deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-43101
Published: 2022-11-03
Description: Tenda AC23 V16.03.07.45_cn was discovered to contain a stack overflow via the devName parameter in the formSetDeviceName function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://github.com/ppcrab/IOT_FIRMWARE/blob/main/Tenda/ac23/ac23.md#formsetdevicenameset_device_namesprintfv4-s1-a1; https://github.com/ppcrab/IOT_FIRMWARE/blob/main/Tenda/ac23/ac23.md#formsetdevicenameset_device_namesprintfv4-s1-a1
CVE: CVE-2022-43102
Published: 2022-11-03
Description: Tenda AC23 V16.03.07.45_cn was discovered to contain a stack overflow via the timeZone parameter in the fromSetSysTime function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://github.com/ppcrab/IOT_FIRMWARE/blob/main/Tenda/ac23/ac23.md#fromsetsystimesub_496104strcpychar-v6-s; https://github.com/ppcrab/IOT_FIRMWARE/blob/main/Tenda/ac23/ac23.md#fromsetsystimesub_496104strcpychar-v6-s
CVE: CVE-2022-43103
Published: 2022-11-03
Description: Tenda AC23 V16.03.07.45_cn was discovered to contain a stack overflow via the list parameter in the formSetQosBand function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://github.com/ppcrab/IOT_FIRMWARE/blob/main/Tenda/ac23/ac23.md#formsetqosband; https://github.com/ppcrab/IOT_FIRMWARE/blob/main/Tenda/ac23/ac23.md#formsetqosband
CVE: CVE-2022-43104
Published: 2022-11-03
Description: Tenda AC23 V16.03.07.45_cn was discovered to contain a stack overflow via the wpapsk_crypto parameter in the fromSetWirelessRepeat function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://github.com/ppcrab/IOT_FIRMWARE/blob/main/Tenda/ac23/ac23.md#fromsetwirelessrepeatsub_45cd64sub_45cad8sub_45bb10; https://github.com/ppcrab/IOT_FIRMWARE/blob/main/Tenda/ac23/ac23.md#fromsetwirelessrepeatsub_45cd64sub_45cad8sub_45bb10
CVE: CVE-2022-43105
Published: 2022-11-03
Description: Tenda AC23 V16.03.07.45_cn was discovered to contain a stack overflow via the shareSpeed parameter in the fromSetWifiGusetBasic function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://github.com/ppcrab/IOT_FIRMWARE/blob/main/Tenda/ac23/ac23.md#fromsetwifigusetbasic; https://github.com/ppcrab/IOT_FIRMWARE/blob/main/Tenda/ac23/ac23.md#fromsetwifigusetbasic
CVE: CVE-2022-43106
Published: 2022-11-03
Description: Tenda AC23 V16.03.07.45_cn was discovered to contain a stack overflow via the schedStartTime parameter in the setSchedWifi function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://github.com/ppcrab/IOT_FIRMWARE/blob/main/Tenda/ac23/ac23.md#setschedwifi-strcpychar-ptr--2-v8; https://github.com/ppcrab/IOT_FIRMWARE/blob/main/Tenda/ac23/ac23.md#setschedwifi-strcpychar-ptr--2-v8
CVE: CVE-2022-43107
Published: 2022-11-03
Description: Tenda AC23 V16.03.07.45_cn was discovered to contain a stack overflow via the time parameter in the setSmartPowerManagement function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://github.com/ppcrab/IOT_FIRMWARE/blob/main/Tenda/ac23/ac23.md#setsmartpowermanagement; https://github.com/ppcrab/IOT_FIRMWARE/blob/main/Tenda/ac23/ac23.md#setsmartpowermanagement
CVE: CVE-2022-43108
Published: 2022-11-03
Description: Tenda AC23 V16.03.07.45_cn was discovered to contain a stack overflow via the firewallEn parameter in the formSetFirewallCfg function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://github.com/ppcrab/IOT_FIRMWARE/blob/main/Tenda/ac23/ac23.md#formsetfirewallcfg; https://github.com/ppcrab/IOT_FIRMWARE/blob/main/Tenda/ac23/ac23.md#formsetfirewallcfg
CVE: CVE-2022-43109
Published: 2022-11-03
Description: D-Link DIR-823G v1.0.2 was found to contain a command injection vulnerability in the function SetNetworkTomographySettings. This vulnerability allows attackers to execute arbitrary commands via a crafted packet.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-77
References: https://github.com/ppcrab/IOT_FIRMWARE/blob/main/%E5%8F%8B%E8%AE%AF/dir-823g/cve_v1.0.2.pdf; https://www.dlink.com/en/security-bulletin/; https://github.com/ppcrab/IOT_FIRMWARE/blob/main/%E5%8F%8B%E8%AE%AF/dir-823g/cve_v1.0.2.pdf
CVE: CVE-2022-44622
Published: 2022-11-03
Description: In JetBrains TeamCity version between 2021.2 and 2022.10 access permissions for secure token health items were excessive
CVSS Score: 2.7 (LOW)
CWE: CWE-284
References: https://www.jetbrains.com/privacy-security/issues-fixed/; https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2022-44623
