deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-30292
Published: 2022-05-04
Description: Heap-based buffer overflow in sqbaselib.cpp in SQUIRREL 3.2 due to lack of a certain sq_reservestack call.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-787
References: https://github.com/albertodemichelis/squirrel/commit/a6413aa690e0bdfef648c68693349a7b878fe60d; https://github.com/sprushed/CVE-2022-30292; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BV7SJJ44AGAX4ILIVPREIXPJ2GOG3FKV/
CVE: CVE-2022-1588
Published: 2022-05-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. Reason: This CVE has been rejected as it was incorrectly assigned. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2022-28890
Published: 2022-05-05
Description: A vulnerability in the RDF/XML parser of Apache Jena allows an attacker to cause an external DTD to be retrieved. This issue affects Apache Jena version 4.4.0 and prior versions. Apache Jena 4.2.x and 4.3.x do not allow external entities.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-611
References: https://lists.apache.org/thread/h88oh642455wljo0p5jgzs9phk4gj878; https://lists.apache.org/thread/h88oh642455wljo0p5jgzs9phk4gj878
CVE: CVE-2022-1590
Published: 2022-05-05
Description: A vulnerability was found in Bludit 3.13.1. It has been declared as problematic. This vulnerability affects the endpoint /admin/new-content of the New Content module. The manipulation of the argument content with the input <script>alert(1)</script> leads to cross site scripting. The attack can be initiated remotely but requires an authentication. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-79
References: https://github.com/joinia/webray.com.cn/blob/main/Bludit/Bluditreadme.md; https://vuldb.com/?id.199060; https://github.com/joinia/webray.com.cn/blob/main/Bludit/Bluditreadme.md
CVE: CVE-2021-41739
Published: 2022-05-05
Description: A OS Command Injection vulnerability was discovered in Artica Proxy 4.30.000000. Attackers can execute OS commands in cyrus.events.php with GET param logs and POST param rp.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://medium.com/%40rootless724/artica-proxy-4-30-cyrus-events-php-rce-3aa2a868c695; https://medium.com/%40rootless724/artica-proxy-4-30-cyrus-events-php-rce-3aa2a868c695
CVE: CVE-2021-45783
Published: 2022-05-05
Description: Bookeen Notea Firmware BK_R_1.0.5_20210608 is affected by a directory traversal vulnerability that allows an attacker to obtain sensitive information.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-22
References: http://bookeen.com; http://packetstormsecurity.com/files/167016/Bookeen-Notea-BK_R_1.0.5_20210608-Directory-Traversal.html; https://github.com/cmaillioux/SecurityResearch/blob/main/CVE-2021-45783
CVE: CVE-2022-1411
Published: 2022-05-05
Description: Unrestructed file upload in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0. Attacker can send malicious files to the victims is able to retrieve the stored data from the web application without that data being made safe to render in the browser and steals victim's cookie leads to account takeover.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-434, CWE-434
References: https://github.com/yetiforcecompany/yetiforcecrm/commit/bf69c427260011ffca42f7b6935bb54080c54124; https://huntr.dev/bounties/75c7cf09-d118-4f91-9686-22b142772529; https://github.com/yetiforcecompany/yetiforcecrm/commit/bf69c427260011ffca42f7b6935bb54080c54124
CVE: CVE-2022-1592
Published: 2022-05-05
Description: Server-Side Request Forgery in scout in GitHub repository clinical-genomics/scout prior to v4.42. An attacker could make the application perform arbitrary requests to fishing steal cookie, request to private area, or lead to xss...
