deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-4270
Published: 2022-12-02
Description: Incorrect privilege assignment issue in M-Files Web in M-Files Web versions before 22.5.11436.1 could have changed permissions accidentally.
CVSS Score: 2.0 (LOW)
CWE: CWE-269, CWE-269
References: https://empower.m-files.com/security-advisories/CVE-2022-4270; https://product.m-files.com/security-advisories/cve-2022-4270/; https://www.m-files.com/about/trust-center/security-advisories/cve-2022-4270/
CVE: CVE-2022-46366
Published: 2022-12-02
Description: Apache Tapestry 3.x allows deserialization of untrusted data, leading to remote code execution. This issue is similar to but distinct from CVE-2020-17531, which applies the the (also unsupported) 4.x version line. NOTE: This vulnerability only affects Apache Tapestry version line 3.x, which is no longer supported by the maintainer. Users are recommended to upgrade to a supported version line of Apache Tapestry.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: http://www.openwall.com/lists/oss-security/2022/12/02/1; https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2022/MNDT-2022-0041/MNDT-2022-0041.md; https://lists.apache.org/thread/bwn1vjrvz1hq0wbdzj23wz322244swhj
CVE: CVE-2022-45215
Published: 2022-12-02
Description: A cross-site scripting (XSS) vulnerability in Book Store Management System v1.0.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter under the Add New System User module.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/Rajeshwar40/CVE/blob/main/CVE-2022-45215; https://www.sourcecodester.com/php/15748/book-store-management-system-project-using-php-codeigniter-3-free-source-code.html; https://github.com/Rajeshwar40/CVE/blob/main/CVE-2022-45215
CVE: CVE-2022-46159
Published: 2022-12-02
Description: Discourse is an open-source discussion platform. In version 2.8.13 and prior on the `stable` branch and version 2.9.0.beta14 and prior on the `beta` and `tests-passed` branches, any authenticated user can create an unlisted topic. These topics, which are not readily available to other users, can take up unnecessary site resources. A patch for this issue is available in the `main` branch of Discourse. There are no known workarounds available.

CVSS Score: 4.3 (MEDIUM)
CWE: CWE-770
References: https://github.com/discourse/discourse/commit/0ce38bd7bce862db251b882613ab7053ca777382; https://github.com/discourse/discourse/security/advisories/GHSA-qf99-xpx6-hgxp; https://github.com/discourse/discourse/commit/0ce38bd7bce862db251b882613ab7053ca777382
CVE: CVE-2022-43272
Published: 2022-12-02
Description: DCMTK v3.6.7 was discovered to contain a memory leak via the T_ASC_Association object.
CVSS Score: 7.5 (HIGH)
CWE: CWE-401
References: https://github.com/songxpu/bug_report/tree/master/DCMTK/memory_leak_in_3.6.7; https://lists.debian.org/debian-lts-announce/2024/06/msg00022.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4HROBSUUV2LZCYUNODI2YM7G7AYYO75B/
CVE: CVE-2022-45480
Published: 2022-12-02
Description: PC Keyboard WiFi & Bluetooth allows an attacker (in a man-in-the-middle position between the server and a connected device) to see all data (including keypresses) in cleartext. CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-319, CWE-319
References: https://www.synopsys.com/blogs/software-security/cyrc-advisory-remote-code-execution-vulnerabilities-mouse-keyboard-apps/; https://www.synopsys.com/blogs/software-security/cyrc-advisory-remote-code-execution-vulnerabilities-mouse-keyboard-apps/
CVE: CVE-2022-45482
Published: 2022-12-02
Description: Lazy Mouse server enforces weak password requirements and doesn't implement rate limiting, allowing remote unauthenticated users to easily and quickly brute force the PIN and execute arbitrary commands. CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-521, CWE-521
