deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-1566
Published: 2022-05-30
Description: The Quotes llama WordPress plugin before 1.0.0 does not sanitise and escape Quotes, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed. The attack could also be performed by tricking an admin to import a malicious CSV file
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/0af030d8-b676-4826-91c0-98706b816f3c; https://wpscan.com/vulnerability/0af030d8-b676-4826-91c0-98706b816f3c
CVE: CVE-2022-1568
Published: 2022-05-30
Description: The Team Members WordPress plugin before 5.1.1 does not escape some of its Team settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://wpscan.com/vulnerability/88328d17-ffc9-4b94-8b01-ad2fd3047fbc; https://wpscan.com/vulnerability/88328d17-ffc9-4b94-8b01-ad2fd3047fbc
CVE: CVE-2022-1582
Published: 2022-05-30
Description: The External Links in New Window / New Tab WordPress plugin before 1.43 does not properly escape URLs it concatenates to onclick event handlers, which makes Stored Cross-Site Scripting attacks possible.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/cbb75383-4351-4488-aaca-ddb0f6f120cd; https://wpscan.com/vulnerability/cbb75383-4351-4488-aaca-ddb0f6f120cd
CVE: CVE-2022-1583
Published: 2022-05-30
Description: The External Links in New Window / New Tab WordPress plugin before 1.43 does not ensure window.opener is set to "null" when links to external sites are clicked, which may enable tabnabbing attacks to occur.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-1022
References: https://wpscan.com/vulnerability/aa9d727c-4d17-4220-b8cb-e6dec30361a9; https://wpscan.com/vulnerability/aa9d727c-4d17-4220-b8cb-e6dec30361a9
CVE: CVE-2022-1589
Published: 2022-05-30
Description: The Change wp-admin login WordPress plugin before 1.1.0 does not properly check for authorisation and is also missing CSRF check when updating its settings, which could allow unauthenticated users to change the settings. The attacked could also be performed via a CSRF vector
CVSS Score: 7.5 (HIGH)
CWE: CWE-352, CWE-863
References: https://wpscan.com/vulnerability/257f9e14-4f43-4852-8384-80c15d087633; https://wpscan.com/vulnerability/257f9e14-4f43-4852-8384-80c15d087633
CVE: CVE-2022-1611
Published: 2022-05-30
Description: The Bulk Page Creator WordPress plugin before 1.1.4 does not protect its page creation functionalities with nonce checks, which makes them vulnerable to CSRF.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://wpscan.com/vulnerability/3843b867-7784-4976-b5ab-8a1e7d45618a; https://wpscan.com/vulnerability/3843b867-7784-4976-b5ab-8a1e7d45618a
CVE: CVE-2022-1643
Published: 2022-05-30
Description: The Birthdays Widget WordPress plugin through 1.7.18 does not sanitise and escape some of its fields, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/73111c7e-c772-4bed-b282-854c1ae57444; https://wpscan.com/vulnerability/73111c7e-c772-4bed-b282-854c1ae57444
CVE: CVE-2022-1644
Published: 2022-05-30
Description: The Call&Book Mobile Bar WordPress plugin through 1.2.2 does not sanitize and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://wpscan.com/vulnerability/0184d70a-548c-4258-b01d-7477f03cc346; https://wpscan.com/vulnerability/0184d70a-548c-4258-b01d-7477f03cc346
CVE: CVE-2022-1645
Published: 2022-05-30
Description: The Amazon Link WordPress plugin through 3.2.10 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/915b7d79-f9dd-451d-bf8f-6d14ec3e67d2; https://wpscan.com/vulnerability/915b7d79-f9dd-451d-bf8f-6d14ec3e67d2
CVE: CVE-2022-1646
Published: 2022-05-30
Description: The Simple Real Estate Pack WordPress plugin through 1.4.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/8a32896d-bf1b-4d7b-8d84-dc38b877928b; https://wpscan.com/vulnerability/8a32896d-bf1b-4d7b-8d84-dc38b877928b
CVE: CVE-2022-1931
Published: 2022-05-31
Description: Incorrect Synchronization in GitHub repository polonel/trudesk prior to 1.2.3.
