deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-25433
Published: 2022-03-18
Description: Tenda AC9 v15.03.2.21 was discovered to contain a stack overflow via the urls parameter in the saveparentcontrolinfo function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/EPhaha/IOT_vuln/tree/main/Tenda/AC9/5; https://github.com/EPhaha/IOT_vuln/tree/main/Tenda/AC9/5
CVE: CVE-2022-25434
Published: 2022-03-18
Description: Tenda AC9 v15.03.2.21 was discovered to contain a stack overflow via the firewallen parameter in the SetFirewallCfg function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/EPhaha/IOT_vuln/tree/main/Tenda/AC9/6; https://github.com/EPhaha/IOT_vuln/tree/main/Tenda/AC9/6
CVE: CVE-2022-25435
Published: 2022-03-18
Description: Tenda AC9 v15.03.2.21 was discovered to contain a stack overflow via the list parameter in the SetStaticRoutecfg function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/EPhaha/IOT_vuln/tree/main/Tenda/AC9/7; https://github.com/EPhaha/IOT_vuln/tree/main/Tenda/AC9/7
CVE: CVE-2022-25437
Published: 2022-03-18
Description: Tenda AC9 v15.03.2.21 was discovered to contain a stack overflow via the list parameter in the SetVirtualServerCfg function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/EPhaha/IOT_vuln/tree/main/Tenda/AC9/9; https://github.com/EPhaha/IOT_vuln/tree/main/Tenda/AC9/9
CVE: CVE-2022-25438
Published: 2022-03-18
Description: Tenda AC9 v15.03.2.21 was discovered to contain a remote command execution (RCE) vulnerability via the SetIPTVCfg function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/EPhaha/IOT_vuln/tree/main/Tenda/AC9/11; https://github.com/EPhaha/IOT_vuln/tree/main/Tenda/AC9/11
CVE: CVE-2022-25439
Published: 2022-03-18
Description: Tenda AC9 v15.03.2.21 was discovered to contain a stack overflow via the list parameter in the SetIpMacBind function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/EPhaha/IOT_vuln/tree/main/Tenda/AC9/8; https://github.com/EPhaha/IOT_vuln/tree/main/Tenda/AC9/8
CVE: CVE-2022-25440
Published: 2022-03-18
Description: Tenda AC9 v15.03.2.21 was discovered to contain a stack overflow via the ntpserver parameter in the SetSysTimeCfg function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/EPhaha/IOT_vuln/tree/main/Tenda/AC9/13; https://github.com/EPhaha/IOT_vuln/tree/main/Tenda/AC9/13
CVE: CVE-2022-25441
Published: 2022-03-18
Description: Tenda AC9 v15.03.2.21 was discovered to contain a remote command execution (RCE) vulnerability via the vlanid parameter in the SetIPTVCfg function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/EPhaha/IOT_vuln/tree/main/Tenda/AC9/12; https://github.com/EPhaha/IOT_vuln/tree/main/Tenda/AC9/12
CVE: CVE-2022-25445
Published: 2022-03-18
Description: Tenda AC6 v15.03.05.09_multi was discovered to contain a stack overflow via the time parameter in the PowerSaveSet function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/EPhaha/IOT_vuln/tree/main/Tenda/AC6/1; https://github.com/EPhaha/IOT_vuln/tree/main/Tenda/AC6/1
CVE: CVE-2022-25446
Published: 2022-03-18
Description: Tenda AC6 v15.03.05.09_multi was discovered to contain a stack overflow via the schedstarttime parameter in the openSchedWifi function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/EPhaha/IOT_vuln/tree/main/Tenda/AC6/3; https://github.com/EPhaha/IOT_vuln/tree/main/Tenda/AC6/3
CVE: CVE-2022-25447
Published: 2022-03-18
Description: Tenda AC6 v15.03.05.09_multi was discovered to contain a stack overflow via the schedendtime parameter in the openSchedWifi function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/EPhaha/IOT_vuln/tree/main/Tenda/AC6/4; https://github.com/EPhaha/IOT_vuln/tree/main/Tenda/AC6/4
CVE: CVE-2022-25448
Published: 2022-03-18
Description: Tenda AC6 v15.03.05.09_multi was discovered to contain a stack overflow via the day parameter in the openSchedWifi function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/EPhaha/IOT_vuln/tree/main/Tenda/AC6/2; https://github.com/EPhaha/IOT_vuln/tree/main/Tenda/AC6/2
CVE: CVE-2022-25449
Published: 2022-03-18
