deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-43536
Published: 2023-01-05
Description: Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying host. Successful exploits could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to complete system compromise in Aruba ClearPass Policy Manager version(s): ClearPass Policy Manager 6.10.x: 6.10.7 and below and ClearPass Policy Manager 6.9.x:  6.9.12 and below.


CVSS Score: 7.2 (HIGH)
CWE: CWE-78, CWE-78
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-020.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-020.txt
CVE: CVE-2022-43537
Published: 2023-01-05
Description: Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying host. Successful exploits could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to complete system compromise in Aruba ClearPass Policy Manager version(s): ClearPass Policy Manager 6.10.x: 6.10.7 and below and ClearPass Policy Manager 6.9.x:  6.9.12 and below.


CVSS Score: 7.2 (HIGH)
CWE: CWE-78, CWE-78
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-020.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-020.txt
CVE: CVE-2022-43538
Published: 2023-01-05
Description: Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying host. Successful exploits could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to complete system compromise in Aruba ClearPass Policy Manager version(s): ClearPass Policy Manager 6.10.x: 6.10.7 and below and ClearPass Policy Manager 6.9.x:  6.9.12 and below.


CVSS Score: 7.2 (HIGH)
CWE: CWE-78, CWE-78
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-020.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-020.txt
CVE: CVE-2022-43539
Published: 2023-01-05
Description:  A vulnerability exists in the ClearPass Policy Manager cluster communications that allow for an attacker in a privileged network position to potentially obtain sensitive information. A successful exploit could allow an attacker to retrieve information that allows for unauthorized actions as a privileged user on the ClearPass Policy Manager cluster in Aruba ClearPass Policy Manager version(s): ClearPass Policy Manager 6.10.x: 6.10.7 and below and ClearPass Policy Manager 6.9.x:  6.9.12 and below.


CVSS Score: 5.7 (MEDIUM)
CWE: CWE-200
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-020.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-020.txt
CVE: CVE-2022-43540
Published: 2023-01-05
Description: A vulnerability exists in the ClearPass OnGuard macOS agent that allows for an attacker with local macOS instance access to potentially obtain sensitive information. A successful exploit could allow an attacker to retrieve information that is of a sensitive nature in Aruba ClearPass Policy Manager version(s): ClearPass Policy Manager 6.10.x: 6.10.7 and below and ClearPass Policy Manager 6.9.x:  6.9.12 and below.


CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-020.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-020.txt
CVE: CVE-2022-44534
Published: 2023-01-05
Description: A vulnerability in the Aruba EdgeConnect Enterprise Orchestrator web-based management interface allows remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to complete system compromise in Aruba EdgeConnect Enterprise Orchestration Software version(s): Aruba EdgeConnect Enterprise Orchestrator (on-premises), Aruba EdgeConnect Enterprise Orchestrator-as-a-Service, Aruba EdgeConnect Enterprise Orchestrator-SP and Aruba EdgeConnect Enterprise Orchestrator Global Enterprise Tenant Orchestrators - Orchestrator 9.2.1.40179 and below, - Orchestrator 9.1.4.40436 and below, - Orchestrator 9.0.7.40110 and below, - Orchestrator 8.10.23.40015 and below, - Any older branches of Orchestrator not specifically mentioned.


CVSS Score: 7.2 (HIGH)
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-021.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-021.txt
CVE: CVE-2022-44535
Published: 2023-01-05
Description: A vulnerability in the Aruba EdgeConnect Enterprise Orchestrator web-based management interface allows remote low-privileged authenticated users to escalate their privileges to those of an administrative user. A successful exploit could allow an attacker to achieve administrative privilege on the web-management interface leading to complete system compromise in Aruba EdgeConnect Enterprise Orchestration Software version(s): Aruba EdgeConnect Enterprise Orchestrator (on-premises), Aruba EdgeConnect Enterprise Orchestrator-as-a-Service, Aruba EdgeConnect Enterprise Orchestrator-SP and Aruba EdgeConnect Enterprise Orchestrator Global Enterprise Tenant Orchestrators - Orchestrator 9.2.1.40179 and below, - Orchestrator 9.1.4.40436 and below, - Orchestrator 9.0.7.40110 and below, - Orchestrator 8.10.23.40015 and below, - Any older branches of Orchestrator not specifically mentioned.