CVSS Score: 8.2 (HIGH)
CWE: CWE-918, CWE-918
References: https://github.com/clinical-genomics/scout/commit/b0ef15f4737d0c801154c1991b52ff5cab4f5c83; https://huntr.dev/bounties/352b39da-0f2e-415a-9793-5480cae8bd27; https://github.com/clinical-genomics/scout/commit/b0ef15f4737d0c801154c1991b52ff5cab4f5c83
CVE: CVE-2022-1575
Published: 2022-05-05
Description: Arbitrary Code Execution through Sanitizer Bypass in GitHub repository jgraph/drawio prior to 18.0.0. - Arbitrary (remote) code execution in the desktop app. - Stored XSS in the web app.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-94, CWE-79
References: https://github.com/jgraph/drawio/commit/f768ed73875d5eca20110b9c1d72f2789cd1bab7; https://huntr.dev/bounties/033d3423-eb05-4b53-a747-1bfcba873127; https://github.com/jgraph/drawio/commit/f768ed73875d5eca20110b9c1d72f2789cd1bab7
CVE: CVE-2022-29938
Published: 2022-05-05
Description: In LibreHealth EHR 2.0.0, lack of sanitization of the GET parameter payment_id in interface\billing\new_payment.php via interface\billing\payment_master.inc.php leads to SQL injection.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/LibreHealthIO/lh-ehr/tags; https://gitlab.com/librehealth/ehr/lh-ehr/-/tags; https://nitroteam.kz/index.php?action=researches&slug=librehealth_r
CVE: CVE-2022-29939
Published: 2022-05-05
Description: In LibreHealth EHR 2.0.0, lack of sanitization of the GET parameters debug and InsId in interface\billing\sl_eob_process.php leads to multiple cross-site scripting (XSS) vulnerabilities.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/LibreHealthIO/lh-ehr/tags; https://gitlab.com/librehealth/ehr/lh-ehr/-/tags; https://nitroteam.kz/index.php?action=researches&slug=librehealth_r
CVE: CVE-2022-29940
Published: 2022-05-05
Description: In LibreHealth EHR 2.0.0, lack of sanitization of the GET parameters formseq and formid in interface\orders\find_order_popup.php leads to multiple cross-site scripting (XSS) vulnerabilities.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/LibreHealthIO/lh-ehr/tags; https://gitlab.com/librehealth/ehr/lh-ehr/-/tags; https://nitroteam.kz/index.php?action=researches&slug=librehealth_r
CVE: CVE-2021-42242
Published: 2022-05-05
Description: A command execution vulnerability exists in jfinal_cms 5.0.1 via com.jflyfox.component.controller.Ueditor.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/jflyfox/jfinal_cms/issues/28; https://github.com/jflyfox/jfinal_cms/issues/28
CVE: CVE-2022-28461
Published: 2022-05-05
Description: mingyuefusu Library Management System all versions as of 03-27-2022 is vulnerable to SQL Injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/lanfei-4/mingyuefusu/issues/1; https://github.com/lanfei-4/mingyuefusu/issues/1
CVE: CVE-2022-28462
Published: 2022-05-05
Description: novel-plus 3.6.0 suffers from an Arbitrary file reading vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-552
References: https://github.com/201206030/novel-plus/issues/85; https://github.com/201206030/novel-plus/issues/85
CVE: CVE-2022-28471
Published: 2022-05-05
Description: In ffjpeg (commit hash: caade60), the function bmp_load() in bmp.c contains an integer overflow vulnerability, which eventually results in the heap overflow in jfif_encode() in jfif.c. This is due to the incomplete patch for issue 38
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-190
References: https://github.com/rockcarry/ffjpeg/issues/49; https://github.com/rockcarry/ffjpeg/issues/49
CVE: CVE-2022-29339
Published: 2022-05-05
Description: In GPAC 2.1-DEV-rev87-g053aae8-master, function BS_ReadByte() in utils/bitstream.c has a failed assertion, which causes a Denial of Service. This vulnerability was fixed in commit 9ea93a2.
