicious user execute arbitrary code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://gist.github.com/Cossack9989/6034c077f46e4f06d0992e9f2fae7f26; https://gist.github.com/Cossack9989/6034c077f46e4f06d0992e9f2fae7f26
CVE: CVE-2022-21821
Published: 2022-03-29
Description: NVIDIA CUDA Toolkit SDK contains an integer overflow vulnerability in cuobjdump.To exploit this vulnerability, a remote attacker would require a local user to download a specially crafted, corrupted file and locally execute cuobjdump against the file. Such an attack may lead to remote code execution that causes complete denial of service and an impact on data confidentiality and integrity.
CVSS Score: 7.8 (HIGH)
CWE: CWE-1285, CWE-190
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5334; https://nvidia.custhelp.com/app/answers/detail/a_id/5334
CVE: CVE-2022-26871
Published: 2022-03-29
Description: An arbitrary file upload vulnerability in Trend Micro Apex Central could allow an unauthenticated remote attacker to upload an arbitrary file which could lead to remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-345, CWE-345
References: https://appweb.trendmicro.com/supportNews/NewsDetail.aspx?id=4435; https://jvn.jp/vu/JVNVU99107357; https://success.trendmicro.com/jp/solution/000290660
CVE: CVE-2021-44082
Published: 2022-03-29
Description: textpattern 4.8.7 is vulnerable to Cross Site Scripting (XSS) via /textpattern/index.php,Body. A remote and unauthenticated attacker can use XSS to trigger remote code execution by uploading a webshell. To do so they must first steal the CSRF token before submitting a file upload request.
CVSS Score: 8.3 (HIGH)
CWE: CWE-79
References: https://pentest.co.uk/labs/leveraging-xss-to-get-rce-in-textpattern/; https://www.cornerpirate.com; https://www.pentest.co.uk
CVE: CVE-2015-3298
Published: 2022-03-30
Description: Yubico ykneo-openpgp before 1.0.10 has a typo in which an invalid PIN can be used. When first powered up, a signature will be issued even though the PIN has not been validated.
CVSS Score: 8.8 (HIGH)
CWE: CWE-347
References: https://developers.yubico.com/ykneo-openpgp/SecurityAdvisory%202015-04-14.html; https://developers.yubico.com/ykneo-openpgp/SecurityAdvisory%202015-04-14.html
CVE: CVE-2021-41594
Published: 2022-03-30
Description: In RSA Archer 6.9.SP1 P3, if some application functions are precluded by the Administrator, this can be bypassed by intercepting the API request at the /api/V2/internal/TaskPermissions/CheckTaskAccess endpoint. If the parameters of this request are replaced with empty fields, the attacker achieves access to the precluded functions.
CVSS Score: 6.5 (MEDIUM)
References: https://www.archerirm.community/t5/security-advisories/archer-an-rsa-business-update-for-multiple-vulnerabilities/ta-p/674497; https://www.rsa.com/en-us/company/vulnerability-response-policy; https://www.archerirm.community/t5/security-advisories/archer-an-rsa-business-update-for-multiple-vulnerabilities/ta-p/674497
CVE: CVE-2022-26244
Published: 2022-03-30
Description: A stored cross-site scripting (XSS) vulnerability in Hospital Patient Record Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the "special" field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://hospital.com; https://github.com/kishan0725/Hospital-Management-System/issues/23; http://hospital.com
CVE: CVE-2022-26947
Published: 2022-03-30
Description: Archer 6.x through 6.9 SP3 (6.9.3.0) contains a reflected XSS vulnerability. A remote authenticated malicious Archer user could potentially exploit this vulnerability by tricking a victim application user into supplying malicious HTML or JavaScript code to the vulnerable web application; the malicious code is then reflected back to the victim and gets executed by the web browser in the context of the vulnerable web application.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-79
References: https://www.archerirm.community/t5/general-support-information/tkb-p/information-support; https://www.archerirm.community/t5/security-advisories/archer-an-rsa-business-update-for-multiple-vulnerabilities/ta-p/674497; https://www.archerirm.community/t5/general-support-information/tkb-p/information-support
CVE: CVE-2022-26948
Published: 2022-03-30
Description: The Archer RSS feed integration for Archer 6.x through 6.9 SP1 (6.9.1.0) is affected by an insecure credential storage vulnerability. A malicious attacker may obtain access to credential information to use it in further attacks.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-522
References: https://www.archerirm.community/t5/general-support-information/tkb-p/information-support; https://www.archerirm.community/t5/security-advisories/archer-an-rsa-business-update-for-multiple-vulnerabilities/ta-p/674497; https://www.archerirm.community/t5/general-support-information/tkb-p/information-support
CVE: CVE-2022-26949
Published: 2022-03-30
Description: Archer 6.x through 6.9 SP2 P1 (6.9.2.1) contains an improper access control vulnerability on attachments. A remote authenticated malicious user could potentially exploit this vulnerability to gain access to files that should only be allowed by extra privileges.