CVSS Score: 8.1 (HIGH)
CWE: CWE-821, CWE-662
References: https://github.com/polonel/trudesk/commit/314540864dbf2c0eaa99aa42c3d317de9501eb67; https://huntr.dev/bounties/50c4cb63-65db-41c5-a16d-0560d7131fde; https://github.com/polonel/trudesk/commit/314540864dbf2c0eaa99aa42c3d317de9501eb67
CVE: CVE-2022-1934
Published: 2022-05-31
Description: Use After Free in GitHub repository mruby/mruby prior to 3.2.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://github.com/mruby/mruby/commit/aa7f98dedb68d735a1665d3a289036c88b0c47ce; https://huntr.dev/bounties/99e6df06-b9f7-4c53-a722-6bb89fbfb51f; https://github.com/mruby/mruby/commit/aa7f98dedb68d735a1665d3a289036c88b0c47ce
CVE: CVE-2022-1926
Published: 2022-05-31
Description: Integer Overflow or Wraparound in GitHub repository polonel/trudesk prior to 1.2.3.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-190, CWE-190
References: https://github.com/polonel/trudesk/commit/b7c15180b6d4e556ad05d0881eb72d8b2f1637a0; https://huntr.dev/bounties/3fda8902-68ee-4734-86a3-9551ab17c893; https://github.com/polonel/trudesk/commit/b7c15180b6d4e556ad05d0881eb72d8b2f1637a0
CVE: CVE-2021-3555
Published: 2022-05-31
Description: A Buffer Overflow vulnerability in the RSTP server component of Eufy Indoor 2K Indoor Camera allows a local attacker to achieve remote code execution. This issue affects: Eufy Indoor 2K Indoor Camera 2.0.9.3 version and prior versions.
CVSS Score: 7.6 (HIGH)
CWE: CWE-120, CWE-120
References: https://www.bitdefender.com/blog/labs/vulnerabilities-identified-in-eufy2k-indoor-camera/; https://www.bitdefender.com/blog/labs/vulnerabilities-identified-in-eufy2k-indoor-camera/
CVE: CVE-2022-1942
Published: 2022-05-31
Description: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: http://seclists.org/fulldisclosure/2022/Oct/28; http://seclists.org/fulldisclosure/2022/Oct/41; https://github.com/vim/vim/commit/71223e2db87c2bf3b09aecb46266b56cda26191d
CVE: CVE-2022-30973
Published: 2022-05-31
Description: We failed to apply the fix for CVE-2022-30126 to the 1.x branch in the 1.28.2 release. In Apache Tika, a regular expression in the StandardsText class, used by the StandardsExtractingContentHandler could lead to a denial of service caused by backtracking on a specially crafted file. This only affects users who are running the StandardsExtractingContentHandler, which is a non-standard handler. This is fixed in 1.28.3.
