deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-40885
Published: 2022-10-19
Description: Bento4 v1.6.0-639 has a memory allocation issue that can cause denial of service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-770, CWE-770
References: https://github.com/axiomatic-systems/Bento4/issues/761; https://github.com/yangfar/CVE/blob/main/CVE-2022-40885.md; https://github.com/axiomatic-systems/Bento4/issues/761
CVE: CVE-2022-42227
Published: 2022-10-19
Description: jsonlint 1.0 is vulnerable to heap-buffer-overflow via /home/hjsz/jsonlint/src/lexer.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-787
References: https://github.com/p-ranav/jsonlint/issues/2; https://github.com/yangfar/CVE/blob/main/CVE-2022-42227.md; https://github.com/p-ranav/jsonlint/issues/2
CVE: CVE-2022-43014
Published: 2022-10-19
Description: OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the joborderID parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/hansmach1ne/CVE-portfolio/tree/main/CVE-2022-43014; https://github.com/hansmach1ne/opencats_zero-days/blob/main/XSS_in_joborderID.md; https://github.com/hansmach1ne/opencats_zero-days/blob/main/XSS_in_joborderID.md
CVE: CVE-2022-43015
Published: 2022-10-19
Description: OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the entriesPerPage parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/hansmach1ne/CVE-portfolio/tree/main/CVE-2022-43015; https://github.com/hansmach1ne/opencats_zero-days/blob/main/XSS_in_entriesPerPage.md; https://github.com/hansmach1ne/opencats_zero-days/blob/main/XSS_in_entriesPerPage.md
CVE: CVE-2022-43016
Published: 2022-10-19
Description: OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the callback component.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/hansmach1ne/CVE-portfolio/tree/main/CVE-2022-43016; https://github.com/hansmach1ne/opencats_zero-days/blob/main/XSS_in_callback.md; https://github.com/hansmach1ne/opencats_zero-days/blob/main/XSS_in_callback.md
CVE: CVE-2022-43017
Published: 2022-10-19
Description: OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the indexFile component.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/hansmach1ne/CVE-portfolio/tree/main/CVE-2022-43017; https://github.com/hansmach1ne/opencats_zero-days/blob/main/XSS_in_indexFile.md; https://github.com/hansmach1ne/opencats_zero-days/blob/main/XSS_in_indexFile.md
CVE: CVE-2022-43018
Published: 2022-10-19
Description: OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the email parameter in the Check Email function.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/hansmach1ne/CVE-portfolio/tree/main/CVE-2022-43018; https://github.com/hansmach1ne/opencats_zero-days/blob/main/XSS_in_checkEmail.md; https://github.com/hansmach1ne/opencats_zero-days/blob/main/XSS_in_checkEmail.md
CVE: CVE-2022-43019
Published: 2022-10-19
Description: OpenCATS v0.9.6 was discovered to contain a remote code execution (RCE) vulnerability via the getDataGridPager's ajax functionality.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502, CWE-502
References: https://github.com/hansmach1ne/CVE-portfolio/tree/main/CVE-2022-43019; https://github.com/hansmach1ne/opencats_zero-days/blob/main/RCE_via_deserialisation.md; https://github.com/hansmach1ne/opencats_zero-days/blob/main/RCE_via_deserialisation.md
CVE: CVE-2022-43020
Published: 2022-10-19
Description: OpenCATS v0.9.6 was discovered to contain a SQL injection vulnerability via the tag_id variable in the Tag update function.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://github.com/hansmach1ne/CVE-portfolio/tree/main/CVE-2022-43020; https://github.com/hansmach1ne/opencats_zero-days/blob/main/SQLI_in_Tag_Updates.md; https://github.com/hansmach1ne/opencats_zero-days/blob/main/SQLI_in_Tag_Updates.md
CVE: CVE-2022-43021
Published: 2022-10-19