References: https://www.synopsys.com/blogs/software-security/cyrc-advisory-remote-code-execution-vulnerabilities-mouse-keyboard-apps/; https://www.synopsys.com/blogs/software-security/cyrc-advisory-remote-code-execution-vulnerabilities-mouse-keyboard-apps/
CVE: CVE-2022-45483
Published: 2022-12-02
Description: Lazy Mouse allows an attacker (in a man in the middle position between the server and a connected device) to see all data (including keypresses) in cleartext. CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-319, CWE-319
References: https://www.synopsys.com/blogs/software-security/cyrc-advisory-remote-code-execution-vulnerabilities-mouse-keyboard-apps/; https://www.synopsys.com/blogs/software-security/cyrc-advisory-remote-code-execution-vulnerabilities-mouse-keyboard-apps/
CVE: CVE-2022-4271
Published: 2022-12-02
Description: Cross-site Scripting (XSS) - Reflected in GitHub repository osticket/osticket prior to 1.16.4.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/osticket/osticket/commit/5213ff138c6be6144a6692376ac0803a42eca168; https://huntr.dev/bounties/a11c922f-255a-412a-aa87-7f3bd7121599; https://github.com/osticket/osticket/commit/5213ff138c6be6144a6692376ac0803a42eca168
CVE: CVE-2022-3591
Published: 2022-12-02
Description: Use After Free in GitHub repository vim/vim prior to 9.0.0789.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://github.com/vim/vim/commit/8f3c3c6cd044e3b5bf08dbfa3b3f04bb3f711bad; https://huntr.dev/bounties/a5a998c2-4b07-47a7-91be-dbc1886b3921; https://security.gentoo.org/glsa/202305-16
CVE: CVE-2022-44277
Published: 2022-12-02
Description: Sanitization Management System v1.0 is vulnerable to SQL Injection via /php-sms/classes/Master.php?f=delete_product.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/llwyx200113/bug_report/blob/main/vendors/oretnom23/sanitization-management-system/SQLi-1.md; https://github.com/llwyx200113/bug_report/blob/main/vendors/oretnom23/sanitization-management-system/SQLi-1.md
CVE: CVE-2022-44345
Published: 2022-12-02
Description: Sanitization Management System v1.0 is vulnerable to SQL Injection via /php-sms/admin/?page=quotes/view_quote&id=.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/BGP-OSPF/bug_report/blob/main/vendors/oretnom23/sanitization-management-system/SQLi-1.md; https://github.com/BGP-OSPF/bug_report/blob/main/vendors/oretnom23/sanitization-management-system/SQLi-1.md
CVE: CVE-2022-44347
Published: 2022-12-02
Description: Sanitization Management System v1.0 is vulnerable to SQL Injection via /php-sms/admin/?page=inquiries/view_inquiry&id=.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/BGP-OSPF/bug_report/blob/main/vendors/oretnom23/sanitization-management-system/SQLi-2.md; https://github.com/BGP-OSPF/bug_report/blob/main/vendors/oretnom23/sanitization-management-system/SQLi-2.md
CVE: CVE-2022-44348
Published: 2022-12-02
Description: Sanitization Management System v1.0 is vulnerable to SQL Injection via /php-sms/admin/orders/update_status.php?id=.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/BGP-OSPF/bug_report/blob/main/vendors/oretnom23/sanitization-management-system/SQLi-3.md; https://github.com/BGP-OSPF/bug_report/blob/main/vendors/oretnom23/sanitization-management-system/SQLi-3.md
CVE: CVE-2022-44362
Published: 2022-12-02
Description: Tenda i21 V1.0.0.14(4656) is vulnerable to Buffer Overflow via /goform/AddSysLogRule.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://github.com/Double-q1015/CVE-vulns/blob/main/Tenda/i21/formAddSysLogRule/readme.md; https://github.com/Double-q1015/CVE-vulns/blob/main/Tenda/i21/formAddSysLogRule/readme.md
CVE: CVE-2022-44363
Published: 2022-12-02
Description: Tenda i21 V1.0.0.14(4656) is vulnerable to Buffer Overflow via /goform/setSnmpInfo.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://github.com/Double-q1015/CVE-vulns/blob/main/Tenda/i21/formSetSnmpInfo/readme.md; https://github.com/Double-q1015/CVE-vulns/blob/main/Tenda/i21/formSetSnmpInfo/readme.md
CVE: CVE-2022-44365
Published: 2022-12-02