CVSS Score: 7.5 (HIGH)
CWE: CWE-617
References: https://github.com/gpac/gpac/commit/9ea93a2ec8f555ceed1ee27294cf94822f14f10f; https://github.com/gpac/gpac/issues/2165; https://github.com/gpac/gpac/commit/9ea93a2ec8f555ceed1ee27294cf94822f14f10f
CVE: CVE-2022-29340
Published: 2022-05-05
Description: GPAC 2.1-DEV-rev87-g053aae8-master. has a Null Pointer Dereference vulnerability in gf_isom_parse_movie_boxes_internal due to improper return value handling of GF_SKIP_BOX, which causes a Denial of Service. This vulnerability was fixed in commit 37592ad.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://github.com/gpac/gpac/commit/37592ad86c6ca934d[PII_REDACTED]3e467acc4a3b0; https://github.com/gpac/gpac/issues/2163; https://github.com/gpac/gpac/commit/37592ad86c6ca934d[PII_REDACTED]3e467acc4a3b0
CVE: CVE-2021-42183
Published: 2022-05-05
Description: MasaCMS 7.2.1 is affected by a path traversal vulnerability in /index.cfm/_api/asset/image/.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://github.com/0xRaw/CVE-2021-42183; https://github.com/MasaCMS/MasaCMS; https://github.com/MasaCMS/MasaCMS/blob/9bff7989ab902b2c42499bd4d1582e30d1ec4fe9/core/mura/content/file/fileManager.cfc#L368
CVE: CVE-2022-1464
Published: 2022-05-05
Description: Stored xss bug in GitHub repository gogs/gogs prior to 0.12.7. As the repo is public , any user can view the report and when open the attachment then xss is executed. This bug allow executed any javascript code in victim account .
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/gogs/gogs/commit/bc77440b301ac8780698be91dff1ac33b7cee850; https://huntr.dev/bounties/34a12146-3a5d-4efc-a0f8-7a3ae04b198d; https://github.com/gogs/gogs/commit/bc77440b301ac8780698be91dff1ac33b7cee850
CVE: CVE-2022-1516
Published: 2022-05-05
Description: A NULL pointer dereference flaw was found in the Linux kernel’s X.25 set of standardized network protocols functionality in the way a user terminates their session using a simulated Ethernet card and continued usage of this connection. This flaw allows a local user to crash the system.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416, CWE-476
References: http://www.openwall.com/lists/oss-security/2022/06/19/1; https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=[PII_REDACTED]c8; https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html
CVE: CVE-2021-39020
Published: 2022-05-05
Description: IBM Guardium Data Encryption (GDE) 4.0.0.7 and lower stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM X-Force ID: 213855.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/213855; https://www.ibm.com/support/pages/node/6579773; https://exchange.xforce.ibmcloud.com/vulnerabilities/213855
CVE: CVE-2022-22415
Published: 2022-05-05
Description: A vulnerability exists where an IBM Robotic Process Automation 21.0.1 regular user is able to obtain view-only access to some admin pages in the Control Center IBM X-Force ID: 223029.
CVSS Score: 6.5 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/223029; https://www.ibm.com/support/pages/node/6570235; https://exchange.xforce.ibmcloud.com/vulnerabilities/223029
CVE: CVE-2022-22433
Published: 2022-05-05
Description: IBM Robotic Process Automation 21.0.1 and 21.0.2 is vulnerable to External Service Interaction attack, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability to induce the application to perform server-side DNS lookups or HTTP requests to arbitrary domain names. By submitting suitable payloads, an attacker can cause the application server to attack other systems that it can interact with. IBM X-Force ID: 224156.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/224156; https://www.ibm.com/support/pages/node/6573913; https://exchange.xforce.ibmcloud.com/vulnerabilities/224156
CVE: CVE-2022-22434
Published: 2022-05-05
Description: IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 could allow a user with physical access to create an API request modified to create additional objects. IBM X-Force ID: 224159.
CVSS Score: 4.6 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/224159; https://www.ibm.com/support/pages/node/6579959; https://exchange.xforce.ibmcloud.com/vulnerabilities/224159
CVE: CVE-2021-38423
Published: 2022-05-05
Description: All versions of GurumDDS improperly calculate the size to be used when allocating the buffer, which may result in a buffer overflow.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-131
References: https://www.cisa.gov/uscert/ics/advisories/icsa-21-315-02; https://www.cisa.gov/uscert/ics/advisories/icsa-21-315-02
CVE: CVE-2021-38425
Published: 2022-05-05
Description: eProsima Fast DDS versions prior to 2.4.0 (#2269) are susceptible to exploitation when an attacker sends a specially crafted packet to flood a target device with unwanted traffic, which may result in a denial-of-service condition and information exposure.