Published: 2022-11-03
Description: In JetBrains TeamCity version before 2022.10, Project Viewer could see scrambled secure values in the MetaRunner settings
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-538
References: https://www.jetbrains.com/privacy-security/issues-fixed/; https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2022-44624
Published: 2022-11-03
Description: In JetBrains TeamCity version before 2022.10, Password parameters could be exposed in the build log if they contained special characters
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-532, CWE-532
References: https://www.jetbrains.com/privacy-security/issues-fixed/; https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2022-44646
Published: 2022-11-03
Description: In JetBrains TeamCity version before 2022.10, no audit items were added upon editing a user's settings
CVSS Score: 2.2 (LOW)
CWE: CWE-223
References: https://www.jetbrains.com/privacy-security/issues-fixed/; https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2022-39323
Published: 2022-11-03
Description: GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. Time based attack using a SQL injection in api REST user_token. This issue has been patched, please upgrade to version 10.0.4. As a workaround, disable login with user_token on API Rest.
CVSS Score: 7.4 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/glpi-project/glpi/security/advisories/GHSA-cp6q-9p4x-8hr9; https://github.com/glpi-project/glpi/security/advisories/GHSA-cp6q-9p4x-8hr9
CVE: CVE-2022-39277
Published: 2022-11-03
Description: GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. External links are not properly sanitized and can therefore be used for a Cross-Site Scripting (XSS) attack. This issue has been patched, please upgrade to GLPI 10.0.4. There are currently no known workarounds.
CVSS Score: 4.5 (MEDIUM)
CWE: CWE-79, CWE-80, CWE-79
References: https://github.com/glpi-project/glpi/security/advisories/GHSA-rhcw-8r7g-8pwc; https://huntr.dev/bounties/8e047ae1-7a7c-48e0-bee3-d1c36e52ff42/; https://github.com/glpi-project/glpi/security/advisories/GHSA-rhcw-8r7g-8pwc
CVE: CVE-2022-39370
Published: 2022-11-03
Description: GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. Connected users may gain access to debug panel through the GLPI update script. This issue has been patched, please upgrade to 10.0.4. As a workaround, delete the `install/update.php` script.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284
References: https://github.com/glpi-project/glpi/security/advisories/GHSA-6c2p-wgx9-vrjc; https://github.com/glpi-project/glpi/security/advisories/GHSA-6c2p-wgx9-vrjc
CVE: CVE-2022-39371
Published: 2022-11-03
Description: GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. Script related HTML tags in assets inventory information are not properly neutralized. This issue has been patched, please upgrade to version 10.0.4. There are currently no known workarounds.
CVSS Score: 7.5 (HIGH)
CWE: CWE-80, CWE-79
References: https://github.com/glpi-project/glpi/security/advisories/GHSA-w7wc-728f-6mm8; https://github.com/glpi-project/glpi/security/advisories/GHSA-w7wc-728f-6mm8
CVE: CVE-2022-39372
Published: 2022-11-03
Description: GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. Authenticated users may store malicious code in their account information. This issue has been patched, please upgrade to version 10.0.4. There are currently no known workarounds.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-80, CWE-79
References: https://github.com/glpi-project/glpi/security/advisories/GHSA-5rj7-95qc-89h2; https://github.com/glpi-project/glpi/security/advisories/GHSA-5rj7-95qc-89h2
CVE: CVE-2022-39373
Published: 2022-11-03
Description: GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. Administrator may store malicious code in entity name. This issue has been patched, please upgrade to version 10.0.4.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/glpi-project/glpi/security/advisories/GHSA-cw37-q82c-w546; https://github.com/glpi-project/glpi/security/advisories/GHSA-cw37-q82c-w546
CVE: CVE-2022-39375
Published: 2022-11-03
Description: GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. Users may be able to create a public RSS feed to inject malicious code in dashboards of other users. This issue has been patched, please upgrade to version 10.0.4. There are currently no known workarounds.
