deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-43595
Published: 2022-12-22
Description: Multiple denial of service vulnerabilities exist in the image output closing functionality of OpenImageIO Project OpenImageIO v2.4.4.2. Specially crafted ImageOutput Objects can lead to multiple null pointer dereferences. An attacker can provide malicious multiple inputs to trigger these vulnerabilities.This vulnerability applies to writing .fits files.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-476
References: https://security.gentoo.org/glsa/202305-33; https://talosintelligence.com/vulnerability_reports/TALOS-2022-1653; https://www.debian.org/security/2023/dsa-5384
CVE: CVE-2022-43596
Published: 2022-12-22
Description: An information disclosure vulnerability exists in the IFFOutput channel interleaving functionality of OpenImageIO Project OpenImageIO v2.4.4.2. A specially crafted ImageOutput Object can lead to leaked heap data. An attacker can provide malicious input to trigger this vulnerability.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-125
References: https://security.gentoo.org/glsa/202305-33; https://talosintelligence.com/vulnerability_reports/TALOS-2022-1654; https://www.debian.org/security/2023/dsa-5384
CVE: CVE-2022-43597
Published: 2022-12-22
Description: Multiple memory corruption vulnerabilities exist in the IFFOutput alignment padding functionality of OpenImageIO Project OpenImageIO v2.4.4.2. A specially crafted ImageOutput Object can lead to arbitrary code execution. An attacker can provide malicious input to trigger these vulnerabilities.This vulnerability arises when the `m_spec.format` is `TypeDesc::UINT8`.
CVSS Score: 8.1 (HIGH)
CWE: CWE-122
References: https://security.gentoo.org/glsa/202305-33; https://talosintelligence.com/vulnerability_reports/TALOS-2022-1655; https://www.debian.org/security/2023/dsa-5384
CVE: CVE-2022-43598
Published: 2022-12-22
Description: Multiple memory corruption vulnerabilities exist in the IFFOutput alignment padding functionality of OpenImageIO Project OpenImageIO v2.4.4.2. A specially crafted ImageOutput Object can lead to arbitrary code execution. An attacker can provide malicious input to trigger these vulnerabilities.This vulnerability arises when the `m_spec.format` is `TypeDesc::UINT16`.
CVSS Score: 8.1 (HIGH)
CWE: CWE-122, CWE-787
References: https://security.gentoo.org/glsa/202305-33; https://talosintelligence.com/vulnerability_reports/TALOS-2022-1655; https://www.debian.org/security/2023/dsa-5384
CVE: CVE-2022-43599
Published: 2022-12-22
Description: Multiple code execution vulnerabilities exist in the IFFOutput::close() functionality of OpenImageIO Project OpenImageIO v2.4.4.2. A specially crafted ImageOutput Object can lead to a heap buffer overflow. An attacker can provide malicious input to trigger these vulnerabilities.This vulnerability arises when the `xmax` variable is set to 0xFFFF and `m_spec.format` is `TypeDesc::UINT8`
CVSS Score: 8.1 (HIGH)
CWE: CWE-122
References: https://security.gentoo.org/glsa/202305-33; https://talosintelligence.com/vulnerability_reports/TALOS-2022-1656; https://www.debian.org/security/2023/dsa-5384
CVE: CVE-2022-43600
Published: 2022-12-22
Description: Multiple code execution vulnerabilities exist in the IFFOutput::close() functionality of OpenImageIO Project OpenImageIO v2.4.4.2. A specially crafted ImageOutput Object can lead to a heap buffer overflow. An attacker can provide malicious input to trigger these vulnerabilities.This vulnerability arises when the `xmax` variable is set to 0xFFFF and `m_spec.format` is `TypeDesc::UINT16`
CVSS Score: 8.1 (HIGH)
CWE: CWE-122
References: https://security.gentoo.org/glsa/202305-33; https://talosintelligence.com/vulnerability_reports/TALOS-2022-1656; https://www.debian.org/security/2023/dsa-5384
CVE: CVE-2022-43601
Published: 2022-12-22
