deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-25900
Published: 2022-07-01
Description: All versions of package git-clone are vulnerable to Command Injection due to insecure usage of the --upload-pack feature of git.
CVSS Score: 8.1 (HIGH)
CWE: CWE-88
References: https://gist.github.com/lirantal/9441f3a[PII_REDACTED]f7a6caa4acb2ccc; https://snyk.io/vuln/SNYK-JS-GITCLONE-2434308; https://gist.github.com/lirantal/9441f3a[PII_REDACTED]f7a6caa4acb2ccc
CVE: CVE-2022-32081
Published: 2022-07-01
Description: MariaDB v10.4 to v10.7 was discovered to contain an use-after-poison in prepare_inplace_add_virtual at /storage/innobase/handler/handler0alter.cc.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416
References: https://jira.mariadb.org/browse/MDEV-26420; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WCOEGSVMIEXDZHBOSV6WVF7FAVRBR2JE/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WTVAONAZXJFGHAJ4RP2OF3EAMQCOTDSQ/
CVE: CVE-2022-32082
Published: 2022-07-01
Description: MariaDB v10.5 to v10.7 was discovered to contain an assertion failure at table->get_ref_count() == 0 in dict0dict.cc.
CVSS Score: 7.5 (HIGH)
CWE: CWE-617
References: https://jira.mariadb.org/browse/MDEV-26433; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WCOEGSVMIEXDZHBOSV6WVF7FAVRBR2JE/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WTVAONAZXJFGHAJ4RP2OF3EAMQCOTDSQ/
CVE: CVE-2022-32083
Published: 2022-07-01
Description: MariaDB v10.2 to v10.6.1 was discovered to contain a segmentation fault via the component Item_subselect::init_expr_cache_tracker.
CVSS Score: 7.5 (HIGH)
References: https://jira.mariadb.org/browse/MDEV-26047; https://lists.debian.org/debian-lts-announce/2022/09/msg00023.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2022-32084
Published: 2022-07-01
Description: MariaDB v10.2 to v10.7 was discovered to contain a segmentation fault via the component sub_select.
CVSS Score: 7.5 (HIGH)
References: https://jira.mariadb.org/browse/MDEV-26427; https://lists.debian.org/debian-lts-announce/2022/09/msg00023.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WCOEGSVMIEXDZHBOSV6WVF7FAVRBR2JE/
CVE: CVE-2022-32085
Published: 2022-07-01
Description: MariaDB v10.2 to v10.7 was discovered to contain a segmentation fault via the component Item_func_in::cleanup/Item::cleanup_processor.
CVSS Score: 7.5 (HIGH)
References: https://jira.mariadb.org/browse/MDEV-26407; https://lists.debian.org/debian-lts-announce/2022/09/msg00023.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2022-32086
Published: 2022-07-01
Description: MariaDB v10.4 to v10.8 was discovered to contain a segmentation fault via the component Item_field::fix_outer_field.
CVSS Score: 7.5 (HIGH)
References: https://jira.mariadb.org/browse/MDEV-26412; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://jira.mariadb.org/browse/MDEV-26412
CVE: CVE-2022-32087
Published: 2022-07-01
Description: MariaDB v10.2 to v10.7 was discovered to contain a segmentation fault via the component Item_args::walk_args.
CVSS Score: 7.5 (HIGH)
References: https://jira.mariadb.org/browse/MDEV-26437; https://lists.debian.org/debian-lts-announce/2022/09/msg00023.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2022-32088
Published: 2022-07-01
Description: MariaDB v10.2 to v10.7 was discovered to contain a segmentation fault via the component Exec_time_tracker::get_loops/Filesort_tracker::report_use/filesort.
CVSS Score: 7.5 (HIGH)
References: https://jira.mariadb.org/browse/MDEV-26419; https://lists.debian.org/debian-lts-announce/2022/09/msg00023.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2022-32089
Published: 2022-07-01
Description: MariaDB v10.5 to v10.7 was discovered to contain a segmentation fault via the component st_select_lex_unit::exclude_level.
