deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-3864
Published: 2022-08-26
Description: A flaw was found in the way the dumpable flag setting was handled when certain SUID binaries executed its descendants. The prerequisite is a SUID binary that sets real UID equal to effective UID, and real GID equal to effective GID. The descendant will then have a dumpable value set to 1. As a result, if the descendant process crashes and core_pattern is set to a relative value, its core dump is stored in the current directory with uid:gid permissions. An unprivileged local user with eligible root SUID binary could use this flaw to place core dumps into root-owned directories, potentially resulting in escalation of privileges.
CVSS Score: 7.0 (HIGH)
CWE: CWE-284
References: https://access.redhat.com/security/cve/CVE-2021-3864; https://bugzilla.redhat.com/show_bug.cgi?id=2015046; https://lore.kernel.org/all/[PII_REDACTED]1744.864115-1-longman%40redhat.com/
CVE: CVE-2021-3913
Published: 2022-08-26
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2021-4215
Published: 2022-08-26
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2021-4216
Published: 2022-08-26
Description: A Floating point exception (division-by-zero) flaw was found in Mupdf for zero width pages in muraster.c. It is fixed in Mupdf-1.20.0-rc1 upstream.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-369, CWE-369
References: https://bugs.ghostscript.com/show_bug.cgi?id=704834; https://github.com/ArtifexSoftware/mupdf/commit/22c47acbd52949421f8c7cb46ea1556827d0fcbf; https://bugs.ghostscript.com/show_bug.cgi?id=704834
CVE: CVE-2022-25625
Published: 2022-08-26
Description: A malicious unauthorized PAM user can access the administration configuration data and change the values.
CVSS Score: 8.8 (HIGH)
References: https://support.broadcom.com/external/content/SecurityAdvisories/0/20850; https://support.broadcom.com/external/content/SecurityAdvisories/0/20850
CVE: CVE-2022-0084
Published: 2022-08-26
Description: A flaw was found in XNIO, specifically in the notifyReadClosed method. The issue revealed this method was logging a message to another expected end. This flaw allows an attacker to send flawed requests to a server, possibly causing log contention-related performance concerns or an unwanted disk fill-up.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770, CWE-770
References: https://access.redhat.com/security/cve/CVE-2022-0084; https://bugzilla.redhat.com/show_bug.cgi?id=2064226; https://github.com/xnio/xnio/commit/fdefb3b8b715d33387cadc4d48991fb1989b0c12
CVE: CVE-2022-0168
Published: 2022-08-26
Description: A denial of service (DOS) issue was found in the Linux kernel’s smb2_ioctl_query_info function in the fs/cifs/smb2ops.c Common Internet File System (CIFS) due to an incorrect return from the memdup_user function. This flaw allows a local, privileged (CAP_SYS_ADMIN) attacker to crash the system.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://access.redhat.com/security/cve/CVE-2022-0168; https://bugzilla.redhat.com/show_bug.cgi?id=2037386; https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=d6f5e358452479fa8a773b5c6ccc9e4ec5a20880
CVE: CVE-2022-0171
Published: 2022-08-26
Description: A flaw was found in the Linux kernel. The existing KVM SEV API has a vulnerability that allows a non-root (host) user-level application to crash the host kernel by creating a confidential guest VM instance in AMD CPU that supports Secure Encrypted Virtualization (SEV).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-459, CWE-212
References: https://access.redhat.com/security/cve/CVE-2022-0171; https://bugzilla.redhat.com/show_bug.cgi?id=2038940; https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=683412ccf61294d727ead4a73d97397396e69a6b
CVE: CVE-2022-0175
Published: 2022-08-26
Description: A flaw was found in the VirGL virtual OpenGL renderer (virglrenderer). The virgl did not properly initialize memory when allocating a host-backed memory resource. A malicious guest could use this flaw to mmap from the guest kernel and read this uninitialized memory from the host, possibly leading to information disclosure.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-909, CWE-909
References: https://access.redhat.com/security/cve/CVE-2022-0175; https://bugzilla.redhat.com/show_bug.cgi?id=2039003; https://gitlab.freedesktop.org/virgl/virglrenderer/-/commit/b05bb61f454eeb8a85164c8a31510aeb9d79129c
CVE: CVE-2022-0207
Published: 2022-08-26
Description: A race condition was found in vdsm. Functionality to obfuscate sensitive values in log files that may lead to values being stored in clear text.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-362, CWE-362
References: https://access.redhat.com/security/cve/CVE-2022-0207; https://bugzilla.redhat.com/show_bug.cgi?id=2033697; https://bugzilla.redhat.com/show_bug.cgi?id=2039248
CVE: CVE-2022-0216
Published: 2022-08-26
Description: A use-after-free vulnerability was found in the LSI53C895A SCSI Host Bus Adapter emulation of QEMU. The flaw occurs while processing repeated messages to cancel the current SCSI request via the lsi_do_msgout function. This flaw allows a malicious privileged user within the guest to crash the QEMU process on the host, resulting in a denial of service.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-416, CWE-416
References: https://access.redhat.com/security/cve/CVE-2022-0216; https://bugzilla.redhat.com/show_bug.cgi?id=2036953; https://gitlab.com/qemu-project/qemu/-/commit/4367a20cc4
CVE: CVE-2022-0217
Published: 2022-08-26
Description: It was discovered that an internal Prosody library to load XML based on libexpat does not properly restrict the XML features allowed in parsed XML data. Given suitable attacker input, this results in expansion of recursive entity references from DTDs (CWE-776). In addition, depending on the libexpat version used, it may also allow injections using XML External Entity References (CWE-611).