CVSS Score: 5.3 (MEDIUM)
References: https://www.archerirm.community/t5/general-support-information/tkb-p/information-support; https://www.archerirm.community/t5/security-advisories/archer-an-rsa-business-update-for-multiple-vulnerabilities/ta-p/674497; https://www.archerirm.community/t5/general-support-information/tkb-p/information-support
CVE: CVE-2022-26950
Published: 2022-03-30
Description: Archer 6.x through 6.9 P2 (6.9.0.2) is affected by an open redirect vulnerability. A remote unprivileged attacker may potentially redirect legitimate users to arbitrary web sites and conduct phishing attacks. The attacker could then steal the victims' credentials and silently authenticate them to the Archer application without the victims realizing an attack occurred.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-601
References: https://www.archerirm.community/t5/general-support-information/tkb-p/information-support; https://www.archerirm.community/t5/security-advisories/archer-an-rsa-business-update-for-multiple-vulnerabilities/ta-p/674497; https://www.archerirm.community/t5/general-support-information/tkb-p/information-support
CVE: CVE-2022-26951
Published: 2022-03-30
Description: Archer 6.x through 6.10 (6.10.0.0) contains a reflected XSS vulnerability. A remote SAML-unauthenticated malicious Archer user could potentially exploit this vulnerability by tricking a victim application user into supplying malicious HTML or JavaScript code to the vulnerable web application; the malicious code is then reflected back to the victim and gets executed by the web browser in the context of the vulnerable web application.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://www.archerirm.community/t5/general-support-information/tkb-p/information-support; https://www.archerirm.community/t5/security-advisories/archer-an-rsa-business-update-for-multiple-vulnerabilities/ta-p/674497; https://www.archerirm.community/t5/general-support-information/tkb-p/information-support
CVE: CVE-2022-27432
Published: 2022-03-30
Description: A Cross-Site Request Forgery (CSRF) in Pluck CMS v4.7.15 allows attackers to change the password of any given user by exploiting this feature leading to account takeover.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://owasp.org/www-community/attacks/csrf; https://www.exploit-db.com/exploits/50831; https://owasp.org/www-community/attacks/csrf
CVE: CVE-2022-27815
Published: 2022-03-30
Description: SWHKD 1.1.5 unsafely uses the /tmp/swhkd.pid pathname. There can be an information leak or denial of service.
CVSS Score: 7.8 (HIGH)
CWE: CWE-59
References: http://www.openwall.com/lists/oss-security/2022/04/14/1; https://github.com/waycrate/swhkd/commit/e661a4940df78fbb7b52c622ac4ae6a3a7f7d8aa; https://github.com/waycrate/swhkd/releases
CVE: CVE-2020-24769
Published: 2022-03-30
Description: SQL injection vulnerability in takeconfirm.php in NexusPHP 1.5 allows remote attackers to execute arbitrary SQL commands via the classes parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/burpheart/CVE/2020-08-13-01.md; https://github.com/burpheart/CVE/blob/master/2020-08-13-01.md; https://nexusphp.org/2021/02/03/nexusphp-v1-6-0-beta2/
CVE: CVE-2020-24770
Published: 2022-03-30
Description: SQL injection vulnerability in modrules.php in NexusPHP 1.5 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/burpheart/CVE/2020-08-13-02.md; https://github.com/burpheart/CVE/blob/master/2020-08-13-02.md; https://nexusphp.org/2021/02/03/nexusphp-v1-6-0-beta2/
CVE: CVE-2020-24771
Published: 2022-03-30
Description: Incorrect access control in NexusPHP 1.5.beta5.20120707 allows unauthorized attackers to access published content.
CVSS Score: 7.5 (HIGH)
CWE: CWE-863
References: https://cwe.mitre.org/data/definitions/306.html; https://github.com/burpheart/CVE/blob/master/2020-08-13-03.md; https://nexusphp.org/2021/02/03/nexusphp-v1-6-0-beta2/
CVE: CVE-2022-24693
Published: 2022-03-30
Description: Baicells Nova436Q and Neutrino 430 devices with firmware through QRTB 2.7.8 have hardcoded credentials that are easily discovered, and can be used by remote attackers to authenticate via ssh. (The credentials are stored in the firmware, encrypted by the crypt function.)
