deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-45347
Published: 2022-02-14
Description: An Incorrect Access Control vulnerability exists in zzcms 8.2, which lets a malicious user bypass authentication by changing the user name in the cookie to use any password.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: https://github.com/forget-code/zzcms/issues/2; https://github.com/forget-code/zzcms/issues/2
CVE: CVE-2022-0579
Published: 2022-02-14
Description: Missing Authorization in Packagist snipe/snipe-it prior to 5.3.9.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://github.com/snipe/snipe-it/commit/db0c0e790892db874573d95f8ae4268b8a011ab1; https://huntr.dev/bounties/70a99cf4-3241-4ffc-b9ed-5c54932f3849; https://github.com/snipe/snipe-it/commit/db0c0e790892db874573d95f8ae4268b8a011ab1
CVE: CVE-2022-25150
Published: 2022-02-14
Description: In Malwarebytes Binisoft Windows Firewall Control before 6.8.1.0, programs executed from the Tools tab can be used to escalate privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://binisoft.org/changelog.txt; https://hackerone.com/bugs?report_id=1205932; https://binisoft.org/changelog.txt
CVE: CVE-2019-16864
Published: 2022-02-14
Description: CompleteFTPService.exe in the server in EnterpriseDT CompleteFTP before 12.1.4 allows Remote Code Execution by leveraging a Windows user account that has SSH access. The exec command is always run as SYSTEM.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: https://enterprisedt.com/products/completeftp/doc/guide/html/history.html; https://github.com/RhinoSecurityLabs/CVEs/tree/master/CVE-2019-16864; https://enterprisedt.com/products/completeftp/doc/guide/html/history.html
CVE: CVE-2021-43106
Published: 2022-02-14
Description: A Header Injection vulnerability exists in Compass Plus TranzWare Online FIMI Web Interface Tranzware Online (TWO) 5.3.33.3 F38 and FIMI 4.2.19.4 25.The HTTP host header can be manipulated and cause the application to behave in unexpected ways. Any changes made to the header would just cause the request to be sent to a completely different Domain/IP address. This is due to that the server implicitly trusts the Host header, and fails to validate or escape it properly. An attacker can use this input to redirect target users to a malicious domain/web page. This would result in expanding the potential to further attacks and malicious actions.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-116
References: https://github.com/IthacaLabs/CompassPlus/tree/main/TranzWare%20Online%20FIMI_Version%204.2.19.4%2025_HHI; https://github.com/IthacaLabs/CompassPlus/tree/main/TranzWare%20Online%20FIMI_Version%204.2.19.4%2025_HHI
CVE: CVE-2021-45348
Published: 2022-02-14
Description: An Arbitrary File Deletion vulnerability exists in SourceCodester Attendance Management System v1.0 via the csv parameter in admin/pageUploadCSV.php, which can cause a Denial of Service (crash).
CVSS Score: 7.5 (HIGH)
References: https://www.sourcecodester.com/php/14173/attendance-management-system.html#comment-96869; https://www.sourcecodester.com/php/14173/attendance-management-system.html#comment-96869
CVE: CVE-2022-24988
Published: 2022-02-14
Description: In galois_2p8 before 0.1.2, PrimitivePolynomialField::new has an off-by-one buffer overflow for a vector.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-193
References: https://github.com/djsweet/galois_2p8/blob/master/CHANGELOG.md; https://github.com/djsweet/galois_2p8/blob/master/CHANGELOG.md
CVE: CVE-2019-25057
Published: 2022-02-14
Description: In Corda before 4.1, the meaning of serialized data can be modified via an attacker-controlled CustomSerializer.
