deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-15325
Published: 2022-09-29
Description: Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded Erlang cookie for ejabberd replication.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-312
References: https://pierrekim.github.io/blog/2020-03-09-zyxel-secumanager-0day-vulnerabilities.html; https://www.zyxel.com/support/vulnerabilities-of-CloudCNM-SecuManager.shtml; https://pierrekim.github.io/blog/2020-03-09-zyxel-secumanager-0day-vulnerabilities.html
CVE: CVE-2020-15326
Published: 2022-09-29
Description: Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded certificate for Ejabberd in ejabberd.pem.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-798
References: https://pierrekim.github.io/blog/2020-03-09-zyxel-secumanager-0day-vulnerabilities.html; https://www.zyxel.com/support/vulnerabilities-of-CloudCNM-SecuManager.shtml; https://pierrekim.github.io/blog/2020-03-09-zyxel-secumanager-0day-vulnerabilities.html
CVE: CVE-2020-15327
Published: 2022-09-29
Description: Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 uses ZODB storage without authentication.
CVSS Score: 7.5 (HIGH)
CWE: CWE-798
References: https://pierrekim.github.io/blog/2020-03-09-zyxel-secumanager-0day-vulnerabilities.html; https://www.zyxel.com/support/vulnerabilities-of-CloudCNM-SecuManager.shtml; https://pierrekim.github.io/blog/2020-03-09-zyxel-secumanager-0day-vulnerabilities.html
CVE: CVE-2020-15328
Published: 2022-09-29
Description: Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has weak /opt/axess/var/blobstorage/ permissions.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-732
References: https://pierrekim.github.io/blog/2020-03-09-zyxel-secumanager-0day-vulnerabilities.html; https://www.zyxel.com/support/vulnerabilities-of-CloudCNM-SecuManager.shtml; https://pierrekim.github.io/blog/2020-03-09-zyxel-secumanager-0day-vulnerabilities.html
CVE: CVE-2020-15329
Published: 2022-09-29
Description: Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has weak Data.fs permissions.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-732
References: https://pierrekim.github.io/blog/2020-03-09-zyxel-secumanager-0day-vulnerabilities.html; https://www.zyxel.com/support/vulnerabilities-of-CloudCNM-SecuManager.shtml; https://pierrekim.github.io/blog/2020-03-09-zyxel-secumanager-0day-vulnerabilities.html
CVE: CVE-2020-15330
Published: 2022-09-29
Description: Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded APP_KEY in /opt/axess/etc/default/axess.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-311
References: https://pierrekim.github.io/blog/2020-03-09-zyxel-secumanager-0day-vulnerabilities.html; https://www.zyxel.com/support/vulnerabilities-of-CloudCNM-SecuManager.shtml; https://pierrekim.github.io/blog/2020-03-09-zyxel-secumanager-0day-vulnerabilities.html
CVE: CVE-2020-15331
Published: 2022-09-29
Description: Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded OAUTH_SECRET_KEY in /opt/axess/etc/default/axess.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-311
References: https://pierrekim.github.io/blog/2020-03-09-zyxel-secumanager-0day-vulnerabilities.html; https://www.zyxel.com/support/vulnerabilities-of-CloudCNM-SecuManager.shtml; https://pierrekim.github.io/blog/2020-03-09-zyxel-secumanager-0day-vulnerabilities.html
CVE: CVE-2020-15332
Published: 2022-09-29
Description: Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has weak /opt/axess/etc/default/axess permissions.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-312
References: https://pierrekim.github.io/blog/2020-03-09-zyxel-secumanager-0day-vulnerabilities.html; https://www.zyxel.com/support/vulnerabilities-of-CloudCNM-SecuManager.shtml; https://pierrekim.github.io/blog/2020-03-09-zyxel-secumanager-0day-vulnerabilities.html
CVE: CVE-2020-15333
Published: 2022-09-29
Description: Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 allows attackers to discover accounts via MySQL "select * from Administrator_users" and "select * from Users_users" requests.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-89
References: https://pierrekim.github.io/blog/2020-03-09-zyxel-secumanager-0day-vulnerabilities.html; https://www.zyxel.com/support/vulnerabilities-of-CloudCNM-SecuManager.shtml; https://pierrekim.github.io/blog/2020-03-09-zyxel-secumanager-0day-vulnerabilities.html
CVE: CVE-2020-15334
Published: 2022-09-29
Description: Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 allows escape-sequence injection into the /var/log/axxmpp.log file.