CVSS Score: 8.8 (HIGH)
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-021.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-021.txt
CVE: CVE-2022-46335
Published: 2023-01-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none.
CVE: CVE-2022-46336
Published: 2023-01-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none.
CVE: CVE-2019-25095
Published: 2023-01-05
Description: A vulnerability, which was classified as problematic, was found in kakwa LdapCherry up to 0.x. Affected is an unknown function of the component URL Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 1.0.0 is able to address this issue. The patch is identified as 6f98076281e9452fdb1adcd1bcbb70a6f968ade9. It is recommended to upgrade the affected component. VDB-217434 is the identifier assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-79
References: https://github.com/kakwa/ldapcherry/commit/6f98076281e9452fdb1adcd1bcbb70a6f968ade9; https://github.com/kakwa/ldapcherry/pull/16; https://github.com/kakwa/ldapcherry/releases/tag/1.0.0
CVE: CVE-2019-25096
Published: 2023-01-05
Description: A vulnerability has been found in soerennb eXtplorer up to 2.1.12 and classified as problematic. Affected by this vulnerability is an unknown functionality. The manipulation leads to cross site scripting. The attack can be launched remotely. Upgrading to version 2.1.13 is able to address this issue. The patch is named b8fcb888f4ff5e171c16797a4b075c6c6f50bf46. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-217435.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-79
References: https://github.com/soerennb/extplorer/commit/b8fcb888f4ff5e171c16797a4b075c6c6f50bf46; https://github.com/soerennb/extplorer/releases/tag/v2.1.13; https://vuldb.com/?ctiid.217435
CVE: CVE-2019-25097
Published: 2023-01-05
Description: A vulnerability was found in soerennb eXtplorer up to 2.1.12 and classified as critical. Affected by this issue is some unknown functionality of the component Directory Content Handler. The manipulation leads to path traversal. Upgrading to version 2.1.13 is able to address this issue. The name of the patch is b8fcb888f4ff5e171c16797a4b075c6c6f50bf46. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-217436.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-22
References: https://github.com/soerennb/extplorer/commit/b8fcb888f4ff5e171c16797a4b075c6c6f50bf46; https://github.com/soerennb/extplorer/releases/tag/v2.1.13; https://vuldb.com/?ctiid.217436
CVE: CVE-2019-25098
Published: 2023-01-05
Description: A vulnerability was found in soerennb eXtplorer up to 2.1.12. It has been classified as critical. This affects an unknown part of the file include/archive.php of the component Archive Handler. The manipulation leads to path traversal. Upgrading to version 2.1.13 is able to address this issue. The identifier of the patch is b8fcb888f4ff5e171c16797a4b075c6c6f50bf46. It is recommended to upgrade the affected component. The identifier VDB-217437 was assigned to this vulnerability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://github.com/soerennb/extplorer/commit/b8fcb888f4ff5e171c16797a4b075c6c6f50bf46; https://github.com/soerennb/extplorer/releases/tag/v2.1.13; https://vuldb.com/?ctiid.217437
CVE: CVE-2022-45857
Published: 2023-01-05
Description: An incorrect user management vulnerability [CWE-286] in the FortiManager version 6.4.6 and below VDOM creation component may allow an attacker to access a FortiGate without a password via newly created VDOMs after the super_admin account is deleted.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-286
References: https://fortiguard.com/psirt/FG-IR-22-371; https://fortiguard.com/psirt/FG-IR-22-371
CVE: CVE-2022-47523
Published: 2023-01-05
Description: Zoho ManageEngine Access Manager Plus before 4309, Password Manager Pro before 12210, and PAM360 before 5801 are vulnerable to SQL Injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-79
References: https://www.manageengine.com/privileged-session-management/advisory/cve-2022-47523.html; https://www.manageengine.com/privileged-session-management/advisory/cve-2022-47523.html
CVE: CVE-2023-22626
Published: 2023-01-05
Description: PgHero before 3.1.0 allows Information Disclosure via EXPLAIN because query results may be present in an error message. (Depending on database user privileges, this may only be information from the database, or may be information from file contents on the database server.)