CVSS Score: 7.5 (HIGH)
CWE: CWE-406
References: https://github.com/eProsima/Fast-DDS; https://www.cisa.gov/uscert/ics/advisories/icsa-21-315-02; https://github.com/eProsima/Fast-DDS
CVE: CVE-2021-38427
Published: 2022-05-05
Description: RTI Connext DDS Professional and Connext DDS Secure Versions 4.2.x to 6.1.0 are vulnerable to a stack-based buffer overflow, which may allow a local attacker to execute arbitrary code.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-121, CWE-787
References: https://support.rti.com/s/login/?ec=302&startURL=%2Fs%2F; https://www.cisa.gov/uscert/ics/advisories/icsa-21-315-02; https://support.rti.com/s/login/?ec=302&startURL=%2Fs%2F
CVE: CVE-2021-38429
Published: 2022-05-05
Description: OCI OpenDDS versions prior to 3.18.1 are vulnerable when an attacker sends a specially crafted packet to flood target devices with unwanted traffic, which may result in a denial-of-service condition and information exposure.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-406
References: https://opendds.org/; https://www.cisa.gov/uscert/ics/advisories/icsa-21-315-02; https://opendds.org/
CVE: CVE-2021-38433
Published: 2022-05-05
Description: RTI Connext DDS Professional and Connext DDS Secure Versions 4.2x to 6.1.0 vulnerable to a stack-based buffer overflow, which may allow a local attacker to execute arbitrary code.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-121
References: https://support.rti.com/s/login/?ec=302&startURL=%2Fs%2F; https://www.cisa.gov/uscert/ics/advisories/icsa-21-315-02; https://support.rti.com/s/login/?ec=302&startURL=%2Fs%2F
CVE: CVE-2021-38435
Published: 2022-05-05
Description: RTI Connext DDS Professional and Connext DDS Secure Versions 4.2x to 6.1.0 not correctly calculate the size when allocating the buffer, which may result in a buffer overflow.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-131
References: https://support.rti.com/s/login/?ec=302&startURL=%2Fs%2F; https://www.cisa.gov/uscert/ics/advisories/icsa-21-315-02; https://support.rti.com/s/login/?ec=302&startURL=%2Fs%2F
CVE: CVE-2021-38439
Published: 2022-05-05
Description: All versions of GurumDDS are vulnerable to heap-based buffer overflow, which may cause a denial-of-service condition or remotely execute arbitrary code.
CVSS Score: 8.6 (HIGH)
CWE: CWE-122
References: https://www.cisa.gov/uscert/ics/advisories/icsa-21-315-02; https://www.cisa.gov/uscert/ics/advisories/icsa-21-315-02
CVE: CVE-2021-38441
Published: 2022-05-05
Description: Eclipse CycloneDDS versions prior to 0.8.0 are vulnerable to a write-what-where condition, which may allow an attacker to write arbitrary values in the XML parser.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-123
References: https://projects.eclipse.org/projects/iot.cyclonedds; https://www.cisa.gov/uscert/ics/advisories/icsa-21-315-02; https://projects.eclipse.org/projects/iot.cyclonedds
CVE: CVE-2021-38443
Published: 2022-05-05
Description: Eclipse CycloneDDS versions prior to 0.8.0 improperly handle invalid structures, which may allow an attacker to write arbitrary values in the XML parser.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-228
References: https://projects.eclipse.org/projects/iot.cyclonedds; https://www.cisa.gov/uscert/ics/advisories/icsa-21-315-02; https://projects.eclipse.org/projects/iot.cyclonedds
CVE: CVE-2021-38445
Published: 2022-05-05
Description: OCI OpenDDS versions prior to 3.18.1 do not handle a length parameter consistent with the actual length of the associated data, which may allow an attacker to remotely execute arbitrary code.
