deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-25805
Published: 2022-06-09
Description: An issue was discovered in the IGEL Universal Management Suite (UMS) 6.07.100. The transmission of cleartext LDAP bind credentials by the cmd_mgt_load_mgt_tree command allows an attacker (who can intercept or inspect traffic between an authenticated UMS client and server) to compromise those LDAP bind credentials.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-319
References: https://github.com/atredispartners/advisories/blob/master/ATREDIS-2022-0002.md; https://www.igel.com/igel-solution-family/universal-management-suite/; https://github.com/atredispartners/advisories/blob/master/ATREDIS-2022-0002.md
CVE: CVE-2022-25806
Published: 2022-06-09
Description: An issue was discovered in the IGEL Universal Management Suite (UMS) 6.07.100. A hardcoded DES key in the PrefDBCredentials class allows an attacker, who has discovered encrypted superuser credentials, to decrypt those credentials using a static 8-byte DES key.
CVSS Score: 8.8 (HIGH)
CWE: CWE-798
References: https://github.com/atredispartners/advisories/blob/master/ATREDIS-2022-0002.md; https://www.igel.com/igel-solution-family/universal-management-suite/; https://github.com/atredispartners/advisories/blob/master/ATREDIS-2022-0002.md
CVE: CVE-2022-25807
Published: 2022-06-09
Description: An issue was discovered in the IGEL Universal Management Suite (UMS) 6.07.100. A hardcoded DES key in the LDAPDesPWEncrypter class allows an attacker, who has discovered encrypted LDAP bind credentials, to decrypt those credentials using a static 8-byte DES key.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-798
References: https://github.com/atredispartners/advisories/blob/master/ATREDIS-2022-0002.md; https://www.igel.com/igel-solution-family/universal-management-suite/; https://github.com/atredispartners/advisories/blob/master/ATREDIS-2022-0002.md
CVE: CVE-2022-30075
Published: 2022-06-09
Description: In TP-Link Router AX50 firmware 210730 and older, import of a malicious backup file via web interface can lead to remote code execution due to improper validation.
CVSS Score: 8.8 (HIGH)
References: http://packetstormsecurity.com/files/167522/TP-Link-AX50-Remote-Code-Execution.html; http://tp-link.com; https://github.com/aaronsvk
CVE: CVE-2022-31649
Published: 2022-06-09
Description: ownCloud owncloud/core before 10.10.0 Improperly Removes Sensitive Information Before Storage or Transfer.
CVSS Score: 7.5 (HIGH)
CWE: CWE-668
References: https://cwe.mitre.org/data/definitions/212.html; https://owncloud.com/security-advisories/cve-2022-31649/; https://owncloud.org/security/
CVE: CVE-2022-32195
Published: 2022-06-09
Description: Open edX platform before 2022-06-06 allows XSS via the "next" parameter in the logout URL.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://discuss.openedx.org/t/security-patch-for-logout-page-xss-vulnerability/7408; https://github.com/edx; https://discuss.openedx.org/t/security-patch-for-logout-page-xss-vulnerability/7408
CVE: CVE-2022-24896
Published: 2022-06-09
Description: Tuleap is a Free & Open Source Suite to manage software developments and collaboration. In versions prior to 13.7.99.239 Tuleap does not properly verify authorizations when displaying the content of tracker report renderer and chart widgets. Malicious users could use this vulnerability to retrieve the name of a tracker they cannot access as well as the name of the fields used in reports.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://github.com/Enalean/tuleap/commit/8e99e7c82d9fe569799019b9e1d614d38a184313; https://github.com/Enalean/tuleap/security/advisories/GHSA-x962-x43g-qw39; https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=8e99e7c82d9fe569799019b9e1d614d38a184313
CVE: CVE-2022-29254
Published: 2022-06-09
Description: silverstripe-omnipay is a SilverStripe integration with Omnipay PHP payments library. For a subset of Omnipay gateways (those that use intermediary states like `isNotification()` or `isRedirect()`), if the payment identifier or success URL is exposed it is possible for payments to be prematurely marked as completed without payment being taken. This is mitigated by the fact that most payment gateways hide this information from users, however some issuing banks offer flawed 3DSecure implementations that may inadvertently expose this data. The following versions have been patched to fix this issue: `2.5.2`, `3.0.2`, `3.1.4`, and `3.2.1`. There are no known workarounds for this vulnerability.
