deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-31651
Published: 2022-05-25
Description: In SoX 14.4.2, there is an assertion failure in rate_init in rate.c in libsox.a.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-617
References: http://www.openwall.com/lists/oss-security/2023/02/03/3; https://lists.debian.org/debian-lts-announce/2023/02/msg00009.html; https://sourceforge.net/p/sox/bugs/360/
CVE: CVE-2021-42692
Published: 2022-05-26
Description: There is a stack-overflow vulnerability in tinytoml v0.4 that can cause a crash or DoS.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787
References: https://github.com/mayah/tinytoml/issues/49; https://github.com/mayah/tinytoml/issues/49
CVE: CVE-2021-42859
Published: 2022-05-26
Description: A memory leak issue was discovered in Mini-XML v3.2 that could cause a denial of service. NOTE: testing reports are inconsistent, with some testers seeing the issue in both the 3.2 release and in the October 2021 development code, but others not seeing the issue in the 3.2 release
CVSS Score: 7.5 (HIGH)
CWE: CWE-772
References: https://github.com/michaelrsweet/mxml/issues/286; https://github.com/michaelrsweet/mxml/issues/286
CVE: CVE-2021-42860
Published: 2022-05-26
Description: A stack buffer overflow exists in Mini-XML v3.2. When inputting an unformed XML string to the mxmlLoadString API, it will cause a stack-buffer-overflow in mxml_string_getc:2611. NOTE: it is unclear whether this input is allowed by the API specification
CVSS Score: 7.5 (HIGH)
CWE: CWE-772
References: https://github.com/michaelrsweet/mxml/issues/286; https://github.com/michaelrsweet/mxml/issues/286
CVE: CVE-2021-40317
Published: 2022-05-26
Description: Piwigo 11.5.0 is affected by a SQL injection vulnerability via admin.php and the id parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/Piwigo/Piwigo/issues/1470; https://github.com/Piwigo/Piwigo/issues/1470
CVE: CVE-2022-29720
Published: 2022-05-26
Description: 74cmsSE v3.5.1 was discovered to contain an arbitrary file read vulnerability via the component \index\controller\Download.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-552
References: https://github.com/PAINCLOWN/74cmsSE-Arbitrary-File-Reading/issues/1; https://github.com/PAINCLOWN/74cmsSE-Arbitrary-File-Reading/issues/1
CVE: CVE-2022-29721
Published: 2022-05-26
Description: 74cmsSE v3.5.1 was discovered to contain a SQL injection vulnerability via the keyword parameter at /home/jobfairol/resumelist.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://github.com/PAINCLOWN/74cmsSE-Arbitrary-File-Reading/issues/2; https://github.com/PAINCLOWN/74cmsSE-Arbitrary-File-Reading/issues/2
CVE: CVE-2021-34360
Published: 2022-05-26
Description: A cross-site request forgery (CSRF) vulnerability has been reported to affect QNAP device running Proxy Server. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of Proxy Server: QTS 4.5.x: Proxy Server 1.4.2 ( 2021/12/30 ) and later QuTS hero h5.0.0: Proxy Server 1.4.3 ( 2022/01/18 ) and later QuTScloud c4.5.6: Proxy Server 1.4.2 ( 2021/12/30 ) and later
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://www.qnap.com/en/security-advisory/qsa-22-18; https://www.qnap.com/en/security-advisory/qsa-22-18
CVE: CVE-2021-4231
Published: 2022-05-26
Description: A vulnerability was found in Angular up to 11.0.4/11.1.0-next.2. It has been classified as problematic. Affected is the handling of comments. The manipulation leads to cross site scripting. It is possible to launch the attack remotely but it might require an authentication first. Upgrading to version 11.0.5 and 11.1.0-next.3 is able to address this issue. The name of the patch is ba8da742e3b243e8f43d4c63aa842b44e14f2b09. It is recommended to upgrade the affected component.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-79
References: https://github.com/angular/angular/commit/ba8da742e3b243e8f43d4c63aa842b44e14f2b09; https://github.com/angular/angular/issues/40136; https://security.snyk.io/vuln/SNYK-JS-ANGULARCORE-1070902
CVE: CVE-2022-1664
Published: 2022-05-26
Description: Dpkg::Source::Archive in dpkg, the Debian package management system, before version 1.21.8, 1.20.10, 1.19.8, 1.18.26 is prone to a directory traversal vulnerability. When extracting untrusted source packages in v2 and v3 source package formats that include a debian.tar, the in-place extraction can lead to directory traversal situations on specially crafted orig.tar and debian.tar tarballs.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://git.dpkg.org/cgit/dpkg/dpkg.git/commit/?id=1f23dddc17f69c[PII_REDACTED]c7fb9936e15fa495; https://git.dpkg.org/cgit/dpkg/dpkg.git/commit/?id=58814cacee39c4ce9e2cd0e3a3b9b57ad437eff5; https://git.dpkg.org/cgit/dpkg/dpkg.git/commit/?id=7a6c03cb34d4a09f35df2f10779cbf1b70a5200b
