deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-44668
Published: 2022-12-13
Description: Windows Media Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-44668; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-44668
CVE: CVE-2022-44669
Published: 2022-12-13
Description: Windows Error Reporting Elevation of Privilege Vulnerability
CVSS Score: 7.0 (HIGH)
CWE: CWE-362
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-44669; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-44669
CVE: CVE-2022-44670
Published: 2022-12-13
Description: Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability
CVSS Score: 8.1 (HIGH)
CWE: CWE-367
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-44670; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-44670
CVE: CVE-2022-44671
Published: 2022-12-13
Description: Windows Graphics Component Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-44671; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-44671
CVE: CVE-2022-44673
Published: 2022-12-13
Description: Windows Client Server Run-time Subsystem (CSRSS) Elevation of Privilege Vulnerability
CVSS Score: 7.0 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-44673; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-44673
CVE: CVE-2022-44674
Published: 2022-12-13
Description: Windows Bluetooth Driver Information Disclosure Vulnerability
CVSS Score: 5.5 (MEDIUM)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-44674; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-44674
CVE: CVE-2022-44675
Published: 2022-12-13
Description: Windows Bluetooth Driver Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-44675; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-44675
CVE: CVE-2022-44676
Published: 2022-12-13
Description: Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability
CVSS Score: 8.1 (HIGH)
CWE: CWE-362
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-44676; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-44676
CVE: CVE-2022-44677
Published: 2022-12-13
Description: Windows Projected File System Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-44677; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-44677
CVE: CVE-2022-44678
Published: 2022-12-13
Description: Windows Print Spooler Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-44678; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-44678
CVE: CVE-2022-44679
Published: 2022-12-13
Description: Windows Graphics Component Information Disclosure Vulnerability
CVSS Score: 6.5 (MEDIUM)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-44679; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-44679
CVE: CVE-2022-44680
Published: 2022-12-13
Description: Windows Graphics Component Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-44680; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-44680
CVE: CVE-2022-44681
Published: 2022-12-13
Description: Windows Print Spooler Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-44681; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-44681
CVE: CVE-2022-44682
Published: 2022-12-13
Description: Windows Hyper-V Denial of Service Vulnerability
CVSS Score: 6.8 (MEDIUM)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-44682; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-44682
CVE: CVE-2022-44683
Published: 2022-12-13
Description: Windows Kernel Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-44683; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-44683
CVE: CVE-2022-44687
Published: 2022-12-13
Description: Raw Image Extension Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-44687; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-44687
CVE: CVE-2022-44688
Published: 2022-12-13
Description: Microsoft Edge (Chromium-based) Spoofing Vulnerability
CVSS Score: 4.3 (MEDIUM)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-44688; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-44688; https://security.gentoo.org/glsa/202305-10
CVE: CVE-2022-44689
Published: 2022-12-13
Description: Windows Subsystem for Linux (WSL2) Kernel Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-44689; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-44689
CVE: CVE-2022-44690
Published: 2022-12-13
Description: Microsoft SharePoint Server Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-44690; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-44690
CVE: CVE-2022-44691
Published: 2022-12-13
Description: Microsoft Office OneNote Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-44691; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-44691
CVE: CVE-2022-44692
Published: 2022-12-13
Description: Microsoft Office Graphics Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-44692; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-44692
CVE: CVE-2022-44693
Published: 2022-12-13
Description: Microsoft SharePoint Server Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-44693; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-44693
CVE: CVE-2022-44694
Published: 2022-12-13
Description: Microsoft Office Visio Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-44694; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-44694
CVE: CVE-2022-44695
Published: 2022-12-13
Description: Microsoft Office Visio Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-44695; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-44695
CVE: CVE-2022-44696
Published: 2022-12-13
Description: Microsoft Office Visio Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-44696; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-44696
CVE: CVE-2022-44697
Published: 2022-12-13
Description: Windows Graphics Component Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-44697; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-44697
CVE: CVE-2022-44698
Published: 2022-12-13
Description: Windows SmartScreen Security Feature Bypass Vulnerability
CVSS Score: 5.4 (MEDIUM)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-44698; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-44698; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-44698
CVE: CVE-2022-44699
Published: 2022-12-13
Description: Azure Network Watcher Agent Security Feature Bypass Vulnerability
CVSS Score: 5.5 (MEDIUM)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-44699; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-44699
CVE: CVE-2022-44702
Published: 2022-12-13
Description: Windows Terminal Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-44702; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-44702
CVE: CVE-2022-44704
Published: 2022-12-13
Description: Microsoft Windows System Monitor (Sysmon) Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-44704; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-44704
CVE: CVE-2022-44707
Published: 2022-12-13
Description: Windows Kernel Denial of Service Vulnerability
CVSS Score: 6.5 (MEDIUM)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-44707; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-44707
CVE: CVE-2022-44708
Published: 2022-12-13
Description: Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
CVSS Score: 8.3 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-44708; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-44708; https://security.gentoo.org/glsa/202305-10
CVE: CVE-2022-44710
Published: 2022-12-13
Description: DirectX Graphics Kernel Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-44710; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-44710
CVE: CVE-2022-44713
Published: 2022-12-13
Description: Microsoft Outlook for Mac Spoofing Vulnerability
CVSS Score: 7.5 (HIGH)
CWE: CWE-290
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-44713; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-44713
CVE: CVE-2022-45005
Published: 2022-12-13
Description: IP-COM EW9 V15.11.0.14(9732) was discovered to contain a command injection vulnerability in the cmd_get_ping_output function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://github.com/splashsc/IOT_Vulnerability_Discovery/blob/main/ip-com/6_ping_cmdi.md; https://github.com/splashsc/IOT_Vulnerability_Discovery/blob/main/ip-com/6_ping_cmdi.md
CVE: CVE-2022-47211
Published: 2022-12-13
Description: Microsoft Office Graphics Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-47211; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-47211
CVE: CVE-2022-47212
Published: 2022-12-13
Description: Microsoft Office Graphics Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-47212; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-47212
CVE: CVE-2022-47213
Published: 2022-12-13
Description: Microsoft Office Graphics Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-47213; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-47213
CVE: CVE-2022-23499
Published: 2022-12-13
Description: HTML sanitizer is written in PHP, aiming to provide XSS-safe markup based on explicitly allowed tags, attributes and values. In versions prior to 1.5.0 or 2.1.1,  malicious markup used in a sequence with special HTML CDATA sections cannot be filtered and sanitized due to a parsing issue in the upstream package masterminds/html5. This allows bypassing the cross-site scripting mechanism of typo3/html-sanitizer. The upstream package masterminds/html5 provides HTML raw text elements (`script`, `style`, `noframes`, `noembed` and `iframe`) as DOMText nodes, which were not processed and sanitized further. None of the mentioned elements were defined in the default builder configuration, that's why only custom behaviors, using one of those tag names, were vulnerable to cross-site scripting. This issue has been fixed in versions 1.5.0 and 2.1.1.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/TYPO3/html-sanitizer/security/advisories/GHSA-hvwx-qh2h-xcfj; https://github.com/TYPO3/html-sanitizer/security/advisories/GHSA-hvwx-qh2h-xcfj
CVE: CVE-2022-2947
Published: 2022-12-13
Description: 


