deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-41991
Published: 2023-01-26
Description: A heap-based buffer overflow vulnerability exists in the m2m DELETE_FILE cmd functionality of Siretta QUARTZ-GOLD G5.0.1.5[PII_REDACTED]20. A specially-crafted network request can lead to a heap buffer overflow. An attacker can send a network request to trigger this vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-122, CWE-787
References: https://talosintelligence.com/vulnerability_reports/TALOS-2022-1639; https://talosintelligence.com/vulnerability_reports/TALOS-2022-1639; https://www.talosintelligence.com/vulnerability_reports/TALOS-2022-1639
CVE: CVE-2022-42490
Published: 2023-01-26
Description: Several OS command injection vulnerabilities exist in the m2m binary of Siretta QUARTZ-GOLD G5.0.1.5[PII_REDACTED]20. A specially-crafted network request can lead to arbitrary command execution. An attacker can send a network request to trigger these vulnerabilities.This command injection is reachable through the m2m's DOWNLOAD_CFG_FILE command
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://talosintelligence.com/vulnerability_reports/TALOS-2022-1640; https://talosintelligence.com/vulnerability_reports/TALOS-2022-1640; https://www.talosintelligence.com/vulnerability_reports/TALOS-2022-1640
CVE: CVE-2022-42491
Published: 2023-01-26
Description: Several OS command injection vulnerabilities exist in the m2m binary of Siretta QUARTZ-GOLD G5.0.1.5[PII_REDACTED]20. A specially-crafted network request can lead to arbitrary command execution. An attacker can send a network request to trigger these vulnerabilities.This command injection is reachable through the m2m's M2M_CONFIG_SET command
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://talosintelligence.com/vulnerability_reports/TALOS-2022-1640; https://talosintelligence.com/vulnerability_reports/TALOS-2022-1640; https://www.talosintelligence.com/vulnerability_reports/TALOS-2022-1640
CVE: CVE-2022-42492
Published: 2023-01-26
Description: Several OS command injection vulnerabilities exist in the m2m binary of Siretta QUARTZ-GOLD G5.0.1.5[PII_REDACTED]20. A specially-crafted network request can lead to arbitrary command execution. An attacker can send a network request to trigger these vulnerabilities.This command injection is reachable through the m2m's DOWNLOAD_AD command.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://talosintelligence.com/vulnerability_reports/TALOS-2022-1640; https://talosintelligence.com/vulnerability_reports/TALOS-2022-1640; https://www.talosintelligence.com/vulnerability_reports/TALOS-2022-1640
CVE: CVE-2022-42493
Published: 2023-01-26
Description: Several OS command injection vulnerabilities exist in the m2m binary of Siretta QUARTZ-GOLD G5.0.1.5[PII_REDACTED]20. A specially-crafted network request can lead to arbitrary command execution. An attacker can send a network request to trigger these vulnerabilities.This command injection is reachable through the m2m's DOWNLOAD_INFO command.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://talosintelligence.com/vulnerability_reports/TALOS-2022-1640; https://talosintelligence.com/vulnerability_reports/TALOS-2022-1640; https://www.talosintelligence.com/vulnerability_reports/TALOS-2022-1640
CVE: CVE-2022-44263
Published: 2023-01-26
Description: Dentsply Sirona Sidexis <= 4.3 is vulnerable to Incorrect Access Control.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732, CWE-732
References: https://twitter.com/obikenobi1/status/[PII_REDACTED]19699458?cxt=HHwWhMDShbeW6fQsAAAA; https://www.chairi.it/cve/CVE-2022-44263.txt; https://twitter.com/obikenobi1/status/[PII_REDACTED]19699458?cxt=HHwWhMDShbeW6fQsAAAA
CVE: CVE-2022-44264
Published: 2023-01-26
Description: Dentsply Sirona Sidexis <= 4.3 is vulnerable to Unquoted Service Path.