CVSS Score: 7.5 (HIGH)
References: https://docs.r3.com/en/platform/corda/4.1/open-source/release-notes.html; https://docs.r3.com/en/platform/corda/4.1/open-source/release-notes.html
CVE: CVE-2021-45310
Published: 2022-02-14
Description: Sangoma Technologies Corporation Switchvox Version 102409 is affected by an information disclosure vulnerability due to an improper access restriction. Users information such as first name, last name, acount id, server uuid, email address, profile image, number, timestamps, etc can be extracted by sending an unauthenticated HTTP GET request to the https://Switchvox-IP/main?cmd=invalid_browser.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://github.com/IthacaLabs/Sangoma/tree/main/Switchvox_Version%20102409; https://github.com/IthacaLabs/Sangoma/tree/main/Switchvox_Version%20102409
CVE: CVE-2022-22295
Published: 2022-02-14
Description: Metinfo v7.5.0 was discovered to contain a SQL injection vulnerability in parameter_admin.class.php via the table_para parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://note.youdao.com/noteshare?id=2bbcb3b4a5cd232f7a0ad47aa70f0f95&sub=1BC1FED9D3274995B3489DB645AA630B; http://note.youdao.com/noteshare?id=2bbcb3b4a5cd232f7a0ad47aa70f0f95&sub=1BC1FED9D3274995B3489DB645AA630B
CVE: CVE-2022-23335
Published: 2022-02-14
Description: Metinfo v7.5.0 was discovered to contain a SQL injection vulnerability in language_general.class.php via doModifyParameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://note.youdao.com/noteshare?id=3009926ba5c401a766901ded26c1df63; http://note.youdao.com/noteshare?id=3009926ba5c401a766901ded26c1df63
CVE: CVE-2022-23336
Published: 2022-02-14
Description: S-CMS v5.0 was discovered to contain a SQL injection vulnerability in member_pay.php via the O_id parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://note.youdao.com/noteshare?id=30c7cdeac5c7611fdf64379eb4569269; http://note.youdao.com/noteshare?id=30c7cdeac5c7611fdf64379eb4569269
CVE: CVE-2022-23337
Published: 2022-02-14
Description: DedeCMS v5.7.87 was discovered to contain a SQL injection vulnerability in article_coonepage_rule.php via the ids parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://note.youdao.com/noteshare?id=608f19009c8bd1ace5f1a59c1ddd657b; http://note.youdao.com/noteshare?id=608f19009c8bd1ace5f1a59c1ddd657b
CVE: CVE-2022-23389
Published: 2022-02-14
Description: PublicCMS v4.0 was discovered to contain a remote code execution (RCE) vulnerability via the cmdarray parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/sanluan/PublicCMS/issues/59; https://github.com/sanluan/PublicCMS/issues/59
CVE: CVE-2022-23390
Published: 2022-02-14
Description: An issue in the getType function of BBS Forum v5.3 and below allows attackers to upload arbitrary files.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://github.com/diyhi/bbs/issues/51; https://github.com/diyhi/bbs/issues/51
CVE: CVE-2022-23391
Published: 2022-02-14
Description: A cross-site scripting (XSS) vulnerability in Pybbs v6.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload inserted into the Search box.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/tomoya92/pybbs/issues/171; https://github.com/tomoya92/pybbs/issues/171
CVE: CVE-2022-23637
Published: 2022-02-14