CVSS Score: 7.5 (HIGH)
CWE: CWE-776, CWE-611, CWE-776
References: https://bugzilla.redhat.com/show_bug.cgi?id=2040639; https://prosody.im/security/advisory_20220113/; https://prosody.im/security/advisory_20220113/1.patch
CVE: CVE-2022-0225
Published: 2022-08-26
Description: A flaw was found in Keycloak. This flaw allows a privileged attacker to use the malicious payload as the group name while creating a new group from the admin console, leading to a stored Cross-site scripting (XSS) attack.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://bugzilla.redhat.com/show_bug.cgi?id=2040268; https://github.com/keycloak/keycloak/security/advisories/GHSA-755v-r4x4-qf7m; https://bugzilla.redhat.com/show_bug.cgi?id=2040268
CVE: CVE-2022-31773
Published: 2022-08-26
Description: IBM DataPower Gateway V10CD, 10.0.1, and 2018.4.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 228357.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/228357; https://www.ibm.com/support/pages/node/6615307; https://exchange.xforce.ibmcloud.com/vulnerabilities/228357
CVE: CVE-2022-34301
Published: 2022-08-26
Description: A flaw was found in CryptoPro Secure Disk bootloaders before 2022-06-01. An attacker may use this bootloader to bypass or tamper with Secure Boot protections. In order to load and execute arbitrary code in the pre-boot stage, an attacker simply needs to replace the existing signed bootloader currently in use with this bootloader. Access to the EFI System Partition is required for booting using external media.
CVSS Score: 6.7 (MEDIUM)
References: https://edk2-docs.gitbook.io/understanding-the-uefi-secure-boot-chain/secure_boot_chain_in_uefi/uefi_secure_boot; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01001.html; https://www.kb.cert.org/vuls/id/309662
CVE: CVE-2022-34302
Published: 2022-08-26
Description: A flaw was found in New Horizon Datasys bootloaders before 2022-06-01. An attacker may use this bootloader to bypass or tamper with Secure Boot protections. In order to load and execute arbitrary code in the pre-boot stage, an attacker simply needs to replace the existing signed bootloader currently in use with this bootloader. Access to the EFI System Partition is required for booting using external media.
CVSS Score: 6.7 (MEDIUM)
References: https://edk2-docs.gitbook.io/understanding-the-uefi-secure-boot-chain/secure_boot_chain_in_uefi/uefi_secure_boot; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01001.html; https://www.kb.cert.org/vuls/id/309662
CVE: CVE-2022-34303
Published: 2022-08-26
Description: A flaw was found in Eurosoft bootloaders before 2022-06-01. An attacker may use this bootloader to bypass or tamper with Secure Boot protections. In order to load and execute arbitrary code in the pre-boot stage, an attacker simply needs to replace the existing signed bootloader currently in use with this bootloader. Access to the EFI System Partition is required for booting using external media.