Description: Tenda AC6 v15.03.05.09_multi was discovered to contain a stack overflow via the deviceId parameter in the saveParentControlInfo function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/EPhaha/IOT_vuln/tree/main/Tenda/AC6/5; https://github.com/EPhaha/IOT_vuln/tree/main/Tenda/AC6/5
CVE: CVE-2022-25450
Published: 2022-03-18
Description: Tenda AC6 V15.03.05.09_multi was discovered to contain a stack overflow via the list parameter in the SetVirtualServerCfg function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/EPhaha/IOT_vuln/tree/main/Tenda/AC6/8; https://github.com/EPhaha/IOT_vuln/tree/main/Tenda/AC6/8
CVE: CVE-2022-25451
Published: 2022-03-18
Description: Tenda AC6 V15.03.05.09_multi was discovered to contain a stack overflow via the list parameter in the setstaticroutecfg function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/EPhaha/IOT_vuln/tree/main/Tenda/AC6/9; https://github.com/EPhaha/IOT_vuln/tree/main/Tenda/AC6/9
CVE: CVE-2022-25452
Published: 2022-03-18
Description: Tenda AC6 v15.03.05.09_multi was discovered to contain a stack overflow via the URLs parameter in the saveParentControlInfo function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/EPhaha/IOT_vuln/tree/main/Tenda/AC6/7; https://github.com/EPhaha/IOT_vuln/tree/main/Tenda/AC6/7
CVE: CVE-2022-25453
Published: 2022-03-18
Description: Tenda AC6 v15.03.05.09_multi was discovered to contain a stack overflow via the time parameter in the saveParentControlInfo function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/EPhaha/IOT_vuln/tree/main/Tenda/AC6/6; https://github.com/EPhaha/IOT_vuln/tree/main/Tenda/AC6/6
CVE: CVE-2022-25454
Published: 2022-03-18
Description: Tenda AC6 v15.03.05.09_multi was discovered to contain a stack overflow via the loginpwd parameter in the SetFirewallCfg function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/EPhaha/IOT_vuln/tree/main/Tenda/AC6/10; https://github.com/EPhaha/IOT_vuln/tree/main/Tenda/AC6/10
CVE: CVE-2022-25455
Published: 2022-03-18
Description: Tenda AC6 v15.03.05.09_multi was discovered to contain a stack overflow via the list parameter in the SetIpMacBind function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/EPhaha/IOT_vuln/tree/main/Tenda/AC6/11; https://github.com/EPhaha/IOT_vuln/tree/main/Tenda/AC6/11
CVE: CVE-2022-25456
Published: 2022-03-18
Description: Tenda AC6 v15.03.05.09_multi was discovered to contain a stack overflow via the security_5g parameter in the WifiBasicSet function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/EPhaha/IOT_vuln/tree/main/Tenda/AC6/12; https://github.com/EPhaha/IOT_vuln/tree/main/Tenda/AC6/12
CVE: CVE-2022-25457
Published: 2022-03-18
Description: Tenda AC6 v15.03.05.09_multi was discovered to contain a stack overflow via the ntpserver parameter in the SetSysTimeCfg function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/EPhaha/IOT_vuln/tree/main/Tenda/AC6/14; https://github.com/EPhaha/IOT_vuln/tree/main/Tenda/AC6/14
CVE: CVE-2022-25458
Published: 2022-03-18
Description: Tenda AC6 v15.03.05.09_multi was discovered to contain a stack overflow via the cmdinput parameter in the exeCommand function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/EPhaha/IOT_vuln/tree/main/Tenda/AC6/13; https://github.com/EPhaha/IOT_vuln/tree/main/Tenda/AC6/13
CVE: CVE-2022-25459
Published: 2022-03-18
Description: Tenda AC6 v15.03.05.09_multi was discovered to contain a stack overflow via the S1 parameter in the SetSysTimeCfg function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/EPhaha/IOT_vuln/tree/main/Tenda/AC6/15; https://github.com/EPhaha/IOT_vuln/tree/main/Tenda/AC6/15
CVE: CVE-2022-25460
Published: 2022-03-18
Description: Tenda AC6 v15.03.05.09_multi was discovered to contain a stack overflow via the endip parameter in the SetPptpServerCfg function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/EPhaha/IOT_vuln/tree/main/Tenda/AC6/17; https://github.com/EPhaha/IOT_vuln/tree/main/Tenda/AC6/17
CVE: CVE-2022-25461
Published: 2022-03-18