CVE: CVE-2022-20809
Published: 2022-05-26
Description: Multiple vulnerabilities in the API and web-based management interfaces of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote attacker to write files or disclose sensitive information on an affected device. For more information about these vulnerabilities, see the Details section of this advisory.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-532, CWE-532
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-expressway-filewrite-bsFVwueV; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-expressway-filewrite-bsFVwueV
CVE: CVE-2022-20821
Published: 2022-05-26
Description: A vulnerability in the health check RPM of Cisco IOS XR Software could allow an unauthenticated, remote attacker to access the Redis instance that is running within the NOSi container. This vulnerability exists because the health check RPM opens TCP port 6379 by default upon activation. An attacker could exploit this vulnerability by connecting to the Redis instance on the open port. A successful exploit could allow the attacker to write to the Redis in-memory database, write arbitrary files to the container filesystem, and retrieve information about the Redis database. Given the configuration of the sandboxed container that the Redis instance runs in, a remote attacker would be unable to execute remote code or abuse the integrity of the Cisco IOS XR Software host system.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-redis-ABJyE5xK; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-redis-ABJyE5xK; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-20821
CVE: CVE-2022-29660
Published: 2022-05-26
Description: CSCMS Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the id parameter at /admin.php/pic/admin/pic/del.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/chshcms/cscms/issues/25#issue[PII_REDACTED]; https://github.com/chshcms/cscms/issues/25#issue[PII_REDACTED]
CVE: CVE-2022-29661
Published: 2022-05-26
Description: CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /admin.php/pic/admin/type/save.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/chshcms/cscms/issues/21#issue[PII_REDACTED]; https://github.com/chshcms/cscms/issues/21#issue[PII_REDACTED]
CVE: CVE-2022-29662
Published: 2022-05-26
Description: CSCMS Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the id parameter at /admin.php/news/admin/news/save.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/chshcms/cscms/issues/17#issue[PII_REDACTED]; https://github.com/chshcms/cscms/issues/17#issue[PII_REDACTED]
CVE: CVE-2022-29663
Published: 2022-05-26
Description: CSCMS Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the id parameter at /admin.php/pic/admin/type/hy.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/chshcms/cscms/issues/22#issue[PII_REDACTED]; https://github.com/chshcms/cscms/issues/22#issue[PII_REDACTED]
CVE: CVE-2022-29664
Published: 2022-05-26
Description: CSCMS Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the id parameter at /admin.php/pic/admin/type/pl_save.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/chshcms/cscms/issues/23#issue[PII_REDACTED]; https://github.com/chshcms/cscms/issues/23#issue[PII_REDACTED]
CVE: CVE-2022-29665
Published: 2022-05-26
Description: CSCMS Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the id parameter at /admin.php/news/admin/topic/save.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/chshcms/cscms/issues/19#issue[PII_REDACTED]; https://github.com/chshcms/cscms/issues/19#issue[PII_REDACTED]
CVE: CVE-2022-29666
Published: 2022-05-26
Description: CSCMS Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the id parameter at /admin.php/pic/admin/lists/zhuan.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/chshcms/cscms/issues/24#issue[PII_REDACTED]; https://github.com/chshcms/cscms/issues/24#issue[PII_REDACTED]
CVE: CVE-2022-29667
Published: 2022-05-26
Description: CSCMS Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via /admin.php/pic/admin/pic/hy. This vulnerability is exploited via restoring deleted photos.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/chshcms/cscms/issues/26#issue[PII_REDACTED]; https://github.com/chshcms/cscms/issues/26#issue[PII_REDACTED]
CVE: CVE-2022-29669
Published: 2022-05-26