CVSS Score: 5.3 (MEDIUM)
References: https://pierrekim.github.io/blog/2020-03-09-zyxel-secumanager-0day-vulnerabilities.html; https://www.zyxel.com/support/vulnerabilities-of-CloudCNM-SecuManager.shtml; https://pierrekim.github.io/blog/2020-03-09-zyxel-secumanager-0day-vulnerabilities.html
CVE: CVE-2020-15337
Published: 2022-09-29
Description: Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a "Use of GET Request Method With Sensitive Query Strings" issue for /registerCpe requests.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://pierrekim.github.io/blog/2020-03-09-zyxel-secumanager-0day-vulnerabilities.html; https://www.zyxel.com/support/vulnerabilities-of-CloudCNM-SecuManager.shtml; https://pierrekim.github.io/blog/2020-03-09-zyxel-secumanager-0day-vulnerabilities.html
CVE: CVE-2020-15338
Published: 2022-09-29
Description: Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a "Use of GET Request Method With Sensitive Query Strings" issue for /cnr requests.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://pierrekim.github.io/blog/2020-03-09-zyxel-secumanager-0day-vulnerabilities.html; https://www.zyxel.com/support/vulnerabilities-of-CloudCNM-SecuManager.shtml; https://pierrekim.github.io/blog/2020-03-09-zyxel-secumanager-0day-vulnerabilities.html
CVE: CVE-2020-15339
Published: 2022-09-29
Description: Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 allows live/CPEManager/AXCampaignManager/handle_campaign_script_link?script_name= XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://pierrekim.github.io/blog/2020-03-09-zyxel-secumanager-0day-vulnerabilities.html; https://www.zyxel.com/support/vulnerabilities-of-CloudCNM-SecuManager.shtml; https://pierrekim.github.io/blog/2020-03-09-zyxel-secumanager-0day-vulnerabilities.html
CVE: CVE-2020-15340
Published: 2022-09-29
Description: Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded opt/axess/AXAssets/default_axess/axess/TR69/Handlers/turbolink/sshkeys/id_rsa SSH key.
CVSS Score: 7.5 (HIGH)
CWE: CWE-311
References: https://pierrekim.github.io/blog/2020-03-09-zyxel-secumanager-0day-vulnerabilities.html; https://www.zyxel.com/support/vulnerabilities-of-CloudCNM-SecuManager.shtml; https://pierrekim.github.io/blog/2020-03-09-zyxel-secumanager-0day-vulnerabilities.html
CVE: CVE-2020-15341
Published: 2022-09-29
Description: Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has an unauthenticated update_all_realm_license API.