CVSS Score: 5.5 (MEDIUM)
References: http://www.openwall.com/lists/oss-security/2022/05/31/2; http://www.openwall.com/lists/oss-security/2022/06/27/5; https://lists.apache.org/thread/gqvb5t4p7tmdpl0y5bdbf72pgxj04h7p
CVE: CVE-2022-23082
Published: 2022-05-31
Description: In CureKit versions v1.0.1 through v1.1.3 are vulnerable to path traversal as the function isFileOutsideDir fails to sanitize the user input which may lead to path traversal.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/whitesource/CureKit/commit/af35e870ed09411d2f1fae6db1b04598cd1a31b6; https://www.mend.io/vulnerability-database/CVE-2022-23082; https://github.com/whitesource/CureKit/commit/af35e870ed09411d2f1fae6db1b04598cd1a31b6
CVE: CVE-2022-22361
Published: 2022-05-31
Description: IBM Business Automation Workflow traditional 21.0.1 through 21.0.3, 20.0.0.1 through 20.0.0.2, 19.0.0.1 through 19.0.0.3, 18.0.0.0 through 18.0.0.1, IBM Business Automation Workflow containers V21.0.1 - V21.0.3 20.0.0.1 through 20.0.0.2, IBM Business Process Manager 8.6.0.0 through 8.6.0.201803, and 8.5.0.0 through 8.5.0.201706 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/220784; https://www.ibm.com/support/pages/node/6590411; https://exchange.xforce.ibmcloud.com/vulnerabilities/220784
CVE: CVE-2022-29220
Published: 2022-05-31
Description: github-action-merge-dependabot is an action that automatically approves and merges dependabot pull requests (PRs). Prior to version 3.2.0, github-action-merge-dependabot does not check if a commit created by dependabot is verified with the proper GPG key. There is just a check if the actor is set to `dependabot[bot]` to determine if the PR is a legit PR. Theoretically, an owner of a seemingly valid and legit action in the pipeline can check if the PR is created by dependabot and if their own action has enough permissions to modify the PR in the pipeline. If so, they can modify the PR by adding a second seemingly valid and legit commit to the PR, as they can set arbitrarily the username and email in for commits in git. Because the bot only checks if the actor is valid, it would pass the malicious changes through and merge the PR automatically, without getting noticed by project maintainers. It would probably not be possible to determine where the malicious commit came from, as it would only say `dependabot[bot]` and the corresponding email-address. Version 3.2.0 contains a patch for this issue.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-283, CWE-345
References: https://github.com/fastify/github-action-merge-dependabot/commit/309f39539c5d918d8a47075587aa8720a9c127f7; https://github.com/fastify/github-action-merge-dependabot/security/advisories/GHSA-v5vr-h3xq-8v6w; https://hackerone.com/bugs?report_id=1564530
CVE: CVE-2022-29243
Published: 2022-05-31
Description: Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Prior to versions 22.2.7 and 23.0.4, missing input-size validation of new session names allows users to create app passwords with long names. These long names are then loaded into memory on usage, resulting in impacted performance. Versions 22.2.7 and 23.0.4 contain a fix for this issue. There are currently no known workarounds available.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20, CWE-400
References: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-7cwm-qph5-4h5w; https://github.com/nextcloud/server/pull/31658; https://hackerone.com/reports/1153138
CVE: CVE-2022-29245
Published: 2022-05-31
Description: SSH.NET is a Secure Shell (SSH) library for .NET. In versions 2020.0.0 and 2020.0.1, during an `X25519` key exchange, the client’s private key is generated with `System.Random`. `System.Random` is not a cryptographically secure random number generator, it must therefore not be used for cryptographic purposes. When establishing an SSH connection to a remote host, during the X25519 key exchange, the private key is generated with a weak random number generator whose seed can be brute forced. This allows an attacker who is able to eavesdrop on the communications to decrypt them. Version 2020.0.2 contains a patch for this issue. As a workaround, one may disable support for `curve25519-sha256` and `curve25519-sha256@libssh.org` key exchange algorithms.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-338
References: https://github.com/sshnet/SSH.NET/blob/bc99ada7da3f05f50d9379f2644941d91d5bf05a/src/Renci.SshNet/Security/KeyExchangeECCurve25519.cs#L51; https://github.com/sshnet/SSH.NET/commit/03c6d60736b8f7b42e44d6989a53f9b644a091fb; https://github.com/sshnet/SSH.NET/releases/tag/2020.0.2
CVE: CVE-2022-29258
Published: 2022-05-31
Description: XWiki Platform Filter UI provides a generic user interface to convert from a XWiki Filter input stream to an output stream with settings for each stream. Starting with versions 6.0-milestone-2 and 5.4.4 and prior to versions 12.10.11, 14.0-rc-1, 13.4.7, and 13.10.3, XWiki Platform Filter UI contains a possible cross-site scripting vector in the `Filter.FilterStreamDescriptorForm` wiki page related to pretty much all the form fields printed in the home page of the application. The issue is patched in versions 12.10.11, 14.0-rc-1, 13.4.7, and 13.10.3. The easiest workaround is to edit the wiki page `Filter.FilterStreamDescriptorForm` (with wiki editor) according to the instructions in the GitHub Security Advisory.