Description: K-Box is a web-based application to manage documents, images, videos and geodata. Prior to version 0.33.1, a stored Cross-Site-Scripting (XSS) vulnerability is present in the markdown editor used by the document abstract and markdown file preview. A specifically crafted anchor link can, if clicked, execute untrusted javascript actions, like retrieving user cookies. Version 0.33.1 includes a patch that allows discarding unsafe links.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/k-box/k-box/commit/3bb4df9a4d01aade5bffaa603a514d1a5fabd214; https://github.com/k-box/k-box/security/advisories/GHSA-wwcw-h4mf-mvxf; https://github.com/k-box/k-box/commit/3bb4df9a4d01aade5bffaa603a514d1a5fabd214
CVE: CVE-2022-23638
Published: 2022-02-14
Description: svg-sanitizer is a SVG/XML sanitizer written in PHP. A cross-site scripting vulnerability impacts all users of the `svg-sanitizer` library prior to version 0.15.0. This issue is fixed in version 0.15.0. There is currently no workaround available.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-79
References: https://github.com/darylldoyle/svg-sanitizer/commit/17e12ba9c2881caa6b167d0fbea555c11207fbb0; https://github.com/darylldoyle/svg-sanitizer/security/advisories/GHSA-fqx8-v33p-4qcc; https://github.com/darylldoyle/svg-sanitizer/commit/17e12ba9c2881caa6b167d0fbea555c11207fbb0
CVE: CVE-2022-23902
Published: 2022-02-14
Description: Tongda2000 v11.10 was discovered to contain a SQL injection vulnerability in export_data.php via the d_name parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://note.youdao.com/noteshare?id=7b52ec937a029a1b2c7f994d4b174583; http://note.youdao.com/noteshare?id=7b52ec937a029a1b2c7f994d4b174583
CVE: CVE-2022-24206
Published: 2022-02-14
Description: Tongda2000 v11.10 was discovered to contain a SQL injection vulnerability in /mobile_seal/get_seal.php via the DEVICE_LIST parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://note.youdao.com/noteshare?id=87fd3a0b18abf28fccd690e97c7ea3c6; http://note.youdao.com/noteshare?id=87fd3a0b18abf28fccd690e97c7ea3c6
CVE: CVE-2021-45005
Published: 2022-02-14
Description: Artifex MuJS v1.1.3 was discovered to contain a heap buffer overflow which is caused by conflicting JumpList of nested try/finally statements.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://bugs.ghostscript.com/show_bug.cgi?id=704749; https://github.com/ccxvii/mujs/commit/df8559e7bdbc6065276e786217eeee70f28fce66; https://bugs.ghostscript.com/show_bug.cgi?id=704749
CVE: CVE-2021-46461
Published: 2022-02-14
Description: njs through 0.7.0, used in NGINX, was discovered to contain an out-of-bounds array access via njs_vmcode_typeof in /src/njs_vmcode.c.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: https://github.com/nginx/njs/commit/d457c9545e7e71ebb5c0479eb16b9d33175855e2; https://github.com/nginx/njs/issues/450; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2021-46462
Published: 2022-02-14
Description: njs through 0.7.1, used in NGINX, was discovered to contain a segmentation violation via njs_object_set_prototype in /src/njs_object.c.
CVSS Score: 7.5 (HIGH)
References: https://github.com/nginx/njs/commit/39e8fa1b7db[PII_REDACTED]f8fa0e9ee93b334ecba; https://github.com/nginx/njs/issues/449; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2021-46463
Published: 2022-02-14
Description: njs through 0.7.1, used in NGINX, was discovered to contain a control flow hijack caused by a Type Confusion vulnerability in njs_promise_perform_then().