CVSS Score: 7.5 (HIGH)
CWE: CWE-522
References: https://pierrekim.github.io/blog/2020-03-09-zyxel-secumanager-0day-vulnerabilities.html; https://www.zyxel.com/support/vulnerabilities-of-CloudCNM-SecuManager.shtml; https://pierrekim.github.io/blog/2020-03-09-zyxel-secumanager-0day-vulnerabilities.html
CVE: CVE-2020-15342
Published: 2022-09-29
Description: Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has an unauthenticated zy_install_user API.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-311
References: https://pierrekim.github.io/blog/2020-03-09-zyxel-secumanager-0day-vulnerabilities.html; https://www.zyxel.com/support/vulnerabilities-of-CloudCNM-SecuManager.shtml; https://pierrekim.github.io/blog/2020-03-09-zyxel-secumanager-0day-vulnerabilities.html
CVE: CVE-2020-15343
Published: 2022-09-29
Description: Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has an unauthenticated zy_install_user_key API.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-311
References: https://pierrekim.github.io/blog/2020-03-09-zyxel-secumanager-0day-vulnerabilities.html; https://www.zyxel.com/support/vulnerabilities-of-CloudCNM-SecuManager.shtml; https://pierrekim.github.io/blog/2020-03-09-zyxel-secumanager-0day-vulnerabilities.html
CVE: CVE-2020-15344
Published: 2022-09-29
Description: Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has an unauthenticated zy_get_user_id_and_key API.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-311
References: https://pierrekim.github.io/blog/2020-03-09-zyxel-secumanager-0day-vulnerabilities.html; https://www.zyxel.com/support/vulnerabilities-of-CloudCNM-SecuManager.shtml; https://pierrekim.github.io/blog/2020-03-09-zyxel-secumanager-0day-vulnerabilities.html
CVE: CVE-2020-15345
Published: 2022-09-29
Description: Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has an unauthenticated zy_get_instances_for_update API.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-311
References: https://pierrekim.github.io/blog/2020-03-09-zyxel-secumanager-0day-vulnerabilities.html; https://www.zyxel.com/support/vulnerabilities-of-CloudCNM-SecuManager.shtml; https://pierrekim.github.io/blog/2020-03-09-zyxel-secumanager-0day-vulnerabilities.html
CVE: CVE-2020-15346
Published: 2022-09-29
Description: Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a /live/GLOBALS API with the CLOUDCNM key.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-311
References: https://pierrekim.github.io/blog/2020-03-09-zyxel-secumanager-0day-vulnerabilities.html; https://www.zyxel.com/support/vulnerabilities-of-CloudCNM-SecuManager.shtml; https://pierrekim.github.io/blog/2020-03-09-zyxel-secumanager-0day-vulnerabilities.html
CVE: CVE-2020-15347
Published: 2022-09-29
Description: Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has the q6xV4aW8bQ4cfD-b password for the axiros account.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-522
References: https://pierrekim.github.io/blog/2020-03-09-zyxel-secumanager-0day-vulnerabilities.html; https://www.zyxel.com/support/vulnerabilities-of-CloudCNM-SecuManager.shtml; https://pierrekim.github.io/blog/2020-03-09-zyxel-secumanager-0day-vulnerabilities.html
CVE: CVE-2020-27601
Published: 2022-09-29
Description: In BigBlueButton before 2.2.7, lockSettingsProps.disablePrivateChat does not apply to already opened chats. This occurs in bigbluebutton-html5/imports/ui/components/chat/service.js.
CVSS Score: 3.5 (LOW)
CWE: CWE-668
References: https://github.com/bigbluebutton/bigbluebutton/commit/7dcdfb191373684bafa7b11cdd0128c9869040a1; https://github.com/bigbluebutton/bigbluebutton/compare/v2.2.6...v2.2.7; https://github.com/bigbluebutton/bigbluebutton/commit/7dcdfb191373684bafa7b11cdd0128c9869040a1
CVE: CVE-2020-27602
Published: 2022-09-29
Description: BigBlueButton before 2.2.7 does not have a protection mechanism for separator injection in meetingId, userId, and authToken.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-74
References: https://github.com/bigbluebutton/bigbluebutton/commit/4bfd924c64da2681f4c037026021f47eb189d717; https://github.com/bigbluebutton/bigbluebutton/compare/v2.2.6...v2.2.7; https://github.com/bigbluebutton/bigbluebutton/commit/4bfd924c64da2681f4c037026021f47eb189d717
CVE: CVE-2020-35674
Published: 2022-09-29
Description: BigProf Online Invoicing System before 2.9 suffers from an unauthenticated SQL Injection found in /membership_passwordReset.php (the endpoint that is responsible for issuing self-service password resets). An unauthenticated attacker is able to send a request containing a crafted payload that can result in sensitive information being extracted from the database, eventually leading into an application takeover. This vulnerability was introduced as a result of the developer trying to roll their own sanitization implementation in order to allow the application to be used in legacy environments.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://labs.ingredous.com/2020/07/13/ois-sqli/; https://labs.ingredous.com/2020/07/13/ois-sqli/
CVE: CVE-2020-35675
Published: 2022-09-29
Description: BigProf Online Invoicing System before 3.0 offers a functionality that allows an administrator to move the records of members across groups. The applicable endpoint (admin/pageTransferOwnership.php) lacks CSRF protection, resulting in an attacker being able to escalate their privileges to Administrator and effectively taking over the application.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/bigprof-software/online-invoicing-system/releases/tag/3.0; https://labs.ingredous.com/2020/07/13/ois-transfer-csrf/; https://github.com/bigprof-software/online-invoicing-system/releases/tag/3.0
CVE: CVE-2021-40691
Published: 2022-09-29
Description: A session hijack risk was identified in the Shibboleth authentication plugin.