CVSS Score: 7.5 (HIGH)
References: https://jira.mariadb.org/browse/MDEV-26410; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WCOEGSVMIEXDZHBOSV6WVF7FAVRBR2JE/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WTVAONAZXJFGHAJ4RP2OF3EAMQCOTDSQ/
CVE: CVE-2022-32091
Published: 2022-07-01
Description: MariaDB v10.7 was discovered to contain an use-after-poison in in __interceptor_memset at /libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416
References: https://jira.mariadb.org/browse/MDEV-26431; https://lists.debian.org/debian-lts-announce/2022/09/msg00023.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WCOEGSVMIEXDZHBOSV6WVF7FAVRBR2JE/
CVE: CVE-2022-31943
Published: 2022-07-01
Description: MCMS v5.2.8 was discovered to contain an arbitrary file upload vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://github.com/ming-soft/MCMS/issues/95; https://github.com/ming-soft/MCMS/issues/95
CVE: CVE-2022-32093
Published: 2022-07-01
Description: Hospital Management System v1.0 was discovered to contain a SQL injection vulnerability via the loginid parameter at adminlogin.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/Danie1233/Hospital-Management-System-v1.0-SQLi-2/; https://github.com/Danie1233/Hospital-Management-System-v1.0-SQLi-2/
CVE: CVE-2022-32094
Published: 2022-07-01
Description: Hospital Management System v1.0 was discovered to contain a SQL injection vulnerability via the loginid parameter at doctorlogin.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/Danie1233/Hospital-Management-System-v1.0-SQLi-3/; https://github.com/Danie1233/Hospital-Management-System-v1.0-SQLi-3/
CVE: CVE-2022-32095
Published: 2022-07-01
Description: Hospital Management System v1.0 was discovered to contain a SQL injection vulnerability via the editid parameter at orders.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/Danie1233/Hospital-Management-System-v1.0-SQLi-4/; https://github.com/Danie1233/Hospital-Management-System-v1.0-SQLi-4/
CVE: CVE-2022-32384
Published: 2022-07-01
Description: Tenda AC23 v16.03.07.44 was discovered to contain a stack overflow via the security_5g parameter in the function formWifiBasicSet.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://ac23.com; http://tenda.com; https://drive.google.com/file/d/16hshiCHS8j3YaFPkQD3xajVuwu_QVBe3/view?usp=sharing
CVE: CVE-2022-32420
Published: 2022-07-01
Description: College Management System v1.0 was discovered to contain a remote code execution (RCE) vulnerability via /College/admin/teacher.php. This vulnerability is exploited via a crafted PHP file.
CVSS Score: 8.8 (HIGH)
References: https://github.com/rainb0w-q/bug_report/blob/main/vendors/itsourcecode.com/college-management-system/RCE-1.md; https://github.com/rainb0w-q/bug_report/blob/main/vendors/itsourcecode.com/college-management-system/RCE-1.md
CVE: CVE-2022-32324
Published: 2022-07-01
Description: PDFAlto v0.4 was discovered to contain a heap buffer overflow via the component /pdfalto/src/pdfalto.cc.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/kermitt2/pdfalto/issues/144; https://github.com/kermitt2/pdfalto/issues/144
CVE: CVE-2022-32325
Published: 2022-07-01
Description: JPEGOPTIM v1.4.7 was discovered to contain a segmentation violation which is caused by a READ memory access at jpegoptim.c.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://github.com/tjko/jpegoptim/issues/107; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XRPXTW3IARYQVKZBPIPIEKABN7DSS5XY/; https://github.com/tjko/jpegoptim/issues/107
CVE: CVE-2022-32411
Published: 2022-07-01
Description: An issue in the languages config file of HongCMS v3.0 allows attackers to getshell.
CVSS Score: 7.2 (HIGH)
References: https://github.com/Neeke/HongCMS/issues/18; https://github.com/Neeke/HongCMS/issues/18
CVE: CVE-2022-32412
Published: 2022-07-01
Description: An issue in the /template/edit component of HongCMS v3.0 allows attackers to getshell.