Description: Tenda AC6 v15.03.05.09_multi was discovered to contain a stack overflow via the startip parameter in the SetPptpServerCfg function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/EPhaha/IOT_vuln/tree/main/Tenda/AC6/16; https://github.com/EPhaha/IOT_vuln/tree/main/Tenda/AC6/16
CVE: CVE-2022-27250
Published: 2022-03-18
Description: The UNISOC chipset through 2022-03-15 allows attackers to obtain remote control of a mobile phone, e.g., to obtain sensitive information from text messages or the device's screen, record video of the device's physical environment, or modify data.
CVSS Score: 9.8 (CRITICAL)
References: https://www.kryptowire.com/news/kryptowire-identifies-vulnerability-in-unisoc-chipset/; https://www.kryptowire.com/news/kryptowire-identifies-vulnerability-in-unisoc-chipset/
CVE: CVE-2022-25389
Published: 2022-03-18
Description: DCN Firewall DCME-520 was discovered to contain an arbitrary file download vulnerability via the path parameter in the file /audit/log/log_management.php.
CVSS Score: 7.5 (HIGH)
References: https://www.adminxe.com/3246.html; https://www.adminxe.com/3246.html
CVE: CVE-2022-25390
Published: 2022-03-18
Description: DCN Firewall DCME-520 was discovered to contain a remote command execution (RCE) vulnerability via the host parameter in the file /system/tool/ping.php.
CVSS Score: 9.8 (CRITICAL)
References: https://www.adminxe.com/3276.html; https://www.adminxe.com/3276.html
CVE: CVE-2022-25578
Published: 2022-03-18
Description: taocms v3.0.2 allows attackers to execute code injection via arbitrarily editing the .htaccess file.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: http://taocms.com; https://github.com/taogogo/taocms/issues/28; http://taocms.com
CVE: CVE-2022-25581
Published: 2022-03-18
Description: Classcms v2.5 and below contains an arbitrary file upload via the component \class\classupload. This vulnerability allows attackers to execute code injection via a crafted .txt file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-434
References: https://github.com/k0xx11/Vulscve/blob/master/classcms2.5-rce.md; https://github.com/k0xx11/Vulscve/blob/master/classcms2.5-rce.md
CVE: CVE-2022-26265
Published: 2022-03-18
Description: Contao Managed Edition v1.5.0 was discovered to contain a remote command execution (RCE) vulnerability via the component php_cli parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/JCCD/Contao-Managed-Edition-1.5-RCE/blob/main/VulnerabilityDetails.md; https://github.com/JCCD/Contao-Managed-Edition-1.5-RCE/blob/main/VulnerabilityDetails.md
CVE: CVE-2022-26266
Published: 2022-03-18
Description: Piwigo v12.2.0 was discovered to contain a SQL injection vulnerability via pwg.users.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/JCCD/Vul/blob/main/Piwigo_12.2.0_SQLinject.md; https://github.com/JCCD/Vul/blob/main/Piwigo_12.2.0_SQLinject.md
CVE: CVE-2022-26267
Published: 2022-03-18
Description: Piwigo v12.2.0 was discovered to contain an information leak via the action parameter in /admin/maintenance_actions.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306
References: https://github.com/JCCD/Vul/blob/main/Piwigo_12.2.0_InforMation_Disclosure.md; https://github.com/JCCD/Vul/blob/main/Piwigo_12.2.0_InforMation_Disclosure.md
CVE: CVE-2022-27226
Published: 2022-03-19
Description: A CSRF issue in /api/crontab on iRZ Mobile Routers through 2022-03-16 allows a threat actor to create a crontab entry in the router administration panel. The cronjob will consequently execute the entry on the threat actor's defined interval, leading to remote code execution, allowing the threat actor to gain filesystem access. In addition, if the router's default credentials aren't rotated or a threat actor discovers valid credentials, remote code execution can be achieved without user interaction.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://packetstormsecurity.com/files/166396/iRZ-Mobile-Router-Cross-Site-Request-Forgery-Remote-Code-Execution.html; https://en.irz.ru; https://github.com/SakuraSamuraii/ez-iRZ
CVE: CVE-2022-0991
Published: 2022-03-19
Description: Insufficient Session Expiration in GitHub repository admidio/admidio prior to 4.1.9.