CVSS Score: 4.5 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/glpi-project/glpi/security/advisories/GHSA-fxcx-93fq-8r9g; https://github.com/glpi-project/glpi/security/advisories/GHSA-fxcx-93fq-8r9g
CVE: CVE-2022-39376
Published: 2022-11-03
Description: GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. Users may be able to inject custom fields values in `mailto` links. This issue has been patched, please upgrade to version 10.0.4. There are currently no known workarounds.
CVSS Score: 2.6 (LOW)
CWE: CWE-20, CWE-20
References: https://github.com/glpi-project/glpi/security/advisories/GHSA-6rh5-m5g7-327w; https://github.com/glpi-project/glpi/security/advisories/GHSA-6rh5-m5g7-327w
CVE: CVE-2020-22818
Published: 2022-11-03
Description: MKCMS V6.2 has SQL injection via /ucenter/reg.php name parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://unc1e.blogspot.com/2020/04/mkcms-v62-has-mutilple-vulnerabilities.html; https://unc1e.blogspot.com/2020/04/mkcms-v62-has-mutilple-vulnerabilities.html
CVE: CVE-2020-22819
Published: 2022-11-03
Description: MKCMS V6.2 has SQL injection via the /ucenter/active.php verify parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://unc1e.blogspot.com/2020/04/mkcms-v62-has-mutilple-vulnerabilities.html; https://unc1e.blogspot.com/2020/04/mkcms-v62-has-mutilple-vulnerabilities.html
CVE: CVE-2020-22820
Published: 2022-11-03
Description: MKCMS V6.2 has SQL injection via the /ucenter/repass.php name parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://unc1e.blogspot.com/2020/04/mkcms-v62-has-mutilple-vulnerabilities.html; https://unc1e.blogspot.com/2020/04/mkcms-v62-has-mutilple-vulnerabilities.html
CVE: CVE-2021-37823
Published: 2022-11-03
Description: OpenCart 3.0.3.7 allows users to obtain database information or read server files through SQL injection in the background.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://medium.com/%40nowczj/sql-injection-exists-in-the-background-of-opencart-d41b5c58e99e; https://medium.com/%40nowczj/sql-injection-exists-in-the-background-of-opencart-d41b5c58e99e
CVE: CVE-2022-2696
Published: 2022-11-03
Description: The Restaurant Menu – Food Ordering System – Table Reservation plugin for WordPress is vulnerable to authorization bypass via several AJAX actions in versions up to, and including 2.3.0 due to missing capability checks and missing nonce validation. This makes it possible for authenticated attackers with minimal permissions to perform a wide variety of actions such as modifying the plugin's settings and modifying the ordering system preferences.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/menu-ordering-reservations/trunk/includes/admin/class-glf-admin-screens.php?rev=2664283; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2793398%40menu-ordering-reservations&new=2793398%40menu-ordering-reservations&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/01486af8-b378-4663-a9c5-167b8580db94?source=cve
CVE: CVE-2022-3776
Published: 2022-11-03
Description: The Restaurant Menu – Food Ordering System – Table Reservation plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.3.1. This is due to missing or incorrect nonce validation on several functions called via AJAX actions such as forms_action, set_option, & chosen_options to name a few . This makes it possible for unauthenticated attackers to perform a variety of administrative actions like modifying forms, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2807967%40menu-ordering-reservations&new=2807967%40menu-ordering-reservations&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/67fe46cd-a6c4-4d0a-842a-f[PII_REDACTED]1?source=cve; https://www.wordfence.com/vulnerability-advisories-continued/#CVE-2022-3776
CVE: CVE-2022-3675
Published: 2022-11-03
Description: Fedora CoreOS supports setting a GRUB bootloader password
using a Butane config. When this feature is enabled, GRUB requires a password to access the
GRUB command-line, modify kernel command-line arguments, or boot
non-default OSTree deployments.  Recent Fedora CoreOS releases have a
misconfiguration which allows booting non-default OSTree deployments
without entering a password.  This allows someone with access to the
GRUB menu to boot into an older version of Fedora CoreOS, reverting
any security fixes that have recently been applied to the machine.  A
password is still required to modify kernel command-line arguments and
to access the GRUB command line.




