deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-0347
Published: 2022-03-07
Description: The LoginPress | Custom Login Page Customizer WordPress plugin before 1.5.12 does not escape the redirect-page parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://wpscan.com/vulnerability/a5084367-842b-496a-a23c-24dbebac1e8b; https://wpscan.com/vulnerability/a5084367-842b-496a-a23c-24dbebac1e8b
CVE: CVE-2022-0349
Published: 2022-03-07
Description: The NotificationX WordPress plugin before 2.3.9 does not sanitise and escape the nx_id parameter before using it in a SQL statement, leading to an Unauthenticated Blind SQL Injection
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://wpscan.com/vulnerability/1d0dd7be-29f3-4043-a9c6-67d02746463a; https://wpscan.com/vulnerability/1d0dd7be-29f3-4043-a9c6-67d02746463a
CVE: CVE-2022-0384
Published: 2022-03-07
Description: The Video Conferencing with Zoom WordPress plugin before 3.8.17 does not have authorisation in its vczapi_get_wp_users AJAX action, allowing any authenticated users, such as subscriber to download the list of email addresses registered on the blog
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://plugins.trac.wordpress.org/changeset/2671219; https://wpscan.com/vulnerability/91c44c45-994b-4aed-b9f9-7db45924eeb4; https://plugins.trac.wordpress.org/changeset/2671219
CVE: CVE-2022-0389
Published: 2022-03-07
Description: The WP Time Slots Booking Form WordPress plugin before 1.1.63 does not sanitise and escape Calendar names, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://wpscan.com/vulnerability/788ead78-9aa2-49a3-b191-12114be8270b; https://wpscan.com/vulnerability/788ead78-9aa2-49a3-b191-12114be8270b
CVE: CVE-2022-0410
Published: 2022-03-07
Description: The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 5.6 does not sanitise and escape the id parameter before using it in a SQL statement via the refUrlDetails AJAX action, available to any authenticated user, leading to a SQL injection
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://wpscan.com/vulnerability/0d6b89f5-cf12-4ad4-831b-fed26763ba20; https://wpscan.com/vulnerability/0d6b89f5-cf12-4ad4-831b-fed26763ba20
CVE: CVE-2022-0420
Published: 2022-03-07
Description: The RegistrationMagic WordPress plugin before 5.0.2.2 does not sanitise and escape the rm_form_id parameter before using it in a SQL statement in the Automation admin dashboard, allowing high privilege users to perform SQL injection attacks
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://plugins.trac.wordpress.org/changeset/2672042; https://wpscan.com/vulnerability/056b5167-3cbc-47d1-9917-52a434796151; https://plugins.trac.wordpress.org/changeset/2672042
CVE: CVE-2022-0422
Published: 2022-03-07
Description: The White Label CMS WordPress plugin before 2.2.9 does not sanitise and validate the wlcms[_login_custom_js] parameter before outputting it back in the response while previewing, leading to a Reflected Cross-Site Scripting issue
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset/2672615; https://wpscan.com/vulnerability/429be4eb-8a6b-4531-9465-9ef0d35c12cc; https://plugins.trac.wordpress.org/changeset/2672615
CVE: CVE-2022-0426
Published: 2022-03-07
Description: The Product Feed PRO for WooCommerce WordPress plugin before 11.2.3 does not escape the rowCount parameter before outputting it back in an attribute via the woosea_categories_dropdown AJAX action (available to any authenticated user), leading to a Reflected Cross-Site Scripting
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset/2670405; https://wpscan.com/vulnerability/de69bcd1-b0b1-4b16-9655-776ee57ad90a; https://plugins.trac.wordpress.org/changeset/2670405
CVE: CVE-2022-0429
Published: 2022-03-07
Description: The WP Cerber Security, Anti-spam & Malware Scan WordPress plugin before 8.9.6 does not sanitise the $url variable before using it in an attribute in the Activity tab in the plugins dashboard, leading to an unauthenticated stored Cross-Site Scripting vulnerability.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://wpscan.com/vulnerability/d1b6f438-f737-4b18-89cf-161238a7421b; https://wpscan.com/vulnerability/d1b6f438-f737-4b18-89cf-161238a7421b
CVE: CVE-2022-0434
Published: 2022-03-07
Description: The Page View Count WordPress plugin before 2.4.15 does not sanitise and escape the post_ids parameter before using it in a SQL statement via a REST endpoint, available to both unauthenticated and authenticated users. As a result, unauthenticated attackers could perform SQL injection attacks