Description: CSCMS Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the id parameter at /admin.php/news/admin/lists/zhuan.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/chshcms/cscms/issues/20#issue[PII_REDACTED]; https://github.com/chshcms/cscms/issues/20#issue[PII_REDACTED]
CVE: CVE-2022-29670
Published: 2022-05-26
Description: CSCMS Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the id parameter at /admin.php/pic/admin/type/del.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/chshcms/cscms/issues/21#issue[PII_REDACTED]; https://github.com/chshcms/cscms/issues/21#issue[PII_REDACTED]
CVE: CVE-2022-29676
Published: 2022-05-26
Description: CSCMS Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the id parameter at /admin.php/pic/admin/lists/zhuan.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/chshcms/cscms/issues/24#issue[PII_REDACTED]; https://github.com/chshcms/cscms/issues/24#issue[PII_REDACTED]
CVE: CVE-2022-29680
Published: 2022-05-26
Description: CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /admin.php/user/zu_del.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/chshcms/cscms/issues/31#issue[PII_REDACTED]; https://github.com/chshcms/cscms/issues/31#issue[PII_REDACTED]
CVE: CVE-2022-29681
Published: 2022-05-26
Description: CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /admin.php/Links/del.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/chshcms/cscms/issues/35#issue[PII_REDACTED]; https://github.com/chshcms/cscms/issues/35#issue[PII_REDACTED]
CVE: CVE-2022-29682
Published: 2022-05-26
Description: CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /admin.php/vod/admin/topic/del.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/chshcms/cscms/issues/36#issue[PII_REDACTED]; https://github.com/chshcms/cscms/issues/36#issue[PII_REDACTED]
CVE: CVE-2022-29683
Published: 2022-05-26
Description: CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /admin.php/Label/page_del.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/chshcms/cscms/issues/34#issue[PII_REDACTED]; https://github.com/chshcms/cscms/issues/34#issue[PII_REDACTED]
CVE: CVE-2022-29684
Published: 2022-05-26
Description: CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /admin.php/Label/js_del.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/chshcms/cscms/issues/33#issue[PII_REDACTED]; https://github.com/chshcms/cscms/issues/33#issue[PII_REDACTED]
CVE: CVE-2022-29685
Published: 2022-05-26
Description: CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /admin.php/User/level_sort.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/chshcms/cscms/issues/32#issue[PII_REDACTED]; https://github.com/chshcms/cscms/issues/32#issue[PII_REDACTED]
CVE: CVE-2022-29686
Published: 2022-05-26
Description: CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /admin.php/singer/admin/lists/zhuan.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/chshcms/cscms/issues/29#issue[PII_REDACTED]; https://github.com/chshcms/cscms/issues/29#issue[PII_REDACTED]
CVE: CVE-2022-29687
Published: 2022-05-26
Description: CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /admin.php/user/level_del.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/chshcms/cscms/issues/30#issue[PII_REDACTED]; https://github.com/chshcms/cscms/issues/30#issue[PII_REDACTED]
CVE: CVE-2022-29688
Published: 2022-05-26
Description: CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /admin.php/singer/admin/singer/hy.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/chshcms/cscms/issues/27#issue[PII_REDACTED]; https://github.com/chshcms/cscms/issues/27#issue[PII_REDACTED]
CVE: CVE-2022-29689
Published: 2022-05-26
Description: CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /admin.php/singer/admin/singer/del.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/chshcms/cscms/issues/28#issue[PII_REDACTED]; https://github.com/chshcms/cscms/issues/28#issue[PII_REDACTED]
CVE: CVE-2022-1886
Published: 2022-05-26
Description: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: https://github.com/vim/vim/commit/2a585c85013be22f59f184d49612074fd9b115d7; https://huntr.dev/bounties/fa0ad526-b608-45b3-9ebc-f2b607834d6a; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TYNK6SDCMOLQJOI3B4AOE66P2G2IH4ZM/
CVE: CVE-2022-24414
Published: 2022-05-26
Description: Dell EMC CloudLink 7.1.3 and all earlier versions, Auth Token is exposed in GET requests. These request parameters can get logged in reverse proxies and server logs. Attackers may potentially use these tokens to access CloudLink server. Tokens should not be used in request URL to avoid such attacks.