CVSS Score: 6.7 (MEDIUM)
References: https://edk2-docs.gitbook.io/understanding-the-uefi-secure-boot-chain/secure_boot_chain_in_uefi/uefi_secure_boot; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01001.html; https://www.kb.cert.org/vuls/id/309662
CVE: CVE-2022-35714
Published: 2022-08-26
Description: IBM Maximo Asset Management 7.6.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 231116.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/231116; https://www.ibm.com/support/pages/node/6615273; https://exchange.xforce.ibmcloud.com/vulnerabilities/231116
CVE: CVE-2022-36522
Published: 2022-08-26
Description: Mikrotik RouterOs through stable v6.48.3 was discovered to contain an assertion failure in the component /advanced-tools/nova/bin/netwatch. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted packet.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-617
References: https://github.com/cq674350529/pocs_slides/blob/master/advisory/MikroTik/CVE-2022-36522/README.md; https://seclists.org/fulldisclosure/2021/Jul/0; https://github.com/cq674350529/pocs_slides/blob/master/advisory/MikroTik/CVE-2022-36522/README.md
CVE: CVE-2022-36529
Published: 2022-08-26
Description: Kensite CMS v1.0 was discovered to contain multiple SQL injection vulnerabilities via the name and oldname parameters at /framework/mod/db/DBMapper.xml.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/seeyoui/kensite_cms; https://github.com/xdon9/xdon/blob/main/kensite_cms; https://github.com/seeyoui/kensite_cms
CVE: CVE-2022-38785
Published: 2022-08-26
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2022-2905. Reason: This candidate is a reservation duplicate of CVE-2022-2905. Notes: All CVE users should reference CVE-2022-2905 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2022-36537
Published: 2022-08-26
Description: ZK Framework v9.6.1, 9.6.0.1, 9.5.1.3, 9.0.1.2 and 8.6.4.1 allows attackers to access sensitive information via a crafted POST request sent to the component AuUploader.
CVSS Score: 7.5 (HIGH)
References: https://tracker.zkoss.org/browse/ZK-5150; https://www.bleepingcomputer.com/news/security/cisa-warns-of-hackers-exploiting-zk-java-framework-rce-flaw/; https://tracker.zkoss.org/browse/ZK-5150
CVE: CVE-2022-2915
Published: 2022-08-26
Description: A Heap-based Buffer Overflow vulnerability in the SonicWall SMA100 appliance allows a remote authenticated attacker to cause Denial of Service (DoS) on the appliance or potentially lead to code execution. This vulnerability impacts 10.2.1.5-34sv and earlier versions.
CVSS Score: 8.8 (HIGH)
CWE: CWE-122, CWE-787
References: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0019; https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0019
CVE: CVE-2022-36542
Published: 2022-08-26
Description: An access control issue in the component /ip/admin/ of Edoc-doctor-appointment-system v1.0.1 allows attackers to arbitrarily edit, read, and delete Administrator data.
CVSS Score: 6.5 (MEDIUM)
References: https://github.com/HashenUdara/edoc-doctor-appointment-system; https://github.com/onEpAth936/cve/blob/master/bug_e/edoc-doctor-appointment-system; https://github.com/HashenUdara/edoc-doctor-appointment-system
CVE: CVE-2022-36543
Published: 2022-08-26
Description: Edoc-doctor-appointment-system v1.0.1 was discovered to contain a SQL injection vulnerability via the id parameter at /patient/doctors.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/HashenUdara/edoc-doctor-appointment-system; https://github.com/onEpAth936/cve/blob/master/bug_e/edoc-doctor-appointment-system/Multiple%20SQL%20injection.md; https://github.com/HashenUdara/edoc-doctor-appointment-system
CVE: CVE-2022-36544
Published: 2022-08-26
Description: Edoc-doctor-appointment-system v1.0.1 was discovered to contain a SQL injection vulnerability via the id parameter at /patient/booking.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/HashenUdara/edoc-doctor-appointment-system; https://github.com/onEpAth936/cve/blob/master/bug_e/edoc-doctor-appointment-system/Multiple%20SQL%20injection.md; https://github.com/HashenUdara/edoc-doctor-appointment-system
CVE: CVE-2022-36545
Published: 2022-08-26
Description: Edoc-doctor-appointment-system v1.0.1 was discovered to contain a SQL injection vulnerability via the id parameter at /patient/settings.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/HashenUdara/edoc-doctor-appointment-system; https://github.com/onEpAth936/cve/blob/master/bug_e/edoc-doctor-appointment-system/Multiple%20SQL%20injection.md; https://github.com/HashenUdara/edoc-doctor-appointment-system
CVE: CVE-2022-36546
Published: 2022-08-26