CVSS Score: 7.0 (HIGH)
CWE: CWE-130
References: https://opendds.org/; https://www.cisa.gov/uscert/ics/advisories/icsa-21-315-02; https://opendds.org/
CVE: CVE-2021-38447
Published: 2022-05-05
Description: OCI OpenDDS versions prior to 3.18.1 are vulnerable when an attacker sends a specially crafted packet to flood target devices with unwanted traffic, which may result in a denial-of-service condition.
CVSS Score: 8.6 (HIGH)
CWE: CWE-405
References: https://opendds.org/; https://www.cisa.gov/uscert/ics/advisories/icsa-21-315-02; https://opendds.org/
CVE: CVE-2021-38487
Published: 2022-05-05
Description: RTI Connext Professional versions 4.1 to 6.1.0, and Connext Micro versions 2.4 and later are vulnerable when an attacker sends a specially crafted packet to flood target devices with unwanted traffic. This may result in a denial-of-service condition and information exposure.
CVSS Score: 8.2 (HIGH)
CWE: CWE-406, CWE-923
References: https://support.rti.com/s/login/?ec=302&startURL=%2Fs%2F; https://www.cisa.gov/uscert/ics/advisories/icsa-21-315-02; https://www.rti.com/vulnerabilities/#cve-2021-38487
CVE: CVE-2021-38693
Published: 2022-05-05
Description: A path traversal vulnerability has been reported to affect QNAP device running QuTScloud, QuTS hero, QTS, QVR Pro Appliance. If exploited, this vulnerability allows attackers to read the contents of unexpected files and expose sensitive data. We have already fixed this vulnerability in the following versions of QuTScloud, QuTS hero, QTS, QVR Pro Appliance: QuTScloud c5.0.1.1949 and later QuTS hero h5.0.0.1949 build 20220215 and later QuTS hero h4.5.4.1951 build 20220218 and later QTS 5.0.0.1986 build 20220324 and later QTS 4.5.4.1991 build 20220329 and later
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://www.qnap.com/en/security-advisory/qsa-22-13; https://www.qnap.com/en/security-advisory/qsa-22-13
CVE: CVE-2021-43547
Published: 2022-05-05
Description: TwinOaks Computing CoreDX DDS versions prior to 5.9.1 are susceptible to exploitation when an attacker sends a specially crafted packet to flood target devices with unwanted traffic. This may result in a denial-of-service condition and information exposure.
CVSS Score: 7.5 (HIGH)
CWE: CWE-406
References: http://www.twinoakscomputing.com/coredx/download; https://www.cisa.gov/uscert/ics/advisories/icsa-21-315-02; http://www.twinoakscomputing.com/coredx/download
CVE: CVE-2021-44051
Published: 2022-05-05
Description: A command injection vulnerability has been reported to affect QNAP NAS running QuTScloud, QuTS hero and QTS. If exploited, this vulnerability allows remote attackers to run arbitrary commands. We have already fixed this vulnerability in the following versions of QuTScloud, QuTS hero and QTS: QuTScloud c5.0.1.1949 and later QuTS hero h5.0.0.1986 build 20220324 and later QTS 5.0.0.1986 build 20220324 and later
CVSS Score: 8.8 (HIGH)
CWE: CWE-77, CWE-77
References: https://www.qnap.com/en/security-advisory/qsa-22-16; https://www.qnap.com/en/security-advisory/qsa-22-16
CVE: CVE-2021-44052
Published: 2022-05-05
Description: An improper link resolution before file access ('Link Following') vulnerability has been reported to affect QNAP device running QuTScloud, QuTS hero, and QTS. If exploited, this vulnerability allows remote attackers to traverse the file system to unintended locations and read or overwrite the contents of unexpected files. We have already fixed this vulnerability in the following versions of QuTScloud, QuTS hero, and QTS: QuTScloud c5.0.1.1998 and later QuTS hero h4.5.4.1971 build 20220310 and later QuTS hero h5.0.0.1986 build 20220324 and later QTS 4.3.4.1976 build 20220303 and later QTS 4.3.3.1945 build 20220303 and later QTS 4.2.6 build 20220304 and later QTS 4.3.6.1965 build 20220302 and later QTS 5.0.0.1986 build 20220324 and later QTS 4.5.4.1991 build 20220329 and later