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://wpscan.com/vulnerability/be[PII_REDACTED]-4ce4-a54f-f36d0ef2d6f1; https://wpscan.com/vulnerability/be[PII_REDACTED]-4ce4-a54f-f36d0ef2d6f1
CVE: CVE-2022-0439
Published: 2022-03-07
Description: The Email Subscribers & Newsletters WordPress plugin before 5.3.2 does not correctly escape the `order` and `orderby` parameters to the `ajax_fetch_report_list` action, making it vulnerable to blind SQL injection attacks by users with roles as low as Subscriber. Further, it does not have any CSRF protection in place for the action, allowing an attacker to trick any logged in user to perform the action by clicking a link.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-352
References: https://wpscan.com/vulnerability/729d3e67-d081-4a4e-ac1e-f6b0a184f095; https://wpscan.com/vulnerability/729d3e67-d081-4a4e-ac1e-f6b0a184f095
CVE: CVE-2022-0440
Published: 2022-03-07
Description: The Catch Themes Demo Import WordPress plugin before 2.1.1 does not validate one of the file to be imported, which could allow high privivilege admin to upload an arbitrary PHP file and gain RCE even in the case of an hardened blog (ie DISALLOW_UNFILTERED_HTML, DISALLOW_FILE_EDIT and DISALLOW_FILE_MODS constants set to true)
CVSS Score: 7.2 (HIGH)
CWE: CWE-434, CWE-434
References: https://wpscan.com/vulnerability/2239095f-8a66-4a5d-ab49-1662a40fddf1; https://wpscan.com/vulnerability/2239095f-8a66-4a5d-ab49-1662a40fddf1
CVE: CVE-2022-0441
Published: 2022-03-07
Description: The MasterStudy LMS WordPress plugin before 2.7.6 does to validate some parameters given when registering a new account, allowing unauthenticated users to register as an admin
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-269
References: https://plugins.trac.wordpress.org/changeset/2667195; https://wpscan.com/vulnerability/173c2efe-ee9c-4539-852f-c242b4f728ed; https://plugins.trac.wordpress.org/changeset/2667195
CVE: CVE-2022-0442
Published: 2022-03-07
Description: The UsersWP WordPress plugin before 1.2.3.1 is missing access controls when updating a user avatar, and does not make sure file names for user avatars are unique, allowing a logged in user to overwrite another users avatar.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-639, CWE-639
References: https://wpscan.com/vulnerability/9cf0822a-c9d6-4ebc-b905-95b143d1a692; https://wpscan.com/vulnerability/9cf0822a-c9d6-4ebc-b905-95b143d1a692
CVE: CVE-2022-0445
Published: 2022-03-07
Description: The WordPress Real Cookie Banner: GDPR (DSGVO) & ePrivacy Cookie Consent WordPress plugin before 2.14.2 does not have CSRF checks in place when resetting its settings, allowing attackers to make a logged in admin reset them via a CSRF attack
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://wpscan.com/vulnerability/d9f28255-0026-4c42-9e67-d17b618c2285; https://wpscan.com/vulnerability/d9f28255-0026-4c42-9e67-d17b618c2285
CVE: CVE-2022-0448
Published: 2022-03-07
Description: The CP Blocks WordPress plugin before 1.0.15 does not sanitise and escape its "License ID" settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://wpscan.com/vulnerability/d4ff63ee-28e6-486e-9aa7-c878b97f707c; https://wpscan.com/vulnerability/d4ff63ee-28e6-486e-9aa7-c878b97f707c
CVE: CVE-2022-0533
Published: 2022-03-07
Description: The Ditty (formerly Ditty News Ticker) WordPress plugin before 3.0.15 is affected by a Reflected Cross-Site Scripting (XSS) vulnerability.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset/2675223/ditty-news-ticker; https://wpscan.com/vulnerability/40f36692-c898-4441-ad24-2dc17856bd74; https://plugins.trac.wordpress.org/changeset/2675223/ditty-news-ticker
CVE: CVE-2022-0535
Published: 2022-03-07
Description: The E2Pdf WordPress plugin before 1.16.45 does not sanitise and escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset/2675049/e2pdf; https://wpscan.com/vulnerability/a4162e96-a3c5-4f38-a60b-aa3ed9508985; https://plugins.trac.wordpress.org/changeset/2675049/e2pdf
CVE: CVE-2021-4198
Published: 2022-03-07
