deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-27870
Published: 2022-06-21
Description: A maliciously crafted TGA file in Autodesk AutoCAD 2023 may be used to write beyond the allocated buffer while parsing TGA file. This vulnerability may be exploited to execute arbitrary code.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0004; https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0004
CVE: CVE-2022-27871
Published: 2022-06-21
Description: Autodesk AutoCAD product suite, Revit, Design Review and Navisworks releases using PDFTron prior to 9.1.17 version may be used to write beyond the allocated buffer while parsing PDF files. This vulnerability may be exploited to execute arbitrary code.
CVSS Score: 7.8 (HIGH)
CWE: CWE-770
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0011; https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0011
CVE: CVE-2022-27872
Published: 2022-06-21
Description: A maliciously crafted PDF file may be used to dereference a pointer for read or write operation while parsing PDF files in Autodesk Navisworks 2022. The vulnerability exists because the application fails to handle a crafted PDF file, which causes an unhandled exception. An attacker can leverage this vulnerability to cause a crash or read sensitive data or execute arbitrary code.
CVSS Score: 7.8 (HIGH)
CWE: CWE-755
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0011; https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0011
CVE: CVE-2022-2068
Published: 2022-06-21
Description: In addition to the c_rehash shell command injection identified in CVE-2022-1292, further circumstances where the c_rehash script does not properly sanitise shell metacharacters to prevent command injection were found by code review. When the CVE-2022-1292 was fixed it was not discovered that there are other places in the script where the file names of certificates being hashed were possibly passed to a command executed through the shell. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script. Use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command line tool. Fixed in OpenSSL 3.0.4 (Affected 3.0.0,3.0.1,3.0.2,3.0.3). Fixed in OpenSSL 1.1.1p (Affected 1.1.1-1.1.1o). Fixed in OpenSSL 1.0.2zf (Affected 1.0.2-1.0.2ze).
CVSS Score: 7.3 (HIGH)
CWE: CWE-78, CWE-78
References: https://cert-portal.siemens.com/productcert/pdf/ssa-332410.pdf; https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=2c9c35870601b4a44d86ddbf512b38df38285cfa; https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=7a9c027159fe9e1bbc2cd38a8a2914bff0d5abd9
CVE: CVE-2022-30874
Published: 2022-06-21
Description: There is a Cross Site Scripting Stored (XSS) vulnerability in NukeViet CMS before 4.5.02.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://blog.stmcyber.com/vulns/cve-2022-30874/; https://github.com/nukeviet/nukeviet; https://whitehub.net/submissions/2968
CVE: CVE-2022-31786
Published: 2022-06-21
Description: IdeaLMS 2022 allows reflected Cross Site Scripting (XSS) via the IdeaLMS/Class/Assessment/ PATH_INFO.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/RNPG/e10524f1781a9981b50fb27bb473b0fe; https://gist.github.com/RNPG/e10524f1781a9981b50fb27bb473b0fe
CVE: CVE-2022-32973
Published: 2022-06-21
Description: An authenticated attacker could create an audit file that bypasses PowerShell cmdlet checks and executes commands with administrator privileges.
CVSS Score: 8.8 (HIGH)
References: https://www.tenable.com/security/tns-2022-11; https://www.tenable.com/security/tns-2022-11
CVE: CVE-2022-32974
Published: 2022-06-21
Description: An authenticated attacker could read arbitrary files from the underlying operating system of the scanner using a custom crafted compliance audit file without providing any valid SSH credentials.
CVSS Score: 6.5 (MEDIUM)
References: https://www.tenable.com/security/tns-2022-11; https://www.tenable.com/security/tns-2022-11
CVE: CVE-2022-33995
Published: 2022-06-21
Description: A path traversal issue in entry attachments in Devolutions Remote Desktop Manager before 2022.2 allows attackers to create or overwrite files in an arbitrary location.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://devolutions.net; https://devolutions.net
CVE: CVE-2022-34008
Published: 2022-06-21
Description: Comodo Antivirus 12.2.2.8012 has a quarantine flaw that allows privilege escalation. To escalate privilege, a low-privileged attacker can use an NTFS directory junction to restore a malicious DLL from quarantine into the System32 folder.