Description: OpenCATS v0.9.6 was discovered to contain a SQL injection vulnerability via the entriesPerPage variable.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://github.com/hansmach1ne/CVE-portfolio/tree/main/CVE-2022-43021; https://github.com/hansmach1ne/opencats_zero-days/blob/main/SQLI_JobOrders.md; https://github.com/hansmach1ne/opencats_zero-days/blob/main/SQLI_JobOrders.md
CVE: CVE-2022-43022
Published: 2022-10-19
Description: OpenCATS v0.9.6 was discovered to contain a SQL injection vulnerability via the tag_id variable in the Tag deletion function.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://github.com/hansmach1ne/CVE-portfolio/tree/main/CVE-2022-43022; https://github.com/hansmach1ne/opencats_zero-days/blob/main/SQLI_tag_deletion.md; https://github.com/hansmach1ne/opencats_zero-days/blob/main/SQLI_tag_deletion.md
CVE: CVE-2022-43023
Published: 2022-10-19
Description: OpenCATS v0.9.6 was discovered to contain a SQL injection vulnerability via the importID parameter in the Import viewerrors function.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://github.com/hansmach1ne/CVE-portfolio/tree/main/CVE-2022-43023; https://github.com/hansmach1ne/opencats_zero-days/blob/main/SQLI_imports_errors.md; https://github.com/hansmach1ne/opencats_zero-days/blob/main/SQLI_imports_errors.md
CVE: CVE-2022-41708
Published: 2022-10-19
Description: Relatedcode's Messenger version 7bcd20b allows an authenticated external attacker to access existing chats in the workspaces of any user of the application. This is possible because the application does not validate permissions correctly.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-281, CWE-281
References: https://fluidattacks.com/advisories/tiesto/; https://github.com/relatedcode/Messenger; https://fluidattacks.com/advisories/tiesto/
CVE: CVE-2022-43024
Published: 2022-10-19
Description: Tenda TX3 US_TX3V1.0br_V16.03.13.11_multi_TDE01 was discovered to contain a stack overflow via the list parameter at /goform/SetVirtualServerCfg.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://github.com/tianhui999/myCVE/blob/main/TX3/TX3-6.md; https://github.com/tianhui999/myCVE/blob/main/TX3/TX3-6.md
CVE: CVE-2022-43025
Published: 2022-10-19
Description: Tenda TX3 US_TX3V1.0br_V16.03.13.11_multi_TDE01 was discovered to contain a stack overflow via the startIp parameter at /goform/SetPptpServerCfg.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://github.com/tianhui999/myCVE/blob/main/TX3/TX3-1.md; https://github.com/tianhui999/myCVE/blob/main/TX3/TX3-1.md
CVE: CVE-2022-43026
Published: 2022-10-19
Description: Tenda TX3 US_TX3V1.0br_V16.03.13.11_multi_TDE01 was discovered to contain a stack overflow via the endIp parameter at /goform/SetPptpServerCfg.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://github.com/tianhui999/myCVE/blob/main/TX3/TX3-2.md; https://github.com/tianhui999/myCVE/blob/main/TX3/TX3-2.md
CVE: CVE-2022-43027
Published: 2022-10-19
Description: Tenda TX3 US_TX3V1.0br_V16.03.13.11_multi_TDE01 was discovered to contain a stack overflow via the firewallEn parameter at /goform/SetFirewallCfg.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://github.com/tianhui999/myCVE/blob/main/TX3/TX3-5.md; https://github.com/tianhui999/myCVE/blob/main/TX3/TX3-5.md
CVE: CVE-2022-43028
Published: 2022-10-19
Description: Tenda TX3 US_TX3V1.0br_V16.03.13.11_multi_TDE01 was discovered to contain a stack overflow via the timeZone parameter at /goform/SetSysTimeCfg.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://github.com/tianhui999/myCVE/blob/main/TX3/TX3-3.md; https://github.com/tianhui999/myCVE/blob/main/TX3/TX3-3.md
CVE: CVE-2022-43029
Published: 2022-10-19
Description: Tenda TX3 US_TX3V1.0br_V16.03.13.11_multi_TDE01 was discovered to contain a stack overflow via the time parameter at /goform/SetSysTimeCfg.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://github.com/tianhui999/myCVE/blob/main/TX3/TX3-4.md; https://github.com/tianhui999/myCVE/blob/main/TX3/TX3-4.md
CVE: CVE-2022-20424
Published: 2022-10-19
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2022-31684