CVSS Score: 7.2 (HIGH)
References: https://github.com/Neeke/HongCMS/issues/19; https://github.com/Neeke/HongCMS/issues/19
CVE: CVE-2022-34903
Published: 2022-07-01
Description: GnuPG through 2.3.6, in unusual situations where an attacker possesses any secret-key information from a victim's keyring and other constraints (e.g., use of GPGME) are met, allows signature forgery via injection into the status line.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-74
References: http://www.openwall.com/lists/oss-security/2022/07/02/1; https://bugs.debian.org/1014157; https://dev.gnupg.org/T6027
CVE: CVE-2022-32551
Published: 2022-07-02
Description: Zoho ManageEngine ServiceDesk Plus MSP before 10604 allows path traversal (to WEBINF/web.xml from sample/WEB-INF/web.xml or sample/META-INF/web.xml).
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://www.manageengine.com/products/service-desk-msp/CVE-2022-32551.html; https://www.manageengine.com/products/service-desk-msp/CVE-2022-32551.html
CVE: CVE-2022-28200
Published: 2022-07-02
Description: NVIDIA DGX A100 contains a vulnerability in SBIOS in the BiosCfgTool, where a local user with elevated privileges can read and write beyond intended bounds in SMRAM, which may lead to code execution, escalation of privileges, denial of service, and information disclosure. The scope of impact can extend to other components.
CVSS Score: 8.2 (HIGH)
CWE: CWE-119, CWE-787
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5367; https://nvidia.custhelp.com/app/answers/detail/a_id/5367
CVE: CVE-2022-33014
Published: 2022-07-02
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2022-33015
Published: 2022-07-02
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2022-33016
Published: 2022-07-02
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2022-2284
Published: 2022-07-02
Description: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122
References: https://github.com/vim/vim/commit/3d51ce18ab1be4f9f6061568a4e7fabf00b21794; https://huntr.dev/bounties/571d25ce-8d53-4fa0-b620-27f2a8a14874; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/43Y3VJPOTTY3NTREDIFUPITM2POG4ZLP/
CVE: CVE-2022-2285
Published: 2022-07-02
Description: Integer Overflow or Wraparound in GitHub repository vim/vim prior to 9.0.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190, CWE-190
References: https://github.com/vim/vim/commit/27efc62f5d86afcb2ecb7565587fe8dea4b036fe; https://huntr.dev/bounties/64574b28-1779-458d-a221-06c434042736; https://lists.debian.org/debian-lts-announce/2022/11/msg00009.html
CVE: CVE-2022-2286
Published: 2022-07-02
Description: Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://github.com/vim/vim/commit/f12129f1714f7d2301935bb21d896609bdac221c; https://huntr.dev/bounties/fe7681fb-2318-436b-8e65-daf66cd597d8; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/43Y3VJPOTTY3NTREDIFUPITM2POG4ZLP/
CVE: CVE-2022-34911
Published: 2022-07-02
Description: An issue was discovered in MediaWiki before 1.35.7, 1.36.x and 1.37.x before 1.37.3, and 1.38.x before 1.38.1. XSS can occur in configurations that allow a JavaScript payload in a username. After account creation, when it sets the page title to "Welcome" followed by the username, the username is not escaped: SpecialCreateAccount::successfulAction() calls ::showSuccessPage() with a message as second parameter, and OutputPage::setPageTitle() uses text().
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://lists.debian.org/debian-lts-announce/2022/09/msg00027.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7N5ZBWLNNPZKFK7Q4KEHGCJ2YELQEUJP/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DKKOQXPYLMBSEVDHFS32BPBR3ZQJKY5B/
CVE: CVE-2022-34912
Published: 2022-07-02
Description: An issue was discovered in MediaWiki before 1.37.3 and 1.38.x before 1.38.1. The contributions-title, used on Special:Contributions, is used as page title without escaping. Hence, in a non-default configuration where a username contains HTML entities, it won't be escaped.