CVSS Score: 2.6 (LOW)
CWE: CWE-20, CWE-306
References: https://docs.fedoraproject.org/en-US/fedora-coreos/grub-password/; https://github.com/coreos/fedora-coreos-tracker/issues/1333; https://lists.fedoraproject.org/archives/list/coreos-status@lists.fedoraproject.org/thread/NHUCNH5Y4UH5DPUCXISYXXVA563TLFEJ/
CVE: CVE-2022-3852
Published: 2022-11-03
Description: The VR Calendar plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.3.3. This is due to missing or incorrect nonce validation on several functions. This makes it possible for unauthenticated attackers to delete, and modify calendars as well as the plugin settings, via forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/vr-calendar-sync/tags/2.3.2/Admin/Classes/VRCalendarAdmin.class.php#L133; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2809350%40vr-calendar-sync&new=2809350%40vr-calendar-sync&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/a868226f-4ca1-4ec1-b55e-3029e3ed2d5b?source=cve
CVE: CVE-2022-42750
Published: 2022-11-03
Description: CandidATS version 3.0.0 allows an external attacker to steal the cookie of arbitrary users. This is possible because the application does not correctly validate the files uploaded by the user.
CVSS Score: 8.8 (HIGH)
CWE: CWE-79, CWE-79
References: https://candidats.net/; https://fluidattacks.com/advisories/castles/; https://candidats.net/
CVE: CVE-2022-42751
Published: 2022-11-03
Description: CandidATS version 3.0.0 allows an external attacker to elevate privileges in the application. This is possible because the application suffers from CSRF. This allows to persuade an administrator to create a new account with administrative permissions.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://candidats.net/; https://fluidattacks.com/advisories/londra/; https://candidats.net/
CVE: CVE-2022-42753
Published: 2022-11-03
Description: SalonERP version 3.0.2 allows an external attacker to steal the cookie of arbitrary users. This is possible because the application does not correctly validate the page parameter against XSS attacks.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://fluidattacks.com/advisories/hardway/; https://salonerp.sourceforge.io/; https://fluidattacks.com/advisories/hardway/
CVE: CVE-2022-43372
Published: 2022-11-03
Description: Emlog Pro v1.7.1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability at /admin/store.php.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/emlog/emlog/issues/195; https://github.com/emlog/emlog/issues/195
CVE: CVE-2022-3258
Published: 2022-11-03
Description: Incorrect Permission Assignment for Critical Resource vulnerability in HYPR Workforce Access on Windows allows Authentication Abuse.
CVSS Score: 3.7 (LOW)
CWE: CWE-732, CWE-732
References: https://www.hypr.com/security-advisories; https://www.hypr.com/security-advisories
CVE: CVE-2021-36906
Published: 2022-11-03
Description: Multiple Insecure Direct Object References (IDOR) vulnerabilities in ExpressTech Quiz And Survey Master plugin <= 7.3.6 on WordPress.