CVSS Score: 7.5 (HIGH)
CWE: CWE-209, CWE-209
References: https://github.com/ankane/pghero/issues/439; https://github.com/ankane/pghero/issues/439
CVE: CVE-2016-15009
Published: 2023-01-05
Description: A vulnerability classified as problematic has been found in OpenACS bug-tracker. Affected is an unknown function of the file lib/nav-bar.adp of the component Search. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. The name of the patch is aee43e5714cd8b697355ec3bf83eefee176d3fc3. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-217440.
CVSS Score: 3.5 (LOW)
CWE: CWE-352
References: https://github.com/openacs/bug-tracker/commit/aee43e5714cd8b697355ec3bf83eefee176d3fc3; https://vuldb.com/?ctiid.217440; https://vuldb.com/?id.217440
CVE: CVE-2016-15010
Published: 2023-01-05
Description: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as problematic was found in University of Cambridge django-ucamlookup up to 1.9.1. Affected by this vulnerability is an unknown functionality of the component Lookup Handler. The manipulation leads to cross site scripting. The attack can be launched remotely. Upgrading to version 1.9.2 is able to address this issue. The identifier of the patch is 5e25e4765637ea4b9e0bf5fcd5e9a922abee7eb3. It is recommended to upgrade the affected component. The identifier VDB-217441 was assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/uisautomation/django-ucamlookup/commit/5e25e4765637ea4b9e0bf5fcd5e9a922abee7eb3; https://github.com/uisautomation/django-ucamlookup/releases/tag/1.9.2; https://vuldb.com/?ctiid.217441
CVE: CVE-2018-25064
Published: 2023-01-05
Description: A vulnerability was found in OSM Lab show-me-the-way. It has been rated as problematic. This issue affects some unknown processing of the file js/site.js. The manipulation leads to cross site scripting. The attack may be initiated remotely. The patch is named 4bed3b34dcc01fe6661f39c0e5d2285b340f7cac. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217439.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-79
References: https://github.com/osmlab/show-me-the-way/commit/4bed3b34dcc01fe6661f39c0e5d2285b340f7cac; https://github.com/osmlab/show-me-the-way/pull/57; https://vuldb.com/?ctiid.217439
CVE: CVE-2021-4303
Published: 2023-01-05
Description: A vulnerability, which was classified as problematic, has been found in shannah Xataface up to 2.x. Affected by this issue is the function testftp of the file install/install_form.js.php of the component Installer. The manipulation leads to cross site scripting. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. Upgrading to version 3.0.0 is able to address this issue. The patch is identified as 94143a4299e386f33bf582139cd4702571d93bde. It is recommended to upgrade the affected component. VDB-217442 is the identifier assigned to this vulnerability. NOTE: Installer is disabled by default.
CVSS Score: 2.0 (LOW)
CWE: CWE-79
References: https://github.com/shannah/xataface/commit/94143a4299e386f33bf582139cd4702571d93bde; https://github.com/shannah/xataface/releases/tag/3.0.0; https://vuldb.com/?ctiid.217442
CVE: CVE-2022-4869
Published: 2023-01-05
Description: A vulnerability was found in Evolution Events Artaxerxes. It has been declared as problematic. This vulnerability affects unknown code of the file arta/common/middleware.py of the component POST Parameter Handler. The manipulation of the argument password leads to information disclosure. The attack can be initiated remotely. The patch is identified as 022111407d34815c16c6eada2de69ca34084dc0d. It is recommended to apply a patch to fix this issue. VDB-217438 is the identifier assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-200
References: https://github.com/evolution-events/Artaxerxes/commit/022111407d34815c16c6eada2de69ca34084dc0d; https://vuldb.com/?ctiid.217438; https://vuldb.com/?id.217438
CVE: CVE-2015-10013
Published: 2023-01-05
Description: A vulnerability was found in WebDevStudios taxonomy-switcher Plugin up to 1.0.3 on WordPress. It has been classified as problematic. Affected is the function taxonomy_switcher_init of the file taxonomy-switcher.php. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 1.0.4 is able to address this issue. It is recommended to upgrade the affected component. VDB-217446 is the identifier assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/WebDevStudios/taxonomy-switcher/commit/e1a0d99f936e7427b31e210c67aeb4833d804099; https://github.com/WebDevStudios/taxonomy-switcher/releases/tag/1.0.4; https://vuldb.com/?ctiid.217446