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://github.com/lukejenkins/CVE-2022-24693; https://img.baicells.com/Upload/20210909/FILE/98d2752f-6e83-49b1-9dab-d291e9023db6.pdf; https://na.baicells.com/Service/Firmware
CVE: CVE-2022-27816
Published: 2022-03-30
Description: SWHKD 1.1.5 unsafely uses the /tmp/swhks.pid pathname. There can be data loss or a denial of service.
CVSS Score: 7.1 (HIGH)
CWE: CWE-59
References: http://www.openwall.com/lists/oss-security/2022/04/14/1; https://github.com/waycrate/swhkd/commit/0b620a09605afb815c6d8d8953bbb7a10a8c0575; https://github.com/waycrate/swhkd/releases
CVE: CVE-2022-28202
Published: 2022-03-30
Description: An XSS issue was discovered in MediaWiki before 1.35.6, 1.36.x before 1.36.4, and 1.37.x before 1.37.2. The widthheight, widthheightpage, and nbytes properties of messages are not escaped when used in galleries or Special:RevisionDelete.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://lists.debian.org/debian-lts-announce/2022/09/msg00027.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PT4CHJKOQOVMI65TSNZRNV6FIWU7SGZD/; https://phabricator.wikimedia.org/T297543
CVE: CVE-2022-1163
Published: 2022-03-30
Description: Cross-site Scripting (XSS) - Stored in GitHub repository mineweb/minewebcms prior to next.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/166629/minewebcms-1.15.2-Cross-Site-Scripting.html; https://github.com/mineweb/minewebcms/commit/06ce52c20f208b0bbf24c6480d60332c9dd19428; https://huntr.dev/bounties/44d40f34-c391-40c0-a517-12a2c0258149
CVE: CVE-2022-28205
Published: 2022-03-30
Description: An issue was discovered in MediaWiki through 1.37.1. The CentralAuth extension mishandles a ttl issue for groups expiring in the future.
CVSS Score: 9.8 (CRITICAL)
References: https://gerrit.wikimedia.org/r/q/Ic6ba1a37b78df5b342ceeba4c1493dbde583b81f; https://phabricator.wikimedia.org/T302248; https://security.gentoo.org/glsa/202305-24
CVE: CVE-2022-28206
Published: 2022-03-30
Description: An issue was discovered in MediaWiki through 1.37.1. ImportPlanValidator.php in the FileImporter extension mishandles the check for edit rights.
CVSS Score: 9.8 (CRITICAL)
References: https://gerrit.wikimedia.org/r/q/I84be9cd3639b8ab0e037a4ec2d3f2f478f0989c5; https://phabricator.wikimedia.org/T294256; https://security.gentoo.org/glsa/202305-24
CVE: CVE-2022-28209
Published: 2022-03-30
Description: An issue was discovered in Mediawiki through 1.37.1. The check for the override-antispoof permission in the AntiSpoof extension is incorrect.