CVSS Score: 7.1 (HIGH)
CWE: CWE-613, CWE-613
References: https://github.com/admidio/admidio/commit/e84e472ebe517e2ff5795c46dc10b5f49dc4d46a; https://huntr.dev/bounties/1c406a4e-15d0-4920-8495-731c48473ba4; https://github.com/admidio/admidio/commit/e84e472ebe517e2ff5795c46dc10b5f49dc4d46a
CVE: CVE-2022-24126
Published: 2022-03-20
Description: A buffer overflow in the NRSessionSearchResult parser in Bandai Namco FromSoftware Dark Souls III through 2022-03-19 allows remote attackers to execute arbitrary code via matchmaking servers, a different vulnerability than CVE-2021-34170.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://fromsoftware.jp; https://github.com/tremwil/ds3-nrssr-rce; https://fromsoftware.jp
CVE: CVE-2022-24125
Published: 2022-03-20
Description: The matchmaking servers of Bandai Namco FromSoftware Dark Souls III through 2022-03-19 allow remote attackers to send arbitrary push requests to clients via a RequestSendMessageToPlayers request. For example, ability to send a push message to hundreds of thousands of machines is only restricted on the client side, and can thus be bypassed with a modified client.
CVSS Score: 8.8 (HIGH)
References: https://fromsoftware.jp; https://github.com/tremwil/ds3-nrssr-rce; https://fromsoftware.jp
CVE: CVE-2021-44345
Published: 2022-03-20
Description: Beijing Wisdom Vision Technology Industry Co., Ltd One Card Integrated Management System 3.0 is vulnerable to SQL Injection.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://www.cnvd.org.cn/flaw/show/3454201; https://www.cnvd.org.cn/flaw/show/3454201
CVE: CVE-2022-25464
Published: 2022-03-20
Description: A stored cross-site scripting (XSS) vulnerability in the component /admin/contenttemp of DoraCMS v2.1.8 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/doramart/DoraCMS/issues/255; https://github.com/doramart/DoraCMS/issues/255
CVE: CVE-2022-26246
Published: 2022-03-20
Description: TMS v2.28.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /TMS/admin/setting/mail/createorupdate.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/xiweicheng/tms/issues/15; https://github.com/xiweicheng/tms/issues/15
CVE: CVE-2022-26247
Published: 2022-03-20
Description: TMS v2.28.0 contains an insecure permissions vulnerability via the component /TMS/admin/user/Update2. This vulnerability allows attackers to modify the administrator account and password.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-732
References: https://github.com/xiweicheng/tms/issues/16; https://github.com/xiweicheng/tms/issues/16
CVE: CVE-2022-26555
Published: 2022-03-20
Description: A stored cross-site scripting (XSS) vulnerability in the Add a Button function of Eova v1.6.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the button name text box.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://gitee.com/eova/eova/issues/I4VRE9; https://gitee.com/eova/eova/issues/I4VRE9
CVE: CVE-2022-25462
Published: 2022-03-20
Description: Yafu v2.0 contains a segmentation fault via the component /factor/avx-ecm/vecarith52.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via unspecified vectors.