Description: Multiple code execution vulnerabilities exist in the IFFOutput::close() functionality of OpenImageIO Project OpenImageIO v2.4.4.2. A specially crafted ImageOutput Object can lead to a heap buffer overflow. An attacker can provide malicious input to trigger these vulnerabilities.This vulnerability arises when the `ymax` variable is set to 0xFFFF and `m_spec.format` is `TypeDesc::UINT16`
CVSS Score: 8.1 (HIGH)
CWE: CWE-122
References: https://security.gentoo.org/glsa/202305-33; https://talosintelligence.com/vulnerability_reports/TALOS-2022-1656; https://www.debian.org/security/2023/dsa-5384
CVE: CVE-2022-43602
Published: 2022-12-22
Description: Multiple code execution vulnerabilities exist in the IFFOutput::close() functionality of OpenImageIO Project OpenImageIO v2.4.4.2. A specially crafted ImageOutput Object can lead to a heap buffer overflow. An attacker can provide malicious input to trigger these vulnerabilities.This vulnerability arises when the `ymax` variable is set to 0xFFFF and `m_spec.format` is `TypeDesc::UINT8`
CVSS Score: 8.1 (HIGH)
CWE: CWE-122
References: https://security.gentoo.org/glsa/202305-33; https://talosintelligence.com/vulnerability_reports/TALOS-2022-1656; https://www.debian.org/security/2023/dsa-5384
CVE: CVE-2022-43603
Published: 2022-12-22
Description: A denial of service vulnerability exists in the ZfileOutput::close() functionality of OpenImageIO Project OpenImageIO v2.4.4.2. A specially crafted ImageOutput Object can lead to denial of service. An attacker can provide a malicious file to trigger this vulnerability.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://security.gentoo.org/glsa/202305-33; https://talosintelligence.com/vulnerability_reports/TALOS-2022-1657; https://www.debian.org/security/2023/dsa-5384
CVE: CVE-2022-4662
Published: 2022-12-22
Description: A flaw incorrect access control in the Linux kernel USB core subsystem was found in the way user attaches usb device. A local user could use this flaw to crash the system.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-455
References: https://lore.kernel.org/all/[PII_REDACTED]0[PII_REDACTED]67%40linuxfoundation.org/; https://lore.kernel.org/all/CAB7eexLLApHJwZfMQ=X-PtRhw0BgO+5KcSMS05FNUYejJXqtSA%40mail.gmail.com/; https://lore.kernel.org/all/[PII_REDACTED]0[PII_REDACTED]67%40linuxfoundation.org/
CVE: CVE-2022-46491
Published: 2022-12-22
Description: A Cross-Site Request Forgery (CSRF) vulnerability in the Add Administrator function of the default version of nbnbk allows attackers to arbitrarily add Administrator accounts.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://github.com/Fanli2012/nbnbk/issues/2; https://github.com/Fanli2012/nbnbk/issues/2
CVE: CVE-2022-46493
Published: 2022-12-22
Description: Default version of nbnbk was discovered to contain an arbitrary file upload vulnerability via the component /api/User/download_img.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434, CWE-434
References: https://github.com/Fanli2012/nbnbk/issues/1; https://github.com/Fanli2012/nbnbk/issues/1
CVE: CVE-2022-47928
Published: 2022-12-22
Description: In MISP before 2.4.167, there is XSS in the template file uploads in app/View/Templates/upload_file.ctp.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/MISP/MISP/commit/684d3e51398d4ea032b06fa4a1cd2bdf7d8b0ede; https://zigrin.com/advisories/misp-reflected-xss-in-uploadfile-action-of-the-templates-controllermisp/; https://github.com/MISP/MISP/commit/684d3e51398d4ea032b06fa4a1cd2bdf7d8b0ede
CVE: CVE-2022-23513
Published: 2022-12-23
Description: Pi-Hole is a network-wide ad blocking via your own Linux hardware, AdminLTE is a Pi-hole Dashboard for stats and more. In case of an attack, the threat actor will obtain the ability to perform an unauthorized query for blocked domains on  `queryads` endpoint. In the case of application, this vulnerability exists because of a lack of validation in code on a root server path:
`/admin/scripts/pi-hole/phpqueryads.php.` Potential threat actor(s) are able to perform an unauthorized query search in blocked domain lists. This could lead to the disclosure for any victims' personal blacklists.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-284
