deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-30838
Published: 2022-05-24
Description: Covid-19 Travel Pass Management System v1.0 is vulnerable to SQL Injection via /ctpms/classes/Master.php?f=update_application_status
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/mikeccltt/bug_report_CVE/blob/main/Covid-19-Travel-Pass-Management-System/sql.md; https://github.com/mikeccltt/bug_report_CVE/blob/main/Covid-19-Travel-Pass-Management-System/sql.md
CVE: CVE-2022-30839
Published: 2022-05-24
Description: Room-rent-portal-site v1.0 is vulnerable to Cross Site Scripting (XSS) via /rrps/classes/Master.php?f=save_category, vehicle_name.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/mikeccltt/bug_report_CVE/blob/main/room-rent-portal-site/xss.md; https://github.com/mikeccltt/bug_report_CVE/blob/main/room-rent-portal-site/xss.md
CVE: CVE-2022-30842
Published: 2022-05-24
Description: Covid-19 Travel Pass Management System v1.0 is vulnerable to Cross Site Scripting (XSS) via /ctpms/classes/Users.php?f=save, firstname.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/mikeccltt/bug_report_CVE/blob/main/Covid-19-Travel-Pass-Management-System/xss.md; https://github.com/mikeccltt/bug_report_CVE/blob/main/Covid-19-Travel-Pass-Management-System/xss.md
CVE: CVE-2022-30843
Published: 2022-05-24
Description: Room-rent-portal-site v1.0 is vulnerable to SQL Injection via /rrps/classes/Master.php?f=delete_category, id.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/mikeccltt/bug_report_CVE/blob/main/room-rent-portal-site/sql.md; https://github.com/mikeccltt/bug_report_CVE/blob/main/room-rent-portal-site/sql.md
CVE: CVE-2022-31261
Published: 2022-05-24
Description: An XXE issue was discovered in Morpheus through 5.2.16 and 5.4.x through 5.4.4. A successful attack requires a SAML identity provider to be configured. In order to exploit the vulnerability, the attacker must know the unique SAML callback ID of the configured identity source. A remote attacker can send a request crafted with an XXE payload to invoke a malicious DTD hosted on a system that they control. This results in reading local files that the application has access to.
CVSS Score: 7.5 (HIGH)
CWE: CWE-611
References: https://docs.morpheusdata.com/en/5.4.4/release_notes/current.html; https://support.morpheusdata.com/s/?language=en_US; https://docs.morpheusdata.com/en/5.4.4/release_notes/current.html
CVE: CVE-2013-10002
Published: 2022-05-24
Description: A vulnerability was found in Telecommunication Software SAMwin Contact Center Suite 5.1. It has been rated as critical. Affected by this issue is the function getCurrentDBVersion in the library SAMwinLIBVB.dll of the credential handler. Authentication is possible with hard-coded credentials. Upgrading to version 6.2 is able to address this issue. It is recommended to upgrade the affected component.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-798, CWE-798
References: http://www.modzero.ch/advisories/MZ-13-06_SAMwin_Architectural_Issues.txt; https://vuldb.com/?id.12788; http://www.modzero.ch/advisories/MZ-13-06_SAMwin_Architectural_Issues.txt
CVE: CVE-2013-10003
Published: 2022-05-24
Description: A vulnerability classified as critical has been found in Telecommunication Software SAMwin Contact Center Suite 5.1. This affects the function getCurrentDBVersion in the library SAMwinLIBVB.dll of the database handler. The manipulation leads to sql injection. The exploit has been disclosed to the public and may be used. Upgrading to version 6.2 is able to address this issue. It is recommended to upgrade the affected component.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89, CWE-89
References: http://www.modzero.ch/advisories/MZ-13-06_SAMwin_Architectural_Issues.txt; https://vuldb.com/?id.12789; http://www.modzero.ch/advisories/MZ-13-06_SAMwin_Architectural_Issues.txt
CVE: CVE-2013-10004
Published: 2022-05-24
Description: A vulnerability classified as critical was found in Telecommunication Software SAMwin Contact Center Suite 5.1. This vulnerability affects the function passwordScramble in the library SAMwinLIBVB.dll of the component Password Handler. Incorrect implementation of a hashing function leads to predictable authentication possibilities. Upgrading to version 6.2 is able to address this issue. It is recommended to upgrade the affected component.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-287, CWE-307
References: http://www.modzero.ch/advisories/MZ-13-07_SAMwin_Collisions.txt; https://vuldb.com/?id.12790; http://www.modzero.ch/advisories/MZ-13-07_SAMwin_Collisions.txt
CVE: CVE-2014-125001
Published: 2022-05-24
Description: A vulnerability classified as critical has been found in Cardo Systems Scala Rider Q3. Affected is the file /cardo/api of the Cardo-Updater. Unauthenticated remote code execution with root permissions is possible. Firewalling or disabling the service is recommended.