CVE: CVE-2018-25065
Published: 2023-01-05
Description: A vulnerability was found in Wikimedia mediawiki-extensions-I18nTags and classified as problematic. This issue affects some unknown processing of the file I18nTags_body.php of the component Unlike Parser. The manipulation leads to cross site scripting. The attack may be initiated remotely. The identifier of the patch is b4bc3cbbb099eab50cf2b544cf577116f1867b94. It is recommended to apply a patch to fix this issue. The identifier VDB-217445 was assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-79
References: https://github.com/wikimedia/mediawiki-extensions-I18nTags/commit/b4bc3cbbb099eab50cf2b544cf577116f1867b94; https://vuldb.com/?ctiid.217445; https://vuldb.com/?id.217445
CVE: CVE-2020-36640
Published: 2023-01-05
Description: A vulnerability, which was classified as problematic, was found in bonitasoft bonita-connector-webservice up to 1.3.0. This affects the function TransformerConfigurationException of the file src/main/java/org/bonitasoft/connectors/ws/SecureWSConnector.java. The manipulation leads to xml external entity reference. Upgrading to version 1.3.1 is able to address this issue. The patch is named a12ad691c05af19e9061d7949b6b828ce48815d5. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-217443.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-611, CWE-611
References: https://github.com/bonitasoft/bonita-connector-webservice/commit/a12ad691c05af19e9061d7949b6b828ce48815d5; https://github.com/bonitasoft/bonita-connector-webservice/pull/17; https://github.com/bonitasoft/bonita-connector-webservice/releases/tag/1.3.1
CVE: CVE-2021-4304
Published: 2023-01-05
Description: A vulnerability was found in eprintsug ulcc-core. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file cgi/toolbox/toolbox. The manipulation of the argument password leads to command injection. The attack can be launched remotely. The patch is named 811edaae81eb044891594f00062a828f51b22cb1. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217447.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-77
References: https://github.com/eprintsug/ulcc-core/commit/811edaae81eb044891594f00062a828f51b22cb1; https://vuldb.com/?ctiid.217447; https://vuldb.com/?id.217447
CVE: CVE-2022-43932
Published: 2023-01-05
Description: Improper neutralization of special elements in output used by a downstream component ('Injection') vulnerability in CGI component in Synology Router Manager (SRM) before 1.2.5-8227-6 and 1.3.1-9346-3 allows remote attackers to read arbitrary files via unspecified vectors.
CVSS Score: 7.5 (HIGH)
References: https://www.synology.com/en-global/security/advisory/Synology_SA_22_25; https://www.synology.com/en-global/security/advisory/Synology_SA_22_25
CVE: CVE-2022-4877
Published: 2023-01-05
Description: A vulnerability has been found in snoyberg keter up to 1.8.1 and classified as problematic. This vulnerability affects unknown code of the file Keter/Proxy.hs. The manipulation of the argument host leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 1.8.2 is able to address this issue. The name of the patch is d41f3697926b231782a3ad8050f5af1ce5cc40b7. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-217444.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/snoyberg/keter/commit/d41f3697926b231782a3ad8050f5af1ce5cc40b7; https://github.com/snoyberg/keter/pull/246; https://github.com/snoyberg/keter/releases/tag/keter%2F1.8.2
CVE: CVE-2023-0077
Published: 2023-01-05
Description: Integer overflow or wraparound vulnerability in CGI component in Synology Router Manager (SRM) before 1.2.5-8227-6 and 1.3.1-9346-3 allows remote attackers to overflow buffers via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
References: https://www.synology.com/en-global/security/advisory/Synology_SA_22_25; https://www.synology.com/en-global/security/advisory/Synology_SA_22_25
CVE: CVE-2021-4305
Published: 2023-01-05
Description: A vulnerability was found in Woorank robots-txt-guard. It has been rated as problematic. Affected by this issue is the function makePathPattern of the file lib/patterns.js. The manipulation of the argument pattern leads to inefficient regular expression complexity. The exploit has been disclosed to the public and may be used. The name of the patch is c03827cd2f9933619c23894ce7c98401ea824020. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-217448.