Published: 2022-10-19
Description: Reactor Netty HTTP Server, in versions 1.0.11 - 1.0.23, may log request headers in some cases of invalid HTTP requests. The logged headers may reveal valid access tokens to those with access to server logs. This may affect only invalid HTTP requests where logging at WARN level is enabled.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-532
References: https://tanzu.vmware.com/security/cve-2022-31684; https://tanzu.vmware.com/security/cve-2022-31684
CVE: CVE-2022-36795
Published: 2022-10-19
Description: In BIG-IP versions 17.0.x before 17.0.0.1, 16.1.x before 16.1.3.1, 15.1.x before 15.1.7, and 14.1.x before 14.1.5.1, when an LTM TCP profile with Auto Receive Window Enabled is configured on a virtual server, undisclosed traffic can cause the virtual server to stop processing new client connections.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-682
References: https://support.f5.com/csp/article/K52494562; https://support.f5.com/csp/article/K52494562
CVE: CVE-2022-38107
Published: 2022-10-19
Description: Sensitive information could be displayed when a detailed technical error message is posted. This information could disclose environmental details.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-209, CWE-209
References: https://docs.sentryone.com/help/sentryone-platform-release-notes; https://www.solarwinds.com/trust-center/security-advisories/CVE-2022-38107; https://docs.sentryone.com/help/sentryone-platform-release-notes
CVE: CVE-2022-41617
Published: 2022-10-19
Description: In versions 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5.1, and 13.1.x before 13.1.5.1, When the Advanced WAF / ASM module is provisioned, an authenticated remote code execution vulnerability exists in the BIG-IP iControl REST interface.
CVSS Score: 7.2 (HIGH)
CWE: CWE-77
References: https://support.f5.com/csp/article/K11830089; https://support.f5.com/csp/article/K11830089
CVE: CVE-2022-41624
Published: 2022-10-19
Description: In BIG-IP versions 17.0.x before 17.0.0.1, 16.1.x before 16.1.3.2, 15.1.x before 15.1.7, 14.1.x before 14.1.5.2, and 13.1.x before 13.1.5.1, when a sideband iRule is configured on a virtual server, undisclosed traffic can cause an increase in memory resource utilization.
CVSS Score: 7.5 (HIGH)
CWE: CWE-401
References: https://support.f5.com/csp/article/K43024307; https://support.f5.com/csp/article/K43024307
CVE: CVE-2022-41691
Published: 2022-10-19
Description: When a BIG-IP Advanced WAF/ASM security policy is configured on a virtual server, undisclosed requests can cause the bd process to terminate.
CVSS Score: 7.5 (HIGH)
CWE: CWE-763
References: https://support.f5.com/csp/article/K02694732; https://support.f5.com/csp/article/K02694732
CVE: CVE-2022-41694
Published: 2022-10-19
Description: In BIG-IP versions 16.1.x before 16.1.3, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5, and all versions of 13.1.x, and BIG-IQ versions 8.x before 8.2.0.1 and all versions of 7.x, when an SSL key is imported on a BIG-IP or BIG-IQ system, undisclosed input can cause MCPD to terminate.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-20
References: https://support.f5.com/csp/article/K64829234; https://support.f5.com/csp/article/K64829234
CVE: CVE-2022-41741
Published: 2022-10-19
Description: NGINX Open Source before versions 1.23.2 and 1.22.1, NGINX Open Source Subscription before versions R2 P1 and R1 P1, and NGINX Plus before versions R27 P1 and R26 P1 have a vulnerability in the module ngx_http_mp4_module that might allow a local attacker to corrupt NGINX worker memory, resulting in its termination or potential other impact using a specially crafted audio or video file. The issue affects only NGINX products that are built with the ngx_http_mp4_module, when the mp4 directive is used in the configuration file. Further, the attack is possible only if an attacker can trigger processing of a specially crafted audio or video file with the module ngx_http_mp4_module.