CVSS Score: 9.8 (CRITICAL)
References: https://gerrit.wikimedia.org/r/q/Id8c4e2e336695ce70ccdf8a51ad729bf4a99f8f7; https://phabricator.wikimedia.org/T304126; https://security.gentoo.org/glsa/202305-24
CVE: CVE-2022-1172
Published: 2022-03-30
Description: Null Pointer Dereference Caused Segmentation Fault in GitHub repository gpac/gpac prior to 2.1.0-DEV.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-476
References: https://github.com/gpac/gpac/commit/55a183e6b8602369c04ea3836e05436a79fbc7f8; https://huntr.dev/bounties/a26cb79c-9257-4fbf-98c5-a5a331efa264; https://github.com/gpac/gpac/commit/55a183e6b8602369c04ea3836e05436a79fbc7f8
CVE: CVE-2022-25598
Published: 2022-03-30
Description: Apache DolphinScheduler user registration is vulnerable to Regular express Denial of Service (ReDoS) attacks, Apache DolphinScheduler users should upgrade to version 2.0.5 or higher.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1333, CWE-1333
References: https://lists.apache.org/thread/hwnw7xr969sg5nv84wz75nfr2c76fl93; https://lists.apache.org/thread/hwnw7xr969sg5nv84wz75nfr2c76fl93
CVE: CVE-2022-1177
Published: 2022-03-30
Description: Accounting User Can Download Patient Reports in openemr in GitHub repository openemr/openemr prior to 6.1.0.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-1220, CWE-863
References: https://github.com/openemr/openemr/commit/a2e918abcf15f9fc1f7cb4a1f2b09ff019021175; https://huntr.dev/bounties/0bb2979b-9643-4cdf-ab58-4354976b481b; https://github.com/openemr/openemr/commit/a2e918abcf15f9fc1f7cb4a1f2b09ff019021175
CVE: CVE-2022-23868
Published: 2022-03-30
Description: RuoYi v4.7.2 contains a CSV injection vulnerability through ruoyi-admin when a victim opens .xlsx log file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-1236
References: https://gitee.com/y_project/RuoYi/issues/I4RBBD; https://gitee.com/y_project/RuoYi/issues/I4RBBD
CVE: CVE-2022-23869
Published: 2022-03-30
Description: In RuoYi v4.7.2 through the WebUI, user test1 does not have permission to reset the password of user test3, but the password of user test3 can be reset through the /system/user/resetPwd request.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-732
References: https://gitee.com/y_project/RuoYi/issues/I4RCO2; https://gitee.com/y_project/RuoYi/issues/I4RCO2
CVE: CVE-2022-1154
Published: 2022-03-30
Description: Use after free in utf_ptr2char in GitHub repository vim/vim prior to 8.2.4646.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://github.com/vim/vim/commit/b55986c52d4cd88a22d0b0b0e8a79547ba13e1d5; https://huntr.dev/bounties/7f0ec6bc-ea0e-45b0-8128-caac72d23425; https://lists.debian.org/debian-lts-announce/2022/05/msg00022.html
CVE: CVE-2022-1178
Published: 2022-03-30
Description: Stored Cross Site Scripting in GitHub repository openemr/openemr prior to 6.0.0.4.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/openemr/openemr/commit/347ad[PII_REDACTED]35d188ba14427bc162419778c; https://huntr.dev/bounties/5813bd1f-b3aa-44f3-a5c0-aeeee2bf6fa4; https://github.com/openemr/openemr/commit/347ad[PII_REDACTED]35d188ba14427bc162419778c
CVE: CVE-2022-1179
Published: 2022-03-30
Description: Non-Privilege User Can Created New Rule and Lead to Stored Cross Site Scripting in GitHub repository openemr/openemr prior to 6.0.0.4.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/openemr/openemr/commit/347ad[PII_REDACTED]35d188ba14427bc162419778c; https://huntr.dev/bounties/8025e31f-7dcf-4db9-ab07-06c1e055ab42; https://github.com/openemr/openemr/commit/347ad[PII_REDACTED]35d188ba14427bc162419778c
CVE: CVE-2022-1180
Published: 2022-03-30
Description: Reflected Cross Site Scripting in GitHub repository openemr/openemr prior to 6.0.0.4.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/openemr/openemr/commit/347ad[PII_REDACTED]35d188ba14427bc162419778c; https://huntr.dev/bounties/0e281ea2-70f7-4ed7-8814-74502eff9dd5; https://github.com/openemr/openemr/commit/347ad[PII_REDACTED]35d188ba14427bc162419778c
CVE: CVE-2022-1181
Published: 2022-03-30
Description: Stored Cross Site Scripting in GitHub repository openemr/openemr prior to 6.0.0.2.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/openemr/openemr/commit/2835cc397610fc28037302dad948c38fda032022; https://huntr.dev/bounties/2534e0fb-f503-4a4b-aed1-ec448c98bf60; https://github.com/openemr/openemr/commit/2835cc397610fc28037302dad948c38fda032022
CVE: CVE-2022-24131
Published: 2022-03-30
Description: DouPHP v1.6 Release 20220121 is affected by Cross Site Scripting (XSS) through /admin/login.php in the background, which will lead to JavaScript code execution.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/zpxlz/douphp; https://github.com/zpxlz/douphp
CVE: CVE-2022-1155
Published: 2022-03-30
Description: Old sessions are not blocked by the login enable function. in GitHub repository snipe/snipe-it prior to 5.3.10.