References: http://packetstormsecurity.com/files/174460/AdminLTE-PiHole-Broken-Access-Control.html; https://github.com/pi-hole/AdminLTE/releases/tag/v5.18; https://github.com/pi-hole/AdminLTE/security/advisories/GHSA-6qh8-6rrj-7497
CVE: CVE-2022-23539
Published: 2022-12-23
Description: Versions `<=8.5.1` of `jsonwebtoken` library could be misconfigured so that legacy, insecure key types are used for signature verification. For example, DSA keys could be used with the RS256 algorithm. You are affected if you are using an algorithm and a key type other than a combination listed in the GitHub Security Advisory as unaffected. This issue has been fixed, please update to version 9.0.0. This version validates for asymmetric key type and algorithm combinations. Please refer to the above mentioned algorithm / key type combinations for the valid secure configuration. After updating to version 9.0.0, if you still intend to continue with signing or verifying tokens using invalid key type/algorithm value combinations, you’ll need to set the `allowInvalidAsymmetricKeyTypes` option  to `true` in the `sign()` and/or `verify()` functions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-327
References: https://github.com/auth0/node-jsonwebtoken/commit/e1fa9dcc12054a8681db4e6373da1b30cf7016e3; https://github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-8cf7-32gw-wr33; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2022-40897
Published: 2022-12-23
Description: Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of Service (ReDoS) in package_index.py.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-1333, CWE-1333
References: https://github.com/pypa/setuptools/blob/fe8a98e696241487ba6ac9f91faa38ade939ec5d/setuptools/package_index.py#L200; https://github.com/pypa/setuptools/commit/43a9c9bfa6aa626ec2a22540bea28d2ca77964be; https://github.com/pypa/setuptools/compare/v65.5.0...v65.5.1
CVE: CVE-2022-40898
Published: 2022-12-23
Description: An issue discovered in Python Packaging Authority (PyPA) Wheel 0.37.1 and earlier allows remote attackers to cause a denial of service via attacker controlled input to wheel cli.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://github.com/pypa/wheel/blob/main/src/wheel/wheelfile.py#L18; https://pypi.org/project/wheel/; https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages/
CVE: CVE-2022-40899
Published: 2022-12-23
Description: An issue discovered in Python Charmers Future 0.18.2 and earlier allows remote attackers to cause a denial of service via crafted Set-Cookie header from malicious web server.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://github.com/PythonCharmers/python-future/blob/master/src/future/backports/http/cookiejar.py#L215; https://github.com/PythonCharmers/python-future/pull/610; https://github.com/python/cpython/pull/17157
CVE: CVE-2022-47931
Published: 2022-12-23
Description: IO FinNet tss-lib before 2.0.0 allows a collision of hash values.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-326, CWE-326
References: https://github.com/IoFinnet/tss-lib/commit/369ec50be1437588a9733443bcb2f15b794601d4; https://github.com/IoFinnet/tss-lib/releases/tag/v2.0.0; https://medium.com/%40iofinnet/security-disclosure-for-ecdsa-and-eddsa-threshold-signature-schemes-4e969af7155b
CVE: CVE-2022-46492
Published: 2022-12-23
Description: nbnbk commit 879858451d53261d10f77d4709aee2d01c72c301 was discovered to contain an arbitrary file read vulnerability via the component /api/Index/getFileBinary.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://github.com/Fanli2012/nbnbk/issues/3; https://github.com/Fanli2012/nbnbk/issues/3
CVE: CVE-2022-4665
Published: 2022-12-23