CVSS Score: 7.0 (HIGH)
CWE: CWE-787, CWE-787
References: https://lists.debian.org/debian-lts-announce/2022/11/msg00031.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BPRVYA4FS34VWB4FEFYNAD7Z2LFCJVEI/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FD6M3PVVKO35WLAA7GLDBS6TEQ26SM64/
CVE: CVE-2022-41742
Published: 2022-10-19
Description: NGINX Open Source before versions 1.23.2 and 1.22.1, NGINX Open Source Subscription before versions R2 P1 and R1 P1, and NGINX Plus before versions R27 P1 and R26 P1 have a vulnerability in the module ngx_http_mp4_module that might allow a local attacker to cause a worker process crash, or might result in worker process memory disclosure by using a specially crafted audio or video file. The issue affects only NGINX products that are built with the module ngx_http_mp4_module, when the mp4 directive is used in the configuration file. Further, the attack is possible only if an attacker can trigger processing of a specially crafted audio or video file with the module ngx_http_mp4_module.
CVSS Score: 7.1 (HIGH)
CWE: CWE-787, CWE-787
References: https://lists.debian.org/debian-lts-announce/2022/11/msg00031.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BPRVYA4FS34VWB4FEFYNAD7Z2LFCJVEI/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FD6M3PVVKO35WLAA7GLDBS6TEQ26SM64/
CVE: CVE-2022-41743
Published: 2022-10-19
Description: NGINX Plus before versions R27 P1 and R26 P1 have a vulnerability in the module ngx_http_hls_module that might allow a local attacker to corrupt NGINX worker memory, resulting in its crash or potential other impact using a specially crafted audio or video file. The issue affects only NGINX Plus when the hls directive is used in the configuration file. Further, the attack is possible only if an attacker can trigger processing of a specially crafted audio or video file with the module ngx_http_hls_module.
CVSS Score: 7.0 (HIGH)
CWE: CWE-787
References: https://support.f5.com/csp/article/K01112063; https://support.f5.com/csp/article/K01112063
CVE: CVE-2022-41770
Published: 2022-10-19
Description: In BIG-IP versions 17.0.x before 17.0.0.1, 16.1.x before 16.1.3.1, 15.1.x before 15.1.7, 14.1.x before 14.1.5.1, and all versions of 13.1.x, and BIG-IQ all versions of 8.x and 7.x, an authenticated iControl REST user can cause an increase in memory resource utilization, via undisclosed requests.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400, CWE-400
References: https://support.f5.com/csp/article/K22505850; https://support.f5.com/csp/article/K22505850
CVE: CVE-2022-41780
Published: 2022-10-19
Description: In F5OS-A version 1.x before 1.1.0 and F5OS-C version 1.x before 1.4.0, a directory traversal vulnerability exists in an undisclosed location of the F5OS CLI that allows an attacker to read arbitrary files.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-22
References: https://support.f5.com/csp/article/K81701735; https://support.f5.com/csp/article/K81701735
CVE: CVE-2022-41787
Published: 2022-10-19
Description: In BIG-IP versions 17.0.x before 17.0.0.1, 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5.1, and 13.1.x before 13.1.5.1, when DNS profile is configured on a virtual server with DNS Express enabled, undisclosed DNS queries with DNSSEC can cause TMM to terminate.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://support.f5.com/csp/article/K70569537; https://support.f5.com/csp/article/K70569537
CVE: CVE-2022-41806
Published: 2022-10-19
Description: In versions 16.1.x before 16.1.3.2 and 15.1.x before 15.1.5.1, when BIG-IP AFM Network Address Translation policy with IPv6/IPv4 translation rules is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-400
References: https://support.f5.com/csp/article/K00721320; https://support.f5.com/csp/article/K00721320
CVE: CVE-2022-41813
Published: 2022-10-19
Description: In versions 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5, and all versions of 13.1.x, when BIG-IP is provisioned with PEM or AFM module, an undisclosed input can cause Traffic Management Microkernel (TMM) to terminate.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://support.f5.com/csp/article/K93723284; https://support.f5.com/csp/article/K93723284
CVE: CVE-2022-41832
Published: 2022-10-19
Description: In BIG-IP versions 17.0.x before 17.0.0.1, 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5.1, and 13.1.x before 13.1.5.1, when a SIP profile is configured on a virtual server, undisclosed messages can cause an increase in memory resource utilization.