Description: Tenda i21 V1.0.0.14(4656) has a stack overflow vulnerability via /goform/setSysPwd.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://github.com/Double-q1015/CVE-vulns/blob/main/Tenda/i21/formSetSysPwd/readme.md; https://github.com/Double-q1015/CVE-vulns/blob/main/Tenda/i21/formSetSysPwd/readme.md
CVE: CVE-2022-44366
Published: 2022-12-02
Description: Tenda i21 V1.0.0.14(4656) is vulnerable to Buffer Overflow via /goform/setDiagnoseInfo.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://github.com/Double-q1015/CVE-vulns/blob/main/Tenda/i21/formSetDiagnoseInfo/readme.md; https://github.com/Double-q1015/CVE-vulns/blob/main/Tenda/i21/formSetDiagnoseInfo/readme.md
CVE: CVE-2022-44367
Published: 2022-12-02
Description: Tenda i21 V1.0.0.14(4656) is vulnerable to Buffer Overflow via /goform/setUplinkInfo.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://github.com/Double-q1015/CVE-vulns/blob/main/Tenda/i21/formSetUplinkInfo/readme.md; https://github.com/Double-q1015/CVE-vulns/blob/main/Tenda/i21/formSetUplinkInfo/readme.md
CVE: CVE-2022-45673
Published: 2022-12-02
Description: Tenda AC6V1.0 V15.03.05.19 is vulnerable to Cross Site Request Forgery (CSRF) via function fromSysToolRestoreSet.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://github.com/ConfusedChenSir/VulnerabilityProjectRecords/blob/main/fromSysToolRestoreSet/fromSysToolRestoreSet.md; https://github.com/ConfusedChenSir/VulnerabilityProjectRecords/blob/main/fromSysToolRestoreSet/fromSysToolRestoreSet.md
CVE: CVE-2022-45674
Published: 2022-12-02
Description: Tenda AC6V1.0 V15.03.05.19 is vulnerable to Cross Site Request Forgery (CSRF) via function fromSysToolReboot.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://github.com/ConfusedChenSir/VulnerabilityProjectRecords/blob/main/fromSysToolReboot/fromSysToolReboot.md; https://github.com/ConfusedChenSir/VulnerabilityProjectRecords/blob/main/fromSysToolReboot/fromSysToolReboot.md
CVE: CVE-2022-45641
Published: 2022-12-02
Description: Tenda AC6V1.0 V15.03.05.19 is vulnerable to Buffer Overflow via formSetMacFilterCfg.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-120
References: https://github.com/Double-q1015/CVE-vulns/blob/main/tenda_ac6/formSetMacFilterCfg/formSetMacFilterCfg.md; https://github.com/Double-q1015/CVE-vulns/blob/main/tenda_ac6/formSetMacFilterCfg/formSetMacFilterCfg.md
CVE: CVE-2022-45643
Published: 2022-12-02
Description: Tenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the deviceId parameter in the addWifiMacFilter function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-120
References: https://github.com/Double-q1015/CVE-vulns/blob/main/tenda_ac6/addWifiMacFilter_deviceId/addWifiMacFilter_deviceId.md; https://github.com/Double-q1015/CVE-vulns/blob/main/tenda_ac6/addWifiMacFilter_deviceId/addWifiMacFilter_deviceId.md
CVE: CVE-2022-45644
Published: 2022-12-02
Description: Tenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the deviceId parameter in the formSetClientState function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-120
References: https://github.com/Double-q1015/CVE-vulns/blob/main/tenda_ac6/formSetClientState_deviceId/formSetClientState_deviceId.md; https://github.com/Double-q1015/CVE-vulns/blob/main/tenda_ac6/formSetClientState_deviceId/formSetClientState_deviceId.md
CVE: CVE-2022-45645
Published: 2022-12-02
Description: Tenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the deviceMac parameter in the addWifiMacFilter function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-120
References: https://github.com/Double-q1015/CVE-vulns/blob/main/tenda_ac6/addWifiMacFilter_deviceMac/addWifiMacFilter_derviceMac.md; https://github.com/Double-q1015/CVE-vulns/blob/main/tenda_ac6/addWifiMacFilter_deviceMac/addWifiMacFilter_derviceMac.md
CVE: CVE-2022-45646
Published: 2022-12-02
Description: Tenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the limitSpeedUp parameter in the formSetClientState function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-120