CVSS Score: 3.7 (LOW)
CWE: CWE-436
References: https://github.com/silverstripe/silverstripe-omnipay/commit/7dee9a1e0a5f54c2dc06e018cff3d9a19044e01b; https://github.com/silverstripe/silverstripe-omnipay/security/advisories/GHSA-48f2-m7jg-866x; https://github.com/silverstripe/silverstripe-omnipay/commit/7dee9a1e0a5f54c2dc06e018cff3d9a19044e01b
CVE: CVE-2022-29255
Published: 2022-06-09
Description: Vyper is a Pythonic Smart Contract Language for the ethereum virtual machine. In versions prior to 0.3.4 when a calling an external contract with no return value, the contract address (including side effects) could be evaluated twice. This may result in incorrect outcomes for contracts. This issue has been addressed in v0.3.4.
CVSS Score: 8.2 (HIGH)
CWE: CWE-670, CWE-670
References: https://github.com/vyperlang/vyper/commit/6b4d8ff185de071252feaa1c319712b2d6577f8d; https://github.com/vyperlang/vyper/security/advisories/GHSA-4v9q-cgpw-cf38; https://github.com/vyperlang/vyper/commit/6b4d8ff185de071252feaa1c319712b2d6577f8d
CVE: CVE-2021-40610
Published: 2022-06-09
Description: Emlog Pro v 1.0.4 cross-site scripting (XSS) in Emlog Pro background management.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/blackQvQ/emlog/issues/1; https://github.com/blackQvQ/emlog/issues/1
CVE: CVE-2021-40668
Published: 2022-06-09
Description: The Android application HTTP File Server (Version 1.4.1) by 'slowscript' is affected by a path traversal vulnerability that permits arbitrary directory listing, file read, and file write.
CVSS Score: 8.1 (HIGH)
CWE: CWE-22
References: https://eddiez.me/path-traversal-in-slowscript-httpfileserver/; https://play.google.com/store/apps/details?id=slowscript.httpfileserver; https://eddiez.me/path-traversal-in-slowscript-httpfileserver/
CVE: CVE-2022-31019
Published: 2022-06-09
Description: Vapor is a server-side Swift HTTP web framework. When using automatic content decoding an attacker can craft a request body that can make the server crash with the following request: `curl -d "array[_0][0][array][_0][0][array]$(for f in $(seq 1100); do echo -n '[_0][0][array]'; done)[string][_0]=hello%20world" http://localhost:8080/foo`. The issue is unbounded, attacker controlled stack growth which will at some point lead to a stack overflow and a process crash. This issue has been fixed in version 4.61.1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-674
References: https://github.com/vapor/vapor/commit/6c63226a4ab82ce53730eb1afb9ca63866fcf033; https://github.com/vapor/vapor/security/advisories/GHSA-qvxg-wjxc-r4gg; https://github.com/vapor/vapor/commit/6c63226a4ab82ce53730eb1afb9ca63866fcf033
CVE: CVE-2022-31026
Published: 2022-06-09
Description: Trilogy is a client library for MySQL. When authenticating, a malicious server could return a specially crafted authentication packet, causing the client to read and return up to 12 bytes of data from an uninitialized variable in stack memory. Users of the trilogy gem should upgrade to version 2.1.1 This issue can be avoided by only connecting to trusted servers.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-908
References: https://github.com/github/trilogy/commit/6bed62789eaf119902b0fe247d2a91d56c31a962; https://github.com/github/trilogy/security/advisories/GHSA-5g4r-2qhx-vqfm; https://github.com/github/trilogy/commit/6bed62789eaf119902b0fe247d2a91d56c31a962
CVE: CVE-2022-31027
Published: 2022-06-09
Description: OAuthenticator is an OAuth token library for the JupyerHub login handler. CILogonOAuthenticator is provided by the OAuthenticator package, and lets users log in to a JupyterHub via CILogon. This is primarily used to restrict a JupyterHub only to users of a given institute. The allowed_idps configuration trait of CILogonOAuthenticator is documented to be a list of domains that indicate the institutions whose users are authorized to access this JupyterHub. This authorization is validated by ensuring that the *email* field provided to us by CILogon has a *domain* that matches one of the domains listed in `allowed_idps`.If `allowed_idps` contains `berkeley.edu`, you might expect only users with valid current credentials provided by University of California, Berkeley to be able to access the JupyterHub. However, CILogonOAuthenticator does *not* verify which provider is used by the user to login, only the email address provided. So a user can login with a GitHub account that has email set to `<something>@berkeley.edu`, and that will be treated exactly the same as someone logging in using the UC Berkeley official Identity Provider. The patch fixing this issue makes a *breaking change* in how `allowed_idps` is interpreted. It's no longer a list of domains, but configuration representing the `EntityID` of the IdPs that are allowed, picked from the [list maintained by CILogon](https://cilogon.org/idplist/). Users are advised to upgrade.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-639