Altair HyperView Player versions 2021.1.0.27 and prior perform operations on a memory buffer but can read from or write to a memory location outside of the intended boundary of the buffer. This hits initially as a read access violation, leading to a memory corruption situation.




CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-284-01; https://www.cisa.gov/uscert/ics/advisories/icsa-22-284-01
CVE: CVE-2022-2949
Published: 2022-12-13
Description: 


Altair HyperView Player versions 2021.1.0.27 and prior are vulnerable to the use of uninitialized memory vulnerability during parsing of H3D files. A DWORD is extracted from an uninitialized buffer and, after sign extension, is used as an index into a stack variable to increment a counter leading to memory corruption.






CVSS Score: 7.8 (HIGH)
CWE: CWE-908
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-284-01; https://www.cisa.gov/uscert/ics/advisories/icsa-22-284-01
CVE: CVE-2022-2950
Published: 2022-12-13
Description: 


Altair HyperView Player versions 2021.1.0.27 and prior are vulnerable to the use of uninitialized memory vulnerability during parsing of H3D files. A DWORD is extracted from an uninitialized buffer and, after sign extension, is used as an index into a stack variable to increment a counter leading to memory corruption.






CVSS Score: 7.8 (HIGH)
CWE: CWE-908
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-284-01; https://www.cisa.gov/uscert/ics/advisories/icsa-22-284-01
CVE: CVE-2022-2951
Published: 2022-12-13
Description: 


Altair HyperView Player versions 2021.1.0.27 and prior are vulnerable to improper validation of array index vulnerability during processing of H3D files. A DWORD value from a PoC file is extracted and used as an index to write to a buffer, leading to memory corruption.