Description: A NULL Pointer Dereference vulnerability in the messaging_ipc.dll component as used in Bitdefender Total Security, Internet Security, Antivirus Plus, Endpoint Security Tools, VPN Standalone allows an attacker to arbitrarily crash product processes and generate crashdump files. This issue affects: Bitdefender Total Security versions prior to 26.0.3.29. Bitdefender Internet Security versions prior to 26.0.3.29. Bitdefender Antivirus Plus versions prior to 26.0.3.29. Bitdefender Endpoint Security Tools versions prior to 7.2.2.92. Bitdefender VPN Standalone versions prior to 25.5.0.48.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://www.bitdefender.com/support/security-advisories/messaging_ipc-dll-null-pointer-dereference-in-multiple-bitdefender-products-va-10016/; https://www.zerodayinitiative.com/advisories/ZDI-22-483/; https://www.bitdefender.com/support/security-advisories/messaging_ipc-dll-null-pointer-dereference-in-multiple-bitdefender-products-va-10016/
CVE: CVE-2021-4199
Published: 2022-03-07
Description: Incorrect Permission Assignment for Critical Resource vulnerability in the crash handling component BDReinit.exe as used in Bitdefender Total Security, Internet Security, Antivirus Plus, Endpoint Security Tools for Windows allows a remote attacker to escalate local privileges to SYSTEM. This issue affects: Bitdefender Total Security versions prior to 26.0.10.45. Bitdefender Internet Security versions prior to 26.0.10.45. Bitdefender Antivirus Plus versions prior to 26.0.10.45. Bitdefender Endpoint Security Tools for Windows versions prior to 7.4.3.146.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732, CWE-732
References: https://www.bitdefender.com/support/security-advisories/incorrect-permission-assignment-for-critical-resource-vulnerability-in-bdreinit-exe-va-10017/; https://www.zerodayinitiative.com/advisories/ZDI-22-484/; https://www.bitdefender.com/support/security-advisories/incorrect-permission-assignment-for-critical-resource-vulnerability-in-bdreinit-exe-va-10017/
CVE: CVE-2022-0754
Published: 2022-03-07
Description: SQL Injection in GitHub repository salesagility/suitecrm prior to 7.12.5.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://github.com/salesagility/suitecrm/commit/e93b269f637de313f45b32c58cef5ec012a34f58; https://huntr.dev/bounties/8afb7991-c6ed-42d9-bd9b-1cc83418df88; https://github.com/salesagility/suitecrm/commit/e93b269f637de313f45b32c58cef5ec012a34f58
CVE: CVE-2022-0755
Published: 2022-03-07
Description: Missing Authorization in GitHub repository salesagility/suitecrm prior to 7.12.5.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://github.com/salesagility/suitecrm/commit/e93b269f637de313f45b32c58cef5ec012a34f58; https://huntr.dev/bounties/cc767dbc-c676-44c1-a9d1-cd17ae77ee7e; https://github.com/salesagility/suitecrm/commit/e93b269f637de313f45b32c58cef5ec012a34f58
CVE: CVE-2022-0756
Published: 2022-03-07
Description: Missing Authorization in GitHub repository salesagility/suitecrm prior to 7.12.5.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://github.com/salesagility/suitecrm/commit/e93b269f637de313f45b32c58cef5ec012a34f58; https://huntr.dev/bounties/55164a63-62e4-4fb6-b4ca-87eca14f6f31; https://github.com/salesagility/suitecrm/commit/e93b269f637de313f45b32c58cef5ec012a34f58
CVE: CVE-2021-38988
Published: 2022-03-07
Description: IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the AIX kernel to cause a denial of service. IBM X-Force ID: 212950.
CVSS Score: 5.5 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/212950; https://www.ibm.com/support/pages/node/6561281; https://exchange.xforce.ibmcloud.com/vulnerabilities/212950
CVE: CVE-2021-38989
Published: 2022-03-07
Description: IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the AIX kernel to cause a denial of service. IBM X-Force ID: 212951.
CVSS Score: 5.5 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/212951; https://www.ibm.com/support/pages/node/6561277; https://exchange.xforce.ibmcloud.com/vulnerabilities/212951
CVE: CVE-2022-22351
Published: 2022-03-07
Description: IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged trusted host user to exploit a vulnerability in the nimsh daemon to cause a denial of service in the nimsh daemon on another trusted host. IBM X-Force ID: 220396
CVSS Score: 8.6 (HIGH)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/220396; https://www.ibm.com/support/pages/node/6561275; https://exchange.xforce.ibmcloud.com/vulnerabilities/220396
CVE: CVE-2022-24738
Published: 2022-03-07
Description: Evmos is the Ethereum Virtual Machine (EVM) Hub on the Cosmos Network. In versions of evmos prior to 2.0.1 attackers are able to drain unclaimed funds from user addresses. To do this an attacker must create a new chain which does not enforce signature verification and connects it to the target evmos instance. The attacker can use this joined chain to transfer unclaimed funds. Users are advised to upgrade. There are no known workarounds for this issue.