References: https://github.com/Double-q1015/CVE-vulns/blob/main/tenda_ac6/formSetClientState_limitSpeedUp/formSetClientState_limitSpeed.md; https://github.com/Double-q1015/CVE-vulns/blob/main/tenda_ac6/formSetClientState_limitSpeedUp/formSetClientState_limitSpeed.md
CVE: CVE-2022-45647
Published: 2022-12-02
Description: Tenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the limitSpeed parameter in the formSetClientState function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-120
References: https://github.com/Double-q1015/CVE-vulns/blob/main/tenda_ac6/formSetClientState_limitSpeed/formSetClientState_limitSpeed.md; https://github.com/Double-q1015/CVE-vulns/blob/main/tenda_ac6/formSetClientState_limitSpeed/formSetClientState_limitSpeed.md
CVE: CVE-2022-45648
Published: 2022-12-02
Description: Tenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the devName parameter in the formSetDeviceName function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-120
References: https://github.com/Double-q1015/CVE-vulns/blob/main/tenda_ac6/formSetDeviceName/formSetDeviceName.md; https://github.com/Double-q1015/CVE-vulns/blob/main/tenda_ac6/formSetDeviceName/formSetDeviceName.md
CVE: CVE-2022-45649
Published: 2022-12-02
Description: Tenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the endIp parameter in the formSetPPTPServer function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-120
References: https://github.com/Double-q1015/CVE-vulns/blob/main/tenda_ac6/formSetPPTPServer_endIp/formSetPPTPServer_endIp.md; https://github.com/Double-q1015/CVE-vulns/blob/main/tenda_ac6/formSetPPTPServer_endIp/formSetPPTPServer_endIp.md
CVE: CVE-2022-45650
Published: 2022-12-02
Description: Tenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the firewallEn parameter in the formSetFirewallCfg function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-120
References: https://github.com/Double-q1015/CVE-vulns/blob/main/tenda_ac6/formSetFirewallCfg/formSetFirewallCfg.md; https://github.com/Double-q1015/CVE-vulns/blob/main/tenda_ac6/formSetFirewallCfg/formSetFirewallCfg.md
CVE: CVE-2022-45651
Published: 2022-12-02
Description: Tenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the list parameter in the formSetVirtualSer function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-120
References: https://github.com/Double-q1015/CVE-vulns/blob/main/tenda_ac6/formSetVirtualSer/formSetVirtualSer.md; https://github.com/Double-q1015/CVE-vulns/blob/main/tenda_ac6/formSetVirtualSer/formSetVirtualSer.md
CVE: CVE-2022-45652
Published: 2022-12-02
Description: Tenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the startIp parameter in the formSetPPTPServer function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-120
References: https://github.com/Double-q1015/CVE-vulns/blob/main/tenda_ac6/formSetPPTPServer_startIp/formSetPPTPServer_startIp.md; https://github.com/Double-q1015/CVE-vulns/blob/main/tenda_ac6/formSetPPTPServer_startIp/formSetPPTPServer_startIp.md
CVE: CVE-2022-45653
Published: 2022-12-02
Description: Tenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the page parameter in the fromNatStaticSetting function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-120
References: https://github.com/Double-q1015/CVE-vulns/blob/main/tenda_ac6/fromNatStaticSetting/fromNatStaticSetting_page.md; https://github.com/Double-q1015/CVE-vulns/blob/main/tenda_ac6/fromNatStaticSetting/fromNatStaticSetting_page.md
CVE: CVE-2022-45654
Published: 2022-12-02
Description: Tenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the ssid parameter in the form_fast_setting_wifi_set function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-120
References: https://github.com/Double-q1015/CVE-vulns/blob/main/tenda_ac6/form_fast_setting_wifi_set_ssid/form_fast_setting_wifi_set_ssid.md; https://github.com/Double-q1015/CVE-vulns/blob/main/tenda_ac6/form_fast_setting_wifi_set_ssid/form_fast_setting_wifi_set_ssid.md