CVSS Score: 7.5 (HIGH)
References: https://github.com/bbuhrow/avx-ecm/issues/1; https://github.com/bbuhrow/avx-ecm/issues/1
CVE: CVE-2020-26007
Published: 2022-03-20
Description: An arbitrary file upload vulnerability in the upload payment plugin of ShopXO v1.9.0 allows attackers to execute arbitrary code via uploading a crafted PHP file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-434
References: https://github.com/gongfuxiang/shopxo/issues/48; https://github.com/gongfuxiang/shopxo/issues/48
CVE: CVE-2020-26008
Published: 2022-03-20
Description: The PluginsUpload function in application/service/PluginsAdminService.php of ShopXO v1.9.0 contains an arbitrary file upload vulnerability which allows attackers to execute arbitrary code via uploading a crafted PHP file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-434
References: https://github.com/gongfuxiang/shopxo/issues/47; https://github.com/gongfuxiang/shopxo/issues/47
CVE: CVE-2021-39383
Published: 2022-03-20
Description: DWSurvey v3.2.0 was discovered to contain a remote command execution (RCE) vulnerability via the component /sysuser/SysPropertyAction.java.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://github.com/wkeyuan/DWSurvey/issues/81; https://github.com/wkeyuan/DWSurvey/issues/81
CVE: CVE-2021-39384
Published: 2022-03-20
Description: DWSurvey v3.2.0 was discovered to contain an arbitrary file write vulnerability via the component /utils/ToHtmlServlet.java.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://github.com/wkeyuan/DWSurvey/issues/80; https://github.com/wkeyuan/DWSurvey/issues/80
CVE: CVE-2021-42194
Published: 2022-03-20
Description: The wechat_return function in /controller/Index.php of EyouCms V1.5.4-UTF8-SP3 passes the user's input directly into the simplexml_ load_ String function, which itself does not prohibit external entities, triggering a XML external entity (XXE) injection vulnerability.
CVSS Score: 7.2 (HIGH)
CWE: CWE-611
References: https://github.com/eyoucms/eyoucms/issues/19; https://github.com/eyoucms/eyoucms/issues/19
CVE: CVE-2022-25481
Published: 2022-03-21
Description: ThinkPHP Framework v5.0.24 was discovered to be configured without the PATHINFO parameter. This allows attackers to access all system environment parameters from index.php. NOTE: this is disputed by a third party because system environment exposure is an intended feature of the debugging mode.
CVSS Score: 7.5 (HIGH)
CWE: CWE-668, CWE-284
References: https://github.com/Lyther/VulnDiscover/blob/master/Web/ThinkPHP_InfoLeak.md; https://github.com/Lyther/VulnDiscover/blob/master/Web/ThinkPHP_InfoLeak.md
CVE: CVE-2022-25505
Published: 2022-03-21
Description: Taocms v3.0.2 was discovered to contain a SQL injection vulnerability via the id parameter in \include\Model\Category.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/taogogo/taocms/issues/27; https://github.com/taogogo/taocms/issues/27
CVE: CVE-2021-36100
Published: 2022-03-21
Description: Specially crafted string in OTRS system configuration can allow the execution of any system command.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-78
References: https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html; https://otrs.com/release-notes/otrs-security-advisory-2022-03/; https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html
CVE: CVE-2022-0475
Published: 2022-03-21
Description: Malicious translator is able to inject JavaScript code in few translatable strings (where HTML is allowed). The code could be executed in the Package manager. This issue affects: OTRS AG OTRS 7.0.x version: 7.0.32 and prior versions, 8.0.x version: 8.0.19 and prior versions.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-79
References: https://otrs.com/release-notes/otrs-security-advisory-2022-05/; https://otrs.com/release-notes/otrs-security-advisory-2022-05/
CVE: CVE-2022-1004
Published: 2022-03-21