Description: Edoc-doctor-appointment-system v1.0.1 was discovered to contain a Cross-Site Request Forgery (CSRF) via /patient/settings.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/HashenUdara/edoc-doctor-appointment-system; https://github.com/onEpAth936/cve/blob/master/bug_e/edoc-doctor-appointment-system/Multiple%20SQL%20injection.md; https://github.com/HashenUdara/edoc-doctor-appointment-system
CVE: CVE-2022-36547
Published: 2022-08-26
Description: Edoc-doctor-appointment-system v1.0.1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability at /patient/index.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Search field.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/HashenUdara/edoc-doctor-appointment-system; https://github.com/onEpAth936/cve/blob/master/bug_e/edoc-doctor-appointment-system/Reflected%20Cross%20Site%20Scripting%20%28XSS%29.md; https://github.com/HashenUdara/edoc-doctor-appointment-system
CVE: CVE-2022-36548
Published: 2022-08-26
Description: Edoc-doctor-appointment-system v1.0.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability at /patient/settings.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name text field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/HashenUdara/edoc-doctor-appointment-system; https://github.com/onEpAth936/cve/blob/master/bug_e/edoc-doctor-appointment-system/Stored%20Cross%20Site%20Scripting%20%28XSS%29.md; https://github.com/HashenUdara/edoc-doctor-appointment-system
CVE: CVE-2019-15167
Published: 2022-08-27
Description: The VRRP parser in tcpdump before 4.9.3 has a buffer over-read in print-vrrp.c:vrrp_print() for VRRP version 3, a different vulnerability than CVE-2018-14463.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-125, CWE-125
References: https://github.com/the-tcpdump-group/tcpdump/commit/a152aebfd1114376ba266ed30416be596ef9d806; https://github.com/the-tcpdump-group/tcpdump/commit/a152aebfd1114376ba266ed30416be596ef9d806
CVE: CVE-2022-3012
Published: 2022-08-27
Description: A vulnerability was found in oretnom23 Fast Food Ordering System. It has been rated as critical. Affected by this issue is some unknown functionality of the file ffos/admin/reports/index.php. The manipulation of the argument date leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-207422 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/0x14dli/ffos-SQL-injection-vulnerability-exists; https://vuldb.com/?id.207422; https://github.com/0x14dli/ffos-SQL-injection-vulnerability-exists
CVE: CVE-2022-3013
Published: 2022-08-27
Description: A vulnerability classified as critical has been found in SourceCodester Simple Task Managing System. This affects an unknown part of the file /loginVaLidation.php. The manipulation of the argument login leads to sql injection. It is possible to initiate the attack remotely. The associated identifier of this vulnerability is VDB-207423.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://vuldb.com/?id.207423; https://vuldb.com/?id.207423
CVE: CVE-2022-3014
Published: 2022-08-27
Description: A vulnerability classified as problematic was found in SourceCodester Simple Task Managing System. This vulnerability affects unknown code. The manipulation of the argument student_add leads to cross site scripting. The attack can be initiated remotely. The identifier of this vulnerability is VDB-207424.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/Drun1baby/CVE_Pentest/blob/main/Task%20Managing%20System%20in%20PHP%20CMS/images/xss.png; https://vuldb.com/?id.207424; https://github.com/Drun1baby/CVE_Pentest/blob/main/Task%20Managing%20System%20in%20PHP%20CMS/images/xss.png
CVE: CVE-2022-3015
Published: 2022-08-27
Description: A vulnerability, which was classified as problematic, has been found in oretnom23 Fast Food Ordering System. This issue affects some unknown processing of the file admin/?page=reports. The manipulation of the argument date leads to cross site scripting. The attack may be initiated remotely. The identifier VDB-207425 was assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://vuldb.com/?id.207425; https://vuldb.com/?id.207425
CVE: CVE-2022-2787
Published: 2022-08-27
Description: Schroot before 1.6.13 had too permissive rules on chroot or session names, allowing a denial of service on the schroot service for all users that may start a schroot session.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-281
References: https://codeberg.org/shelter/reschroot/commit/6f7166a285e1e97aea390be633591f9791b29a6d; https://lists.debian.org/debian-lts-announce/2022/08/msg00007.html; https://lists.debian.org/debian-security-announce/2022/msg00182.html
CVE: CVE-2022-38791
Published: 2022-08-27