CVE: CVE-2022-45655
Published: 2022-12-02
Description: Tenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the timeZone parameter in the form_fast_setting_wifi_set function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-120
References: https://github.com/Double-q1015/CVE-vulns/blob/main/tenda_ac6/form_fast_setting_wifi_set_timeZone/form_fast_setting_wifi_set_timeZone.md; https://github.com/Double-q1015/CVE-vulns/blob/main/tenda_ac6/form_fast_setting_wifi_set_timeZone/form_fast_setting_wifi_set_timeZone.md
CVE: CVE-2022-45656
Published: 2022-12-02
Description: Tenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the time parameter in the fromSetSysTime function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-120
References: https://github.com/Double-q1015/CVE-vulns/blob/main/tenda_ac6/fromSetSysTime/fromSetSysTime.md; https://github.com/Double-q1015/CVE-vulns/blob/main/tenda_ac6/fromSetSysTime/fromSetSysTime.md
CVE: CVE-2022-45657
Published: 2022-12-02
Description: Tenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the list parameter in the fromSetIpMacBind function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-120
References: https://github.com/Double-q1015/CVE-vulns/blob/main/tenda_ac6/fromSetIpMacBind/fromSetIpMacBind.md; https://github.com/Double-q1015/CVE-vulns/blob/main/tenda_ac6/fromSetIpMacBind/fromSetIpMacBind.md
CVE: CVE-2022-45658
Published: 2022-12-02
Description: Tenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the schedEndTime parameter in the setSchedWifi function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-120
References: https://github.com/Double-q1015/CVE-vulns/blob/main/tenda_ac6/setSchedWifi_schedEndTime/setSchedWifi_schedEndTime.md; https://github.com/Double-q1015/CVE-vulns/blob/main/tenda_ac6/setSchedWifi_schedEndTime/setSchedWifi_schedEndTime.md
CVE: CVE-2022-45659
Published: 2022-12-02
Description: Tenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the wpapsk_crypto parameter in the fromSetWirelessRepeat function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-120
References: https://github.com/Double-q1015/CVE-vulns/blob/main/tenda_ac6/fromSetWirelessRepeat/fromSetWirelessRepeat.md; https://github.com/Double-q1015/CVE-vulns/blob/main/tenda_ac6/fromSetWirelessRepeat/fromSetWirelessRepeat.md
CVE: CVE-2022-45660
Published: 2022-12-02
Description: Tenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the schedStartTime parameter in the setSchedWifi function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-120
References: https://github.com/Double-q1015/CVE-vulns/blob/main/tenda_ac6/setSchedWifi_schedStartTime/setSchedWifi_schedStartTime.md; https://github.com/Double-q1015/CVE-vulns/blob/main/tenda_ac6/setSchedWifi_schedStartTime/setSchedWifi_schedStartTime.md
CVE: CVE-2022-45661
Published: 2022-12-02
Description: Tenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the time parameter in the setSmartPowerManagement function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-120
References: https://github.com/Double-q1015/CVE-vulns/blob/main/tenda_ac6/setSmartPowerManagement/setSmartPowerManagement.md; https://github.com/Double-q1015/CVE-vulns/blob/main/tenda_ac6/setSmartPowerManagement/setSmartPowerManagement.md
CVE: CVE-2022-45663
Published: 2022-12-02
Description: Tenda i22 V1.0.0.3(4687) was discovered to contain a buffer overflow via the index parameter in the formWifiMacFilterSet function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-120
References: https://github.com/Double-q1015/CVE-vulns/blob/main/tenda_i22/formWifiMacFilterSet/formWifiMacFilterSet.md; https://github.com/Double-q1015/CVE-vulns/blob/main/tenda_i22/formWifiMacFilterSet/formWifiMacFilterSet.md
CVE: CVE-2022-45664
Published: 2022-12-02
Description: Tenda i22 V1.0.0.3(4687) was discovered to contain a buffer overflow via the list parameter in the formwrlSSIDget function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-120