Description: Unrestricted Upload of File with Dangerous Type in GitHub repository ampache/ampache prior to 5.5.6.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://github.com/ampache/ampache/commit/8293fa86e5f50a168b7f5c892ffbd6aa555134bd; https://huntr.dev/bounties/5e7f3ecc-3b08-4e0e-8bf8-ae7ae229941f; https://github.com/ampache/ampache/commit/8293fa86e5f50a168b7f5c892ffbd6aa555134bd
CVE: CVE-2021-32692
Published: 2022-12-23
Description: Activity Watch is a free and open-source automated time tracker. Versions prior to 0.11.0 allow an attacker to execute arbitrary commands on any macOS machine with ActivityWatch running. The attacker can exploit this vulnerability by having the user visiting a website with the page title set to a malicious string. An attacker could use another application to accomplish the same, but the web browser is the most likely attack vector. This issue is patched in version 0.11.0. As a workaround, users can run the latest version of aw-watcher-window from source, or manually patch the `printAppTitle.scpt` file.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-77, CWE-78
References: https://github.com/ActivityWatch/activitywatch/security/advisories/GHSA-3x6w-q32m-jqf3; https://github.com/ActivityWatch/activitywatch/security/advisories/GHSA-3x6w-q32m-jqf3
CVE: CVE-2022-33324
Published: 2022-12-23
Description: Improper Resource Shutdown or Release vulnerability in Mitsubishi Electric Corporation MELSEC iQ-R Series R00/01/02CPU Firmware versions "32" and prior, Mitsubishi Electric Corporation MELSEC iQ-R Series R04/08/16/32/120(EN)CPU Firmware versions "65" and prior, Mitsubishi Electric Corporation MELSEC iQ-R Series R08/16/32/120SFCPU Firmware versions "29" and prior, Mitsubishi Electric Corporation MELSEC iQ-R Series R08/16/32/120PSFCPU Firmware versions "08" and prior, Mitsubishi Electric Corporation MELSEC iQ-R Series R12CCPU-V Firmware versions "17" and prior, Mitsubishi Electric Corporation MELSEC iQ-L Series L04/08/16/32HCPU Firmware versions "05" and prior and Mitsubishi Electric Corporation MELIPC Series MI5122-VW Firmware versions "07" and prior allows a remote unauthenticated attacker to cause a Denial of Service condition in Ethernet communication on the module by sending specially crafted packets. A system reset of the module is required for recovery.
CVSS Score: 7.5 (HIGH)
CWE: CWE-404, CWE-404
References: https://jvn.jp/vu/JVNVU96883262; https://www.cisa.gov/uscert/ics/advisories/icsa-22-356-03; https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-018_en.pdf
CVE: CVE-2022-4683
Published: 2022-12-23
Description: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository usememos/memos prior to 0.9.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-614, CWE-311
References: https://github.com/usememos/memos/commit/7efa749c6628c75b19a912ca170529f5c293bb2e; https://huntr.dev/bounties/84973f6b-739a-4d7e-8757-fc58cbbaf6ef; https://github.com/usememos/memos/commit/7efa749c6628c75b19a912ca170529f5c293bb2e
CVE: CVE-2022-4684
Published: 2022-12-23
Description: Improper Access Control in GitHub repository usememos/memos prior to 0.9.0.
CVSS Score: 8.8 (HIGH)
CWE: CWE-284
References: https://github.com/usememos/memos/commit/dca35bde877aab6e64ef51b52e590b5d48f692f9; https://huntr.dev/bounties/b66f2bdd-8b41-456c-bf65-92302c2e03b5; https://github.com/usememos/memos/commit/dca35bde877aab6e64ef51b52e590b5d48f692f9
CVE: CVE-2022-4685
Published: 2022-12-23
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. Reason: This CVE has been rejected as it was incorrectly assigned. All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2022-4686
Published: 2022-12-23
Description: Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.0.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-639, CWE-639
References: https://github.com/usememos/memos/commit/dca35bde877aab6e64ef51b52e590b5d48f692f9; https://huntr.dev/bounties/caa0b22c-501f-44eb-af65-65c315cd1637; https://github.com/usememos/memos/commit/dca35bde877aab6e64ef51b52e590b5d48f692f9
CVE: CVE-2022-4687
Published: 2022-12-23
Description: Incorrect Use of Privileged APIs in GitHub repository usememos/memos prior to 0.9.0.