CVSS Score: 8.1 (HIGH)
CWE: CWE-269, CWE-269
References: http://www.remote-exploit.org/archives/2014/06/03/ride_with_the_devil/; https://vuldb.com/?id.13428; http://www.remote-exploit.org/archives/2014/06/03/ride_with_the_devil/
CVE: CVE-2021-4229
Published: 2022-05-24
Description: A vulnerability was found in ua-parser-js 0.7.29/0.8.0/1.0.0. It has been rated as critical. This issue affects the crypto mining component which introduces a backdoor. Upgrading to version 0.7.30, 0.8.1 and 1.0.1 is able to address this issue. It is recommended to upgrade the affected component.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-912, CWE-829
References: https://github.com/advisories/GHSA-pjwm-rvh2-c87w; https://github.com/faisalman/ua-parser-js/issues/536; https://vuldb.com/?id.185453
CVE: CVE-2021-4230
Published: 2022-05-24
Description: A vulnerability has been found in Airfield Online and classified as problematic. This vulnerability affects the path /backups/ of the MySQL backup handler. An attacker is able to get access to sensitive data without proper authentication. It is recommended to the change the configuration settings.
CVSS Score: 3.7 (LOW)
CWE: CWE-287, CWE-287
References: https://vuldb.com/?id.183172; https://vuldb.com/?id.183172
CVE: CVE-2022-1849
Published: 2022-05-24
Description: Session Fixation in GitHub repository filegator/filegator prior to 7.8.0.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-384, CWE-384
References: https://github.com/filegator/filegator/commit/fcd3995f64f5dfc6a4c2c059cc22a2fef1e81225; https://huntr.dev/bounties/881f8f36-d5c8-470d-8261-f109e6d5db4b; https://github.com/filegator/filegator/commit/fcd3995f64f5dfc6a4c2c059cc22a2fef1e81225
CVE: CVE-2022-29249
Published: 2022-05-24
Description: JavaEZ is a library that adds new functions to make Java easier. A weakness in JavaEZ 1.6 allows force decryption of locked text by unauthorized actors. The issue is NOT critical for non-secure applications, however may be critical in a situation where the highest levels of security are required. This issue ONLY affects v1.6 and does not affect anything pre-1.6. The vulnerability has been patched in release 1.7. Currently, there is no way to fix the issue without upgrading.