CVSS Score: 6.1 (MEDIUM)
References: https://lists.debian.org/debian-lts-announce/2022/09/msg00027.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7N5ZBWLNNPZKFK7Q4KEHGCJ2YELQEUJP/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DKKOQXPYLMBSEVDHFS32BPBR3ZQJKY5B/
CVE: CVE-2022-34913
Published: 2022-07-02
Description: md2roff 1.7 has a stack-based buffer overflow via a Markdown file containing a large number of consecutive characters to be processed. NOTE: the vendor's position is that the product is not intended for untrusted input
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/nereusx/md2roff/issues/4; https://github.com/nereusx/md2roff/issues/4
CVE: CVE-2022-2287
Published: 2022-07-02
Description: Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125
References: https://github.com/vim/vim/commit/5e59ea54c0c37c2f84770f068d[PII_REDACTED]8774; https://huntr.dev/bounties/654aa069-3a9d-45d3-9a52-c1cf3490c284; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/43Y3VJPOTTY3NTREDIFUPITM2POG4ZLP/
CVE: CVE-2022-2290
Published: 2022-07-03
Description: Cross-site Scripting (XSS) - Reflected in GitHub repository zadam/trilium prior to 0.52.4, 0.53.1-beta.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/zadam/trilium/commit/3faae63b849a1fabc31b823bb7af3a84d32256a7; https://huntr.dev/bounties/367c5c8d-ad6f-46be-8503-06648ecf09cf; https://github.com/zadam/trilium/commit/3faae63b849a1fabc31b823bb7af3a84d32256a7
CVE: CVE-2022-2288
Published: 2022-07-03
Description: Out-of-bounds Write in GitHub repository vim/vim prior to 9.0.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/vim/vim/commit/c6fdb15d423df22e[PII_REDACTED]d082322475e48a; https://huntr.dev/bounties/a71bdcb7-4e9b-4650-ab6a-fe8e3e9852ad; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/43Y3VJPOTTY3NTREDIFUPITM2POG4ZLP/
CVE: CVE-2022-2289
Published: 2022-07-03
Description: Use After Free in GitHub repository vim/vim prior to 9.0.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://github.com/vim/vim/commit/c5274dd12224421f2430b30c53b881b9403d649e; https://huntr.dev/bounties/7447d2ea-db5b-4883-adf4-1eaf7deace64; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/43Y3VJPOTTY3NTREDIFUPITM2POG4ZLP/
CVE: CVE-2022-32284
Published: 2022-07-04
Description: Use of insufficiently random values vulnerability exists in Vnet/IP communication module VI461 of YOKOGAWA Wide Area Communication Router (WAC Router) AW810D, which may allow a remote attacker to cause denial-of-service (DoS) condition by sending a specially crafted packet.
CVSS Score: 7.5 (HIGH)
CWE: CWE-330
References: https://jvn.jp/vu/JVNVU95343906/index.html; https://web-material3.yokogawa.com/1/32825/files/YSAR-22-0005-E.pdf; https://web-material3.yokogawa.com/19/32825/files/YSAR-22-0005-J.pdf
CVE: CVE-2022-33208
Published: 2022-07-04
Description: Authentication bypass by capture-replay vulnerability exists in Machine automation controller NJ series all models V 1.48 and earlier, Machine automation controller NX7 series all models V1.28 and earlier, Machine automation controller NX1 series all models V1.48 and earlier, Automation software 'Sysmac Studio' all models V1.49 and earlier, and Programmable Terminal (PT) NA series NA5-15W/NA5-12W/NA5-9W/NA5-7W models Runtime V1.15 and earlier, which may allow a remote attacker who can analyze the communication between the affected controller and automation software 'Sysmac Studio' and/or a Programmable Terminal (PT) to access the controller.