CVSS Score: 4.3 (MEDIUM)
References: https://bugzilla.redhat.com/show_bug.cgi?id=2043411; https://bugzilla.redhat.com/show_bug.cgi?id=2043411
CVE: CVE-2021-40692
Published: 2022-09-29
Description: Insufficient capability checks made it possible for teachers to download users outside of their courses.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863
References: https://bugzilla.redhat.com/show_bug.cgi?id=2043414; https://bugzilla.redhat.com/show_bug.cgi?id=2043414
CVE: CVE-2021-40693
Published: 2022-09-29
Description: An authentication bypass risk was identified in the external database authentication functionality, due to a type juggling vulnerability.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-287
References: https://bugzilla.redhat.com/show_bug.cgi?id=2043417; https://bugzilla.redhat.com/show_bug.cgi?id=2043417
CVE: CVE-2021-40694
Published: 2022-09-29
Description: Insufficient escaping of the LaTeX preamble made it possible for site administrators to read files available to the HTTP server system account.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-116
References: https://bugzilla.redhat.com/show_bug.cgi?id=2043421; https://bugzilla.redhat.com/show_bug.cgi?id=2043421
CVE: CVE-2021-40695
Published: 2022-09-29
Description: It was possible for a student to view their quiz grade before it had been released, using a quiz web service.
CVSS Score: 4.3 (MEDIUM)
References: https://bugzilla.redhat.com/show_bug.cgi?id=2043424; https://bugzilla.redhat.com/show_bug.cgi?id=2043424
CVE: CVE-2021-42045
Published: 2022-09-29
Description: An issue was discovered in SecurePoll in the Growth extension in MediaWiki through 1.36.2. Simple polls allow users to create alerts by changing their User-Agent HTTP header and submitting a vote.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://gerrit.wikimedia.org/r/q/I4f04083cd00884d3b[PII_REDACTED]4c81c7639a578; https://phabricator.wikimedia.org/T289385; https://gerrit.wikimedia.org/r/q/I4f04083cd00884d3b[PII_REDACTED]4c81c7639a578
CVE: CVE-2021-42046
Published: 2022-09-29
Description: An issue was discovered in the GlobalWatchlist extension in MediaWiki through 1.36.2. The rev-deleted-user and ntimes messages were not properly escaped and allowed for users to inject HTML and JavaScript.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gerrit.wikimedia.org/r/q/Ib7f9b009730fe0df283cec1169f84c7a83a58b1d; https://gerrit.wikimedia.org/r/q/Id2204fb5afe591d63764466de35ac0aaa5999983; https://phabricator.wikimedia.org/T286385
CVE: CVE-2021-42047
Published: 2022-09-29
Description: An issue was discovered in the Growth extension in MediaWiki through 1.36.2. On any Wiki with the Mentor Dashboard feature enabled, users can login with a mentor account and trigger an XSS payload (such as alert) via Growthexperiments-mentor-dashboard-mentee-overview-no-js-fallback.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://gerrit.wikimedia.org/r/c/mediawiki/extensions/GrowthExperiments/+/720088; https://phabricator.wikimedia.org/T289063; https://gerrit.wikimedia.org/r/c/mediawiki/extensions/GrowthExperiments/+/720088
CVE: CVE-2021-42048
Published: 2022-09-29
Description: An issue was discovered in the Growth extension in MediaWiki through 1.36.2. Any admin can add arbitrary JavaScript code to the Newcomer home page footer, which can be executed by viewers with zero edits.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://gerrit.wikimedia.org/r/q/Iaa90a8976834d70caad592e9d1b18510318db537; https://phabricator.wikimedia.org/T289064; https://gerrit.wikimedia.org/r/q/Iaa90a8976834d70caad592e9d1b18510318db537
CVE: CVE-2021-42049
Published: 2022-09-29
Description: An issue was discovered in the Translate extension in MediaWiki through 1.36.2. Oversighters cannot undo revisions or oversight on pages where they suppressed information (such as PII). This allows oversighters to whitewash revisions.
