deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-25207
Published: 2022-02-15
Description: A cross-site request forgery (CSRF) vulnerability in Jenkins Chef Sinatra Plugin 1.20 and earlier allows attackers to have Jenkins send an HTTP request to an attacker-controlled URL and have it parse an XML response.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://www.openwall.com/lists/oss-security/2022/02/15/2; https://www.jenkins.io/security/advisory/2022-02-15/#SECURITY-1377; http://www.openwall.com/lists/oss-security/2022/02/15/2
CVE: CVE-2022-25208
Published: 2022-02-15
Description: A missing permission check in Jenkins Chef Sinatra Plugin 1.20 and earlier allows attackers with Overall/Read permission to have Jenkins send an HTTP request to an attacker-controlled URL and have it parse an XML response.
CVSS Score: 8.8 (HIGH)
CWE: CWE-862
References: http://www.openwall.com/lists/oss-security/2022/02/15/2; https://www.jenkins.io/security/advisory/2022-02-15/#SECURITY-1377; http://www.openwall.com/lists/oss-security/2022/02/15/2
CVE: CVE-2022-25209
Published: 2022-02-15
Description: Jenkins Chef Sinatra Plugin 1.20 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVSS Score: 8.8 (HIGH)
CWE: CWE-611
References: https://www.jenkins.io/security/advisory/2022-02-15/#SECURITY-1377; https://www.jenkins.io/security/advisory/2022-02-15/#SECURITY-1377
CVE: CVE-2022-25210
Published: 2022-02-15
Description: Jenkins Convertigo Mobile Platform Plugin 1.1 and earlier uses static fields to store job configuration information, allowing attackers with Item/Configure permission to capture passwords of the jobs that will be configured.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-662
References: https://www.jenkins.io/security/advisory/2022-02-15/#SECURITY-2280; https://www.jenkins.io/security/advisory/2022-02-15/#SECURITY-2280
CVE: CVE-2022-25211
Published: 2022-02-15
Description: A missing permission check in Jenkins SWAMP Plugin 1.2.6 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified web server using attacker-specified credentials.
CVSS Score: 8.8 (HIGH)
CWE: CWE-862
References: https://www.jenkins.io/security/advisory/2022-02-15/#SECURITY-1988; https://www.jenkins.io/security/advisory/2022-02-15/#SECURITY-1988
CVE: CVE-2022-25212
Published: 2022-02-15
Description: A cross-site request forgery (CSRF) vulnerability in Jenkins SWAMP Plugin 1.2.6 and earlier allows attackers to connect to an attacker-specified web server using attacker-specified credentials.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://www.jenkins.io/security/advisory/2022-02-15/#SECURITY-1988; https://www.jenkins.io/security/advisory/2022-02-15/#SECURITY-1988
CVE: CVE-2021-43049
Published: 2022-02-15
Description: The Database component of TIBCO Software Inc.'s TIBCO BusinessConnect Container Edition contains an easily exploitable vulnerability that allows an unauthenticated attacker with network access to obtain the usernames and passwords of users of the affected system. Affected releases are TIBCO Software Inc.'s TIBCO BusinessConnect Container Edition: versions 1.1.0 and below.
CVSS Score: 9.8 (CRITICAL)
References: https://www.tibco.com/services/support/advisories; https://www.tibco.com/support/advisories/2022/01/tibco-security-advisory-february-15-2022-tibco-bcce-2021-43049; https://www.tibco.com/services/support/advisories
CVE: CVE-2021-43050
Published: 2022-02-15
Description: The Auth Server component of TIBCO Software Inc.'s TIBCO BusinessConnect Container Edition contains an easily exploitable vulnerability that allows an unauthenticated attacker with local access to obtain administrative usernames and passwords for the affected system. Affected releases are TIBCO Software Inc.'s TIBCO BusinessConnect Container Edition: versions 1.1.0 and below.