CVSS Score: 7.8 (HIGH)
CWE: CWE-428, CWE-428
References: https://twitter.com/obikenobi1/status/[PII_REDACTED]19699458?cxt=HHwWhMDShbeW6fQsAAAA; https://www.chairi.it/cve/CVE-2022-44264.txt; https://twitter.com/obikenobi1/status/[PII_REDACTED]19699458?cxt=HHwWhMDShbeW6fQsAAAA
CVE: CVE-2022-45770
Published: 2023-01-26
Description: Improper input validation in adgnetworkwfpdrv.sys in Adguard For Windows x86 through 7.11 allows local privilege escalation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20, CWE-20
References: https://adguard.com/en/versions/windows/release.html#version-71140780; https://github.com/Marsel-marsel/CVE-2022-45770; https://hackmag.com/security/aguard-cve/
CVE: CVE-2022-47951
Published: 2023-01-26
Description: An issue was discovered in OpenStack Cinder before 19.1.2, 20.x before 20.0.2, and 21.0.0; Glance before 23.0.1, 24.x before 24.1.1, and 25.0.0; and Nova before 24.1.2, 25.x before 25.0.2, and 26.0.0. By supplying a specially created VMDK flat image that references a specific backing file path, an authenticated user may convince systems to return a copy of that file's contents from the server, resulting in unauthorized access to potentially sensitive data.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://launchpad.net/bugs/1996188; https://lists.debian.org/debian-lts-announce/2023/01/msg00040.html; https://lists.debian.org/debian-lts-announce/2023/01/msg00041.html
CVE: CVE-2023-0455
Published: 2023-01-26
Description: Unrestricted Upload of File with Dangerous Type in GitHub repository unilogies/bumsys prior to v1.0.3-beta.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: http://packetstormsecurity.com/files/172674/Bumsys-Business-Management-System-1.0.3-beta-Shell-Upload.html; https://github.com/unilogies/bumsys/commit/a5beff7868ab63bf4ec752a1102f8da033c66b28; https://huntr.dev/bounties/b5e9c578-1a33-4745-bf6b-e7cdb89793f7
CVE: CVE-2023-0470
Published: 2023-01-26
Description: Cross-site Scripting (XSS) - Stored in GitHub repository modoboa/modoboa prior to 2.0.4.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/modoboa/modoboa/commit/354ab[PII_REDACTED]249097a7f3a1881d81ecd2fd2; https://huntr.dev/bounties/baae3180-b63b-4880-b2af-1a3f30056c2b; https://github.com/modoboa/modoboa/commit/354ab[PII_REDACTED]249097a7f3a1881d81ecd2fd2
CVE: CVE-2023-0488
Published: 2023-01-26
Description: Cross-site Scripting (XSS) - Stored in GitHub repository pyload/pyload prior to 0.5.0b3.dev42.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/pyload/pyload/commit/46d75a3087f3237d06530d55998938e2e2bda6bd; https://huntr.dev/bounties/4311d8d7-682c-4f2a-b92c-3f9f1a36255a; https://github.com/pyload/pyload/commit/46d75a3087f3237d06530d55998938e2e2bda6bd
CVE: CVE-2023-0509
Published: 2023-01-26
Description: Improper Certificate Validation in GitHub repository pyload/pyload prior to 0.5.0b3.dev44.