CVSS Score: 7.5 (HIGH)
CWE: CWE-327, CWE-328, CWE-326, CWE-327
References: https://github.com/JavaEZLib/JavaEZ/releases/tag/1.7; https://github.com/JavaEZLib/JavaEZ/security/advisories/GHSA-67fj-6w6m-w5j8; https://github.com/JavaEZLib/JavaEZ/releases/tag/1.7
CVE: CVE-2020-4926
Published: 2022-05-24
Description: A vulnerability in the Spectrum Scale 5.1 core component and IBM Elastic Storage System 6.1 could allow unauthorized access to user data or injection of arbitrary data in the communication protocol. IBM X-Force ID: 191600.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-862
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/191600; https://www.ibm.com/support/pages/node/6565399; https://www.ibm.com/support/pages/node/6589109
CVE: CVE-2022-22309
Published: 2022-05-24
Description: The POWER systems FSP is vulnerable to unauthenticated logins through the serial port/TTY interface. This vulnerability can be more critical if the serial port is connected to a serial-over-lan device. IBM X-Force ID: 217095.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-306
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/217095; https://www.ibm.com/support/pages/node/6589099; https://exchange.xforce.ibmcloud.com/vulnerabilities/217095
CVE: CVE-2022-22495
Published: 2022-05-24
Description: IBM i 7.3, 7.4, and 7.5 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 226941.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/226941; https://www.ibm.com/support/pages/node/6589203; https://exchange.xforce.ibmcloud.com/vulnerabilities/226941
CVE: CVE-2021-32962
Published: 2022-05-24
Description: The AGG Software Web Server version 4.0.40.1014 and prior is vulnerable to cross-site scripting, which may allow an attacker to remotely execute arbitrary code.
CVSS Score: 8.2 (HIGH)
CWE: CWE-79
References: https://www.cisa.gov/uscert/ics/advisories/icsa-21-161-02; https://www.cisa.gov/uscert/ics/advisories/icsa-21-161-02
CVE: CVE-2021-32964
Published: 2022-05-24
Description: The AGG Software Web Server version 4.0.40.1014 and prior is vulnerable to a path traversal attack, which may allow an attacker to read arbitrary files from the file system.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-23, CWE-22
References: https://www.cisa.gov/uscert/ics/advisories/icsa-21-161-02; https://www.cisa.gov/uscert/ics/advisories/icsa-21-161-02
CVE: CVE-2021-32965
Published: 2022-05-24
Description: Delta Electronics DIAScreen versions prior to 1.1.0 are vulnerable to type confusion, which may allow an attacker to remotely execute arbitrary code.
CVSS Score: 7.8 (HIGH)
CWE: CWE-843
References: https://www.cisa.gov/uscert/ics/advisories/icsa-21-208-05; https://www.cisa.gov/uscert/ics/advisories/icsa-21-208-05
CVE: CVE-2021-32969
Published: 2022-05-24
Description: Delta Electronics DIAScreen versions prior to 1.1.0 are vulnerable to an out-of-bounds write condition, which may result in a system crash or allow an attacker to remotely execute arbitrary code.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.cisa.gov/uscert/ics/advisories/icsa-21-208-05; https://www.cisa.gov/uscert/ics/advisories/icsa-21-208-05
CVE: CVE-2022-1669
Published: 2022-05-24
Description: A buffer overflow vulnerability has been detected in the firewall function of the device management web portal. The device runs a CGI binary (index.cgi) to offer a management web application. Once authenticated with valid credentials in this web portal, a potential attacker could submit any "Address" value and it would be copied to a second variable with a "strcpy" vulnerable function without checking its length. Because of this, it is possible to send a long address value to overflow the process stack, controlling the function return address.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-121
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-137-01; https://www.cisa.gov/uscert/ics/advisories/icsa-22-137-01
CVE: CVE-2021-3597
Published: 2022-05-24
Description: A flaw was found in undertow. The HTTP2SourceChannel fails to write the final frame under some circumstances, resulting in a denial of service. The highest threat from this vulnerability is availability. This flaw affects Undertow versions prior to 2.0.35.SP1, prior to 2.2.6.SP1, prior to 2.2.7.SP1, prior to 2.0.36.SP1, prior to 2.2.9.Final and prior to 2.0.39.Final.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-362, CWE-362
References: https://bugzilla.redhat.com/show_bug.cgi?id=1970930; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://bugzilla.redhat.com/show_bug.cgi?id=1970930
CVE: CVE-2021-3629
Published: 2022-05-24
Description: A flaw was found in Undertow. A potential security issue in flow control handling by the browser over http/2 may potentially cause overhead or a denial of service in the server. The highest threat from this vulnerability is availability. This flaw affects Undertow versions prior to 2.0.40.Final and prior to 2.2.11.Final.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-400, CWE-400
References: https://bugzilla.redhat.com/show_bug.cgi?id=1977362; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://bugzilla.redhat.com/show_bug.cgi?id=1977362
CVE: CVE-2021-3717
Published: 2022-05-24
Description: A flaw was found in Wildfly. An incorrect JBOSS_LOCAL_USER challenge location when using the elytron configuration may lead to JBOSS_LOCAL_USER access to all users on the machine. The highest threat from this vulnerability is to confidentiality, integrity, and availability. This flaw affects wildfly-core versions prior to 17.0.