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-843
References: https://github.com/nginx/njs/commit/6a40a85ff239497c6458c7dbef18f6a2736fe992; https://github.com/nginx/njs/issues/447; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2021-4201
Published: 2022-02-14
Description: Missing access control in ForgeRock Access Management 7.1.0 and earlier versions on all platforms allows remote unauthenticated attackers to hijack sessions, including potentially admin-level sessions. This issue affects: ForgeRock Access Management 7.1 versions prior to 7.1.1; 6.5 versions prior to 6.5.4; all previous versions.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-284, CWE-287
References: https://backstage.forgerock.com/knowledge/kb/article/a50037155#x7ZPA0; https://backstage.forgerock.com/knowledge/kb/article/a50037155#x7ZPA0
CVE: CVE-2022-0581
Published: 2022-02-14
Description: Crash in the CMS protocol dissector in Wireshark 3.6.0 to 3.6.1 and 3.4.0 to 3.4.11 allows denial of service via packet injection or crafted capture file
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-416
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0581.json; https://gitlab.com/wireshark/wireshark/-/issues/17935; https://lists.debian.org/debian-lts-announce/2022/03/msg00041.html
CVE: CVE-2022-0582
Published: 2022-02-14
Description: Unaligned access in the CSN.1 protocol dissector in Wireshark 3.6.0 to 3.6.1 and 3.4.0 to 3.4.11 allows denial of service via packet injection or crafted capture file
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-476
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0582.json; https://gitlab.com/wireshark/wireshark/-/issues/17882; https://lists.debian.org/debian-lts-announce/2022/03/msg00041.html
CVE: CVE-2022-0583
Published: 2022-02-14
Description: Crash in the PVFS protocol dissector in Wireshark 3.6.0 to 3.6.1 and 3.4.0 to 3.4.11 allows denial of service via packet injection or crafted capture file
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-787
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0583.json; https://gitlab.com/wireshark/wireshark/-/issues/17840; https://lists.debian.org/debian-lts-announce/2022/03/msg00041.html
CVE: CVE-2022-0586
Published: 2022-02-14
Description: Infinite loop in RTMPT protocol dissector in Wireshark 3.6.0 to 3.6.1 and 3.4.0 to 3.4.11 allows denial of service via packet injection or crafted capture file
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-835
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0586.json; https://gitlab.com/wireshark/wireshark/-/issues/17813; https://lists.debian.org/debian-lts-announce/2022/03/msg00041.html
CVE: CVE-2022-23410
Published: 2022-02-14
Description: AXIS IP Utility before 4.18.0 allows for remote code execution and local privilege escalation by the means of DLL hijacking. IPUtility.exe would attempt to load DLLs from its current working directory which could allow for remote code execution if a compromised DLL would be placed in the same folder.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427, CWE-427
References: https://www.axis.com/files/tech_notes/CVE-2022-23410.pdf; https://www.axis.com/files/tech_notes/CVE-2022-23410.pdf
CVE: CVE-2022-23992
Published: 2022-02-14
Description: XCOM Data Transport for Windows, Linux, and UNIX 11.6 releases contain a vulnerability due to insufficient input validation that could potentially allow remote attackers to execute arbitrary commands with elevated privileges.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/XCOM-Data-Transport---Windows-and-XCOM-Data-Transport--Linux--UNIX-Vulnerability-CVE-2022-23992/18750; https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/XCOM-Data-Transport---Windows-and-XCOM-Data-Transport--Linux--UNIX-Vulnerability-CVE-2022-23992/18750
CVE: CVE-2022-24704
Published: 2022-02-14
Description: The rad_packet_recv function in opt/src/accel-pppd/radius/packet.c suffers from a buffer overflow vulnerability, whereby user input len is copied into a fixed buffer &attr->val.integer without any bound checks. If the client connects to the server and sends a large radius packet, a buffer overflow vulnerability will be triggered.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://github.com/accel-ppp/accel-ppp/pull/35; https://github.com/accel-ppp/accel-ppp/pull/35
CVE: CVE-2022-24705
Published: 2022-02-14