CVSS Score: 8.4 (HIGH)
References: https://www.tibco.com/services/support/advisories; https://www.tibco.com/support/advisories/2022/01/tibco-security-advisory-february-15-2022-tibco-bcce-2021-43050; https://www.tibco.com/services/support/advisories
CVE: CVE-2022-22770
Published: 2022-02-15
Description: The Web Server component of TIBCO Software Inc.'s TIBCO AuditSafe contains an easily exploitable vulnerability that allows an unauthenticated attacker with network access to execute API methods on the affected system. Affected releases are TIBCO Software Inc.'s TIBCO AuditSafe: versions 1.1.0 and below.
CVSS Score: 9.8 (CRITICAL)
References: https://www.tibco.com/services/support/advisories; https://www.tibco.com/services/support/advisories
CVE: CVE-2021-42713
Published: 2022-02-15
Description: Splashtop Remote Client (Personal Edition) through 3.4.6.1 creates a Temporary File in a Directory with Insecure Permissions.
CVSS Score: 7.8 (HIGH)
CWE: CWE-668
References: https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2022/MNDT-2022-0006/MNDT-2022-0006.md; https://www.splashtop.com/security; https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2022/MNDT-2022-0006/MNDT-2022-0006.md
CVE: CVE-2021-42714
Published: 2022-02-15
Description: Splashtop Remote Client (Business Edition) through 3.4.8.3 creates a Temporary File in a Directory with Insecure Permissions.
CVSS Score: 7.8 (HIGH)
CWE: CWE-668
References: https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2022/MNDT-2022-0005/MNDT-2022-0005.md; https://www.splashtop.com/security; https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2022/MNDT-2022-0005/MNDT-2022-0005.md
CVE: CVE-2022-23639
Published: 2022-02-15
Description: crossbeam-utils provides atomics, synchronization primitives, scoped threads, and other utilities for concurrent programming in Rust. crossbeam-utils prior to version 0.8.7 incorrectly assumed that the alignment of `{i,u}64` was always the same as `Atomic{I,U}64`. However, the alignment of `{i,u}64` on a 32-bit target can be smaller than `Atomic{I,U}64`. This can cause unaligned memory accesses and data race. Crates using `fetch_*` methods with `AtomicCell<{i,u}64>` are affected by this issue. 32-bit targets without `Atomic{I,U}64` and 64-bit targets are not affected by this issue. This has been fixed in crossbeam-utils 0.8.7. There are currently no known workarounds.
CVSS Score: 8.1 (HIGH)
CWE: CWE-362
References: https://github.com/crossbeam-rs/crossbeam/pull/781; https://github.com/crossbeam-rs/crossbeam/releases/tag/crossbeam-utils-0.8.7; https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-qc84-gqf4-9926
CVE: CVE-2022-24589
Published: 2022-02-15
Description: Burden v3.0 was discovered to contain a stored cross-site scripting (XSS) in the Add Category function. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the task parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/Nguyen-Trung-Kien/CVE; https://github.com/Nguyen-Trung-Kien/CVE/blob/main/CVE-2022-24589/CVE-2022-24589.pdf; https://github.com/Nguyen-Trung-Kien/CVE
CVE: CVE-2021-33945
Published: 2022-02-15
Description: RICOH Printer series SP products 320DN, SP 325DNw, SP 320SN, SP 320SFN, SP 325SNw, SP 325SFNw, SP 330SN, Aficio SP 3500SF, SP 221S, SP 220SNw, SP 221SNw, SP 221SF, SP 220SFNw, SP 221SFNw v1.06 were discovered to contain a stack buffer overflow in the file /etc/wpa_supplicant.conf. This vulnerability allows attackers to cause a Denial of Service (DoS) via crafted overflow data.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/Ainevsia/CVE-Request/tree/main/Ricoh/1; https://www.ricoh.com/info/2022/0228_1/; https://github.com/Ainevsia/CVE-Request/tree/main/Ricoh/1
CVE: CVE-2021-37354
Published: 2022-02-15