CVSS Score: 7.8 (HIGH)
CWE: CWE-59
References: https://antivirus.comodo.com/; https://r0h1rr1m.medium.com/comodo-antivirus-local-privilege-escalation-through-insecure-file-move-476a4601d9b8; https://antivirus.comodo.com/
CVE: CVE-2021-39006
Published: 2022-06-21
Description: IBM QRadar WinCollect Agent 10.0 and 10.0.1 could allow an attacker to obtain sensitive information due to missing best practices. IBM X-Force ID: 213549.
CVSS Score: 5.3 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/213549; https://www.ibm.com/support/pages/node/6596947; https://exchange.xforce.ibmcloud.com/vulnerabilities/213549
CVE: CVE-2021-36761
Published: 2022-06-21
Description: The GeoAnalytics feature in Qlik Sense April 2020 patch 4 allows SSRF.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-918
References: https://www.cyberiskvision.com/advisory/; https://www.cyberiskvision.com/advisory/
CVE: CVE-2021-40510
Published: 2022-06-21
Description: XML eXternal Entity (XXE) in OBDA systems’ Mastro 1.0 allows remote attackers to read system files via custom DTDs.
CVSS Score: 7.5 (HIGH)
CWE: CWE-611
References: https://www.cyberiskvision.com/advisory/; https://www.obdasystems.com/mastro; https://www.cyberiskvision.com/advisory/
CVE: CVE-2021-40511
Published: 2022-06-21
Description: OBDA systems’ Mastro 1.0 is vulnerable to XML Entity Expansion (aka “billion laughs”) attack allowing denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-776
References: https://www.cyberiskvision.com/advisory/; https://www.obdasystems.com/mastro; https://www.cyberiskvision.com/advisory/
CVE: CVE-2022-31095
Published: 2022-06-21
Description: discourse-chat is a chat plugin for the Discourse application. Versions prior to 0.4 are vulnerable to an exposure of sensitive information, where an attacker who knows the message ID for a channel they do not have access to can view that message using the chat message lookup endpoint, primarily affecting direct message channels. There are no known workarounds for this issue, and users are advised to update the plugin.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200, CWE-862
References: https://github.com/discourse/discourse-chat/security/advisories/GHSA-r979-jhp2-3f6h; https://github.com/discourse/discourse-chat/security/advisories/GHSA-r979-jhp2-3f6h
CVE: CVE-2017-20082
Published: 2022-06-22
Description: A vulnerability, which was classified as problematic, has been found in JUNG Smart Visu Server 1.0.804/1.0.830/1.0.832. This issue affects some unknown processing. The manipulation leads to backdoor. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. Upgrading to version 1.0.900 is able to address this issue. It is recommended to upgrade the affected component.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-912
References: http://seclists.org/fulldisclosure/2017/Feb/18; https://vuldb.com/?id.96815; http://seclists.org/fulldisclosure/2017/Feb/18
CVE: CVE-2017-20083
Published: 2022-06-22
Description: A vulnerability, which was classified as critical, was found in JUNG Smart Visu Server 1.0.804/1.0.830/1.0.832. Affected is an unknown function of the component SSH Server. The manipulation leads to backdoor. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. Upgrading to version 1.0.900 is able to address this issue. It is recommended to upgrade the affected component.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-912
References: http://seclists.org/fulldisclosure/2017/Feb/18; https://vuldb.com/?id.96816; http://seclists.org/fulldisclosure/2017/Feb/18
CVE: CVE-2017-20084
Published: 2022-06-22