CVSS Score: 7.5 (HIGH)
CWE: CWE-401
References: https://support.f5.com/csp/article/K10347453; https://support.f5.com/csp/article/K10347453
CVE: CVE-2022-41833
Published: 2022-10-19
Description: In all BIG-IP 13.1.x versions, when an iRule containing the HTTP::collect command is configured on a virtual server, undisclosed requests can cause Traffic Management Microkernel (TMM) to terminate.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://support.f5.com/csp/article/K69940053; https://support.f5.com/csp/article/K69940053
CVE: CVE-2022-41835
Published: 2022-10-19
Description: In F5OS-A version 1.x before 1.1.0 and F5OS-C version 1.x before 1.5.0, excessive file permissions in F5OS allows an authenticated local attacker to execute limited set of commands in a container and impact the F5OS controller.
CVSS Score: 7.3 (HIGH)
CWE: CWE-269
References: https://support.f5.com/csp/article/K33484483; https://support.f5.com/csp/article/K33484483
CVE: CVE-2022-41836
Published: 2022-10-19
Description: When an 'Attack Signature False Positive Mode' enabled security policy is configured on a virtual server, undisclosed requests can cause the bd process to terminate.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://support.f5.com/csp/article/K47204506; https://support.f5.com/csp/article/K47204506
CVE: CVE-2022-41983
Published: 2022-10-19
Description: On specific hardware platforms, on BIG-IP versions 16.1.x before 16.1.3.1, 15.1.x before 15.1.7, 14.1.x before 14.1.5.1, and all versions of 13.1.x, while Intel QAT (QuickAssist Technology) and the AES-GCM/CCM cipher is in use, undisclosed conditions can cause BIG-IP to send data unencrypted even with an SSL Profile applied.