Description: Xerox Phaser 4622 v35.013.01.000 was discovered to contain a buffer overflow in the function sub_3226AC via the TIMEZONE variable. This vulnerability allows attackers to cause a Denial of Service (DoS) via crafted overflow data.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/Ainevsia/CVE-Request/tree/main/Xerox/1; https://github.com/Ainevsia/CVE-Request/tree/main/Xerox/1
CVE: CVE-2021-46262
Published: 2022-02-15
Description: Tenda AC Series Router AC11_V02.03.01.104_CN was discovered to contain a stack buffer overflow in the PPPoE module. This vulnerability allows attackers to cause a Denial of Service (DoS) via crafted overflow data.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/Ainevsia/CVE-Request/tree/main/Tenda/7; https://github.com/Ainevsia/CVE-Request/tree/main/Tenda/7
CVE: CVE-2021-46263
Published: 2022-02-15
Description: Tenda AC Series Router AC11_V02.03.01.104_CN was discovered to contain a stack buffer overflow in the wifiTime module. This vulnerability allows attackers to cause a Denial of Service (DoS) via crafted overflow data.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/Ainevsia/CVE-Request/tree/main/Tenda/11; https://github.com/Ainevsia/CVE-Request/tree/main/Tenda/11
CVE: CVE-2021-46264
Published: 2022-02-15
Description: Tenda AC Series Router AC11_V02.03.01.104_CN was discovered to contain a stack buffer overflow in the onlineList module. This vulnerability allows attackers to cause a Denial of Service (DoS) via crafted overflow data.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/Ainevsia/CVE-Request/tree/main/Tenda/9; https://github.com/Ainevsia/CVE-Request/tree/main/Tenda/9
CVE: CVE-2021-46265
Published: 2022-02-15
Description: Tenda AC Series Router AC11_V02.03.01.104_CN was discovered to contain a stack buffer overflow in the wanBasicCfg module. This vulnerability allows attackers to cause a Denial of Service (DoS) via crafted overflow data.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/Ainevsia/CVE-Request/tree/main/Tenda/13; https://github.com/Ainevsia/CVE-Request/tree/main/Tenda/13
CVE: CVE-2021-46321
Published: 2022-02-15
Description: Tenda AC Series Router AC11_V02.03.01.104_CN was discovered to contain a stack buffer overflow in the wifiBasicCfg module. This vulnerability allows attackers to cause a Denial of Service (DoS) via crafted overflow data.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/Ainevsia/CVE-Request/tree/main/Tenda/15; https://github.com/Ainevsia/CVE-Request/tree/main/Tenda/15
CVE: CVE-2022-23641
Published: 2022-02-15
Description: Discourse is an open source discussion platform. In versions prior to 2.8.1 in the `stable` branch, 2.9.0.beta2 in the `beta` branch, and 2.9.0.beta2 in the `tests-passed` branch, users can trigger a Denial of Service attack by posting a streaming URL. Parsing Oneboxes in the background job trigger an infinite loop, which cause memory leaks. This issue is patched in version 2.8.1 of the `stable` branch, 2.9.0.beta2 of the `beta` branch, and 2.9.0.beta2 of the `tests-passed` branch. As a workaround, disable onebox in admin panel completely or specify allow list of domains that will be oneboxed.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-835, CWE-835
References: https://github.com/discourse/discourse/commit/a34075d205a8857e29574ffd82aaece0c467565e; https://github.com/discourse/discourse/pull/15927; https://github.com/discourse/discourse/security/advisories/GHSA-22xw-f62v-cfxv
CVE: CVE-2021-35380
Published: 2022-02-15
Description: A Directory Traversal vulnerability exists in Solari di Udine TermTalk Server (TTServer) 3.24.0.2, which lets an unauthenticated malicious user gain access to the files on the remote system by gaining access to the relative path of the file they want to download (http://url:port/file?valore).