Description: In MariaDB before 10.9.2, compress_write in extra/mariabackup/ds_compress.cc does not release data_mutex upon a stream write failure, which allows local users to trigger a deadlock.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-667
References: https://jira.mariadb.org/browse/MDEV-28719; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WCOEGSVMIEXDZHBOSV6WVF7FAVRBR2JE/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WTVAONAZXJFGHAJ4RP2OF3EAMQCOTDSQ/
CVE: CVE-2022-38792
Published: 2022-08-27
Description: The exotel (aka exotel-py) package in PyPI as of 0.1.6 includes a code execution backdoor inserted by a third party.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/jertel/elastalert2/pull/931; https://github.com/sarathsp06/exotel-py/issues/10; https://inspector.pypi.io/project/exotel/0.1.6/packages/8b/ed/9ebeb34d4adb9b01151d73ccfde9c1cb2d629c3b146953c8727559a65446/exotel-0.1.6.tar.gz/exotel-0.1.6/setup.py
CVE: CVE-2022-38794
Published: 2022-08-27
Description: Zaver through 2020-12-15 allows directory traversal via the GET /.. substring.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://github.com/zyearn/zaver/issues/22; https://github.com/zyearn/zaver/issues/22
CVE: CVE-2022-3016
Published: 2022-08-28
Description: Use After Free in GitHub repository vim/vim prior to 9.0.0286.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://github.com/vim/vim/commit/6d24a51b94beb1991cddce221f90b455e2d50db7; https://huntr.dev/bounties/260516c2-5c4a-4b7f-a01c-04b1aeeea371; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XWOJOA7PZZAMBI5GFTL6PWHXMWSDLUXL/
CVE: CVE-2022-3017
Published: 2022-08-28
Description: Cross-Site Request Forgery (CSRF) in GitHub repository froxlor/froxlor prior to 0.10.38.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://github.com/froxlor/froxlor/commit/bbe82286aae21328668f24857995a67598fe978a; https://huntr.dev/bounties/5250c4b1-132b-4da6-9bd6-db36cb56bea0; https://github.com/froxlor/froxlor/commit/bbe82286aae21328668f24857995a67598fe978a
CVE: CVE-2022-36755
Published: 2022-08-28
Description: D-Link DIR845L A1 contains a authentication vulnerability via an AUTHORIZED_GROUP=1 value, as demonstrated by a request for getcfg.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://drive.google.com/file/d/1yc4aYBiU_ao-YYCNGPfayhwWIaXxkWQJ/view?usp=sharing; https://www.dlink.com/en/security-bulletin/; https://drive.google.com/file/d/1yc4aYBiU_ao-YYCNGPfayhwWIaXxkWQJ/view?usp=sharing
CVE: CVE-2022-36756
Published: 2022-08-28
Description: DIR845L A1 v1.00-v1.03 is vulnerable to command injection via /htdocs/upnpinc/gena.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://drive.google.com/file/d/1S9MODTsa70LS3UPFY1ohyPJXtqr17IkQ/view?usp=sharing; https://www.dlink.com/en/security-bulletin/; https://drive.google.com/file/d/1S9MODTsa70LS3UPFY1ohyPJXtqr17IkQ/view?usp=sharing
CVE: CVE-2022-37053
Published: 2022-08-28
Description: TRENDnet TEW733GR v1.03B01 is vulnerable to Command injection via /htdocs/upnpinc/gena.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: http://trendnet.com; https://drive.google.com/file/d/1P_-h5wNtRiyVToDUjRNZhsmtILINv7EL/view?usp=sharing; http://trendnet.com
CVE: CVE-2022-37057
Published: 2022-08-28
Description: D-Link Go-RT-AC750 GORTAC750_revA_v101b03 and GO-RT-AC750_revB_FWv200b02 are vulnerable to Command Injection via cgibin, ssdpcgi_main.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://drive.google.com/file/d/1_UUpraFTxxB97ujrgVLQZXQ8Q8M58BAF/view?usp=sharing; https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10308; https://www.dlink.com/en/security-bulletin/
CVE: CVE-2022-38556
Published: 2022-08-28
Description: Trendnet TEW733GR v1.03B01 contains a Static Default Credential vulnerability in /etc/init0.d/S80telnetd.sh.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://github.com/xxy1126/Vuln/tree/main/2; https://github.com/xxy1126/Vuln/tree/main/2
CVE: CVE-2022-38557
Published: 2022-08-28
Description: D-Link DIR845L v1.00-v1.03 contains a Static Default Credential vulnerability in /etc/init0.d/S80telnetd.sh.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://github.com/xxy1126/Vuln/tree/main/3; https://www.dlink.com/en/security-bulletin/; https://github.com/xxy1126/Vuln/tree/main/3
CVE: CVE-2022-37055
Published: 2022-08-28
Description: D-Link Go-RT-AC750 GORTAC750_revA_v101b03 and GO-RT-AC750_revB_FWv200b02 are vulnerable to Buffer Overflow via cgibin, hnap_main,
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120, CWE-120
References: https://drive.google.com/file/d/1hmIk0jQoex4QDyjIUg_6yxi-J6ROCh8S/view?usp=sharing; https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10308; https://www.dlink.com/en/security-bulletin/