deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-21801
Published: 2022-01-28
Description: A denial of service vulnerability exists in the netserver recv_command functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted network request can lead to a reboot. An attacker can send a malicious packet to trigger this vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190, CWE-190
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1450; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1450
CVE: CVE-2022-22790
Published: 2022-01-28
Description: SYNEL - eharmony Directory Traversal. Directory Traversal - is an attack against a server or a Web application aimed at unauthorized access to the file system. on the "Name" parameter the attacker can return to the root directory and open the host file. The path exposes sensitive files that users upload
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-22
References: https://www.gov.il/en/departments/faq/cve_advisories; https://www.gov.il/en/departments/faq/cve_advisories
CVE: CVE-2022-22791
Published: 2022-01-28
Description: SYNEL - eharmony Authenticated Blind & Stored XSS. Inject JS code into the "comments" field could lead to potential stealing of cookies, loading of HTML tags and JS code onto the system.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-79
References: https://www.gov.il/en/departments/faq/cve_advisories; https://www.gov.il/en/departments/faq/cve_advisories
CVE: CVE-2022-22938
Published: 2022-01-28
Description: VMware Workstation (16.x prior to 16.2.2) and Horizon Client for Windows (5.x prior to 5.5.3) contains a denial-of-service vulnerability in the Cortado ThinPrint component. The issue exists in TrueType font parser. A malicious actor with access to a virtual machine or remote desktop may exploit this issue to trigger a denial-of-service condition in the Thinprint service running on the host machine where VMware Workstation or Horizon Client for Windows is installed.
CVSS Score: 6.5 (MEDIUM)
References: https://www.vmware.com/security/advisories/VMSA-2022-0002.html; https://www.vmware.com/security/advisories/VMSA-2022-0002.html
CVE: CVE-2022-22992
Published: 2022-01-28
Description: A command injection remote code execution vulnerability was discovered on Western Digital My Cloud Devices that could allow an attacker to execute arbitrary system commands on the device. The vulnerability was addressed by escaping individual arguments to shell functions coming from user input.
CVSS Score: 7.8 (HIGH)
CWE: CWE-116
References: https://www.westerndigital.com/support/product-security/wdc-22002-my-cloud-os5-firmware-5-19-117; https://www.westerndigital.com/support/product-security/wdc-22002-my-cloud-os5-firmware-5-19-117
CVE: CVE-2022-22993
Published: 2022-01-28
Description: A limited SSRF vulnerability was discovered on Western Digital My Cloud devices that could allow an attacker to impersonate a server and reach any page on the server by bypassing access controls. The vulnerability was addressed by creating a whitelist for valid parameters.
CVSS Score: 7.8 (HIGH)
CWE: CWE-918, CWE-918
References: https://www.westerndigital.com/support/product-security/wdc-22002-my-cloud-os5-firmware-5-19-117; https://www.zerodayinitiative.com/advisories/ZDI-22-348/; https://www.westerndigital.com/support/product-security/wdc-22002-my-cloud-os5-firmware-5-19-117
CVE: CVE-2022-22994
Published: 2022-01-28
Description: A remote code execution vulnerability was discovered on Western Digital My Cloud devices where an attacker could trick a NAS device into loading through an unsecured HTTP call. This was a result insufficient verification of calls to the device. The vulnerability was addressed by disabling checks for internet connectivity using HTTP.
CVSS Score: 8.8 (HIGH)
CWE: CWE-345, CWE-345
References: https://www.westerndigital.com/support/product-security/wdc-22002-my-cloud-os5-firmware-5-19-117; https://www.zerodayinitiative.com/advisories/ZDI-22-349/; https://www.westerndigital.com/support/product-security/wdc-22002-my-cloud-os5-firmware-5-19-117
CVE: CVE-2022-23456
Published: 2022-01-28
Description: Potential arbitrary file deletion vulnerability has been identified in HP Support Assistant software.