CVSS Score: 6.5 (MEDIUM)
References: https://gerrit.wikimedia.org/r/q/I4d95220ef[PII_REDACTED]35f7ebedc9b945c3348e3; https://phabricator.wikimedia.org/T286884; https://gerrit.wikimedia.org/r/q/I4d95220ef[PII_REDACTED]35f7ebedc9b945c3348e3
CVE: CVE-2021-43403
Published: 2022-09-29
Description: An issue was discovered in FusionPBX before 4.5.30. The log_viewer.php Log View page allows an authenticated user to choose an arbitrary filename for download (i.e., not necessarily freeswitch.log in the intended directory).
CVSS Score: 6.5 (MEDIUM)
References: https://github.com/fusionpbx/fusionpbx/commit/57b7bf0d6b67bda07d550b07d984a44755510d9c; https://github.com/fusionpbx/fusionpbx/commit/57b7bf0d6b67bda07d550b07d984a44755510d9c
CVE: CVE-2021-45788
Published: 2022-09-29
Description: Time-based SQL Injection vulnerabilities were found in Metersphere v1.15.4 via the "orders" parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/metersphere/metersphere/issues/8651; https://github.com/metersphere/metersphere/issues/8651
CVE: CVE-2021-45789
Published: 2022-09-29
Description: An arbitrary file read vulnerability was found in Metersphere v1.15.4, where authenticated users can read any file on the server via the file download function.
CVSS Score: 6.5 (MEDIUM)
References: https://github.com/metersphere/metersphere/issues/8652; https://github.com/metersphere/metersphere/issues/8652
CVE: CVE-2021-45790
Published: 2022-09-29
Description: An arbitrary file upload vulnerability was found in Metersphere v1.15.4. Unauthenticated users can upload any file to arbitrary directory, where attackers can write a cron job to execute commands.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://github.com/metersphere/metersphere/issues/8653; https://github.com/metersphere/metersphere/issues/8653
CVE: CVE-2021-45843
Published: 2022-09-29
Description: glFusion CMS v1.7.9 is affected by a reflected Cross Site Scripting (XSS) vulnerability. The value of the title request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. This input was echoed unmodified in the application's response.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/glfusion/XSS-Reflected; https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/glfusion/XSS-Reflected
CVE: CVE-2022-1718
Published: 2022-09-29
Description: The trudesk application allows large characters to insert in the input field "Full Name" on the signup field which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request in GitHub repository polonel/trudesk prior to 1.2.2. This can lead to Denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: https://github.com/polonel/trudesk/commit/87e231e04495fb705fe1e03cb56fc4136bafe895; https://huntr.dev/bounties/1ff8afe4-6ff7-45aa-a652-d8aac7e5be7e; https://github.com/polonel/trudesk/commit/87e231e04495fb705fe1e03cb56fc4136bafe895
CVE: CVE-2022-1719
Published: 2022-09-29
Description: Reflected XSS on ticket filter function in GitHub repository polonel/trudesk prior to 1.2.2. This vulnerability is capable of executing a malicious javascript code in web page
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/polonel/trudesk/commit/36a542abbbb74828338ce402d65653ac58db42e0; https://huntr.dev/bounties/790ba3fd-41e9-4393-8e2f-71161b56279b; https://github.com/polonel/trudesk/commit/36a542abbbb74828338ce402d65653ac58db42e0
CVE: CVE-2022-1725
Published: 2022-09-29