CVSS Score: 7.6 (HIGH)
CWE: CWE-598, CWE-200
References: https://www.dell.com/support/kbdoc/en-us/000197425/dsa-2022-064-dell-emc-cloudlink-security-update-for-security-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000197425/dsa-2022-064-dell-emc-cloudlink-security-update-for-security-vulnerabilities
CVE: CVE-2022-24417
Published: 2022-05-26
Description: Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution during SMM.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-20
References: https://www.dell.com/support/kbdoc/en-us/000199285/dsa-2022-095; https://www.dell.com/support/kbdoc/en-us/000199285/dsa-2022-095
CVE: CVE-2022-24418
Published: 2022-05-26
Description: Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution during SMM.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-20
References: https://www.dell.com/support/kbdoc/en-us/000199285/dsa-2022-095; https://www.dell.com/support/kbdoc/en-us/000199285/dsa-2022-095
CVE: CVE-2022-24422
Published: 2022-05-26
Description: Dell iDRAC9 versions 5.00.00.00 and later but prior to 5.10.10.00, contain an improper authentication vulnerability. A remote unauthenticated attacker may potentially exploit this vulnerability to gain access to the VNC Console.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-287, CWE-287
References: https://www.dell.com/support/kbdoc/en-us/000199267/dsa-2022-068-dell-idrac9-security-update-for-an-improper-authentication-vulnerability; https://www.dell.com/support/kbdoc/en-us/000199267/dsa-2022-068-dell-idrac9-security-update-for-an-improper-authentication-vulnerability
CVE: CVE-2022-26857
Published: 2022-05-26
Description: Dell OpenManage Enterprise Versions 3.8.3 and prior contain an improper authorization vulnerability. A remote authenticated malicious user with low privileges may potentially exploit this vulnerability to bypass blocked functionalities and perform unauthorized actions.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-285
References: https://www.dell.com/support/kbdoc/en-us/000197800/dsa-2022-077; https://www.dell.com/support/kbdoc/en-us/000197800/dsa-2022-077
CVE: CVE-2022-26865
Published: 2022-05-26
Description: Dell Support Assist OS Recovery versions before 5.5.2 contain an Authentication Bypass vulnerability. An unauthenticated attacker with physical access to the system may exploit this vulnerability by bypassing OS Recovery authentication in order to run arbitrary code on the system as Administrator.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-288, CWE-287
References: https://www.dell.com/support/kbdoc/en-us/000198780/dsa-2022-102; https://www.dell.com/support/kbdoc/en-us/000198780/dsa-2022-102
CVE: CVE-2022-29082
Published: 2022-05-26
Description: Dell EMC NetWorker versions 19.1.x, 19.1.0.x, 19.1.1.x, 19.2.x, 19.2.0.x, 19.2.1.x 19.3.x, 19.3.0.x, 19.4.x, 19.4.0.x, 19.5.x,19.5.0.x, 19.6 and 19.6.0.1 and 19.6.0.2 contain an Improper Validation of Certificate with Host Mismatch vulnerability in Rabbitmq port 5671 which could allow remote attackers to spoof certificates.