CVSS Score: 5.5 (MEDIUM)
References: https://support.hp.com/us-en/document/ish_5[PII_REDACTED]023-16; https://support.hp.com/us-en/document/ish_5[PII_REDACTED]023-16
CVE: CVE-2022-23727
Published: 2022-01-28
Description: There is a privilege escalation vulnerability in some webOS TVs. Due to wrong setting environments, local attacker is able to perform specific operation to exploit this vulnerability. Exploitation may cause the attacker to obtain a higher privilege
CVSS Score: 7.8 (HIGH)
References: https://lgsecurity.lge.com/bulletins/tv; https://lgsecurity.lge.com/bulletins/tv
CVE: CVE-2022-23979
Published: 2022-01-28
Description: Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability discovered in Ultimate Reviews WordPress plugin (versions <= 3.0.15).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/ultimate-reviews/wordpress-ultimate-reviews-plugin-3-0-15-authenticated-stored-cross-site-scripting-xss-vulnerability; https://wordpress.org/plugins/ultimate-reviews/#developers; https://patchstack.com/database/vulnerability/ultimate-reviews/wordpress-ultimate-reviews-plugin-3-0-15-authenticated-stored-cross-site-scripting-xss-vulnerability
CVE: CVE-2022-23887
Published: 2022-01-28
Description: YzmCMS v6.3 was discovered to contain a Cross-Site Request Forgery (CSRF) which allows attackers to arbitrarily delete user accounts via /admin/admin_manage/delete.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://github.com/yzmcms/yzmcms/issues/59; https://github.com/yzmcms/yzmcms/issues/59
CVE: CVE-2022-23888
Published: 2022-01-28
Description: YzmCMS v6.3 was discovered to contain a Cross-Site Request Forgey (CSRF) via the component /yzmcms/comment/index/init.html.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/yzmcms/yzmcms/issues/60; https://github.com/yzmcms/yzmcms/issues/60
CVE: CVE-2022-23889
Published: 2022-01-28
Description: The comment function in YzmCMS v6.3 was discovered as being able to be operated concurrently, allowing attackers to create an unusually large number of comments.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-674
References: https://github.com/yzmcms/yzmcms/issues/61; https://github.com/yzmcms/yzmcms/issues/61
CVE: CVE-2021-23484
Published: 2022-01-28
Description: The package zip-local before 0.3.5 are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) which can lead to an extraction of a crafted file outside the intended extraction directory.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://github.com/Mostafa-Samir/zip-local/blob/master/main.js%23L365; https://github.com/Mostafa-Samir/zip-local/commit/949446a95a660c0752b1db0c654f0fd619ae6085; https://snyk.io/vuln/SNYK-JS-ZIPLOCAL-2327477
CVE: CVE-2021-23558
Published: 2022-01-28
Description: The package bmoor before 0.10.1 are vulnerable to Prototype Pollution due to missing sanitization in set function. **Note:** This vulnerability derives from an incomplete fix in [CVE-2020-7736](https://security.snyk.io/vuln/SNYK-JS-BMOOR-598664)
CVSS Score: 7.3 (HIGH)
CWE: CWE-1321
References: https://github.com/b-heilman/bmoor/commit/29b0162cc1dc1791fc060891f568b0ae29bc542b; https://snyk.io/blog/remediate-javascript-type-confusion-bypassed-input-validation/; https://snyk.io/vuln/SNYK-JS-BMOOR-2342622
CVE: CVE-2021-23760
Published: 2022-01-28
Description: The package keyget from 0.0.0 are vulnerable to Prototype Pollution via the methods set, push, and at which could allow an attacker to cause a denial of service and may lead to remote code execution. **Note:** This vulnerability derives from an incomplete fix to [CVE-2020-28272](https://security.snyk.io/vuln/SNYK-JS-KEYGET-1048048)
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-1321
References: https://snyk.io/vuln/SNYK-JS-KEYGET-2342624; https://snyk.io/vuln/SNYK-JS-KEYGET-2342624
CVE: CVE-2021-44358
Published: 2022-01-28
Description: A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. SetRec param is not object. An attacker can send an HTTP request to trigger this vulnerability.