CVSS Score: 2.7 (LOW)
CWE: CWE-639, CWE-639
References: https://patchstack.com/database/vulnerability/quiz-master-next/wordpress-quiz-and-survey-master-plugin-7-3-6-multiple-insecure-direct-object-references-idor-vulnerabilities?_s_id=cve; https://wordpress.org/plugins/quiz-master-next/#developers; https://patchstack.com/database/vulnerability/quiz-master-next/wordpress-quiz-and-survey-master-plugin-7-3-6-multiple-insecure-direct-object-references-idor-vulnerabilities?_s_id=cve
CVE: CVE-2021-39077
Published: 2022-11-03
Description: IBM Security Guardium 10.5, 10.6, 11.0, 11.1, 11.2, 11.3, and 11.4 stores user credentials in plain clear text which can be read by a local privileged user. IBM X-Force ID: 215587.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-319, CWE-312
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/215587; https://www.ibm.com/support/pages/node/6831647; https://exchange.xforce.ibmcloud.com/vulnerabilities/215587
CVE: CVE-2021-44862
Published: 2022-11-03
Description: Netskope client is impacted by a vulnerability where an authenticated, local attacker can view sensitive information stored in NSClient logs which should be restricted. The vulnerability exists because the sensitive information is not masked/scrubbed before writing in the logs. A malicious user can use the sensitive information to download data and impersonate another user.

CVSS Score: 8.4 (HIGH)
CWE: CWE-532, CWE-532
References: https://www.netskope.com/company/security-compliance-and-assurance/security-advisories-and-disclosures/netskope-security-advisory-nskpsa-2022-001; https://www.netskope.com/company/security-compliance-and-assurance/security-advisories-and-disclosures/netskope-security-advisory-nskpsa-2022-001
CVE: CVE-2022-22425
Published: 2022-11-03
Description: "IBM InfoSphere Information Server 11.7 is potentially vulnerable to CSV Injection. A remote attacker could execute arbitrary commands on the system, caused by improper validation of csv file contents. IBM X-Force ID: 223598."
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1236, CWE-1236
References: https://www.ibm.com/support/pages/node/6829953; https://www.ibm.com/support/pages/node/6829953
CVE: CVE-2022-22442
Published: 2022-11-03
Description: "IBM InfoSphere Information Server 11.7 could allow an authenticated user to access information restricted to users with elevated privileges due to improper access controls. IBM X-Force ID: 224427."
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: https://www.ibm.com/support/pages/node/6829325; https://www.ibm.com/support/pages/node/6829325
CVE: CVE-2022-25952
Published: 2022-11-03
Description: Cross-Site Request Forgery (CSRF) vulnerability in Keywordrush Content Egg plugin <= 5.4.0 on WordPress.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://patchstack.com/database/vulnerability/content-egg/wordpress-content-egg-plugin-5-4-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://wordpress.org/plugins/content-egg/#developers; https://patchstack.com/database/vulnerability/content-egg/wordpress-content-egg-plugin-5-4-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2022-30608
Published: 2022-11-03
Description: "IBM InfoSphere Information Server 11.7 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a "user that the website trusts. IBM X-Force ID: 227295.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://www.ibm.com/support/pages/node/6829335; https://www.ibm.com/support/pages/node/6829335
CVE: CVE-2022-30615
Published: 2022-11-03
Description: "IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 227592.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.ibm.com/support/pages/node/6829311; https://www.ibm.com/support/pages/node/6829311
CVE: CVE-2022-34339
Published: 2022-11-03
Description: "IBM Cognos Analytics 11.2.1, 11.2.0, 11.1.7 stores user credentials in plain clear text which can be read by an authenticated user. IBM X-Force ID: 229963."
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-312, CWE-312
References: https://www.ibm.com/support/pages/node/6828527; https://www.ibm.com/support/pages/node/6828527
CVE: CVE-2022-35279
Published: 2022-11-03
Description: "IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, 19.0.0.1, 19.0.0.2, 19.0.0.3, 20.0.0.1, 20.0.0.2, 21.0.2, 21.0.3, and 22.0.1 could disclose sensitive version information to authenticated users which could be used in further attacks against the system. IBM X-Force ID: 230537."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-312, CWE-312
References: https://www.ibm.com/support/pages/node/6829847; https://www.ibm.com/support/pages/node/6829847
CVE: CVE-2022-35642
Published: 2022-11-03
Description: "IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 227592."
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-78
References: https://www.ibm.com/support/pages/node/6829311; https://www.ibm.com/support/pages/node/6829311
CVE: CVE-2022-35717
Published: 2022-11-03
Description: "IBM InfoSphere Information Server 11.7 could allow a locally authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request. IBM X-"Force ID: 231361.
CVSS Score: 7.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://www.ibm.com/support/pages/node/6829365; https://www.ibm.com/support/pages/node/6829365