CVSS Score: 7.8 (HIGH)
CWE: CWE-552, CWE-552
References: https://bugzilla.redhat.com/show_bug.cgi?id=1991305; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://bugzilla.redhat.com/show_bug.cgi?id=1991305
CVE: CVE-2021-42612
Published: 2022-05-24
Description: A use after free in cleanup_index in index.c in Halibut 1.2 allows an attacker to cause a segmentation fault or possibly have other unspecified impact via a crafted text document.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://carteryagemann.com/halibut-case-study.html#poc-halibut-text-uaf; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CC7UZ7NRXDA7YSCSGWE2CBQM7OZS3K2R/; https://carteryagemann.com/halibut-case-study.html#poc-halibut-text-uaf
CVE: CVE-2021-42613
Published: 2022-05-24
Description: A double free in cleanup_index in index.c in Halibut 1.2 allows an attacker to cause a denial of service or possibly have other unspecified impact via a crafted text document.
CVSS Score: 7.8 (HIGH)
CWE: CWE-415
References: https://carteryagemann.com/halibut-case-study.html#poc-halibut-winhelp-df; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CC7UZ7NRXDA7YSCSGWE2CBQM7OZS3K2R/; https://carteryagemann.com/halibut-case-study.html#poc-halibut-winhelp-df
CVE: CVE-2021-42614
Published: 2022-05-24
Description: A use after free in info_width_internal in bk_info.c in Halibut 1.2 allows an attacker to cause a segmentation fault or possibly have unspecified other impact via a crafted text document.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://carteryagemann.com/halibut-case-study.html#poc-halibut-info-uaf; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CC7UZ7NRXDA7YSCSGWE2CBQM7OZS3K2R/; https://carteryagemann.com/halibut-case-study.html#poc-halibut-info-uaf
CVE: CVE-2022-22977
Published: 2022-05-24
Description: VMware Tools for Windows(12.0.0, 11.x.y and 10.x.y) contains an XML External Entity (XXE) vulnerability. A malicious actor with non-administrative local user privileges in the Windows guest OS, where VMware Tools is installed, may exploit this issue leading to a denial-of-service condition or unintended information disclosure.
CVSS Score: 7.1 (HIGH)
CWE: CWE-611
References: https://www.vmware.com/security/advisories/VMSA-2022-0015.html; https://www.vmware.com/security/advisories/VMSA-2022-0015.html
CVE: CVE-2022-23050
Published: 2022-05-24
Description: ManageEngine AppManager15 (Build No:15510) allows an authenticated admin user to upload a DLL file to perform a DLL hijack attack inside the 'working' folder through the 'Upload Files / Binaries' functionality.
CVSS Score: 7.2 (HIGH)
CWE: CWE-427
References: https://fluidattacks.com/advisories/cerati/; https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2022-23050.html; https://fluidattacks.com/advisories/cerati/
CVE: CVE-2022-29333
Published: 2022-05-24
Description: A vulnerability in CyberLink Power Director v14 allows attackers to escalate privileges via a crafted .exe file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: http://cyberlink.com; http://power.com; https://www.youtube.com/watch?v=r75k-ae3_ng
CVE: CVE-2022-22497
Published: 2022-05-24
Description: IBM Aspera Faspex 4.4.1 and 5.0.0 could allow unauthorized access due to an incorrectly computed security token. IBM X-Force ID: 226951.