CVSS Score: 8.1 (HIGH)
CWE: CWE-294
References: https://jvn.jp/en/vu/JVNVU97050784/index.html; https://www.ia.omron.com/product/vulnerability/OMSR-2022-001_en.pdf; https://jvn.jp/en/vu/JVNVU97050784/index.html
CVE: CVE-2022-33948
Published: 2022-07-04
Description: HOME SPOT CUBE2 V102 contains an OS command injection vulnerability due to improper processing of data received from DHCP server. An adjacent attacker may execute an arbitrary OS command on the product if a malicious DHCP server is placed on the WAN side of the product.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://jvn.jp/en/jp/JVN41017328/index.html; https://www.au.com/support/service/mobile/guide/wlan/home_spot_cube_2/; https://jvn.jp/en/jp/JVN41017328/index.html
CVE: CVE-2022-33971
Published: 2022-07-04
Description: Authentication bypass by capture-replay vulnerability exists in Machine automation controller NX7 series all models V1.28 and earlier, Machine automation controller NX1 series all models V1.48 and earlier, and Machine automation controller NJ series all models V 1.48 and earlier, which may allow an adjacent attacker who can analyze the communication between the controller and the specific software used by OMRON internally to cause a denial-of-service (DoS) condition or execute a malicious program.
CVSS Score: 7.5 (HIGH)
CWE: CWE-294
References: https://jvn.jp/en/vu/JVNVU97050784/index.html; https://www.ia.omron.com/product/vulnerability/OMSR-2022-002_en.pdf; https://jvn.jp/en/vu/JVNVU97050784/index.html
CVE: CVE-2022-34151
Published: 2022-07-04
Description: Use of hard-coded credentials vulnerability exists in Machine automation controller NJ series all models V 1.48 and earlier, Machine automation controller NX7 series all models V1.28 and earlier, Machine automation controller NX1 series all models V1.48 and earlier, Automation software 'Sysmac Studio' all models V1.49 and earlier, and Programmable Terminal (PT) NA series NA5-15W/NA5-12W/NA5-9W/NA5-7W models Runtime V1.15 and earlier, which may allow a remote attacker who successfully obtained the user credentials by analyzing the affected product to access the controller.
CVSS Score: 8.1 (HIGH)
CWE: CWE-798
References: https://jvn.jp/en/vu/JVNVU97050784/index.html; https://www.ia.omron.com/product/vulnerability/OMSR-2022-001_en.pdf; https://jvn.jp/en/vu/JVNVU97050784/index.html
CVE: CVE-2022-26051
Published: 2022-07-04
Description: Operation restriction bypass vulnerability in Portal of Cybozu Garoon 4.0.0 to 5.5.1 allows a remote authenticated attacker to alter the data of Portal.
CVSS Score: 4.3 (MEDIUM)
References: https://cs.cybozu.co.jp/2022/007429.html; https://jvn.jp/en/jp/JVN73897863/index.html; https://cs.cybozu.co.jp/2022/007429.html
CVE: CVE-2022-26054
Published: 2022-07-04
Description: Operation restriction bypass vulnerability in Link of Cybozu Garoon 4.0.0 to 5.5.1 allows a remote authenticated attacker to alter the data of Link.
CVSS Score: 4.3 (MEDIUM)
References: https://cs.cybozu.co.jp/2022/007429.html; https://jvn.jp/en/jp/JVN73897863/index.html; https://cs.cybozu.co.jp/2022/007429.html
CVE: CVE-2022-26368
Published: 2022-07-04
Description: Browse restriction bypass and operation restriction bypass vulnerability in Cabinet of Cybozu Garoon 4.0.0 to 5.5.1 allows a remote authenticated attacker to alter and/or obtain the data of Cabinet.
CVSS Score: 5.4 (MEDIUM)
References: https://cs.cybozu.co.jp/2022/007429.html; https://jvn.jp/en/jp/JVN73897863/index.html; https://cs.cybozu.co.jp/2022/007429.html
CVE: CVE-2022-27627
Published: 2022-07-04
Description: Cross-site scripting vulnerability in Organization's Information of Cybozu Garoon 4.10.2 to 5.5.1 allows a remote attacker to execute an arbitrary script on the logged-in user's web browser.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://cs.cybozu.co.jp/2022/007429.html; https://jvn.jp/en/jp/JVN73897863/index.html; https://cs.cybozu.co.jp/2022/007429.html
CVE: CVE-2022-27661
Published: 2022-07-04
Description: Operation restriction bypass vulnerability in Workflow of Cybozu Garoon 4.0.0 to 5.5.1 allows a remote authenticated attacker to alter the data of Workflow.