References: https://github.com/Double-q1015/CVE-vulns/blob/main/tenda_i22/formwrlSSIDget/formWifiMacFilterGet.md; https://github.com/Double-q1015/CVE-vulns/blob/main/tenda_i22/formwrlSSIDget/formWifiMacFilterGet.md
CVE: CVE-2022-45667
Published: 2022-12-02
Description: Tenda i22 V1.0.0.3(4687) is vulnerable to Cross Site Request Forgery (CSRF) via function fromSysToolRestoreSet.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://github.com/Double-q1015/CVE-vulns/blob/main/tenda_i22/fromSysToolRestoreSet/fromSysToolRestoreSet.md; https://github.com/Double-q1015/CVE-vulns/blob/main/tenda_i22/fromSysToolRestoreSet/fromSysToolRestoreSet.md
CVE: CVE-2022-45668
Published: 2022-12-02
Description: Tenda i22 V1.0.0.3(4687) is vulnerable to Cross Site Request Forgery (CSRF) via function fromSysToolReboot.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://github.com/Double-q1015/CVE-vulns/blob/main/tenda_i22/fromSysToolReboot/fromSysToolReboot.md; https://github.com/Double-q1015/CVE-vulns/blob/main/tenda_i22/fromSysToolReboot/fromSysToolReboot.md
CVE: CVE-2022-45669
Published: 2022-12-02
Description: Tenda i22 V1.0.0.3(4687) was discovered to contain a buffer overflow via the index parameter in the formWifiMacFilterGet function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-120
References: https://github.com/ConfusedChenSir/VulnerabilityProjectRecords/blob/main/formWifiMacFilterGet/formWifiMacFilterGet.md; https://github.com/ConfusedChenSir/VulnerabilityProjectRecords/blob/main/formWifiMacFilterGet/formWifiMacFilterGet.md
CVE: CVE-2022-45670
Published: 2022-12-02
Description: Tenda i22 V1.0.0.3(4687) was discovered to contain a buffer overflow via the ping1 parameter in the formSetAutoPing function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-120
References: https://github.com/ConfusedChenSir/VulnerabilityProjectRecords/blob/main/formSetAutoPing_ping1/formSetAutoPing_ping1.md; https://github.com/ConfusedChenSir/VulnerabilityProjectRecords/blob/main/formSetAutoPing_ping1/formSetAutoPing_ping1.md
CVE: CVE-2022-45671
Published: 2022-12-02
Description: Tenda i22 V1.0.0.3(4687) was discovered to contain a buffer overflow via the appData parameter in the formSetAppFilterRule function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-120
References: https://github.com/Double-q1015/CVE-vulns/blob/main/tenda_i22/formSetAppFilterRule/formSetAppFilterRule.md; https://github.com/Double-q1015/CVE-vulns/blob/main/tenda_i22/formSetAppFilterRule/formSetAppFilterRule.md
CVE: CVE-2022-45672
Published: 2022-12-02
Description: Tenda i22 V1.0.0.3(4687) was discovered to contain a buffer overflow via the formWx3AuthorizeSet function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-120
References: https://github.com/Double-q1015/CVE-vulns/blob/main/tenda_i22/formWx3AuthorizeSet/formWx3AuthorizeSet.md; https://github.com/Double-q1015/CVE-vulns/blob/main/tenda_i22/formWx3AuthorizeSet/formWx3AuthorizeSet.md
CVE: CVE-2022-46145
Published: 2022-12-02
Description: authentik is an open-source identity provider. Versions prior to 2022.11.2 and 2022.10.2 are vulnerable to unauthorized user creation and potential account takeover. With the default flows, unauthenticated users can create new accounts in authentik. If a flow exists that allows for email-verified password recovery, this can be used to overwrite the email address of admin accounts and take over their accounts. authentik 2022.11.2 and 2022.10.2 fix this issue. As a workaround, a policy can be created and bound to the `default-user-settings-flow flow` with the contents `return request.user.is_authenticated`.
CVSS Score: 8.1 (HIGH)
CWE: CWE-287, CWE-306
References: https://github.com/goauthentik/authentik/security/advisories/GHSA-mjfw-54m5-fvjf; https://goauthentik.io/docs/releases/2022.10#fixed-in-2022102; https://goauthentik.io/docs/releases/2022.11#fixed-in-2022112