CVSS Score: 7.8 (HIGH)
CWE: CWE-129
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-284-01; https://www.cisa.gov/uscert/ics/advisories/icsa-22-284-01
CVE: CVE-2022-38628
Published: 2022-12-13
Description: Nortek Linear eMerge E3-Series 0.32-08f, 0.32-07p, 0.32-07e, 0.32-09c, 0.32-09b, 0.32-09a, and 0.32-08e were discovered to contain a cross-site scripting (XSS) vulnerability which is chained with a local session fixation. This vulnerability allows attackers to escalate privileges via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-384, CWE-384
References: https://github.com/omarhashem123/Security-Research/blob/main/CVE-2022-38628/CVE-2022-38628.txt; https://github.com/omarhashem123/Security-Research/blob/main/CVE-2022-38628/CVE-2022-38628.txt
CVE: CVE-2022-46404
Published: 2022-12-13
Description: A command injection vulnerability has been identified in Atos Unify OpenScape 4000 Assistant and Unify OpenScape 4000 Manager (8 before R2.22.18, 10 before 0.28.13, and 10 R1 before R1.34.4) that may allow an unauthenticated attacker to upload arbitrary files and achieve administrative access to the system.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-77
References: https://networks.unify.com/security/advisories/OBSO-2211-02.pdf; https://www.heise.de/news/Kommunikationssoftware-Kritische-Sicherheitsluecke-in-Atos-Unify-OpenScape-4[PII_REDACTED].html; https://networks.unify.com/security/advisories/OBSO-2211-02.pdf
CVE: CVE-2022-4171
Published: 2022-12-13
Description: The demon image annotation plugin for WordPress is vulnerable to improper input validation in versions up to, and including 5.0. This is due to the plugin improperly validating the number of characters supplied during an annotation despite there being a setting to limit the number characters input. This means that unauthenticated attackers can bypass the length restrictions and input more characters than allowed via the settings.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-1284
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2830349%40demon-image-annotation&new=2830349%40demon-image-annotation&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/ac5549ec-f931-4b13-b5f9-0d6f3e53aae4?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2830349%40demon-image-annotation&new=2830349%40demon-image-annotation&sfp_email=&sfph_mail=
CVE: CVE-2022-4207
Published: 2022-12-13
Description: The Image Hover Effects Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several values that can be added to an Image Hover in versions 9.8.1 to 9.8.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. By default, the plugin only allows administrators access to edit Image Hovers, however, if a site admin makes the plugin's features available to lower privileged users through the 'Who Can Edit?' setting then this can be exploited by those users.
CVSS Score: 5.5 (MEDIUM)
References: https://github.com/MrOxizen/image-hover-effects-ultimate/commit/4ba784e1a2a0cf02e8b8cbe3db7323735d7dedc9; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2830197%40image-hover-effects-ultimate&new=2830197%40image-hover-effects-ultimate&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/f00cdef3-d733-4e85-8099-204ef76096b4
CVE: CVE-2022-2660
Published: 2022-12-13
Description: Delta Industrial Automation DIALink versions 1.4.0.0 and prior are vulnerable to the use of a hard-coded cryptographic key which could allow an attacker to decrypt sensitive data and compromise the machine.






CVSS Score: 9.8 (CRITICAL)
CWE: CWE-321, CWE-798
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-235-02; https://www.cisa.gov/uscert/ics/advisories/icsa-22-235-02
CVE: CVE-2022-2757
Published: 2022-12-13
Description: 


Due to the lack of adequately implemented access-control rules, all versions Kingspan TMS300 CS are vulnerable to an attacker viewing and modifying the application settings without authenticating by accessing a specific uniform resource locator (URL) on the webserver.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287, CWE-287
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-256-04; https://www.cisa.gov/uscert/ics/advisories/icsa-22-256-04
CVE: CVE-2022-38355
Published: 2022-12-13
Description: Daikin SVMPC1 version 2.1.22 and prior and SVMPC2 version 1.2.3 and prior are vulnerable to 

attackers with access to the local area network (LAN) to disclose sensitive information stored by the affected product without requiring authentication.


CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-284-02; https://www.cisa.gov/uscert/ics/advisories/icsa-22-284-02
CVE: CVE-2022-41653
Published: 2022-12-13
Description: Daikin SVMPC1 version 2.1.22 and prior and SVMPC2 version 1.2.3 and prior are vulnerable to an attacker obtaining user login credentials and control the system.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-259, CWE-798
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-284-02; https://www.cisa.gov/uscert/ics/advisories/icsa-22-284-02
CVE: CVE-2022-43996
Published: 2022-12-13
Description: The csaf_provider package before 0.8.2 allows XSS via a crafted CSAF document uploaded as text/html. The endpoint upload allows valid CSAF advisories (JSON format) to be uploaded with Content-Type text/html and filenames ending in .html. When subsequently accessed via web browser, these advisories are served and interpreted as HTML pages. Such uploaded advisories can contain JavaScript code that will execute within the browser context of users inspecting the advisory.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://wid.cert-bund.de/.well-known/csaf/white/2022/bsi-2022-0003.json; https://wid.cert-bund.de/.well-known/csaf/white/2022/bsi-2022-0003.json
CVE: CVE-2022-46381
Published: 2022-12-13
Description: Certain Linear eMerge E3-Series devices are vulnerable to XSS via the type parameter (e.g., to the badging/badge_template_v0.php component). This affects 0.32-08f, 0.32-07p, 0.32-07e, 0.32-09c, 0.32-09b, 0.32-09a, and 0.32-08e.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/omarhashem123/Security-Research/blob/main/CVE-2022-46381/CVE-2022-46381.txt; https://github.com/omarhashem123/Security-Research/blob/main/CVE-2022-46381/CVE-2022-46381.txt
CVE: CVE-2022-44874
Published: 2022-12-13
Description: wasm3 commit 7890a2097569fde845881e0b352d813573e371f9 was discovered to contain a segmentation fault via the component op_CallIndirect at /m3_exec.h.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://github.com/wasm3/wasm3/issues/380; https://github.com/wasm3/wasm3/issues/380
CVE: CVE-2022-37155
Published: 2022-12-14
Description: RCE in SPIP 3.1.13 through 4.1.2 allows remote authenticated users to execute arbitrary code via the _oups parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: https://blog.spip.net/Mise-a-jour-critique-de-securite-sortie-de-SPIP-4-1-5-SPIP-4-0-8-et-SPIP-3-2-16.html; https://github.com/Abyss-W4tcher/ab4yss-wr4iteups/blob/ffa980faa9e3598d49d6fb7def4f7a67cfb5f427/SPIP%20-%20Pentest/SPIP%204.1.2/SPIP_4.1.2_AUTH_RCE/SPIP_4.1.2_AUTH_RCE_Abyss_Watcher_12_07_22.md; https://pastebin.com/ZH7CPc8X
CVE: CVE-2022-40264
Published: 2022-12-14
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ICONICS/Mitsubishi Electric GENESIS64 versions 10.96 to 10.97.2 allows an unauthenticated attacker to create, tamper with or destroy arbitrary files by getting a legitimate user import a project package file crafted by the attacker.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://iconics.com/About/Security/CERT; https://jvn.jp/vu/JVNVU95858406/index.html; https://www.cisa.gov/uscert/ics/advisories/icsa-22-347-01
CVE: CVE-2022-42139
Published: 2022-12-14
Description: Delta Electronics DVW-W02W2-E2 1.5.0.10 is vulnerable to Command Injection via Crafted URL.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://cyberdanube.com/en/en-authenticated-command-injection-in-delta-electronics-dvw-w02w2-e2/; https://cyberdanube.com/en/en-authenticated-command-injection-in-delta-electronics-dvw-w02w2-e2/
CVE: CVE-2022-42140
Published: 2022-12-14
Description: Delta Electronics DX-2100-L1-CN 2.42 is vulnerable to Command Injection via lform/net_diagnose.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78, CWE-78
References: https://cyberdanube.com/en/en-multiple-vulnerabilities-in-delta-electronics-dx-2100-l1-cn/; https://cyberdanube.com/en/en-multiple-vulnerabilities-in-delta-electronics-dx-2100-l1-cn/
CVE: CVE-2022-42141
Published: 2022-12-14
Description: Delta Electronics DX-2100-L1-CN 2.42 is vulnerable to Cross Site Scripting (XSS) via lform/urlfilter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://cyberdanube.com/en/en-multiple-vulnerabilities-in-delta-electronics-dx-2100-l1-cn/; https://cyberdanube.com/en/en-multiple-vulnerabilities-in-delta-electronics-dx-2100-l1-cn/
CVE: CVE-2020-9419
Published: 2022-12-14
Description: Multiple stored cross-site scripting (XSS) vulnerabilities in Arcadyan Wifi routers VRV9506JAC23 allow remote attackers to inject arbitrary web script or HTML via the hostName and domain_name parameters present in the LAN configuration section of the administrative dashboard.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://gist.github.com/AsherDLL/03d0762b5a535e300f1121caebe333ce; https://gist.github.com/AsherDLL/03d0762b5a535e300f1121caebe333ce