CVSS Score: 4.3 (MEDIUM)
References: https://cs.cybozu.co.jp/2022/007429.html; https://jvn.jp/en/jp/JVN73897863/index.html; https://cs.cybozu.co.jp/2022/007429.html
CVE: CVE-2022-27803
Published: 2022-07-04
Description: Improper input validation vulnerability in Space of Cybozu Garoon 4.0.0 to 5.5.1 allows a remote authenticated attacker to alter the data of Space.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: https://cs.cybozu.co.jp/2022/007429.html; https://jvn.jp/en/jp/JVN73897863/index.html; https://cs.cybozu.co.jp/2022/007429.html
CVE: CVE-2022-27807
Published: 2022-07-04
Description: Improper input validation vulnerability in Link of Cybozu Garoon 4.0.0 to 5.5.1 allows a remote authenticated attacker to disable to add Categories.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: https://cs.cybozu.co.jp/2022/007429.html; https://jvn.jp/en/jp/JVN73897863/index.html; https://cs.cybozu.co.jp/2022/007429.html
CVE: CVE-2022-28692
Published: 2022-07-04
Description: Improper input validation vulnerability in Scheduler of Cybozu Garoon 4.0.0 to 5.5.1 allows a remote authenticated attacker to alter the data of Scheduler.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: https://cs.cybozu.co.jp/2022/007429.html; https://jvn.jp/en/jp/JVN73897863/index.html; https://cs.cybozu.co.jp/2022/007429.html
CVE: CVE-2022-28713
Published: 2022-07-04
Description: Improper authentication vulnerability in Scheduler of Cybozu Garoon 4.10.0 to 5.5.1 allows a remote attacker to obtain some data of Facility Information without logging in to the product.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-287
References: https://cs.cybozu.co.jp/2022/007429.html; https://jvn.jp/en/jp/JVN73897863/index.html; https://cs.cybozu.co.jp/2022/007429.html
CVE: CVE-2022-28718
Published: 2022-07-04
Description: Operation restriction bypass vulnerability in Bulletin of Cybozu Garoon 4.0.0 to 5.5.1 allow a remote authenticated attacker to alter the data of Bulletin.
CVSS Score: 4.3 (MEDIUM)
References: https://cs.cybozu.co.jp/2022/007429.html; https://jvn.jp/en/jp/JVN73897863/index.html; https://cs.cybozu.co.jp/2022/007429.html
CVE: CVE-2022-29467
Published: 2022-07-04
Description: Address information disclosure vulnerability in Cybozu Garoon 4.2.0 to 5.5.1 allows a remote authenticated attacker to obtain some data of Address.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://cs.cybozu.co.jp/2022/007429.html; https://jvn.jp/en/jp/JVN73897863/index.html; https://cs.cybozu.co.jp/2022/007429.html
CVE: CVE-2022-29471
Published: 2022-07-04
Description: Browse restriction bypass vulnerability in Bulletin of Cybozu Garoon allows a remote authenticated attacker to obtain the data of Bulletin.
CVSS Score: 4.3 (MEDIUM)
References: https://cs.cybozu.co.jp/2022/007429.html; https://jvn.jp/en/jp/JVN73897863/index.html; https://cs.cybozu.co.jp/2022/007429.html
CVE: CVE-2022-29484
Published: 2022-07-04
Description: Operation restriction bypass vulnerability in Space of Cybozu Garoon 4.0.0 to 5.9.0 allows a remote authenticated attacker to delete the data of Space.
CVSS Score: 8.1 (HIGH)
References: https://cs.cybozu.co.jp/2022/007429.html; https://jvn.jp/en/jp/JVN73897863/index.html; https://cs.cybozu.co.jp/2022/007429.html