CVSS Score: 7.4 (HIGH)
CWE: CWE-80, CWE-116, CWE-79
References: https://github.com/xwiki/xwiki-platform/commit/21906acb5ee2304552f56f9bbdbf8e7d368f7f3a; https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-xjfw-5vv5-vjq2; https://jira.xwiki.org/browse/XWIKI-19293
CVE: CVE-2022-31002
Published: 2022-05-31
Description: Sofia-SIP is an open-source Session Initiation Protocol (SIP) User-Agent library. Prior to version 1.13.8, an attacker can send a message with evil sdp to FreeSWITCH, which may cause a crash. This type of crash may be caused by a URL ending with `%`. Version 1.13.8 contains a patch for this issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125, CWE-125
References: https://github.com/freeswitch/sofia-sip/commit/51841eb53679434a386fb2dcbca925dcc48d58ba; https://github.com/freeswitch/sofia-sip/security/advisories/GHSA-g3x6-p824-x6hm; https://lists.debian.org/debian-lts-announce/2022/09/msg00001.html
CVE: CVE-2022-31001
Published: 2022-05-31
Description: Sofia-SIP is an open-source Session Initiation Protocol (SIP) User-Agent library. Prior to version 1.13.8, an attacker can send a message with evil sdp to FreeSWITCH, which may cause crash. This type of crash may be caused by `#define MATCH(s, m) (strncmp(s, m, n = sizeof(m) - 1) == 0)`, which will make `n` bigger and trigger out-of-bound access when `IS_NON_WS(s[n])`. Version 1.13.8 contains a patch for this issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125, CWE-125
References: https://github.com/freeswitch/sofia-sip/commit/a99804b336d0e16d26ab7119d56184d2d7110a36; https://github.com/freeswitch/sofia-sip/security/advisories/GHSA-79jq-hh82-cv9g; https://lists.debian.org/debian-lts-announce/2022/09/msg00001.html
CVE: CVE-2022-31003
Published: 2022-05-31
Description: Sofia-SIP is an open-source Session Initiation Protocol (SIP) User-Agent library. Prior to version 1.13.8, when parsing each line of a sdp message, `rest = record + 2` will access the memory behind `\0` and cause an out-of-bounds write. An attacker can send a message with evil sdp to FreeSWITCH, causing a crash or more serious consequence, such as remote code execution. Version 1.13.8 contains a patch for this issue.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-122, CWE-787, CWE-787
References: https://github.com/freeswitch/sofia-sip/commit/907f2ac0ee504c93ebfefd676b4632a3575908c9; https://github.com/freeswitch/sofia-sip/security/advisories/GHSA-8w5j-6g2j-pxcp; https://lists.debian.org/debian-lts-announce/2022/09/msg00001.html
CVE: CVE-2022-31005
Published: 2022-05-31
Description: Vapor is an HTTP web framework for Swift. Users of Vapor prior to version 4.60.3 with FileMiddleware enabled are vulnerable to an integer overflow vulnerability that can crash the application. Version 4.60.3 contains a patch for this issue. As a workaround, disable FileMiddleware and serve via a Content Delivery Network.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: https://github.com/vapor/vapor/commit/953a349b539b3e0d3653585c8ffb50c427986df1; https://github.com/vapor/vapor/releases/tag/4.60.3; https://github.com/vapor/vapor/security/advisories/GHSA-vj2m-9f5j-mpr5
CVE: CVE-2022-31007
Published: 2022-05-31
Description: eLabFTW is an electronic lab notebook manager for research teams. Prior to version 4.3.0, a vulnerability allows an authenticated user with an administrator role in a team to assign itself system administrator privileges within the application, or create a new system administrator account. The issue has been corrected in eLabFTW version 4.3.0. In the context of eLabFTW, an administrator is a user account with certain privileges to manage users and content in their assigned team/teams. A system administrator account can manage all accounts, teams and edit system-wide settings within the application. The impact is not deemed as high, as it requires the attacker to have access to an administrator account. Regular user accounts cannot exploit this to gain admin rights. A workaround for one if the issues is removing the ability of administrators to create accounts.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-842, CWE-1287