References: https://github.com/jupyterhub/oauthenticator/security/advisories/GHSA-r7v4-jwx9-wx43; https://github.com/jupyterhub/oauthenticator/security/advisories/GHSA-r7v4-jwx9-wx43
CVE: CVE-2022-31030
Published: 2022-06-09
Description: containerd is an open source container runtime. A bug was found in the containerd's CRI implementation where programs inside a container can cause the containerd daemon to consume memory without bound during invocation of the `ExecSync` API. This can cause containerd to consume all available memory on the computer, denying service to other legitimate workloads. Kubernetes and crictl can both be configured to use containerd's CRI implementation; `ExecSync` may be used when running probes or when executing processes via an "exec" facility. This bug has been fixed in containerd 1.6.6 and 1.5.13. Users should update to these versions to resolve the issue. Users unable to upgrade should ensure that only trusted images and commands are used.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-400
References: http://www.openwall.com/lists/oss-security/2022/06/07/1; https://github.com/containerd/containerd/commit/c1bcabb4541930f643aa36a2b38655e131346382; https://github.com/containerd/containerd/security/advisories/GHSA-5ffw-gxpp-mxpf
CVE: CVE-2022-31386
Published: 2022-06-09
Description: A Server-Side Request Forgery (SSRF) in the getFileBinary function of nbnbk cms 3 allows attackers to force the application to make arbitrary requests via injection of arbitrary URLs into the URL parameter.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-918
References: https://github.com/Fanli2012/nbnbk/issues/5; https://github.com/Fanli2012/nbnbk/issues/5
CVE: CVE-2022-31390
Published: 2022-06-09
Description: Jizhicms v2.2.5 was discovered to contain a Server-Side Request Forgery (SSRF) vulnerability via the Update function in app/admin/c/TemplateController.php.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-918
References: https://github.com/Cherry-toto/jizhicms/issues/75; https://github.com/Cherry-toto/jizhicms/issues/75
CVE: CVE-2022-31393
Published: 2022-06-09
Description: Jizhicms v2.2.5 was discovered to contain a Server-Side Request Forgery (SSRF) vulnerability via the Index function in app/admin/c/PluginsController.php.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-918
References: https://github.com/Cherry-toto/jizhicms/issues/76; https://github.com/Cherry-toto/jizhicms/issues/76
CVE: CVE-2022-31827
Published: 2022-06-09
Description: MonstaFTP v2.10.3 was discovered to contain a Server-Side Request Forgery (SSRF) via the function performFetchRequest at HTTPFetcher.php.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-918
References: https://github.com/zer0yu/CVE_Request/blob/master/MonstaFTP/MonstaFTP_v2_10_3_SSRF.md; https://github.com/zer0yu/CVE_Request/blob/master/MonstaFTP/MonstaFTP_v2_10_3_SSRF.md
CVE: CVE-2022-31830
Published: 2022-06-09
Description: Kity Minder v1.3.5 was discovered to contain a Server-Side Request Forgery (SSRF) via the init function at ImageCapture.class.php.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-918
References: https://github.com/fex-team/kityminder/issues/345; https://github.com/fex-team/kityminder/issues/345
CVE: CVE-2021-40961
Published: 2022-06-09
Description: CMS Made Simple <=2.2.15 is affected by SQL injection in modules/News/function.admin_articlestab.php. The $sortby variable is concatenated with $query1, but it is possible to inject arbitrary SQL language without using the '.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/beerpwn/CVE/blob/master/cms_made_simple_2021/sqli_order_by/CMS-MS-SQLi-report.md; https://packetstormsecurity.com/files/161895/CMS-Made-Simple-2.2.15-SQL-Injection.html; https://seclists.org/fulldisclosure/2021/Mar/49
CVE: CVE-2022-1998
Published: 2022-06-09
Description: A use after free in the Linux kernel File System notify functionality was found in the way user triggers copy_info_records_to_user() call to fail in copy_event_to_user(). A local user could use this flaw to crash the system or potentially escalate their privileges on the system.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/fs/notify/fanotify/fanotify_user.c?h=v5.17&id=ee12595147ac1fbfb5bcb23837e26dd58d94b15d; https://seclists.org/oss-sec/2022/q1/99; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2022-23138
Published: 2022-06-09
Description: ZTE's MF297D product has cryptographic issues vulnerability. Due to the use of weak random values, the security of the device is reduced, and it may face the risk of attack.