Description: A vulnerability has been found in JUNG Smart Visu Server 1.0.804/1.0.830/1.0.832 and classified as critical. Affected by this vulnerability is an unknown functionality of the component KNX Group Address. The manipulation leads to backdoor. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. Upgrading to version 1.0.900 is able to address this issue. It is recommended to upgrade the affected component.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-912
References: http://seclists.org/fulldisclosure/2017/Feb/18; https://vuldb.com/?id.96817; http://seclists.org/fulldisclosure/2017/Feb/18
CVE: CVE-2022-23056
Published: 2022-06-22
Description: In ERPNext, versions v13.0.0-beta.13 through v13.30.0 are vulnerable to Stored XSS at the Patient History page which allows a low privilege user to conduct an account takeover attack.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/frappe/erpnext/blob/21a3ea462aaf319e466c067c2ec406eb9abe6ed3/erpnext/healthcare/page/patient_history/patient_history.js#L288; https://www.mend.io/vulnerability-database/CVE-2022-23056; https://github.com/frappe/erpnext/blob/21a3ea462aaf319e466c067c2ec406eb9abe6ed3/erpnext/healthcare/page/patient_history/patient_history.js#L288
CVE: CVE-2022-23057
Published: 2022-06-22
Description: In ERPNext, versions v12.0.9--v13.0.3 are vulnerable to Stored Cross-Site-Scripting (XSS), due to user input not being validated properly. A low privileged attacker could inject arbitrary code into input fields when editing his profile.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/frappe/frappe/commit/497ea861f481c6a3c52fe2aed9d0df1b6c99e9d7; https://www.mend.io/vulnerability-database/CVE-2022-23057; https://github.com/frappe/frappe/commit/497ea861f481c6a3c52fe2aed9d0df1b6c99e9d7
CVE: CVE-2022-23058
Published: 2022-06-22
Description: ERPNext in versions v12.0.9-v13.0.3 are affected by a stored XSS vulnerability that allows low privileged users to store malicious scripts in the ‘username’ field in ‘my settings’ which can lead to full account takeover.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/frappe/frappe/commit/497ea861f481c6a3c52fe2aed9d0df1b6c99e9d7; https://www.mend.io/vulnerability-database/CVE-2022-23058; https://github.com/frappe/frappe/commit/497ea861f481c6a3c52fe2aed9d0df1b6c99e9d7
CVE: CVE-2022-23055
Published: 2022-06-22
Description: In ERPNext, versions v11.0.0-beta through v13.0.2 are vulnerable to Missing Authorization, in the chat rooms functionality. A low privileged attacker can send a direct message or a group message to any member or group, impersonating themselves as the administrator. The attacker can also read chat messages of groups that they do not belong to, and of other users.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-862
References: https://github.com/frappe/frappe/blob/v13.0.2/frappe/chat/doctype/chat_message/chat_message.py#L134; https://github.com/frappe/frappe/blob/v13.0.2/frappe/chat/doctype/chat_message/chat_message.py#L155; https://www.mend.io/vulnerability-database/CVE-2022-23055
CVE: CVE-2022-21952
Published: 2022-06-22
Description: A Missing Authentication for Critical Function vulnerability in spacewalk-java of SUSE Manager Server 4.1, SUSE Manager Server 4.2 allows remote attackers to easily exhaust available disk resources leading to DoS. This issue affects: SUSE Manager Server 4.1 spacewalk-java versions prior to 4.1.46. SUSE Manager Server 4.2 spacewalk-java versions prior to 4.2.37.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306, CWE-306, CWE-770
References: https://bugzilla.suse.com/show_bug.cgi?id=1199512; https://bugzilla.suse.com/show_bug.cgi?id=1199512
CVE: CVE-2022-31248
Published: 2022-06-22