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://www.exploit-db.com/exploits/50638; https://www.swascan.com/it/security-blog/; https://www.swascan.com/solari-di-udine/
CVE: CVE-2022-23643
Published: 2022-02-15
Description: Sourcegraph is a code search and navigation engine. Sourcegraph versions 3.35 and 3.36 reintroduced a previously fixed side-channel vulnerabilitity in the Code Monitoring feature where strings in private source code could be guessed by an authenticated but unauthorized actor. This issue affects only the Code Monitoring feature, whereas CVE-2021-43823 also affected saved searches. A successful attack would require an authenticated bad actor to create many Code Monitors to receive confirmation that a specific string exists. This could allow an attacker to guess formatted tokens in source code, such as API keys. This issue was patched in versions 3.35.2 and 3.36.3 of Sourcegraph. Those who are unable to upgrade may disable the Code Monitor feature in their installation.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200, CWE-203, CWE-203
References: https://github.com/sourcegraph/sourcegraph/pull/30547; https://github.com/sourcegraph/sourcegraph/security/advisories/GHSA-xqv2-x6f2-w3pf; https://github.com/sourcegraph/sourcegraph/pull/30547
CVE: CVE-2021-46249
Published: 2022-02-15
Description: An authorization bypass exploited by a user-controlled key in SpecificApps REST API in ScratchOAuth2 before commit d856dc704b2504cd3b92cf089fdd366dd40775d6 allows app owners to set flags that indicate whether an app is verified on their own apps.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-639
References: https://github.com/ScratchVerifier/ScratchOAuth2/commit/d856dc704b2504cd3b92cf089fdd366dd40775d6; https://github.com/ScratchVerifier/ScratchOAuth2/commit/d856dc704b2504cd3b92cf089fdd366dd40775d6
CVE: CVE-2021-46250
Published: 2022-02-15
Description: An issue in SOA2Login::commented of ScratchOAuth2 before commit a91879bd58fa83b09283c0708a1864cdf067c64a allows attackers to authenticate as other users on downstream components that rely on ScratchOAuth2.
CVSS Score: 10.0 (CRITICAL)
References: https://github.com/ScratchVerifier/ScratchOAuth2/commit/a91879bd58fa83b09283c0708a1864cdf067c64a; https://github.com/ScratchVerifier/ScratchOAuth2/commit/a91879bd58fa83b09283c0708a1864cdf067c64a
CVE: CVE-2021-46251
Published: 2022-02-15
Description: A reflected cross-site scripting (XSS) in ScratchOAuth2 before commit 1603f04e44ef67dde6ccffe866d2dca16defb293 allows attackers to execute arbitrary web scripts or HTML via a crafted POST request.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/ScratchVerifier/ScratchOAuth2/commit/1603f04e44ef67dde6ccffe866d2dca16defb293; https://github.com/ScratchVerifier/ScratchOAuth2/commit/1603f04e44ef67dde6ccffe866d2dca16defb293
CVE: CVE-2021-46252
Published: 2022-02-15
Description: A Cross-Site Request Forgery (CSRF) in RequirementsBypassPage.php of Scratch Wiki scratch-confirmaccount-v3 allows attackers to modify account request requirement bypasses.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://github.com/InternationalScratchWiki/scratch-confirmaccount-v3/commit/5ed5479de0a279377aa9f64362481efb4e75d8f9; https://github.com/InternationalScratchWiki/scratch-confirmaccount-v3/pull/155; https://github.com/InternationalScratchWiki/scratch-confirmaccount-v3/commit/5ed5479de0a279377aa9f64362481efb4e75d8f9
CVE: CVE-2022-0611
Published: 2022-02-16
Description: Missing Authorization in Packagist snipe/snipe-it prior to 5.3.11.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://github.com/snipe/snipe-it/commit/321be4733d3997fc738f0118e1b9af5905f95439; https://huntr.dev/bounties/7b7447fc-f1b0-446c-b016-ee3f6511010b; https://github.com/snipe/snipe-it/commit/321be4733d3997fc738f0118e1b9af5905f95439
CVE: CVE-2022-25235
Published: 2022-02-16
Description: xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks for whether a UTF-8 character is valid in a certain context.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-116, CWE-116
References: http://www.openwall.com/lists/oss-security/2022/02/19/1; https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf; https://github.com/libexpat/libexpat/pull/562
CVE: CVE-2022-25236
Published: 2022-02-16
Description: xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-668, CWE-668
References: http://packetstormsecurity.com/files/167238/Zoom-XMPP-Stanza-Smuggling-Remote-Code-Execution.html; http://www.openwall.com/lists/oss-security/2022/02/19/1; https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf
CVE: CVE-2022-25241
Published: 2022-02-16
Description: In FileCloud before 21.3, the CSV user import functionality is vulnerable to Cross-Site Request Forgery (CSRF).