CVSS Score: 7.5 (HIGH)
CWE: CWE-330
References: https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1024624; https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1024624
CVE: CVE-2022-2035
Published: 2022-06-09
Description: A reflected cross-site scripting (XSS) vulnerability exists in the playerConfUrl parameter in the /defaultui/player/modern.html file for SCORM Engine versions < 20.1.45.914, 21.1.x < 21.1.7.219. The issue exists because there are no limitations on the domain or format of the url supplied by the user, allowing an attacker to craft malicious urls which can trigger a reflected XSS payload in the context of a victim's browser.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.tenable.com/security/research/tra-2022-21; https://www.tenable.com/security/research/tra-2022-21
CVE: CVE-2022-32272
Published: 2022-06-09
Description: OPSWAT MetaDefender Core before 5.1.2, MetaDefender ICAP before 4.12.1, and MetaDefender Email Gateway Security before 5.6.1 have incorrect access control, resulting in privilege escalation.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-269
References: http://packetstormsecurity.com/files/171549/OPSWAT-Metadefender-Core-4.21.1-Privilege-Escalation.html; https://docs.opswat.com/mdcore/release-notes; https://docs.opswat.com/mdemail/release-notes
CVE: CVE-2022-0823
Published: 2022-06-09
Description: An improper control of interaction frequency vulnerability in Zyxel GS1200 series switches could allow a local attacker to guess the password by using a timing side-channel attack.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-203
References: https://www.zyxel.com/support/Zyxel-security-advisory-for-password-guessing-vulnerability-of-GS1200-series-switches.shtml; https://www.zyxel.com/support/Zyxel-security-advisory-for-password-guessing-vulnerability-of-GS1200-series-switches.shtml
CVE: CVE-2022-24969
Published: 2022-06-09
Description: bypass CVE-2021-25640 > In Apache Dubbo prior to 2.6.12 and 2.7.15, the usage of parseURL method will lead to the bypass of the white host check which can cause open redirect or SSRF vulnerability.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-918, CWE-601, CWE-918
References: https://lists.apache.org/thread/1xbckc3467wfk5r7n2o44r2brdsbwxgr; https://lists.apache.org/thread/1xbckc3467wfk5r7n2o44r2brdsbwxgr
CVE: CVE-2022-2000
Published: 2022-06-09
Description: Out-of-bounds Write in GitHub repository vim/vim prior to 8.2.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: http://seclists.org/fulldisclosure/2022/Oct/28; http://seclists.org/fulldisclosure/2022/Oct/41; http://seclists.org/fulldisclosure/2022/Oct/43
CVE: CVE-2022-2016
Published: 2022-06-09
Description: Cross-site Scripting (XSS) - Reflected in GitHub repository neorazorx/facturascripts prior to 2022.1.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/neorazorx/facturascripts/commit/7b4ddb9269a230e2dd07c6a8d3211c9a88f4f09f; https://huntr.dev/bounties/5fa17e9b-c767-46b4-af64-aafb8c2aa521; https://github.com/neorazorx/facturascripts/commit/7b4ddb9269a230e2dd07c6a8d3211c9a88f4f09f
CVE: CVE-2022-2017
Published: 2022-06-09
Description: A vulnerability was found in SourceCodester Prison Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /pms/admin/visits/view_visit.php of the component Visit Handler. The manipulation of the argument id with the input 2%27and%201=2%20union%20select%201,2,3,4,5,6,7,user(),database()--+ leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://github.com/ch0ing/vul/blob/main/WebRay.com.cn/Prison%20Management%20System%28SQLI%292.md; https://vuldb.com/?id.201365; https://github.com/ch0ing/vul/blob/main/WebRay.com.cn/Prison%20Management%20System%28SQLI%292.md
CVE: CVE-2022-2018
Published: 2022-06-09
Description: A vulnerability classified as critical has been found in SourceCodester Prison Management System 1.0. Affected is an unknown function of the file /admin/?page=inmates/view_inmate of the component Inmate Handler. The manipulation of the argument id with the input 1%27%20and%201=2%20union%20select%201,user(),3,4,5,6,7,8,9,0,database(),2,3,4,5,6,7,8,9,0,1,2,3,4--+ leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://github.com/ch0ing/vul/blob/main/WebRay.com.cn/Prison%20Management%20System%28SQLI%29.md; https://vuldb.com/?id.201366; https://github.com/ch0ing/vul/blob/main/WebRay.com.cn/Prison%20Management%20System%28SQLI%29.md
CVE: CVE-2022-2019
Published: 2022-06-09
Description: A vulnerability classified as critical was found in SourceCodester Prison Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /classes/Users.php?f=save of the component New User Creation. The manipulation leads to improper authorization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-285