CVSS Score: 3.5 (LOW)
CWE: CWE-1333
References: https://github.com/Woorank/robots-txt-guard/commit/c03827cd2f9933619c23894ce7c98401ea824020; https://github.com/Woorank/robots-txt-guard/pull/4; https://vuldb.com/?ctiid.217448
CVE: CVE-2007-10001
Published: 2023-01-05
Description: A vulnerability classified as problematic has been found in web-cyradm. This affects an unknown part of the file search.php. The manipulation of the argument searchstring leads to sql injection. It is recommended to apply a patch to fix this issue. The identifier VDB-217449 was assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-89
References: https://github.com/web-cyradm/web-cyradm/commit/3e8f0717f133907bb6a09cb674b05c5f273da3e1; https://vuldb.com/?ctiid.217449; https://vuldb.com/?id.217449
CVE: CVE-2017-20162
Published: 2023-01-05
Description: A vulnerability, which was classified as problematic, has been found in vercel ms up to 1.x. This issue affects the function parse of the file index.js. The manipulation of the argument str leads to inefficient regular expression complexity. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2.0.0 is able to address this issue. The patch is named caae2988ba2a37765d055c4eee63d383320ee662. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-217451.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-1333, CWE-1333
References: https://github.com/vercel/ms/commit/caae2988ba2a37765d055c4eee63d383320ee662; https://github.com/vercel/ms/pull/89; https://github.com/vercel/ms/releases/tag/2.0.0
CVE: CVE-2020-36641
Published: 2023-01-05
Description: A vulnerability classified as problematic was found in gturri aXMLRPC up to 1.12.0. This vulnerability affects the function ResponseParser of the file src/main/java/de/timroes/axmlrpc/ResponseParser.java. The manipulation leads to xml external entity reference. Upgrading to version 1.14.0 is able to address this issue. The patch is identified as 456752ebc1ef4c0db980cb5b01a0b3cd0a9e0bae. It is recommended to upgrade the affected component. VDB-217450 is the identifier assigned to this vulnerability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-611
References: https://github.com/gturri/aXMLRPC/commit/456752ebc1ef4c0db980cb5b01a0b3cd0a9e0bae; https://github.com/gturri/aXMLRPC/releases/tag/aXMLRPC-1.14.0; https://vuldb.com/?ctiid.217450
CVE: CVE-2014-125040
Published: 2023-01-05
Description: A vulnerability was found in stevejagodzinski DevNewsAggregator. It has been rated as critical. Affected by this issue is the function getByName of the file php/data_access/RemoteHtmlContentDataAccess.php. The manipulation of the argument name leads to sql injection. The name of the patch is b9de907e7a8c9ca9d75295da675e58c5bf06b172. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-217484.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/stevejagodzinski/DevNewsAggregator/commit/b9de907e7a8c9ca9d75295da675e58c5bf06b172; https://vuldb.com/?ctiid.217484; https://vuldb.com/?id.217484
CVE: CVE-2015-10014
Published: 2023-01-05
Description: A vulnerability classified as critical has been found in arekk uke. This affects an unknown part of the file lib/uke/finder.rb. The manipulation leads to sql injection. The identifier of the patch is 52fd3b2d0bc16227ef57b7b98a3658bb67c1833f. It is recommended to apply a patch to fix this issue. The identifier VDB-217485 was assigned to this vulnerability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/arekk/uke/commit/52fd3b2d0bc16227ef57b7b98a3658bb67c1833f; https://vuldb.com/?ctiid.217485; https://vuldb.com/?id.217485
CVE: CVE-2022-45995
Published: 2023-01-05
Description: There is an unauthorized buffer overflow vulnerability in Tenda AX12 v22.03.01.21 _ cn. This vulnerability can cause the web service not to restart or even execute arbitrary code. It is a different vulnerability from CVE-2022-2414.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120, CWE-120
References: https://github.com/bugfinder0/public_bug/tree/main/tenda/ax12/1; https://github.com/bugfinder0/public_bug/tree/main/tenda/ax12/1