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://packetstormsecurity.com/files/166074/FileCloud-21.2-Cross-Site-Request-Forgery.html; https://herolab.usd.de/security-advisories/; https://www.filecloud.com/supportdocs/display/cloud/Advisory+2022-01-3+Threat+of+CSRF+via+User+Creation
CVE: CVE-2022-25242
Published: 2022-02-16
Description: In FileCloud before 21.3, file upload is not protected against Cross-Site Request Forgery (CSRF).
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://herolab.usd.de/security-advisories/; https://www.filecloud.com/supportdocs/display/cloud/Advisory+2022-01-2+Threat+of+CSRF+via+File+Upload; https://herolab.usd.de/security-advisories/
CVE: CVE-2022-0612
Published: 2022-02-16
Description: Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/livehelperchat/livehelperchat/commit/4d4f1db1701f09177896a38e43fd0c693835f03b; https://huntr.dev/bounties/eadcf7d2-a479-4901-abcc-1505d3f1b32f; https://github.com/livehelperchat/livehelperchat/commit/4d4f1db1701f09177896a38e43fd0c693835f03b
CVE: CVE-2022-0613
Published: 2022-02-16
Description: Authorization Bypass Through User-Controlled Key in NPM urijs prior to 1.19.8.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-639, CWE-639
References: https://github.com/medialize/uri.js/commit/6ea641cc8648b025ed5f30b090c2abd4d1a5249f; https://huntr.dev/bounties/f53d5c42-c108-40b8-917d-9dad51535083; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MXSSATHALUSXXD2KT6UFZAX7EG4GR332/
CVE: CVE-2022-0614
Published: 2022-02-16
Description: Use of Out-of-range Pointer Offset in Homebrew mruby prior to 3.2.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-823, CWE-119
References: https://github.com/mruby/mruby/commit/ff3a5ebed6ffbe3e70481531cfb969b497aa73ad; https://huntr.dev/bounties/a980ce4d-c359-4425-92c4-e844c0055879; https://github.com/mruby/mruby/commit/ff3a5ebed6ffbe3e70481531cfb969b497aa73ad
CVE: CVE-2021-46388
Published: 2022-02-16
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: Reason: The issue is not a vulnerability (fails CNT2) - Has no impact on availability, integrity or confidence as only documented html templates are shown without additional data or the option to store changes. Notes
CVE: CVE-2022-0559
Published: 2022-02-16
Description: Use After Free in GitHub repository radareorg/radare2 prior to 5.6.2.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416, CWE-416
References: https://github.com/radareorg/radare2/commit/b5cb90b28ec71fda3504da04e3cc94a362807f5e; https://huntr.dev/bounties/aa80adb7-e900-44a5-ad05-91f3ccdfc81e; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BZTIMAS53YT66FUS4QHQAFRJOBMUFG6D/
CVE: CVE-2022-23358
Published: 2022-02-16
Description: EasyCMS v1.6 allows for SQL injection via ArticlemAction.class.php. In the background, search terms provided by the user were not sanitized and were used directly to construct a SQL statement.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/jojosec/EasyCMS-s-SQL-injection-new-/blob/main/README.md; https://github.com/jojosec/EasyCMS-s-SQL-injection-new-/blob/main/README.md
CVE: CVE-2021-45391
Published: 2022-02-16
Description: A Buffer Overflow vulnerability exists in Tenda Router AX12 V22.03.01.21_CN in the sub_422CE4 function in the goform/setIPv6Status binary file /usr/sbin/httpd via the conType parameter, which causes a Denial of Service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: http://tendawifi.com/index.html; https://github.com/sec-bin/IoT-CVE/tree/main/Tenda/AX12/1; https://www.tenda.com.cn/
CVE: CVE-2021-26726
Published: 2022-02-16