CVSS Score: 7.7 (HIGH)
CWE: CWE-20, CWE-20
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421
CVE: CVE-2021-44359
Published: 2022-01-28
Description: A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. SetCrop param is not object. An attacker can send an HTTP request to trigger this vulnerability.
CVSS Score: 7.7 (HIGH)
CWE: CWE-20, CWE-20
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421
CVE: CVE-2021-44360
Published: 2022-01-28
Description: A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. SetNorm param is not object. An attacker can send an HTTP request to trigger this vulnerability.
CVSS Score: 7.7 (HIGH)
CWE: CWE-20, CWE-20
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421
CVE: CVE-2021-44361
Published: 2022-01-28
Description: A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. Set3G param is not object. An attacker can send an HTTP request to trigger this vulnerability.
CVSS Score: 7.7 (HIGH)
CWE: CWE-20, CWE-20
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421
CVE: CVE-2021-44362
Published: 2022-01-28
Description: A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. SetCloudSchedule param is not object. An attacker can send an HTTP request to trigger this vulnerability.
CVSS Score: 7.7 (HIGH)
CWE: CWE-20, CWE-20
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421
CVE: CVE-2021-44363
Published: 2022-01-28
Description: A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. SetPush param is not object. An attacker can send an HTTP request to trigger this vulnerability.
CVSS Score: 7.7 (HIGH)
CWE: CWE-20, CWE-20
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421
CVE: CVE-2021-44364
Published: 2022-01-28
Description: A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. SetWifi param is not object. An attacker can send an HTTP request to trigger this vulnerability.
CVSS Score: 7.7 (HIGH)
CWE: CWE-20, CWE-20
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421
CVE: CVE-2021-44365
Published: 2022-01-28
Description: A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. SetDevName param is not object. An attacker can send an HTTP request to trigger this vulnerability.
CVSS Score: 7.7 (HIGH)
CWE: CWE-20, CWE-20
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421
CVE: CVE-2021-44367
Published: 2022-01-28
Description: A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. SetUpnp param is not object. An attacker can send an HTTP request to trigger this vulnerability.
CVSS Score: 7.7 (HIGH)
CWE: CWE-20, CWE-20
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421
CVE: CVE-2021-44368
Published: 2022-01-28
Description: A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. SetNetPort param is not object. An attacker can send an HTTP request to trigger this vulnerability.
CVSS Score: 7.7 (HIGH)
CWE: CWE-20, CWE-20
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421
CVE: CVE-2021-44369
Published: 2022-01-28
Description: A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. SetNtp param is not object. An attacker can send an HTTP request to trigger this vulnerability.
CVSS Score: 7.7 (HIGH)
CWE: CWE-20, CWE-20
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421
CVE: CVE-2021-44370
Published: 2022-01-28
Description: A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. SetFtp param is not object. An attacker can send an HTTP request to trigger this vulnerability.
CVSS Score: 7.7 (HIGH)
CWE: CWE-20, CWE-20
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421
CVE: CVE-2021-44371
Published: 2022-01-28
Description: A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. SetEmail param is not object. An attacker can send an HTTP request to trigger this vulnerability.
CVSS Score: 7.7 (HIGH)
CWE: CWE-20, CWE-20
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421
CVE: CVE-2021-44372
Published: 2022-01-28
Description: A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. SetLocalLink param is not object. An attacker can send an HTTP request to trigger this vulnerability.
CVSS Score: 7.7 (HIGH)
CWE: CWE-20, CWE-20
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421
CVE: CVE-2021-44373
Published: 2022-01-28
Description: A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. SetAutoFocus param is not object. An attacker can send an HTTP request to trigger this vulnerability.