Description: A Observable Response Discrepancy vulnerability in spacewalk-java of SUSE Manager Server 4.1, SUSE Manager Server 4.2 allows remote attackers to discover valid usernames. This issue affects: SUSE Manager Server 4.1 spacewalk-java versions prior to 4.1.46-1. SUSE Manager Server 4.2 spacewalk-java versions prior to 4.2.37-1.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-204
References: https://bugzilla.suse.com/show_bug.cgi?id=1199629; https://bugzilla.suse.com/show_bug.cgi?id=1199629
CVE: CVE-2022-23077
Published: 2022-06-22
Description: In habitica versions v4.119.0 through v4.232.2 are vulnerable to DOM XSS via the login page.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/HabitRPG/habitica/commit/5bcfdbe066e8c899f3ecf3fdcdbacc2ecba7f02f; https://www.mend.io/vulnerability-database/CVE-2022-23077; https://github.com/HabitRPG/habitica/commit/5bcfdbe066e8c899f3ecf3fdcdbacc2ecba7f02f
CVE: CVE-2022-23078
Published: 2022-06-22
Description: In habitica versions v4.119.0 through v4.232.2 are vulnerable to open redirect via the login page.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-601
References: https://github.com/HabitRPG/habitica/commit/5bcfdbe066e8c899f3ecf3fdcdbacc2ecba7f02f; https://www.mend.io/vulnerability-database/CVE-2022-23078; https://github.com/HabitRPG/habitica/commit/5bcfdbe066e8c899f3ecf3fdcdbacc2ecba7f02f
CVE: CVE-2022-2174
Published: 2022-06-22
Description: Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 1.2.18.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/microweber/microweber/commit/c51285f791e48e536111cd57a9544ccbf7f33961; https://huntr.dev/bounties/ac68e3fc-8cf1-4a62-90ee-95c4b2bad607; https://github.com/microweber/microweber/commit/c51285f791e48e536111cd57a9544ccbf7f33961
CVE: CVE-2022-23079
Published: 2022-06-22
Description: In motor-admin versions 0.0.1 through 0.2.56 are vulnerable to host header injection in the password reset functionality where malicious actor can send fake password reset email to arbitrary victim.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-116
References: https://github.com/motor-admin/motor-admin/commit/a461b7507940a1fa062836daa89c82404fe3ecf9; https://www.mend.io/vulnerability-database/CVE-2022-23079; https://github.com/motor-admin/motor-admin/commit/a461b7507940a1fa062836daa89c82404fe3ecf9
CVE: CVE-2022-20651
Published: 2022-06-22
Description: A vulnerability in the logging component of Cisco Adaptive Security Device Manager (ASDM) could allow an authenticated, local attacker to view sensitive information in clear text on an affected system. Cisco ADSM must be deployed in a shared workstation environment for this issue to be exploited. This vulnerability is due to the storage of unencrypted credentials in certain logs. An attacker could exploit this vulnerability by accessing the logs on an affected system. A successful exploit could allow the attacker to view the credentials of other users of the shared device.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-532, CWE-532
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asdm-logging-jnLOY422; https://www.rapid7.com/blog/post/2022/08/11/rapid7-discovered-vulnerabilities-in-cisco-asa-asdm-and-firepower-services-software/; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asdm-logging-jnLOY422
CVE: CVE-2022-32549
Published: 2022-06-22
Description: Apache Sling Commons Log <= 5.4.0 and Apache Sling API <= 2.25.0 are vulnerable to log injection. The ability to forge logs may allow an attacker to cover tracks by injecting fake logs and potentially corrupt log files.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-117, CWE-116
References: https://lists.apache.org/thread/7z6h3806mwcov5kx6l96pq839sn0po1v; https://lists.apache.org/thread/7z6h3806mwcov5kx6l96pq839sn0po1v