CVSS Score: 8.1 (HIGH)
CWE: CWE-648, CWE-269
References: https://github.com/usememos/memos/commit/dca35bde877aab6e64ef51b52e590b5d48f692f9; https://huntr.dev/bounties/b908377f-a61b-432c-8e6a-c7498da69788; https://github.com/usememos/memos/commit/dca35bde877aab6e64ef51b52e590b5d48f692f9
CVE: CVE-2022-4688
Published: 2022-12-23
Description: Improper Authorization in GitHub repository usememos/memos prior to 0.9.0.
CVSS Score: 8.8 (HIGH)
CWE: CWE-285
References: https://github.com/usememos/memos/commit/dca35bde877aab6e64ef51b52e590b5d48f692f9; https://huntr.dev/bounties/23856e7e-94ff-4dee-97d0-0cd47e9b8ff6; https://github.com/usememos/memos/commit/dca35bde877aab6e64ef51b52e590b5d48f692f9
CVE: CVE-2022-4689
Published: 2022-12-23
Description: Improper Access Control in GitHub repository usememos/memos prior to 0.9.0.
CVSS Score: 8.8 (HIGH)
CWE: CWE-284
References: https://github.com/usememos/memos/commit/dca35bde877aab6e64ef51b52e590b5d48f692f9; https://huntr.dev/bounties/a78c4326-6e7b-47fe-aa82-461e5c12a4e3; https://github.com/usememos/memos/commit/dca35bde877aab6e64ef51b52e590b5d48f692f9
CVE: CVE-2022-4690
Published: 2022-12-23
Description: Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.0.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/usememos/memos/commit/c07b4a57caa89905e54b800f4d8fb720bbf5bf82; https://huntr.dev/bounties/7e1be91d-3b13-4300-8af2-9bd9665ec335; https://github.com/usememos/memos/commit/c07b4a57caa89905e54b800f4d8fb720bbf5bf82
CVE: CVE-2022-46171
Published: 2022-12-23
Description: Tauri is a framework for building binaries for all major desktop platforms. The filesystem glob pattern wildcards `*`, `?`, and `[...]` match file path literals and leading dots by default, which unintentionally exposes sub folder content of allowed paths. Scopes without the wildcards are not affected. As `**` allows for sub directories the behavior there is also as expected. The issue has been patched in the latest release and was backported into the currently supported 1.x branches. There are no known workarounds at the time of publication.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://github.com/tauri-apps/tauri/commit/72389b00d7b495ffd7750eb1e75a3b8537d07cf3; https://github.com/tauri-apps/tauri/commit/f0602e7c294245ab6ef6fbf2a976ef398340ef58; https://github.com/tauri-apps/tauri/security/advisories/GHSA-6mv3-wm7j-h4w5
CVE: CVE-2022-47524
Published: 2022-12-23
Description: F-Secure SAFE Browser 19.1 before 19.2 for Android allows an IDN homograph attack.
CVSS Score: 5.4 (MEDIUM)
References: https://www.f-secure.com/en/home/support/security-advisories/cve-2022-47524; https://www.f-secure.com/en/home/support/security-advisories/cve-2022-47524
CVE: CVE-2022-23547
Published: 2022-12-23
Description: PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. This issue is similar to GHSA-9pfh-r8x4-w26w. Possible buffer overread when parsing a certain STUN message. The vulnerability affects applications that uses STUN including PJNATH and PJSUA-LIB. The patch is available as commit in the master branch.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-122, CWE-125
References: https://github.com/pjsip/pjproject/commit/bc4812d31a67d5e2f973fbfaf950d6118226cf36; https://github.com/pjsip/pjproject/security/advisories/GHSA-9pfh-r8x4-w26w; https://github.com/pjsip/pjproject/security/advisories/GHSA-cxwq-5g9x-x7fr
CVE: CVE-2022-43551
Published: 2022-12-23
Description: A vulnerability exists in curl <7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP. Using its HSTS support, curl can be instructed to use HTTPS instead of using an insecure clear-text HTTP step even when HTTP is provided in the URL. However, the HSTS mechanism could be bypassed if the host name in the given URL first uses IDN characters that get replaced to ASCII counterparts as part of the IDN conversion. Like using the character UTF-8 U+3002 (IDEOGRAPHIC FULL STOP) instead of the common ASCII full stop (U+002E) `.`. Then in a subsequent request, it does not detect the HSTS state and makes a clear text transfer. Because it would store the info IDN encoded but look for it IDN decoded.