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-59, CWE-59
References: https://www.qnap.com/en/security-advisory/qsa-22-16; https://www.qnap.com/en/security-advisory/qsa-22-16
CVE: CVE-2021-44053
Published: 2022-05-05
Description: A cross-site scripting (XSS) vulnerability has been reported to affect QNAP device running QTS, QuTS hero and QuTScloud. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of QTS, QuTS hero and QuTScloud: QTS 4.5.4.1991 build 20220329 and later QTS 5.0.0.1986 build 20220324 and later QuTS hero h5.0.0.1986 build 20220324 and later QuTS hero h4.5.4.1971 build 20220310 and later QuTScloud c5.0.1.1949 and later
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.qnap.com/en/security-advisory/qsa-22-16; https://www.qnap.com/en/security-advisory/qsa-22-16
CVE: CVE-2021-44054
Published: 2022-05-05
Description: An open redirect vulnerability has been reported to affect QNAP device running QuTScloud, QuTS hero and QTS. If exploited, this vulnerability allows attackers to redirect users to an untrusted page that contains malware. We have already fixed this vulnerability in the following versions of QuTScloud, QuTS hero and QTS: QuTScloud c5.0.1.1949 and later QuTS hero h5.0.0.1949 build 20220215 and later QuTS hero h4.5.4.1951 build 20220218 and later QTS 5.0.0.1986 build 20220324 and later QTS 4.5.4.1991 build 20220329 and later
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-601, CWE-601
References: https://www.qnap.com/en/security-advisory/qsa-22-16; https://www.qnap.com/en/security-advisory/qsa-22-16
CVE: CVE-2021-44055
Published: 2022-05-05
Description: An missing authorization vulnerability has been reported to affect QNAP device running Video Station. If exploited, this vulnerability allows remote attackers to access data or perform actions that they should not be allowed to perform. We have already fixed this vulnerability in the following versions of Video Station: Video Station 5.5.9 ( 2022/02/16 ) and later
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://www.qnap.com/en/security-advisory/qsa-22-14; https://www.qnap.com/en/security-advisory/qsa-22-14
CVE: CVE-2021-44056
Published: 2022-05-05
Description: An improper authentication vulnerability has been reported to affect QNAP device running Video Station. If exploited, this vulnerability allows attackers to compromise the security of the system. We have already fixed this vulnerability in the following versions of Video Station: Video Station 5.5.9 and later Video Station 5.3.13 and later Video Station 5.1.8 and later
CVSS Score: 7.1 (HIGH)
CWE: CWE-287, CWE-287
References: https://www.qnap.com/en/security-advisory/qsa-22-14; https://www.qnap.com/en/security-advisory/qsa-22-14
CVE: CVE-2021-44057
Published: 2022-05-05
Description: An improper authentication vulnerability has been reported to affect QNAP device running Photo Station. If exploited, this vulnerability allows attackers to compromise the security of the system. We have already fixed this vulnerability in the following versions of Photo Station: Photo Station 6.0.20 ( 2022/02/15 ) and later Photo Station 5.7.16 ( 2022/02/11 ) and later Photo Station 5.4.13 ( 2022/02/11 ) and later
CVSS Score: 7.1 (HIGH)
CWE: CWE-287, CWE-287
References: https://www.qnap.com/en/security-advisory/qsa-22-15; https://www.qnap.com/en/security-advisory/qsa-22-15
CVE: CVE-2022-1388
Published: 2022-05-05
Description: On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all 12.1.x and 11.6.x versions, undisclosed requests may bypass iControl REST authentication. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306, CWE-306
References: http://packetstormsecurity.com/files/167007/F5-BIG-IP-Remote-Code-Execution.html; http://packetstormsecurity.com/files/167118/F5-BIG-IP-16.0.x-Remote-Code-Execution.html; http://packetstormsecurity.com/files/167150/F5-BIG-IP-iControl-Remote-Code-Execution.html