Description: NULL Pointer Dereference in GitHub repository vim/vim prior to 8.2.4959.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: http://seclists.org/fulldisclosure/2022/Oct/28; http://seclists.org/fulldisclosure/2022/Oct/41; https://github.com/vim/vim/commit/b62dc5e7825bc195efe3041d5b3a9f1528359e1c
CVE: CVE-2022-38222
Published: 2022-09-29
Description: There is a use-after-free issue in JBIG2Stream::close() located in JBIG2Stream.cc in Xpdf 4.04. It can be triggered by sending a crafted PDF file to (for example) the pdfimages binary. It allows an attacker to cause Denial of Service or possibly have unspecified other impact.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://forum.xpdfreader.com/viewtopic.php?f=3&t=42320; https://forum.xpdfreader.com/viewtopic.php?f=3&t=42320
CVE: CVE-2022-40278
Published: 2022-09-29
Description: An issue was discovered in Samsung TizenRT through 3.0_GBM (and 3.1_PRE). createDB in security/provisioning/src/provisioningdatabasemanager.c has a missing sqlite3_free after sqlite3_exec, leading to a denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416
References: https://github.com/Samsung/TizenRT/blob/f8f776dd183246ad8890422c1ee5e8f33ab2aaaf/external/iotivity/iotivity_1.2-rel/resource/csdk/security/provisioning/src/provisioningdatabasemanager.c#L103; https://github.com/Samsung/TizenRT/blob/f8f776dd183246ad8890422c1ee5e8f33ab2aaaf/external/iotivity/iotivity_1.2-rel/resource/csdk/security/provisioning/src/provisioningdatabasemanager.c#L107; https://github.com/Samsung/TizenRT/issues/5628
CVE: CVE-2022-40279
Published: 2022-09-29
Description: An issue was discovered in Samsung TizenRT through 3.0_GBM (and 3.1_PRE). l2_packet_receive_timeout in wpa_supplicant/src/l2_packet/l2_packet_pcap.c has a missing check on the return value of pcap_dispatch, leading to a denial of service (malfunction).
CVSS Score: 7.5 (HIGH)
CWE: CWE-252
References: https://github.com/Samsung/TizenRT/blob/f8f776dd183246ad8890422c1ee5e8f33ab2aaaf/external/wpa_supplicant/src/l2_packet/l2_packet_pcap.c#L181; https://github.com/Samsung/TizenRT/issues/5629; https://linux.die.net/man/3/pcap_dispatch
CVE: CVE-2019-20227
Published: 2022-09-29
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during the year 2019. Notes: none
CVE: CVE-2019-20228
Published: 2022-09-29
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during the year 2019. Notes: none
CVE: CVE-2019-20229
Published: 2022-09-29
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during the year 2019. Notes: none
CVE: CVE-2019-20230
Published: 2022-09-29
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during the year 2019. Notes: none
CVE: CVE-2019-20231
Published: 2022-09-29
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during the year 2019. Notes: none
CVE: CVE-2019-20232
Published: 2022-09-29
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during the year 2019. Notes: none
CVE: CVE-2019-20233
Published: 2022-09-29
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during the year 2019. Notes: none
CVE: CVE-2019-20234
Published: 2022-09-29
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during the year 2019. Notes: none
CVE: CVE-2019-20235
Published: 2022-09-29
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during the year 2019. Notes: none
CVE: CVE-2019-20236
Published: 2022-09-29
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during the year 2019. Notes: none