CVSS Score: 8.1 (HIGH)
CWE: CWE-287, CWE-287
References: https://github.com/tharsis/evmos/commit/28870258d4ee9f1b8aeef5eba891681f89348f71; https://github.com/tharsis/evmos/releases/tag/v2.0.1; https://github.com/tharsis/evmos/security/advisories/GHSA-5jgq-x857-p8xw
CVE: CVE-2022-24737
Published: 2022-03-07
Description: HTTPie is a command-line HTTP client. HTTPie has the practical concept of sessions, which help users to persistently store some of the state that belongs to the outgoing requests and incoming responses on the disk for further usage. Before 3.1.0, HTTPie didn‘t distinguish between cookies and hosts they belonged. This behavior resulted in the exposure of some cookies when there are redirects originating from the actual host to a third party website. Users are advised to upgrade. There are no known workarounds.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://github.com/httpie/httpie/commit/65ab7d5caaaf2f95e61f9dd65441801c2ddee38b; https://github.com/httpie/httpie/releases/tag/3.1.0; https://github.com/httpie/httpie/security/advisories/GHSA-9w4w-cpc8-h2fq
CVE: CVE-2021-36809
Published: 2022-03-08
Description: A local attacker can overwrite arbitrary files on the system with VPN client logs using administrator privileges, potentially resulting in a denial of service and data loss, in all versions of Sophos SSL VPN client.
CVSS Score: 6.1 (MEDIUM)
References: https://www.sophos.com/en-us/security-advisories/sophos-sa-20220303-sslvpn-local-dos; https://www.sophos.com/en-us/security-advisories/sophos-sa-20220303-sslvpn-local-dos
CVE: CVE-2021-43944
Published: 2022-03-08
Description: This issue exists to document that a security improvement in the way that Jira Server and Data Center use templates has been implemented. Affected versions of Atlassian Jira Server and Data Center allowed remote attackers with system administrator permissions to execute arbitrary code via Template Injection leading to Remote Code Execution (RCE) in the Email Templates feature. The affected versions are before version 8.13.15, and from version 8.14.0 before 8.20.3.
CVSS Score: 7.2 (HIGH)
CWE: CWE-94, CWE-94
References: https://jira.atlassian.com/browse/JRASERVER-73072; https://jira.atlassian.com/browse/JRASERVER-73072
CVE: CVE-2021-41541
Published: 2022-03-08
Description: A vulnerability has been identified in Climatix POL909 (AWB module) (All versions < V11.44), Climatix POL909 (AWM module) (All versions < V11.36). The Group Management page of affected devices is vulnerable to cross-site scripting (XSS). The vulnerability allows an attacker to send malicious JavaScript code which could result in hijacking of the user's cookie/session tokens, redirecting the user to a malicious webpage and performing unintended browser action.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://cert-portal.siemens.com/productcert/pdf/ssa-252466.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-252466.pdf
CVE: CVE-2021-41542
Published: 2022-03-08