CVSS Score: 3.7 (LOW)
CWE: CWE-319
References: https://support.f5.com/csp/article/K31523465; https://support.f5.com/csp/article/K31523465
CVE: CVE-2022-3327
Published: 2022-10-20
Description: Missing Authentication for Critical Function in GitHub repository ikus060/rdiffweb prior to 2.5.0a6.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306, CWE-306
References: https://github.com/ikus060/rdiffweb/commit/f2a32f2a9f3fb8be1a9432ac3d81d3aacdb13095; https://huntr.dev/bounties/02207c8f-2b15-4a31-a86a-74fd2fca0ed1; https://github.com/ikus060/rdiffweb/commit/f2a32f2a9f3fb8be1a9432ac3d81d3aacdb13095
CVE: CVE-2022-41358
Published: 2022-10-20
Description: A stored cross-site scripting (XSS) vulnerability in Garage Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the categoriesName parameter in createCategories.php.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://packetstormsecurity.com/files/168718/Garage-Management-System-1.0-Cross-Site-Scripting.html; https://cxsecurity.com/issue/WLB[PII_REDACTED]; https://github.com/thecasual/CVE-2022-41358
CVE: CVE-2022-27624
Published: 2022-10-20
Description: A vulnerability regarding improper restriction of operations within the bounds of a memory buffer is found in the packet decryption functionality of Out-of-Band (OOB) Management. This allows remote attackers to execute arbitrary commands via unspecified vectors. The following models with Synology DiskStation Manager (DSM) versions before 7.1.1-42962-2 may be affected: DS3622xs+, FS3410, and HD6500.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-119
References: https://www.synology.com/security/advisory/Synology_SA_22_17; https://www.synology.com/security/advisory/Synology_SA_22_17
CVE: CVE-2022-27625
Published: 2022-10-20
Description: A vulnerability regarding improper restriction of operations within the bounds of a memory buffer is found in the message processing functionality of Out-of-Band (OOB) Management. This allows remote attackers to execute arbitrary commands via unspecified vectors. The following models with Synology DiskStation Manager (DSM) versions before 7.1.1-42962-2 may be affected: DS3622xs+, FS3410, and HD6500.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-119
References: https://www.synology.com/security/advisory/Synology_SA_22_17; https://www.synology.com/security/advisory/Synology_SA_22_17
CVE: CVE-2022-27626
Published: 2022-10-20
Description: A vulnerability regarding concurrent execution using shared resource with improper synchronization ('Race Condition') is found in the session processing functionality of Out-of-Band (OOB) Management. This allows remote attackers to execute arbitrary commands via unspecified vectors. The following models with Synology DiskStation Manager (DSM) versions before 7.1.1-42962-2 may be affected: DS3622xs+, FS3410, and HD6500.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-362
References: https://www.synology.com/security/advisory/Synology_SA_22_17; https://www.synology.com/security/advisory/Synology_SA_22_17
CVE: CVE-2022-3576
Published: 2022-10-20
Description: A vulnerability regarding out-of-bounds read is found in the session processing functionality of Out-of-Band (OOB) Management. This allows remote attackers to obtain sensitive information via unspecified vectors. The following models with Synology DiskStation Manager (DSM) versions before 7.1.1-42962-2 may be affected: DS3622xs+, FS3410, and HD6500.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-125
References: https://www.synology.com/security/advisory/Synology_SA_22_17; https://www.synology.com/security/advisory/Synology_SA_22_17
CVE: CVE-2020-12744
Published: 2022-10-20
Description: The MSI installer in Verint Desktop Resources 15.2 allows an unprivileged local user to elevate their privileges during install or repair.
CVSS Score: 7.8 (HIGH)
CWE: CWE-281, CWE-281
References: https://github.com/bwiltse/cve/blob/master/Verint/Verint-CVE-2020-12744.txt; https://github.com/bwiltse/verint; https://github.com/bwiltse/cve/blob/master/Verint/Verint-CVE-2020-12744.txt
CVE: CVE-2021-33231
Published: 2022-10-20
Description: Cross Site Scripting (XSS) vulnerability in New equipment page in EasyVista Service Manager 2018.1.181.1 allows remote attackers to run arbitrary code via the notes field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://easyvista.com; https://armysick.github.io/cve-2021-33231/; http://easyvista.com
CVE: CVE-2022-26954
Published: 2022-10-20
Description: Multiple open redirect vulnerabilities in NopCommerce 4.10 through 4.50.1 allow remote attackers to conduct phishing attacks by redirecting users to attacker-controlled web sites via the returnUrl parameter, processed by the (1) ChangePassword function, (2) SignInCustomerAsync function, (3) SuccessfulAuthentication method, or (4) NopRedirectResultExecutor class.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601, CWE-601
References: https://gist.github.com/adeadfed/baea45138b7eb29e09f6505d56b56413; https://github.com/nopSolutions/nopCommerce/releases; https://gist.github.com/adeadfed/baea45138b7eb29e09f6505d56b56413