CVSS Score: 7.5 (HIGH)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/226951; https://www.ibm.com/support/pages/node/6589601; https://exchange.xforce.ibmcloud.com/vulnerabilities/226951
CVE: CVE-2022-29334
Published: 2022-05-24
Description: An issue in H v1.0 allows attackers to bypass authentication via a session replay attack.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-294
References: https://github.com/SiJiDo/H/issues/27; https://github.com/SiJiDo/H/issues/27
CVE: CVE-2022-29337
Published: 2022-05-24
Description: C-DATA FD702XW-X-R430 v2.1.13_X001 was discovered to contain a command injection vulnerability via the va_cmd parameter in formlanipv6. This vulnerability allows attackers to execute arbitrary commands via a crafted HTTP request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://east-trowel-102.notion.site/CVE-2022-XXXX-OS-CommandInjection-formlanipv6-043ddebec5a1456b[PII_REDACTED]7c04e8; https://east-trowel-102.notion.site/CVE-2022-XXXX-OS-CommandInjection-formlanipv6-043ddebec5a1456b[PII_REDACTED]7c04e8
CVE: CVE-2022-29349
Published: 2022-05-25
Description: kkFileView v4.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the url parameter at /controller/OnlinePreviewController.java.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/kekingcn/kkFileView/issues/347; https://github.com/kekingcn/kkFileView/issues/347
CVE: CVE-2022-29358
Published: 2022-05-25
Description: epub2txt2 v2.04 was discovered to contain an integer overflow via the function bug in _parse_special_tag at sxmlc.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted XML file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-190
References: https://github.com/kevinboone/epub2txt2/issues/22; https://github.com/kevinboone/epub2txt2/issues/22
CVE: CVE-2022-29359
Published: 2022-05-25
Description: A stored cross-site scripting (XSS) vulnerability in /scas/?page=clubs/application_form&id=7 of School Club Application System v0.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the firstname parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.sourcecodester.com/php/15266/school-club-application-system-phpoop-free-source-code.html; https://zsecure.notion.site/School-Club-Application-a096d8c[PII_REDACTED]3e0f9bd10436771; https://www.sourcecodester.com/php/15266/school-club-application-system-phpoop-free-source-code.html
CVE: CVE-2022-29361
Published: 2022-05-25
Description: Improper parsing of HTTP requests in Pallets Werkzeug v2.1.0 and below allows attackers to perform HTTP Request Smuggling using a crafted HTTP request with multiple requests included inside the body. NOTE: the vendor's position is that this behavior can only occur in unsupported configurations involving development mode and an HTTP server from outside the Werkzeug project
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-444
References: https://github.com/pallets/werkzeug/commit/9a3a981d70d2e9ec3344b5192f86fcaf3210cd85; https://github.com/pallets/werkzeug/issues/2420; https://github.com/pallets/werkzeug/commit/9a3a981d70d2e9ec3344b5192f86fcaf3210cd85
CVE: CVE-2022-29362
Published: 2022-05-25
Description: A cross-site scripting (XSS) vulnerability in /navigation/create?ParentID=%23 of ZKEACMS v3.5.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the ParentID parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/SeriaWei/ZKEACMS/issues/457; https://github.com/SeriaWei/ZKEACMS/issues/457
CVE: CVE-2022-29710
Published: 2022-05-25
Description: A cross-site scripting (XSS) vulnerability in uploadConfirm.php of LimeSurvey v5.3.9 and below allows attackers to execute arbitrary web scripts or HTML via a crafted plugin.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/LimeSurvey/LimeSurvey/commit/f7b35619a1c4b[PII_REDACTED]c7d5870fd599a0f9c; https://github.com/LimeSurvey/LimeSurvey/commit/f7b35619a1c4b[PII_REDACTED]c7d5870fd599a0f9c