Description: A vulnerability has been identified in Climatix POL909 (AWB module) (All versions < V11.44), Climatix POL909 (AWM module) (All versions < V11.36). The User Management page of affected devices is vulnerable to cross-site scripting (XSS). The vulnerability allows an attacker to send malicious JavaScript code which could result in hijacking of the user's cookie/session tokens, redirecting the user to a malicious webpage and performing unintended browser action.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://cert-portal.siemens.com/productcert/pdf/ssa-252466.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-252466.pdf
CVE: CVE-2021-41543
Published: 2022-03-08
Description: A vulnerability has been identified in Climatix POL909 (AWB module) (All versions < V11.44), Climatix POL909 (AWM module) (All versions < V11.36). The handling of log files in the web application of affected devices contains an information disclosure vulnerability which could allow logged in users to access sensitive files.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284, CWE-532
References: https://cert-portal.siemens.com/productcert/pdf/ssa-252466.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-252466.pdf
CVE: CVE-2021-42016
Published: 2022-03-08
Description: A vulnerability has been identified in RUGGEDCOM i800, RUGGEDCOM i801, RUGGEDCOM i802, RUGGEDCOM i803, RUGGEDCOM M2100, RUGGEDCOM M2100F, RUGGEDCOM M2200, RUGGEDCOM M2200F, RUGGEDCOM M969, RUGGEDCOM M969F, RUGGEDCOM RMC30, RUGGEDCOM RMC8388 V4.X, RUGGEDCOM RMC8388 V5.X, RUGGEDCOM RP110, RUGGEDCOM RS1600, RUGGEDCOM RS1600F, RUGGEDCOM RS1600T, RUGGEDCOM RS400, RUGGEDCOM RS400F, RUGGEDCOM RS401, RUGGEDCOM RS416, RUGGEDCOM RS416F, RUGGEDCOM RS416P, RUGGEDCOM RS416PF, RUGGEDCOM RS416Pv2 V4.X, RUGGEDCOM RS416Pv2 V5.X, RUGGEDCOM RS416v2 V4.X, RUGGEDCOM RS416v2 V5.X, RUGGEDCOM RS8000, RUGGEDCOM RS8000A, RUGGEDCOM RS8000H, RUGGEDCOM RS8000T, RUGGEDCOM RS900, RUGGEDCOM RS900 (32M) V4.X, RUGGEDCOM RS900 (32M) V5.X, RUGGEDCOM RS900F, RUGGEDCOM RS900G, RUGGEDCOM RS900G (32M) V4.X, RUGGEDCOM RS900G (32M) V5.X, RUGGEDCOM RS900GF, RUGGEDCOM RS900GP, RUGGEDCOM RS900GPF, RUGGEDCOM RS900L, RUGGEDCOM RS900M-GETS-C01, RUGGEDCOM RS900M-GETS-XX, RUGGEDCOM RS900M-STND-C01, RUGGEDCOM RS900M-STND-XX, RUGGEDCOM RS900W, RUGGEDCOM RS910, RUGGEDCOM RS910L, RUGGEDCOM RS910W, RUGGEDCOM RS920L, RUGGEDCOM RS920W, RUGGEDCOM RS930L, RUGGEDCOM RS930W, RUGGEDCOM RS940G, RUGGEDCOM RS940GF, RUGGEDCOM RS969, RUGGEDCOM RSG2100, RUGGEDCOM RSG2100 (32M) V4.X, RUGGEDCOM RSG2100 (32M) V5.X, RUGGEDCOM RSG2100F, RUGGEDCOM RSG2100P, RUGGEDCOM RSG2100P (32M) V4.X, RUGGEDCOM RSG2100P (32M) V5.X, RUGGEDCOM RSG2100PF, RUGGEDCOM RSG2200, RUGGEDCOM RSG2200F, RUGGEDCOM RSG2288 V4.X, RUGGEDCOM RSG2288 V5.X, RUGGEDCOM RSG2300 V4.X, RUGGEDCOM RSG2300 V5.X, RUGGEDCOM RSG2300F, RUGGEDCOM RSG2300P V4.X, RUGGEDCOM RSG2300P V5.X, RUGGEDCOM RSG2300PF, RUGGEDCOM RSG2488 V4.X, RUGGEDCOM RSG2488 V5.X, RUGGEDCOM RSG2488F, RUGGEDCOM RSG907R, RUGGEDCOM RSG908C, RUGGEDCOM RSG909R, RUGGEDCOM RSG910C, RUGGEDCOM RSG920P V4.X, RUGGEDCOM RSG920P V5.X, RUGGEDCOM RSL910, RUGGEDCOM RST2228, RUGGEDCOM RST2228P, RUGGEDCOM RST916C, RUGGEDCOM RST916P. A timing attack, in a third-party component, could make the retrieval of the private key possible, used for encryption of sensitive data. 

If a threat actor were to exploit this, the data integrity and security could be compromised.