CVSS Score: 7.4 (HIGH)
CWE: CWE-295
References: https://github.com/pyload/pyload/commit/a9098bdf7406e6faf9df3da6ff2d584e90c13bbb; https://huntr.dev/bounties/a370e0c2-a41c-4871-ad91-bc6f31a8e839; https://github.com/pyload/pyload/commit/a9098bdf7406e6faf9df3da6ff2d584e90c13bbb
CVE: CVE-2022-46966
Published: 2023-01-26
Description: Revenue Collection System v1.0 was discovered to contain a SQL injection vulnerability at step1.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://cxsecurity.com/issue/WLB[PII_REDACTED]; https://packetstormsecurity.com/files/169916/Revenue-Collection-System-1.0-SQL-Injection-Remote-Code-Execution.html; https://cxsecurity.com/issue/WLB[PII_REDACTED]
CVE: CVE-2022-46967
Published: 2023-01-26
Description: An access control issue in Revenue Collection System v1.0 allows unauthenticated attackers to view the contents of /admin/DBbackup/ directory.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-522
References: https://packetstormsecurity.com/files/169916/Revenue-Collection-System-1.0-SQL-Injection-Remote-Code-Execution.html; https://packetstormsecurity.com/files/169916/Revenue-Collection-System-1.0-SQL-Injection-Remote-Code-Execution.html
CVE: CVE-2023-0493
Published: 2023-01-26
Description: Improper Neutralization of Equivalent Special Elements in GitHub repository btcpayserver/btcpayserver prior to 1.7.5.


CVSS Score: 5.3 (MEDIUM)
CWE: CWE-76, CWE-74
References: http://packetstormsecurity.com/files/171732/BTCPay-Server-1.7.4-HTML-Injection.html; https://github.com/btcpayserver/btcpayserver/pull/4545/commits/02070d65836cd24627929b3403efbae8de56039a; https://huntr.dev/bounties/3a73b45c-6f3e-4536-a327-cdfdbc59896f
CVE: CVE-2023-0519
Published: 2023-01-26
Description: Cross-site Scripting (XSS) - Stored in GitHub repository modoboa/modoboa prior to 2.0.4.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/modoboa/modoboa/commit/eef9ab72b5305578a3ad7a7463bd284aa645e98b; https://huntr.dev/bounties/891ad0cb-d12f-4c5e-aac8-d7326caf2129; https://github.com/modoboa/modoboa/commit/eef9ab72b5305578a3ad7a7463bd284aa645e98b
CVE: CVE-2023-22740
Published: 2023-01-27
Description: Discourse is an open source platform for community discussion. Versions prior to 3.1.0.beta1 (beta) (tests-passed) are vulnerable to  Allocation of Resources Without Limits. Users can create chat drafts of an unlimited length, which can cause a denial of service by generating an excessive load on the server. Additionally, an unlimited number of drafts were loaded when loading the user. This issue has been patched in version 2.1.0.beta1 (beta) and (tests-passed). Users should upgrade to the latest version where a limit has been introduced. There are no workarounds available.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-770
References: https://github.com/discourse/discourse/commit/5eaf0802398ff06604f03b27a28dd274f2ffa576; https://github.com/discourse/discourse/security/advisories/GHSA-pwj4-rf62-p224; https://github.com/discourse/discourse/commit/5eaf0802398ff06604f03b27a28dd274f2ffa576
CVE: CVE-2023-24060
Published: 2023-01-27
Description: Haven 5d15944 allows Server-Side Request Forgery (SSRF) via the feed[url]= Feeds functionality. Authenticated users with the ability to create new RSS Feeds or add RSS Feeds can supply an arbitrary hostname (or even the hostname of the Haven server itself). NOTE: this product has significant usage but does not have numbered releases; ordinary end users may typically use the master branch.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-918, CWE-918
References: https://github.com/havenweb/haven/issues/51; https://havenweb.org/; https://github.com/havenweb/haven/issues/51
CVE: CVE-2020-36658
Published: 2023-01-27
Description: In Apache::Session::LDAP before 0.5, validity of the X.509 certificate is not checked by default when connecting to remote LDAP backends, because the default configuration of the Net::LDAPS module for Perl is used. NOTE: this can, for example, be fixed in conjunction with the CVE-2020-16093 fix.