CVSS Score: 7.5 (HIGH)
CWE: CWE-319, CWE-319
References: https://hackerone.com/reports/1755083; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TVWZW5CNSJ7UYAF2BGSYAWAEXDJYUBHA/; https://security.gentoo.org/glsa/202310-12
CVE: CVE-2022-44565
Published: 2022-12-23
Description: An improper access validation vulnerability exists in airMAX AC <8.7.11, airFiber 60/LR <2.6.2, airFiber 60 XG/HD <v1.0.0 and airFiber GBE <1.4.1 that allows a malicious actor to retrieve status and usage data from the UISP device.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-284
References: https://community.ui.com/releases/Security-Advisory-Bulletin-027-027/123e4577-9f00-4777-abe1-64a1d56fee05; https://community.ui.com/releases/Security-Advisory-Bulletin-027-027/123e4577-9f00-4777-abe1-64a1d56fee05
CVE: CVE-2022-44567
Published: 2022-12-23
Description: A command injection vulnerability exists in Rocket.Chat-Desktop <3.8.14 that could allow an attacker to pass a malicious url of openInternalVideoChatWindow to shell.openExternal(), which may lead to remote code execution (internalVideoChatWindow.ts#L17). To exploit the vulnerability, the internal video chat window must be disabled or a Mac App Store build must be used (internalVideoChatWindow.ts#L14). The vulnerability may be exploited by an XSS attack because the function openInternalVideoChatWindow is exposed in the Rocket.Chat-Desktop-API.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78, CWE-78
References: https://hackerone.com/reports/1781102; https://hackerone.com/reports/1781102
CVE: CVE-2022-46641
Published: 2022-12-23
Description: D-Link DIR-846 A1_FW100A43 was discovered to contain a command injection vulnerability via the lan(0)_dhcps_staticlist parameter in the SetIpMacBindSettings function.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-77, CWE-77
References: https://github.com/CyberUnicornIoT/IoTvuln/blob/main/d-link/dir-846/D-Link%20dir-846%20SetIpMacBindSettings%20Command%20Injection%20Vulnerability.md; https://www.dlink.com/en/security-bulletin/; https://github.com/CyberUnicornIoT/IoTvuln/blob/main/d-link/dir-846/D-Link%20dir-846%20SetIpMacBindSettings%20Command%20Injection%20Vulnerability.md
CVE: CVE-2022-46642
Published: 2022-12-23
Description: D-Link DIR-846 A1_FW100A43 was discovered to contain a command injection vulnerability via the auto_upgrade_hour parameter in the SetAutoUpgradeInfo function.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-77, CWE-77
References: https://github.com/CyberUnicornIoT/IoTvuln/blob/main/d-link/dir-846/D-Link%20dir-846%20SetAutoUpgradeInfo%20command%20injection%20vulnerability.md; https://www.dlink.com/en/security-bulletin/; https://github.com/CyberUnicornIoT/IoTvuln/blob/main/d-link/dir-846/D-Link%20dir-846%20SetAutoUpgradeInfo%20command%20injection%20vulnerability.md
CVE: CVE-2022-38757
Published: 2022-12-23
Description: A vulnerability has been identified in Micro Focus ZENworks 2020 Update 3a and prior versions. This vulnerability allows administrators with rights to perform actions (e.g., install a bundle) on a set of managed devices, to be able to exercise these rights on managed devices in the ZENworks zone but which are outside the scope of the administrator. This vulnerability does not result in the administrators gaining additional rights on the managed devices, either in the scope or outside the scope of the administrator.
CVSS Score: 7.2 (HIGH)
CWE: CWE-269, CWE-269
References: https://kmviewer.saas.microfocus.com/#/PH_206719; https://kmviewer.saas.microfocus.com/#/PH_206720; https://portal.microfocus.com/s/article/KM000012895?language=en_US