CVSS Score: 7.5 (HIGH)
CWE: CWE-208, CWE-203
References: https://cert-portal.siemens.com/productcert/html/ssa-256353.html; https://cert-portal.siemens.com/productcert/pdf/ssa-256353.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-256353.pdf
CVE: CVE-2021-42017
Published: 2022-03-08
Description: A vulnerability has been identified in RUGGEDCOM i800, RUGGEDCOM i801, RUGGEDCOM i802, RUGGEDCOM i803, RUGGEDCOM M2100, RUGGEDCOM M2100F, RUGGEDCOM M2200, RUGGEDCOM M2200F, RUGGEDCOM M969, RUGGEDCOM M969F, RUGGEDCOM RMC30, RUGGEDCOM RMC8388 V4.X, RUGGEDCOM RMC8388 V5.X, RUGGEDCOM RP110, RUGGEDCOM RS1600, RUGGEDCOM RS1600F, RUGGEDCOM RS1600T, RUGGEDCOM RS400, RUGGEDCOM RS400F, RUGGEDCOM RS401, RUGGEDCOM RS416, RUGGEDCOM RS416F, RUGGEDCOM RS416P, RUGGEDCOM RS416PF, RUGGEDCOM RS416Pv2 V4.X, RUGGEDCOM RS416Pv2 V5.X, RUGGEDCOM RS416v2 V4.X, RUGGEDCOM RS416v2 V5.X, RUGGEDCOM RS8000, RUGGEDCOM RS8000A, RUGGEDCOM RS8000H, RUGGEDCOM RS8000T, RUGGEDCOM RS900, RUGGEDCOM RS900 (32M) V4.X, RUGGEDCOM RS900 (32M) V5.X, RUGGEDCOM RS900F, RUGGEDCOM RS900G, RUGGEDCOM RS900G (32M) V4.X, RUGGEDCOM RS900G (32M) V5.X, RUGGEDCOM RS900GF, RUGGEDCOM RS900GP, RUGGEDCOM RS900GPF, RUGGEDCOM RS900L, RUGGEDCOM RS900M-GETS-C01, RUGGEDCOM RS900M-GETS-XX, RUGGEDCOM RS900M-STND-C01, RUGGEDCOM RS900M-STND-XX, RUGGEDCOM RS900W, RUGGEDCOM RS910, RUGGEDCOM RS910L, RUGGEDCOM RS910W, RUGGEDCOM RS920L, RUGGEDCOM RS920W, RUGGEDCOM RS930L, RUGGEDCOM RS930W, RUGGEDCOM RS940G, RUGGEDCOM RS940GF, RUGGEDCOM RS969, RUGGEDCOM RSG2100, RUGGEDCOM RSG2100 (32M) V4.X, RUGGEDCOM RSG2100 (32M) V5.X, RUGGEDCOM RSG2100F, RUGGEDCOM RSG2100P, RUGGEDCOM RSG2100P (32M) V4.X, RUGGEDCOM RSG2100P (32M) V5.X, RUGGEDCOM RSG2100PF, RUGGEDCOM RSG2200, RUGGEDCOM RSG2200F, RUGGEDCOM RSG2288 V4.X, RUGGEDCOM RSG2288 V5.X, RUGGEDCOM RSG2300 V4.X, RUGGEDCOM RSG2300 V5.X, RUGGEDCOM RSG2300F, RUGGEDCOM RSG2300P V4.X, RUGGEDCOM RSG2300P V5.X, RUGGEDCOM RSG2300PF, RUGGEDCOM RSG2488 V4.X, RUGGEDCOM RSG2488 V5.X, RUGGEDCOM RSG2488F, RUGGEDCOM RSG907R, RUGGEDCOM RSG908C, RUGGEDCOM RSG909R, RUGGEDCOM RSG910C, RUGGEDCOM RSG920P V4.X, RUGGEDCOM RSG920P V5.X, RUGGEDCOM RSL910, RUGGEDCOM RST2228, RUGGEDCOM RST2228P, RUGGEDCOM RST916C, RUGGEDCOM RST916P. A new variant of the POODLE attack has left a third-party component vulnerable due to the implementation flaws of the CBC encryption mode in TLS 1.0 to 1.2.

If an attacker were to exploit this, they could act as a man-in-the-middle and eavesdrop on encrypted communications.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-358, CWE-295
References: https://cert-portal.siemens.com/productcert/html/ssa-256353.html; https://cert-portal.siemens.com/productcert/pdf/ssa-256353.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-256353.pdf
CVE: CVE-2021-44478
Published: 2022-03-08
Description: A vulnerability has been identified in Polarion ALM (All versions < V21 R2 P2), Polarion WebClient for SVN (All versions). A cross-site scripting is present due to improper neutralization of data sent to the web page through the SVN WebClient in the affected product. An attacker could exploit this to execute arbitrary code and extract sensitive information by sending a specially crafted link to users with administrator privileges.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://cert-portal.siemens.com/productcert/pdf/ssa-562051.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-562051.pdf