CVE: CVE-2022-29405
Published: 2022-05-25
Description: In Apache Archiva, any registered user can reset password for any users. This is fixed in Archiva 2.2.8
CVSS Score: 6.5 (MEDIUM)
References: https://archiva.apache.org/docs/2.2.8/release-notes.html; https://archiva.apache.org/docs/2.2.8/release-notes.html
CVE: CVE-2022-1815
Published: 2022-05-25
Description: Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository jgraph/drawio prior to 18.1.2.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200, CWE-918
References: https://github.com/jgraph/drawio/commit/c287bef9101d024b1fd59d55ecd530f25000f9d8; https://huntr.dev/bounties/6e856a25-9117-47c6-9375-52f78876902f; https://github.com/jgraph/drawio/commit/c287bef9101d024b1fd59d55ecd530f25000f9d8
CVE: CVE-2022-1883
Published: 2022-05-25
Description: SQL Injection in GitHub repository camptocamp/terraboard prior to 2.2.0.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/camptocamp/terraboard/commit/2a5dbaac015dc0714b41a59995e24f5767f89ddc; https://huntr.dev/bounties/a25d15bd-cd23-487e-85cd-587960f1b9e7; https://github.com/camptocamp/terraboard/commit/2a5dbaac015dc0714b41a59995e24f5767f89ddc
CVE: CVE-2022-21951
Published: 2022-05-25
Description: A Cleartext Transmission of Sensitive Information vulnerability in SUSE Rancher, Rancher allows attackers on the network to read and change network data due to missing encryption of data transmitted via the network when a cluster is created from an RKE template with the CNI value overridden This issue affects: SUSE Rancher Rancher versions prior to 2.5.14; Rancher versions prior to 2.6.5.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-319, CWE-319
References: https://bugzilla.suse.com/show_bug.cgi?id=1199443; https://github.com/rancher/rancher/security/advisories/GHSA-vrph-m5jj-c46c; https://bugzilla.suse.com/show_bug.cgi?id=1199443
CVE: CVE-2021-44974
Published: 2022-05-25
Description: radareorg radare2 version 5.5.2 is vulnerable to NULL Pointer Dereference via libr/bin/p/bin_symbols.c binary symbol parser.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: http://www.openwall.com/lists/oss-security/2022/05/25/1; https://census-labs.com/news/2022/05/24/multiple-vulnerabilities-in-radare2/; https://github.com/radareorg/radare2/issues/19478
CVE: CVE-2022-26945
Published: 2022-05-25
Description: go-getter up to 1.5.11 and 2.0.2 allowed protocol switching, endless redirect, and configuration bypass via abuse of custom HTTP response header processing. Fixed in 1.6.1 and 2.1.0.
CVSS Score: 9.8 (CRITICAL)
References: https://discuss.hashicorp.com; https://discuss.hashicorp.com/t/hcsec-2022-13-multiple-vulnerabilities-in-go-getter-library/39930; https://discuss.hashicorp.com
CVE: CVE-2022-28862
Published: 2022-05-25
Description: In Archibus Web Central before 26.2, multiple SQL Injection vulnerabilities occur in dwr/call/plaincall/workflow.runWorkflowRule.dwr. Through the injection of arbitrary SQL statements, a potential attacker can modify query syntax and perform unauthorized (and unexpected) operations against the remote database. This is fixed in all recent versions, such as version 26.2.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.gruppotim.it/it/footer/red-team.html; https://www.telecomitalia.com/tit/it/innovazione/cybersecurity/red-team.html; https://www.gruppotim.it/it/footer/red-team.html
CVE: CVE-2022-30321
Published: 2022-05-25
Description: go-getter up to 1.5.11 and 2.0.2 allowed arbitrary host access via go-getter path traversal, symlink processing, and command injection flaws. Fixed in 1.6.1 and 2.1.0.
CVSS Score: 8.6 (HIGH)
CWE: CWE-22, CWE-59, CWE-77
References: https://discuss.hashicorp.com; https://discuss.hashicorp.com/t/hcsec-2022-13-multiple-vulnerabilities-in-go-getter-library/39930; https://github.com/hashicorp/go-getter/releases