CVSS Score: 8.1 (HIGH)
CWE: CWE-295, CWE-295
References: https://github.com/LemonLDAPNG/Apache-Session-LDAP/commit/490722b71eed1ed1ab33d58c78578f23e043561f; https://lists.debian.org/debian-lts-announce/2023/01/msg00024.html; https://github.com/LemonLDAPNG/Apache-Session-LDAP/commit/490722b71eed1ed1ab33d58c78578f23e043561f
CVE: CVE-2020-36659
Published: 2023-01-27
Description: In Apache::Session::Browseable before 1.3.6, validity of the X.509 certificate is not checked by default when connecting to remote LDAP backends, because the default configuration of the Net::LDAPS module for Perl is used. NOTE: this can, for example, be fixed in conjunction with the CVE-2020-16093 fix.
CVSS Score: 8.1 (HIGH)
CWE: CWE-295, CWE-295
References: https://github.com/LemonLDAPNG/Apache-Session-Browseable/commit/fdf393235140b293cae5578ef136055a78f3574f; https://lists.debian.org/debian-lts-announce/2023/01/msg00025.html; https://github.com/LemonLDAPNG/Apache-Session-Browseable/commit/fdf393235140b293cae5578ef136055a78f3574f
CVE: CVE-2022-2712
Published: 2023-01-27
Description: In Eclipse GlassFish versions 5.1.0 to 6.2.5, there is a vulnerability in relative path traversal because it does not filter request path starting with './'. Successful exploitation could allow an remote unauthenticated attacker to access critical data, such as configuration files and deployed application source code.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://bugs.eclipse.org/580502; https://bugs.eclipse.org/580502
CVE: CVE-2023-0527
Published: 2023-01-27
Description: A vulnerability was found in PHPGurukul Online Security Guards Hiring System 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file search-request.php. The manipulation of the argument searchdata with the input "><script>alert(document.domain)</script> leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-219596.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/ctflearner/Vulnerability/blob/main/Online-Security-guard-POC.md; https://vuldb.com/?ctiid.219596; https://vuldb.com/?id.219596
CVE: CVE-2023-0528
Published: 2023-01-27
Description: A vulnerability was found in SourceCodester Online Tours & Travels Management System 1.0. It has been classified as critical. This affects an unknown part of the file admin/abc.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-219597 was assigned to this vulnerability.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-89
References: https://github.com/linmoren/online-tours-travels-management-system/blob/main/admin_abc_id.md; https://vuldb.com/?ctiid.219597; https://vuldb.com/?id.219597
CVE: CVE-2023-0529
Published: 2023-01-27
Description: A vulnerability was found in SourceCodester Online Tours & Travels Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file admin/add_payment.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-219598 is the identifier assigned to this vulnerability.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-89
References: https://github.com/linmoren/online-tours-travels-management-system/blob/main/_admin_add_payment_id.md; https://vuldb.com/?ctiid.219598; https://vuldb.com/?id.219598
CVE: CVE-2023-0530
Published: 2023-01-27
Description: A vulnerability was found in SourceCodester Online Tours & Travels Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file admin/approve_user.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-219599.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-89
References: https://github.com/linmoren/online-tours-travels-management-system/blob/main/admin_approve_user_id.md; https://vuldb.com/?ctiid.219599; https://vuldb.com/?id.219599
CVE: CVE-2023-0531
Published: 2023-01-27
Description: A vulnerability classified as critical has been found in SourceCodester Online Tours & Travels Management System 1.0. Affected is an unknown function of the file admin/booking_report.php. The manipulation of the argument to_date leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-219600.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-89
References: https://github.com/linmoren/online-tours-travels-management-system/blob/main/tototo_date.md; https://vuldb.com/?ctiid.219600; https://vuldb.com/?id.219600
CVE: CVE-2023-0532
Published: 2023-01-27
Description: A vulnerability classified as critical was found in SourceCodester Online Tours & Travels Management System 1.0. Affected by this vulnerability is an unknown functionality of the file admin/disapprove_user.php. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-219601 was assigned to this vulnerability.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-89