Description: The rad_packet_recv function in radius/packet.c suffers from a memcpy buffer overflow, resulting in an overly-large recvfrom into a fixed buffer that causes a buffer overflow and overwrites arbitrary memory. If the server connects with a malicious client, crafted client requests can remotely trigger this vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://github.com/accel-ppp/accel-ppp/pull/35; https://github.com/accel-ppp/accel-ppp/pull/35
CVE: CVE-2022-25139
Published: 2022-02-14
Description: njs through 0.7.0, used in NGINX, was discovered to contain a heap use-after-free in njs_await_fulfilled.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: https://github.com/nginx/njs/commit/6a07c2156a07ef307b6dcf3c2ca8571a5f1af7a6; https://github.com/nginx/njs/issues/451; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2022-0580
Published: 2022-02-14
Description: Incorrect Authorization in Packagist librenms/librenms prior to 22.2.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-863, CWE-863
References: https://github.com/librenms/librenms/commit/95970af78e4c899744a715766d744deef8c505f7; https://huntr.dev/bounties/2494106c-7703-4558-bb1f-1eae59d264e3; https://notes.netbytesec.com/2022/02/multiple-vulnerabilities-in-librenms.html
CVE: CVE-2022-21818
Published: 2022-02-15
Description: NVIDIA License System contains a vulnerability in the installation scripts for the DLS virtual appliance, where a user on a network after signing in to the portal can access other users’ credentials, allowing them to gain escalated privileges, resulting in limited impact to both confidentiality and integrity.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-312, CWE-312
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5319; https://nvidia.custhelp.com/app/answers/detail/a_id/5319
CVE: CVE-2021-43952
Published: 2022-02-15
Description: Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to restore the default configuration of fields via a Cross-Site Request Forgery (CSRF) vulnerability in the /secure/admin/RestoreDefaults.jspa endpoint. The affected versions are before version 8.21.0.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://jira.atlassian.com/browse/JRASERVER-73138; https://jira.atlassian.com/browse/JRASERVER-73138
CVE: CVE-2021-43950
Published: 2022-02-15
Description: Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to view import source configuration information via a Broken Access Control vulnerability in the Insight Import Source feature. The affected versions are before version 4.21.0.
CVSS Score: 4.3 (MEDIUM)
References: https://jira.atlassian.com/browse/JSDSERVER-10983; https://jira.atlassian.com/browse/JSDSERVER-10983
CVE: CVE-2021-43953
Published: 2022-02-15
Description: Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to toggle the Thread Contention and CPU monitoring settings via a Cross-Site Request Forgery (CSRF) vulnerability in the /secure/admin/ViewInstrumentation.jspa endpoint. The affected versions are before version 8.13.16, and from version 8.14.0 before 8.20.5.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://jira.atlassian.com/browse/JRASERVER-73170; https://jira.atlassian.com/browse/JRASERVER-73170
CVE: CVE-2021-43940
Published: 2022-02-15
Description: Affected versions of Atlassian Confluence Server and Data Center allow authenticated local attackers to achieve elevated privileges on the local system via a DLL Hijacking vulnerability in the Confluence installer. This vulnerability only affects installations of Confluence Server and Data Center on Windows. The affected versions are before version 7.4.10, and from version 7.5.0 before 7.12.3.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427, CWE-427
References: https://jira.atlassian.com/browse/CONFSERVER-66550; https://jira.atlassian.com/browse/CONFSERVER-66550
CVE: CVE-2021-43941
Published: 2022-02-15
Description: Affected versions of Atlassian Jira Server and Data Center allow remote attackers to modify several resources (including CsvFieldMappingsPage.jspa and ImporterValueMappingsPage.jspa) via a Cross-Site Request Forgery (CSRF) vulnerability in the jira-importers-plugin. The affected versions are before version 8.13.15, and from version 8.14.0 before 8.20.3.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://jira.atlassian.com/browse/JRASERVER-73073; https://jira.atlassian.com/browse/JRASERVER-73073
CVE: CVE-2021-43948
Published: 2022-02-15
Description: Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to view the names of private objects via an Improper Authorization vulnerability in the "Move objects" feature. The affected versions are before version 4.21.0.