CVSS Score: 7.7 (HIGH)
CWE: CWE-20, CWE-20
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421
CVE: CVE-2021-44374
Published: 2022-01-28
Description: A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. SetMask param is not object. An attacker can send an HTTP request to trigger this vulnerability.
CVSS Score: 7.7 (HIGH)
CWE: CWE-20, CWE-20
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421
CVE: CVE-2021-44376
Published: 2022-01-28
Description: A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. SetIsp param is not object. An attacker can send an HTTP request to trigger this vulnerability.
CVSS Score: 7.7 (HIGH)
CWE: CWE-20, CWE-20
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421
CVE: CVE-2021-44377
Published: 2022-01-28
Description: A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. SetImage param is not object. An attacker can send an HTTP request to trigger this vulnerability.
CVSS Score: 7.7 (HIGH)
CWE: CWE-20, CWE-20
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421
CVE: CVE-2021-44378
Published: 2022-01-28
Description: A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. SetEnc param is not object. An attacker can send an HTTP request to trigger this vulnerability.
CVSS Score: 7.7 (HIGH)
CWE: CWE-20, CWE-20
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421
CVE: CVE-2021-44379
Published: 2022-01-28
Description: A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. SetAutoMaint param is not object. An attacker can send an HTTP request to trigger this vulnerability.
CVSS Score: 7.7 (HIGH)
CWE: CWE-20, CWE-20
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421
CVE: CVE-2021-44380
Published: 2022-01-28
Description: A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. SetTime param is not object. An attacker can send an HTTP request to trigger this vulnerability.
CVSS Score: 7.7 (HIGH)
CWE: CWE-20, CWE-20
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421
CVE: CVE-2021-44381
Published: 2022-01-28
Description: A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. SetPowerLed param is not object. An attacker can send an HTTP request to trigger this vulnerability.
CVSS Score: 7.7 (HIGH)
CWE: CWE-20, CWE-20
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421
CVE: CVE-2021-44382
Published: 2022-01-28
Description: A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot.SetIrLights param is not object. An attacker can send an HTTP request to trigger this vulnerability.
CVSS Score: 7.7 (HIGH)
CWE: CWE-20, CWE-20
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421
CVE: CVE-2021-44383
Published: 2022-01-28
Description: A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. SetAutoUpgrade param is not object. An attacker can send an HTTP request to trigger this vulnerability.
CVSS Score: 7.7 (HIGH)
CWE: CWE-20, CWE-20
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421
CVE: CVE-2021-44384
Published: 2022-01-28
Description: A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. SetPtzTattern param is not object. An attacker can send an HTTP request to trigger this vulnerability.
CVSS Score: 7.7 (HIGH)
CWE: CWE-20, CWE-20
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421
CVE: CVE-2021-44385
Published: 2022-01-28
Description: A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. SetPtzSerial param is not object. An attacker can send an HTTP request to trigger this vulnerability.
CVSS Score: 7.7 (HIGH)
CWE: CWE-20, CWE-20
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421
CVE: CVE-2021-44386
Published: 2022-01-28
Description: A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. SetPtzPatrol param is not object. An attacker can send an HTTP request to trigger this vulnerability.
CVSS Score: 7.7 (HIGH)
CWE: CWE-20, CWE-20
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421
CVE: CVE-2021-44387
Published: 2022-01-28
Description: A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. SetPtzPreset param is not object. An attacker can send an HTTP request to trigger this vulnerability.
CVSS Score: 7.7 (HIGH)
CWE: CWE-20, CWE-20
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421
CVE: CVE-2021-44388
Published: 2022-01-28
Description: A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. Login param is not object. An attacker can send an HTTP request to trigger this vulnerability.
CVSS Score: 7.7 (HIGH)
CWE: CWE-20, CWE-20
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421
CVE: CVE-2021-44389
Published: 2022-01-28
Description: A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. GetAbility param is not object. An attacker can send an HTTP request to trigger this vulnerability.
CVSS Score: 7.7 (HIGH)
CWE: CWE-20, CWE-20
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1421