References: https://github.com/linmoren/online-tours-travels-management-system/blob/main/admin_disapprove_user_id.md; https://vuldb.com/?ctiid.219601; https://vuldb.com/?id.219601
CVE: CVE-2023-0533
Published: 2023-01-27
Description: A vulnerability, which was classified as critical, has been found in SourceCodester Online Tours & Travels Management System 1.0. Affected by this issue is some unknown functionality of the file admin/expense_report.php. The manipulation of the argument from_date leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-219602 is the identifier assigned to this vulnerability.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-89
References: https://github.com/linmoren/online-tours-travels-management-system/blob/main/admin_expense_report_from_date.md; https://vuldb.com/?ctiid.219602; https://vuldb.com/?id.219602
CVE: CVE-2023-0534
Published: 2023-01-27
Description: A vulnerability, which was classified as critical, was found in SourceCodester Online Tours & Travels Management System 1.0. This affects an unknown part of the file admin/expense_report.php. The manipulation of the argument to_date leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-219603.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-89
References: https://github.com/linmoren/online-tours-travels-management-system/blob/main/admin_expense_report_to_date.md; https://vuldb.com/?ctiid.219603; https://vuldb.com/?id.219603
CVE: CVE-2022-44024
Published: 2023-01-27
Description: An issue was discovered in NetScout nGeniusONE 6.3.2 before P10. It allows Reflected Cross-Site Scripting (XSS), issue 1 of 6.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.netscout.com/securityadvisories; https://www.netscout.com/securityadvisories
CVE: CVE-2022-44025
Published: 2023-01-27
Description: An issue was discovered in NetScout nGeniusONE 6.3.2 before P10. It allows Reflected Cross-Site Scripting (XSS), issue 2 of 6.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.netscout.com/securityadvisories; https://www.netscout.com/securityadvisories
CVE: CVE-2022-44026
Published: 2023-01-27
Description: An issue was discovered in NetScout nGeniusONE 6.3.2 before P10. It allows Reflected Cross-Site Scripting (XSS), issue 3 of 6.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.netscout.com/securityadvisories; https://www.netscout.com/securityadvisories
CVE: CVE-2022-44027
Published: 2023-01-27
Description: An issue was discovered in NetScout nGeniusONE 6.3.2 before P10. It allows Reflected Cross-Site Scripting (XSS), issue 4 of 6.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.netscout.com/securityadvisories; https://www.netscout.com/securityadvisories
CVE: CVE-2022-44028
Published: 2023-01-27
Description: An issue was discovered in NetScout nGeniusONE 6.3.2 before P10. It allows Reflected Cross-Site Scripting (XSS), issue 5 of 6.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.netscout.com/securityadvisories; https://www.netscout.com/securityadvisories
CVE: CVE-2022-44029
Published: 2023-01-27
Description: An issue was discovered in NetScout nGeniusONE 6.3.2 before P10. It allows Reflected Cross-Site Scripting (XSS), issue 6 of 6.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.netscout.com/securityadvisories; https://www.netscout.com/securityadvisories
CVE: CVE-2022-44298
Published: 2023-01-27
Description: SiteServer CMS 7.1.3 is vulnerable to SQL Injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/siteserver/cms/issues/3492; https://github.com/siteserver/cms/issues/3492
CVE: CVE-2022-44715
Published: 2023-01-27
Description: Improper File Permissions in NetScout nGeniusONE 6.3.2 build 904 allows authenticated remote users to gain permissions via a crafted payload.
CVSS Score: 8.8 (HIGH)
CWE: CWE-732, CWE-732
References: https://www.netscout.com/securityadvisories; https://www.netscout.com/securityadvisories
CVE: CVE-2022-44717
Published: 2023-01-27
Description: An issue was discovered in NetScout nGeniusONE 6.3.2 build 904. Open Redirection can occur (issue 1 of 2). After successful login, an attacker must visit the vulnerable parameter and inject a crafted payload to successfully redirect to an unknown host. The attack vector is Network, and the Attack Complexity required is High. Privileges required are administrator, User Interaction is required, and Scope is unchanged. The user must visit the vulnerable parameter and inject a crafted payload to successfully redirect to an unknown host.