Description: A remote code execution vulnerability affecting a Valmet DNA service listening on TCP port 1517, allows an attacker to execute commands with SYSTEM privileges This issue affects: Valmet DNA versions from Collection 2012 until Collection 2021.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-209, CWE-272, CWE-305, CWE-330
References: https://www.nozominetworks.com/labs/vulnerability-advisories/cve-2021-26726/; https://www.valmet.com/about-us/research-and-development/vulnerabilityadvisories/; https://www.nozominetworks.com/labs/vulnerability-advisories/cve-2021-26726/
CVE: CVE-2019-4291
Published: 2022-02-16
Description: IBM Maximo Anywhere 7.6.4.0 could allow an attacker to reverse engineer the application due to the lack of binary protection precautions. IBM X-Force ID: 160697.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-326
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/160697; https://www.ibm.com/support/pages/node/6556834; https://exchange.xforce.ibmcloud.com/vulnerabilities/160697
CVE: CVE-2019-4351
Published: 2022-02-16
Description: IBM Maximo Anywhere 7.6.4.0 applications could disclose sensitive information to a user with physical access to the device. IBM X-Force ID: 161493.
CVSS Score: 4.6 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/161493; https://www.ibm.com/support/pages/node/6556820; https://exchange.xforce.ibmcloud.com/vulnerabilities/161493
CVE: CVE-2019-4352
Published: 2022-02-16
Description: IBM Maximo Anywhere 7.6.4.0 applications could allow obfuscation of the application source code. IBM X-Force ID: 161494.
CVSS Score: 2.4 (LOW)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/161494; https://www.ibm.com/support/pages/node/6556808; https://exchange.xforce.ibmcloud.com/vulnerabilities/161494
CVE: CVE-2020-6917
Published: 2022-02-16
Description: Potential security vulnerabilities including compromise of integrity, and allowed communication with untrusted clients has been identified in HP Support Assistant software.
CVSS Score: 7.8 (HIGH)
References: https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2022/MNDT-2022-0030/MNDT-2022-0030.md; https://support.hp.com/us-en/document/ish_5[PII_REDACTED]023-16; https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2022/MNDT-2022-0030/MNDT-2022-0030.md
CVE: CVE-2020-6918
Published: 2022-02-16
Description: Potential security vulnerabilities including compromise of integrity, and allowed communication with untrusted clients has been identified in HP Support Assistant software.
CVSS Score: 7.8 (HIGH)
References: https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2022/MNDT-2022-0030/MNDT-2022-0030.md; https://support.hp.com/us-en/document/ish_5[PII_REDACTED]023-16; https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2022/MNDT-2022-0030/MNDT-2022-0030.md
CVE: CVE-2020-6919
Published: 2022-02-16
Description: Potential security vulnerabilities including compromise of integrity, and allowed communication with untrusted clients has been identified in HP Support Assistant software.
CVSS Score: 7.8 (HIGH)
References: https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2022/MNDT-2022-0030/MNDT-2022-0030.md; https://support.hp.com/us-en/document/ish_5[PII_REDACTED]023-16; https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2022/MNDT-2022-0030/MNDT-2022-0030.md
CVE: CVE-2020-6920
Published: 2022-02-16
Description: Potential security vulnerabilities including compromise of integrity, and allowed communication with untrusted clients has been identified in HP Support Assistant software.
CVSS Score: 5.5 (MEDIUM)
References: https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2022/MNDT-2022-0030/MNDT-2022-0030.md; https://support.hp.com/us-en/document/ish_5[PII_REDACTED]023-16; https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2022/MNDT-2022-0030/MNDT-2022-0030.md