CVSS Score: 3.7 (LOW)
CWE: CWE-297, CWE-295
References: https://www.dell.com/support/kbdoc/000198987; https://www.dell.com/support/kbdoc/000198987
CVE: CVE-2022-29091
Published: 2022-05-26
Description: Dell Unity, Dell UnityVSA, and Dell UnityXT versions prior to 5.2.0.0.5.173 contain a Reflected Cross-Site Scripting Vulnerability in Unisphere GUI. An Unauthenticated Remote Attacker could potentially exploit this vulnerability, leading to the execution of malicious HTML or JavaScript code in a victim user's web browser in the context of the vulnerable web application. Exploitation may lead to information disclosure, session theft, or client-side request forgery.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.dell.com/support/kbdoc/000199446; https://www.dell.com/support/kbdoc/000199446
CVE: CVE-2022-30472
Published: 2022-05-26
Description: Tenda AC Seris Router AC18_V15.03.05.19(6318) has a stack-based buffer overflow vulnerability in function fromAddressNat
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/lcyfrank/VulnRepo/tree/master/IoT/Tenda/1; https://github.com/lcyfrank/VulnRepo/tree/master/IoT/Tenda/1
CVE: CVE-2022-30473
Published: 2022-05-26
Description: Tenda AC Series Router AC18_V15.03.05.19(6318) has a stack-based buffer overflow vulnerability in function form_fast_setting_wifi_set
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://github.com/lcyfrank/VulnRepo/tree/master/IoT/Tenda/2; https://github.com/lcyfrank/VulnRepo/tree/master/IoT/Tenda/2
CVE: CVE-2022-30474
Published: 2022-05-26
Description: Tenda AC Series Router AC18_V15.03.05.19(6318) was discovered to contain a heap overflow in the httpd module when handling /goform/saveParentControlInfo request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/lcyfrank/VulnRepo/tree/master/IoT/Tenda/5; https://github.com/lcyfrank/VulnRepo/tree/master/IoT/Tenda/5
CVE: CVE-2022-30475
Published: 2022-05-26
Description: Tenda AC Series Router AC18_V15.03.05.19(6318) was discovered to contain a stack-based buffer overflow in the httpd module when handling /goform/WifiExtraSet request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://github.com/lcyfrank/VulnRepo/tree/master/IoT/Tenda/3; https://github.com/lcyfrank/VulnRepo/tree/master/IoT/Tenda/3
CVE: CVE-2022-30476
Published: 2022-05-26
Description: Tenda AC Series Router AC18_V15.03.05.19(6318) was discovered to contain a stack-based buffer overflow in the httpd module when handling /goform/SetFirewallCfg request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/lcyfrank/VulnRepo/tree/master/IoT/Tenda/6; https://github.com/lcyfrank/VulnRepo/tree/master/IoT/Tenda/6
CVE: CVE-2022-30477
Published: 2022-05-26
Description: Tenda AC Series Router AC18_V15.03.05.19(6318) was discovered to contain a stack-based buffer overflow in the httpd module when handling /goform/SetClientState request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/lcyfrank/VulnRepo/tree/master/IoT/Tenda/4; https://github.com/lcyfrank/VulnRepo/tree/master/IoT/Tenda/4
CVE: CVE-2022-30500
Published: 2022-05-26
Description: Jfinal cms 5.1.0 is vulnerable to SQL Injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/jflyfox/jfinal_cms/issues/35; https://github.com/jflyfox/jfinal_cms/issues/35
CVE: CVE-2022-30783
Published: 2022-05-26
Description: An invalid return code in fuse_kern_mount enables intercepting of libfuse-lite protocol traffic between NTFS-3G and the kernel in NTFS-3G through 2021.8.22 when using libfuse-lite.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-252
References: http://www.openwall.com/lists/oss-security/2022/06/07/4; https://github.com/tuxera/ntfs-3g/releases; https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-6mv4-4v73-xw58
CVE: CVE-2022-30784
Published: 2022-05-26
Description: A crafted NTFS image can cause heap exhaustion in ntfs_get_attribute_value in NTFS-3G through 2021.8.22.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120, CWE-20
References: https://github.com/tuxera/ntfs-3g/releases; https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-xchm-ph5h-hw4x; https://lists.debian.org/debian-lts-announce/2022/06/msg00017.html
CVE: CVE-2022-30785
Published: 2022-05-26
Description: A file handle created in fuse_lib_opendir, and later used in fuse_lib_readdir, enables arbitrary memory read and write operations in NTFS-3G through 2021.8.22 when using libfuse-lite.
CVSS Score: 6.7 (MEDIUM)
References: http://www.openwall.com/lists/oss-security/2022/06/07/4; https://github.com/tuxera/ntfs-3g/releases; https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-6mv4-4v73-xw58
CVE: CVE-2022-30786
Published: 2022-05-26
Description: A crafted NTFS image can cause a heap-based buffer overflow in ntfs_names_full_collate in NTFS-3G through 2021.8.22.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-20
References: https://github.com/tuxera/ntfs-3g/releases; https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-xchm-ph5h-hw4x; https://lists.debian.org/debian-lts-announce/2022/06/msg00017.html
CVE: CVE-2022-30787
Published: 2022-05-26
Description: An integer underflow in fuse_lib_readdir enables arbitrary memory read operations in NTFS-3G through 2021.8.22 when using libfuse-lite.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-191
References: http://www.openwall.com/lists/oss-security/2022/06/07/4; https://github.com/tuxera/ntfs-3g/releases; https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-6mv4-4v73-xw58