References: https://github.com/elabftw/elabftw/releases/tag/4.3.0; https://github.com/elabftw/elabftw/security/advisories/GHSA-937c-m7p3-775v; https://github.com/elabftw/elabftw/releases/tag/4.3.0
CVE: CVE-2022-31011
Published: 2022-05-31
Description: TiDB is an open-source NewSQL database that supports Hybrid Transactional and Analytical Processing (HTAP) workloads. Under certain conditions, an attacker can construct malicious authentication requests to bypass the authentication process, resulting in privilege escalation or unauthorized access. Only users using TiDB 5.3.0 are affected by this vulnerability. TiDB version 5.3.1 contains a patch for this issue. Other mitigation strategies include turning off Security Enhanced Mode (SEM), disabling local login for non-root accounts, and ensuring that the same IP cannot be logged in as root and normal user at the same time.
CVSS Score: 7.8 (HIGH)
CWE: CWE-287
References: https://github.com/pingcap/tidb/releases/tag/v5.3.1; https://github.com/pingcap/tidb/security/advisories/GHSA-4whx-7p29-mq22; https://github.com/pingcap/tidb/releases/tag/v5.3.1
CVE: CVE-2022-1808
Published: 2022-05-31
Description: Execution with Unnecessary Privileges in GitHub repository polonel/trudesk prior to 1.2.3.
CVSS Score: 8.8 (HIGH)
CWE: CWE-250
References: https://github.com/polonel/trudesk/commit/f739eac6fc52adc0cba83a49034100e5b99ac7c8; https://huntr.dev/bounties/9-polonel/trudesk; https://github.com/polonel/trudesk/commit/f739eac6fc52adc0cba83a49034100e5b99ac7c8
CVE: CVE-2022-1893
Published: 2022-05-31
Description: Improper Removal of Sensitive Information Before Storage or Transfer in GitHub repository polonel/trudesk prior to 1.2.3.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-212, CWE-212
References: https://github.com/polonel/trudesk/commit/ae904d37eaa38bffebfbfe8e949c0385c63e3263; https://huntr.dev/bounties/a1cfe61b-5248-4a73-9a80-0b764edc9b26; https://github.com/polonel/trudesk/commit/ae904d37eaa38bffebfbfe8e949c0385c63e3263
CVE: CVE-2022-1947
Published: 2022-05-31
Description: Use of Incorrect Operator in GitHub repository polonel/trudesk prior to 1.2.3.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-480
References: https://github.com/polonel/trudesk/commit/a9e38f25c2af2722dee4fdafb2fb70d30d5106c5; https://huntr.dev/bounties/cb4d0ab3-51ba-4a42-9e38-ac0e544266f1; https://github.com/polonel/trudesk/commit/a9e38f25c2af2722dee4fdafb2fb70d30d5106c5
CVE: CVE-2022-31013
Published: 2022-05-31
Description: Chat Server is the chat server for Vartalap, an open-source messaging application. Versions 2.3.2 until 2.6.0 suffer from a bug in validating the access token, resulting in authentication bypass. The function `this.authProvider.verifyAccessKey` is an async function, as the code is not using `await` to wait for the verification result. Every time the function responds back with success, along with an unhandled exception if the token is invalid. A patch is available in version 2.6.0.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-287, CWE-20
References: https://github.com/ramank775/chat-server/discussions/78; https://github.com/ramank775/chat-server/releases/tag/v2.6.0; https://github.com/ramank775/chat-server/security/advisories/GHSA-xx4j-qqpp-v277