CVSS Score: 7.4 (HIGH)
CWE: CWE-840
References: https://github.com/snipe/snipe-it/commit/bdabbbd4e98e88ee01e728ceb4fd512661fbd38d; https://huntr.dev/bounties/ebc26354-2414-4f72-88aa-f044aec2b2e1; https://github.com/snipe/snipe-it/commit/bdabbbd4e98e88ee01e728ceb4fd512661fbd38d
CVE: CVE-2022-25619
Published: 2022-03-30
Description: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in ping tool of Profelis IT Consultancy SambaBox allows AUTHENTICATED user to cause run arbitrary code. This issue affects: Profelis IT Consultancy SambaBox 4.0 version 4.0 and prior versions on x86.
CVSS Score: 3.8 (LOW)
CWE: CWE-77, CWE-77
References: https://www.sambabox.io/sambabox-surum-4-0/; https://www.sambabox.io/sambabox-surum-4-0/
CVE: CVE-2022-25620
Published: 2022-03-30
Description: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Group Functionality of Profelis IT Consultancy SambaBox allows AUTHENTICATED user to cause execute arbitrary codes on the vulnerable server. This issue affects: Profelis IT Consultancy SambaBox 4.0 version 4.0 and prior versions on x86.
CVSS Score: 3.8 (LOW)
CWE: CWE-80, CWE-79
References: https://www.sambabox.io/sambabox-surum-4-0/; https://www.sambabox.io/sambabox-surum-4-0/
CVE: CVE-2020-35501
Published: 2022-03-30
Description: A flaw was found in the Linux kernels implementation of audit rules, where a syscall can unexpectedly not be correctly not be logged by the audit subsystem
CVSS Score: 3.4 (LOW)
CWE: CWE-863
References: https://bugzilla.redhat.com/show_bug.cgi?id=1908577; https://bugzilla.redhat.com/show_bug.cgi?id=1908577
CVE: CVE-2021-1000
Published: 2022-03-30
Description: In createBluetoothDeviceSlice of ConnectedDevicesSliceProvider.java, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12LAndroid ID: A-185190688
CVSS Score: 7.8 (HIGH)
CWE: CWE-276
References: https://source.android.com/security/bulletin/android-12l; https://source.android.com/security/bulletin/android-12l
CVE: CVE-2021-1033
Published: 2022-03-30
Description: In createGeneralSlice of ConnectedDevicesSliceProvider.java.java, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12LAndroid ID: A-185247656
CVSS Score: 7.8 (HIGH)
CWE: CWE-276
References: https://source.android.com/security/bulletin/android-12l; https://source.android.com/security/bulletin/android-12l
CVE: CVE-2021-23850
Published: 2022-03-30
Description: A specially crafted TCP/IP packet may cause a camera recovery image telnet interface to crash. It may also cause a buffer overflow which could enable remote code execution. The recovery image can only be booted with administrative rights or with physical access to the camera and allows the upload of a new firmware in case of a damaged firmware.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-121, CWE-120
References: https://psirt.bosch.com/security-advisories/bosch-sa-478243-bt.html; https://psirt.bosch.com/security-advisories/bosch-sa-446276-bt.html; https://psirt.bosch.com/security-advisories/bosch-sa-478243-bt.html
CVE: CVE-2021-23851
Published: 2022-03-30
Description: A specially crafted TCP/IP packet may cause the camera recovery image web interface to crash. It may also cause a buffer overflow which could enable remote code execution. The recovery image can only be booted with administrative rights or with physical access to the camera and allows the upload of a new firmware in case of a damaged firmware.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-121, CWE-120
References: https://psirt.bosch.com/security-advisories/bosch-sa-478243-bt.html; https://psirt.bosch.com/security-advisories/bosch-sa-446276-bt.html; https://psirt.bosch.com/security-advisories/bosch-sa-478243-bt.html
CVE: CVE-2021-39739
Published: 2022-03-30
Description: In ArrayMap, there is a possible leak of the content of SMS messages due to log information disclosure. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12LAndroid ID: A-184525194
CVSS Score: 3.3 (LOW)
CWE: CWE-532
References: https://source.android.com/security/bulletin/android-12l; https://source.android.com/security/bulletin/android-12l
CVE: CVE-2021-39740
Published: 2022-03-30
Description: In Messaging, there is a possible way to bypass attachment restrictions due to improper input validation. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12LAndroid ID: A-209965112
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: https://source.android.com/security/bulletin/android-12l; https://source.android.com/security/bulletin/android-12l
CVE: CVE-2021-39741
Published: 2022-03-30
Description: In Keymaster, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12LAndroid ID: A-173567719
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://source.android.com/security/bulletin/android-12l; https://source.android.com/security/bulletin/android-12l