CVE: CVE-2022-23080
Published: 2022-06-22
Description: In directus versions v9.0.0-beta.2 through 9.6.0 are vulnerable to server-side request forgery (SSRF) in the media upload functionality which allows a low privileged user to perform internal network port scans.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-918
References: https://github.com/directus/directus/commit/6da3f1ed5034115b1da[PII_REDACTED]1bf0d808d83; https://www.mend.io/vulnerability-database/CVE-2022-23080; https://github.com/directus/directus/commit/6da3f1ed5034115b1da[PII_REDACTED]1bf0d808d83
CVE: CVE-2022-23081
Published: 2022-06-22
Description: In openlibrary versions deploy-2016-07-0 through deploy-2021-12-22 are vulnerable to Reflected XSS.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://github.com/internetarchive/openlibrary/pull/6597/commits/5460c8e8b517ef83c6a3b33654ba43ef0cbf051e; https://www.mend.io/vulnerability-database/CVE-2022-23081; https://github.com/internetarchive/openlibrary/pull/6597/commits/5460c8e8b517ef83c6a3b33654ba43ef0cbf051e
CVE: CVE-2022-32159
Published: 2022-06-22
Description: In openlibrary versions deploy-2016-07-0 through deploy-2021-12-22 are vulnerable to Stored XSS.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/internetarchive/infogami/pull/195/commits/ccc2141c5fb093870c9e2742c01336ecca8cd12e; https://www.mend.io/vulnerability-database/CVE-2022-32159; https://github.com/internetarchive/infogami/pull/195/commits/ccc2141c5fb093870c9e2742c01336ecca8cd12e
CVE: CVE-2017-20085
Published: 2022-06-23
Description: A vulnerability has been found in Atahualpa Theme and classified as problematic. Affected by this vulnerability is an unknown functionality. The manipulation leads to basic cross site scripting. The attack can be launched remotely.
CVSS Score: 3.5 (LOW)
CWE: CWE-80, CWE-79
References: http://seclists.org/fulldisclosure/2017/Feb/83; https://vuldb.com/?id.97375; http://seclists.org/fulldisclosure/2017/Feb/83
CVE: CVE-2017-20086
Published: 2022-06-23
Description: A vulnerability, which was classified as critical, was found in VaultPress Plugin 1.8.4. This affects an unknown part. The manipulation leads to code injection. It is possible to initiate the attack remotely.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-94, CWE-94
References: http://seclists.org/fulldisclosure/2017/Feb/95; https://vuldb.com/?id.97383; http://seclists.org/fulldisclosure/2017/Feb/95
CVE: CVE-2017-20087
Published: 2022-06-23
Description: A vulnerability, which was classified as problematic, has been found in Alpine PhotoTile for Instagram Plugin 1.2.7.7. Affected by this issue is some unknown functionality. The manipulation leads to basic cross site scripting. The attack may be launched remotely.
CVSS Score: 3.5 (LOW)
CWE: CWE-80, CWE-79
References: http://seclists.org/fulldisclosure/2017/Feb/94; https://vuldb.com/?id.97382; http://seclists.org/fulldisclosure/2017/Feb/94
CVE: CVE-2017-20088
Published: 2022-06-23
Description: A vulnerability classified as problematic has been found in Atahualpa Theme. Affected is an unknown function. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotely.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-352
References: http://seclists.org/fulldisclosure/2017/Feb/90; https://vuldb.com/?id.97380; http://seclists.org/fulldisclosure/2017/Feb/90
CVE: CVE-2017-20089
Published: 2022-06-23
Description: A vulnerability was found in Gwolle Guestbook Plugin 1.7.4. It has been rated as problematic. This issue affects some unknown processing. The manipulation leads to basic cross site scripting. The attack may be initiated remotely.