CVSS Score: 4.3 (MEDIUM)
References: https://jira.atlassian.com/browse/JSDSERVER-10981; https://jira.atlassian.com/browse/JSDSERVER-10981
CVE: CVE-2022-0587
Published: 2022-02-15
Description: Improper Authorization in Packagist librenms/librenms prior to 22.2.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-285
References: https://github.com/librenms/librenms/commit/95970af78e4c899744a715766d744deef8c505f7; https://huntr.dev/bounties/0c7c9ecd-33ac-4865-b05b-447ced735469; https://notes.netbytesec.com/2022/02/multiple-vulnerabilities-in-librenms.html
CVE: CVE-2022-0588
Published: 2022-02-15
Description: Missing Authorization in Packagist librenms/librenms prior to 22.2.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-862, CWE-862
References: https://github.com/librenms/librenms/commit/95970af78e4c899744a715766d744deef8c505f7; https://huntr.dev/bounties/caab3310-0d70-4c8a-8768-956f8dd3326d; https://notes.netbytesec.com/2022/02/multiple-vulnerabilities-in-librenms.html
CVE: CVE-2022-0589
Published: 2022-02-15
Description: Cross-site Scripting (XSS) - Stored in Packagist librenms/librenms prior to 22.1.0.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/librenms/librenms/commit/4c9d4eefd8064a0285f9718ef38f5617d7f9d6fa; https://huntr.dev/bounties/d943d95c-076f-441a-ab21-cbf6b15f6768; https://notes.netbytesec.com/2022/02/multiple-vulnerabilities-in-librenms.html
CVE: CVE-2021-46557
Published: 2022-02-15
Description: Vicidial 2.14-783a was discovered to contain a cross-site scripting (XSS) vulnerability via the input tabs.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/Zeyad-Azima/Vicidial-stored-XSS; https://github.com/Zeyad-Azima/Vicidial-stored-XSS
CVE: CVE-2021-46558
Published: 2022-02-15
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Add User module of Issabel PBX 20200102 allows attackers to execute arbitrary web scripts or HTML via a crafted payload inserted into the username and password fields.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/Zeyad-Azima/Issabel-stored-XSS; https://github.com/Zeyad-Azima/Issabel-stored-XSS
CVE: CVE-2022-23317
Published: 2022-02-15
Description: CobaltStrike <=4.5 HTTP(S) listener does not determine whether the request URL begins with "/", and attackers can obtain relevant information by specifying the URL.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: https://donghuangt1.com/writings/Stager/; https://donghuangt1.com/writings/Stager/
CVE: CVE-2022-23384
Published: 2022-02-15
Description: YzmCMS v6.3 is affected by Cross Site Request Forgery (CSRF) in /admin.add
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/yzmcms/yzmcms/issues/58; https://github.com/yzmcms/yzmcms/issues/58
CVE: CVE-2021-41552
Published: 2022-02-15
Description: CommScope SURFboard SBG6950AC2 9.1.103AA23 devices allow Command Injection.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: https://arris.my.salesforce.com/sfc/p/#30000000kUAL/a/4Q000000Raud/cRx46eSijpwhTpoeWSgB1dQehSMwFrLV1gurcqI35QY; https://commscope.com; https://arris.my.salesforce.com/sfc/p/#30000000kUAL/a/4Q000000Raud/cRx46eSijpwhTpoeWSgB1dQehSMwFrLV1gurcqI35QY
CVE: CVE-2021-42712
Published: 2022-02-15
Description: Splashtop Streamer through 3.4.8.3 creates a Temporary File in a Directory with Insecure Permissions.
CVSS Score: 7.8 (HIGH)
CWE: CWE-668
References: https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2022/MNDT-2022-0007/MNDT-2022-0007.md; https://www.splashtop.com/security; https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2022/MNDT-2022-0007/MNDT-2022-0007.md
CVE: CVE-2021-43734
Published: 2022-02-15
Description: kkFileview v4.0.0 has arbitrary file read through a directory traversal vulnerability which may lead to sensitive file leak on related host.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://github.com/kekingcn/kkFileView/issues/304; https://github.com/kekingcn/kkFileView/issues/304
CVE: CVE-2022-0596
Published: 2022-02-15
Description: Improper Validation of Specified Quantity in Input in Packagist microweber/microweber prior to 1.2.11.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-1284, CWE-1284
References: https://github.com/microweber/microweber/commit/91a9d899741557c75050614ff7adb8c0e3feb005; https://huntr.dev/bounties/f68b994e-2b8b-49f5-af2a-8cd99e8048a5; https://github.com/microweber/microweber/commit/91a9d899741557c75050614ff7adb8c0e3feb005