CVSS Score: 3.1 (LOW)
CWE: CWE-601, CWE-601
References: https://www.netscout.com/securityadvisories; https://www.netscout.com/securityadvisories
CVE: CVE-2022-44718
Published: 2023-01-27
Description: An issue was discovered in NetScout nGeniusONE 6.3.2 build 904. Open Redirection can occur (issue 2 of 2). After successful login, an attacker must visit the vulnerable parameter and inject a crafted payload to successfully redirect to an unknown host. The attack vector is Network, and the Attack Complexity required is High. Privileges required are administrator, User Interaction is required, and Scope is unchanged. The user must visit the vulnerable parameter and inject a crafted payload to successfully redirect to an unknown host.
CVSS Score: 3.5 (LOW)
CWE: CWE-601, CWE-601
References: https://www.netscout.com/securityadvisories; https://www.netscout.com/securityadvisories
CVE: CVE-2022-47632
Published: 2023-01-27
Description: Razer Synapse before 3.7.0830.081906 allows privilege escalation due to an unsafe installation path, improper privilege management, and improper certificate validation. Attackers can place malicious DLLs into %PROGRAMDATA%\Razer\Synapse3\Service\bin if they do so before the service is installed and if they deny write access for the SYSTEM user. Although the service will not start if the malicious DLLs are unsigned, it suffices to use self-signed DLLs. The validity of the DLL signatures is not checked. As a result, local Windows users can abuse the Razer driver installer to obtain administrative privileges on Windows.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-427, CWE-427
References: http://packetstormsecurity.com/files/170772/Razer-Synapse-3.7.0731.072516-Local-Privilege-Escalation.html; http://packetstormsecurity.com/files/174696/Razer-Synapse-Race-Condition-DLL-Hijacking.html; http://seclists.org/fulldisclosure/2023/Sep/6
CVE: CVE-2022-48066
Published: 2023-01-27
Description: An issue in the component global.so of Totolink A830R V4.1.2cu.5182 allows attackers to bypass authentication via a crafted cookie.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287, CWE-287
References: https://befitting-vinca-933.notion.site/Totolink-A830R-V4-1-2cu-5182-Login-Authentication-Bypass-Vulnerability-e0dfe09f136a4cf59e3754edbd934c15; https://befitting-vinca-933.notion.site/Totolink-A830R-V4-1-2cu-5182-Login-Authentication-Bypass-Vulnerability-e0dfe09f136a4cf59e3754edbd934c15
CVE: CVE-2022-48067
Published: 2023-01-27
Description: An information disclosure vulnerability in Totolink A830R V4.1.2cu.5182 allows attackers to obtain the root password via a brute-force attack.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-798, CWE-798
References: https://befitting-vinca-933.notion.site/Totolink-A830R-V4-1-2cu-5182-Sensitive-Information-Disclosure-567f4a17d5cc401b97e5c3e61aae8ca0; https://befitting-vinca-933.notion.site/Totolink-A830R-V4-1-2cu-5182-Sensitive-Information-Disclosure-567f4a17d5cc401b97e5c3e61aae8ca0
CVE: CVE-2022-48069
Published: 2023-01-27
Description: Totolink A830R V4.1.2cu.5182 was discovered to contain a command injection vulnerability via the QUERY_STRING parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-78, CWE-78
References: https://befitting-vinca-933.notion.site/Totolink-A830R-V4-1-2cu-5182-command-injection-2a88f84e3f[PII_REDACTED]ddf3a76c9d31; https://befitting-vinca-933.notion.site/Totolink-A830R-V4-1-2cu-5182-command-injection-2a88f84e3f[PII_REDACTED]ddf3a76c9d31