References: https://github.com/ch0ing/vul/blob/main/WebRay.com.cn/Prison%20Management%20System--.md; https://vuldb.com/?id.201367; https://github.com/ch0ing/vul/blob/main/WebRay.com.cn/Prison%20Management%20System--.md
CVE: CVE-2022-2020
Published: 2022-06-09
Description: A vulnerability, which was classified as problematic, has been found in SourceCodester Prison Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/?page=system_info of the component System Name Handler. The manipulation with the input <img src="" onerror="alert(1)"> leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-79
References: https://github.com/ch0ing/vul/blob/main/WebRay.com.cn/Prison%20Management%20System%28XSS%29.md; https://vuldb.com/?id.201368; https://github.com/ch0ing/vul/blob/main/WebRay.com.cn/Prison%20Management%20System%28XSS%29.md
CVE: CVE-2022-30760
Published: 2022-06-09
Description: An Insecure Direct Object Reference (IDOR) issue in fn2Web in ihb eG FlexNow before 2.04.09.016 allows remote authenticated attackers to obtain sensitive student information (final grades, study courses, degrees) by changing the student ID parameter in the HTTP POST request to the FrontControllerSS endpoint.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-639
References: https://homepage.ruhr-uni-bochum.de/Christian.Krug-q97/CVE-2022-30760.html; https://wiki.ihb-eg.de/doku.php/releasenotes/fn2web2.04.09; https://homepage.ruhr-uni-bochum.de/Christian.Krug-q97/CVE-2022-30760.html
CVE: CVE-2022-31031
Published: 2022-06-09
Description: PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In versions prior to and including 2.12.1 a stack buffer overflow vulnerability affects PJSIP users that use STUN in their applications, either by: setting a STUN server in their account/media config in PJSUA/PJSUA2 level, or directly using `pjlib-util/stun_simple` API. A patch is available in commit 450baca which should be included in the next release. There are no known workarounds for this issue.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120, CWE-787
References: https://github.com/pjsip/pjproject/commit/450baca94f475345542c[PII_REDACTED]c390889202; https://github.com/pjsip/pjproject/security/advisories/GHSA-26j7-ww69-c4qj; https://lists.debian.org/debian-lts-announce/2023/02/msg00029.html
CVE: CVE-2022-31214
Published: 2022-06-09
Description: A Privilege Context Switching issue was discovered in join.c in Firejail 0.9.68. By crafting a bogus Firejail container that is accepted by the Firejail setuid-root program as a join target, a local attacker can enter an environment in which the Linux user namespace is still the initial user namespace, the NO_NEW_PRIVS prctl is not activated, and the entered mount namespace is under the attacker's control. In this way, the filesystem layout can be adjusted to gain root privileges through execution of available setuid-root binaries such as su or sudo.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://firejail.wordpress.com/download-2/release-notes/; https://lists.debian.org/debian-lts-announce/2022/06/msg00023.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6RZOTZ36RUSL6DOVHITY25ZYKWTG5HN3/
CVE: CVE-2016-15002
Published: 2022-06-09
Description: A vulnerability, which was classified as critical, was found in MONyog Ultimate 6.63. This affects an unknown part of the component Cookie Handler. The manipulation of the argument HasServerEdit/IsAdmin leads to privilege escalation. It is possible to initiate the attack remotely.
CVSS Score: 7.3 (HIGH)
CWE: CWE-269, CWE-565
References: https://vuldb.com/?id.98355; https://youtu.be/KKlwi-u6wyA; https://vuldb.com/?id.98355
CVE: CVE-2019-25064
Published: 2022-06-09
Description: A vulnerability was found in CoreHR Core Portal up to 27.0.7. It has been classified as problematic. Affected is an unknown function. The manipulation leads to cross site request forgery. It is possible to launch the attack remotely. Upgrading to version 27.0.8 is able to address this issue. It is recommended to upgrade the affected component.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://vuldb.com/?id.146832; https://vuldb.com/?id.146832
CVE: CVE-2019-25065
Published: 2022-06-09
Description: A vulnerability was found in OpenNetAdmin 18.1.1. It has been rated as critical. Affected by this issue is some unknown functionality. The manipulation leads to privilege escalation. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-78, CWE-78
References: https://0day.today/exploit/33544; https://vuldb.com/?id.146798; https://0day.today/exploit/33544