CVSS Score: 3.5 (LOW)
CWE: CWE-80, CWE-79
References: http://seclists.org/bugtraq/2017/Mar/1; https://vuldb.com/?id.97379; http://seclists.org/bugtraq/2017/Mar/1
CVE: CVE-2017-20090
Published: 2022-06-23
Description: A vulnerability was found in Global Content Blocks Plugin 2.1.5. It has been declared as problematic. This vulnerability affects unknown code. The manipulation leads to cross-site request forgery. The attack can be initiated remotely.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-352
References: http://seclists.org/bugtraq/2017/Mar/0; https://vuldb.com/?id.97378; http://seclists.org/bugtraq/2017/Mar/0
CVE: CVE-2017-20091
Published: 2022-06-23
Description: A vulnerability was found in File Manager Plugin 3.0.1. It has been classified as problematic. This affects an unknown part. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-352
References: http://seclists.org/bugtraq/2017/Feb/57; https://vuldb.com/?id.97377; http://seclists.org/bugtraq/2017/Feb/57
CVE: CVE-2022-31009
Published: 2022-06-23
Description: wire-ios is an iOS client for the Wire secure messaging application. Invalid accent colors of Wire communication partners may render the iOS Wire Client partially unusable by causing it to crash multiple times on launch. These invalid accent colors can be used by and sent between Wire users. The root cause was an unnecessary assert statement when converting an integer value into the corresponding enum value, causing an exception instead of a fallback to a default value. This issue is fixed in [wire-ios](https://github.com/wireapp/wire-ios/commit/caa0e27dbe51f9edfda8c7a9f017d93b8cfddefb) and in Wire for iOS 3.100. There is no workaround available, but users may use other Wire clients (such as the [web app](https://app.wire.com)) to continue using Wire, or upgrade their client.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-617
References: https://github.com/wireapp/wire-ios/commit/caa0e27dbe51f9edfda8c7a9f017d93b8cfddefb; https://github.com/wireapp/wire-ios/security/advisories/GHSA-83m6-p7x5-925j; https://github.com/wireapp/wire-ios/commit/caa0e27dbe51f9edfda8c7a9f017d93b8cfddefb
CVE: CVE-2022-34305
Published: 2022-06-23
Description: In Apache Tomcat 10.1.0-M1 to 10.1.0-M16, 10.0.0-M1 to 10.0.22, 9.0.30 to 9.0.64 and 8.5.50 to 8.5.81 the Form authentication example in the examples web application displayed user provided data without filtering, exposing a XSS vulnerability.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://www.openwall.com/lists/oss-security/2022/06/23/1; https://lists.apache.org/thread/k04zk0nq6w57m72w5gb0r6z9ryhmvr4k; https://security.gentoo.org/glsa/202208-34
CVE: CVE-2022-2175
Published: 2022-06-23
Description: Buffer Over-read in GitHub repository vim/vim prior to 8.2.
CVSS Score: 7.8 (HIGH)
CWE: CWE-126, CWE-125
References: https://github.com/vim/vim/commit/6046aded8da002b08d380db29de2ba0268b6616e; https://huntr.dev/bounties/7f0481c2-8b57-4324-b47c-795d1ea67e55; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GFD2A4YLBR7OIRHTL7CK6YNMEIQ264CN/
CVE: CVE-2021-26636
Published: 2022-06-23
Description: Stored XSS and SQL injection vulnerability in MaxBoard could lead to occur Remote Code Execution, which could lead to information exposure and privilege escalation.
CVSS Score: 8.8 (HIGH)
CWE: CWE-79, CWE-89, CWE-79, CWE-89
References: https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=66781; https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=66781
CVE: CVE-2021-26637
Published: 2022-06-23
Description: There is no account authentication and permission check logic in the firmware and existing apps of SiHAS's SGW-300, ACM-300, GCM-300, so unauthorized users can remotely control the device.
CVSS Score: 8.8 (HIGH)
CWE: CWE-287, CWE-306, CWE-862
References: https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=66782; https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=66782
CVE: CVE-2021-26638
Published: 2022-06-23
Description: Improper Authentication vulnerability in S&D smarthome(smartcare) application can cause authentication bypass and information exposure. Remote attackers can use this vulerability to take control of the home environment including indoor control.
CVSS Score: 7.3 (HIGH)
CWE: CWE-287, CWE-287
References: https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=66783; https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=66783