CVE: CVE-2022-31015
Published: 2022-05-31
Description: Waitress is a Web Server Gateway Interface server for Python 2 and 3. Waitress versions 2.1.0 and 2.1.1 may terminate early due to a thread closing a socket while the main thread is about to call select(). This will lead to the main thread raising an exception that is not handled and then causing the entire application to be killed. This issue has been fixed in Waitress 2.1.2 by no longer allowing the WSGI thread to close the socket. Instead, that is always delegated to the main thread. There is no work-around for this issue. However, users using waitress behind a reverse proxy server are less likely to have issues if the reverse proxy always reads the full response.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-248, CWE-362
References: https://github.com/Pylons/waitress/commit/4f6789b035610e0552738cdc4b35ca809a592d48; https://github.com/Pylons/waitress/issues/374; https://github.com/Pylons/waitress/pull/377
CVE: CVE-2021-27778
Published: 2022-06-01
Description: HCL Traveler is vulnerable to a cross-site scripting (XSS) caused by improper validation of the Name parameter for Approved Applications in the Traveler administration web pages. An attacker could exploit this vulnerability to execute a malicious script to access any cookies, session tokens, or other sensitive information retained by the browser and used with that site.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0098044; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0098044
CVE: CVE-2022-1285
Published: 2022-06-01
Description: Server-Side Request Forgery (SSRF) in GitHub repository gogs/gogs prior to 0.12.8.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-918, CWE-918
References: https://github.com/gogs/gogs/commit/7885f454a4946c4bbec1b4f8c603b5eea7429c7f; https://huntr.dev/bounties/da1fbd6e-7a02-458e-9c2e-6d226c47046d; https://github.com/gogs/gogs/commit/7885f454a4946c4bbec1b4f8c603b5eea7429c7f
CVE: CVE-2022-29875
Published: 2022-06-01
Description: A vulnerability has been identified in Biograph Horizon PET/CT Systems (All VJ30 versions < VJ30C-UD01), MAGNETOM Family (NUMARIS X: VA12M, VA12S, VA10B, VA20A, VA30A, VA31A), MAMMOMAT Revelation (All VC20 versions < VC20D), NAEOTOM Alpha (All VA40 versions < VA40 SP2), SOMATOM X.cite (All versions < VA30 SP5 or VA40 SP2), SOMATOM X.creed (All versions < VA30 SP5 or VA40 SP2), SOMATOM go.All (All versions < VA30 SP5 or VA40 SP2), SOMATOM go.Now (All versions < VA30 SP5 or VA40 SP2), SOMATOM go.Open Pro (All versions < VA30 SP5 or VA40 SP2), SOMATOM go.Sim (All versions < VA30 SP5 or VA40 SP2), SOMATOM go.Top (All versions < VA30 SP5 or VA40 SP2), SOMATOM go.Up (All versions < VA30 SP5 or VA40 SP2), Symbia E/S (All VB22 versions < VB22A-UD03), Symbia Evo (All VB22 versions < VB22A-UD03), Symbia Intevo (All VB22 versions < VB22A-UD03), Symbia T (All VB22 versions < VB22A-UD03), Symbia.net (All VB22 versions < VB22A-UD03), syngo.via VB10 (All versions), syngo.via VB20 (All versions), syngo.via VB30 (All versions), syngo.via VB40 (All versions < VB40B HF06), syngo.via VB50 (All versions), syngo.via VB60 (All versions < VB60B HF02). The application deserialises untrusted data without sufficient validations that could result in an arbitrary deserialization. This could allow an unauthenticated attacker to execute code in the affected system if ports 32912/tcp or 32914/tcp are reachable.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502, CWE-502
References: https://www.siemens-healthineers.com/support-documentation/cybersecurity/shsa-455016; https://www.siemens-healthineers.com/support-documentation/cybersecurity/shsa-455016