Description: Accounted time is shown in the Ticket Detail View (External Interface), even if ExternalFrontend::TicketDetailView###AccountedTimeDisplay is disabled.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200, CWE-200
References: https://otrs.com/release-notes/otrs-security-advisory-2022-06/; https://otrs.com/release-notes/otrs-security-advisory-2022-06/
CVE: CVE-2021-45876
Published: 2022-03-21
Description: Multiple versions of GARO Wallbox GLB/GTB/GTC are affected by unauthenticated command injection. The url parameter of the function module downloadAndUpdate is vulnerable to an command Injection. Unfiltered user input is used to generate code which then gets executed when downloading new firmware.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://github.com/delikely/advisory/tree/main/GARO; https://github.com/delikely/advisory/tree/main/GARO
CVE: CVE-2021-45877
Published: 2022-03-21
Description: Multiple versions of GARO Wallbox GLB/GTB/GTC are affected by hard coded credentials. A hardcoded credential exist in /etc/tomcat8/tomcat-user.xml, which allows attackers to gain authorized access and control the tomcat completely on port 8000 in the tomcat manger page.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://github.com/delikely/advisory/tree/main/GARO; https://github.com/delikely/advisory/tree/main/GARO
CVE: CVE-2021-45878
Published: 2022-03-21
Description: Multiple versions of GARO Wallbox GLB/GTB/GTC are affected by incorrect access control. Lack of access control on the web manger pages allows any user to view and modify information.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-306
References: https://github.com/delikely/advisory/tree/main/GARO; https://github.com/delikely/advisory/tree/main/GARO
CVE: CVE-2022-0415
Published: 2022-03-21
Description: Remote Command Execution in uploading repository file in GitHub repository gogs/gogs prior to 0.12.6.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20, CWE-434
References: https://github.com/gogs/gogs/commit/0fef3c9082269e9a4e817274942a5d7c50617284; https://huntr.dev/bounties/b4928cfe-4110-462f-a180-6d[PII_REDACTED]; https://github.com/gogs/gogs/commit/0fef3c9082269e9a4e817274942a5d7c50617284
CVE: CVE-2022-24656
Published: 2022-03-21
Description: HexoEditor 1.1.8 is affected by Cross Site Scripting (XSS). By putting a common XSS payload in a markdown file, if opened with the app, will execute several times.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/zhuzhuyule/HexoEditor/issues/3; https://github.com/zhuzhuyule/HexoEditor/issues/3
CVE: CVE-2022-1035
Published: 2022-03-21
Description: Segmentation Fault caused by MP4Box -lsr in GitHub repository gpac/gpac prior to 2.1.0-DEV.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/gpac/gpac/commit/3718d583c6ade191dc7979c64f48c001ca6f0243; https://huntr.dev/bounties/851942a4-1d64-4553-8fdc-9fccd167864b; https://www.debian.org/security/2023/dsa-5411
CVE: CVE-2022-25570
Published: 2022-03-21
Description: In Click Studios (SA) Pty Ltd Passwordstate 9435, users with access to a passwordlist can gain access to additional password lists without permissions. Specifically, an authenticated user who has write permissions to a password list in one folder (with the default permission model) can extend his permissions to all other password lists in the same folder.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-276
References: https://sysadms.de/2022/03/cve-2022-25570-standard-berechtigungsmodell-im-passwortmanager-passwordstate-ermoeglicht-rechteausweitung/; https://www.clickstudios.com.au/passwordstate-changelog.aspx; https://sysadms.de/2022/03/cve-2022-25570-standard-berechtigungsmodell-im-passwortmanager-passwordstate-ermoeglicht-rechteausweitung/
CVE: CVE-2020-24772
Published: 2022-03-21
Description: In Dreamacro Clash for Windows v0.11.4, an attacker could embed a malicious iframe in a website with a crafted URL that would launch the Clash Windows client and force it to open a remote SMB share. Windows will perform NTLM authentication when opening the SMB share and that request can be relayed (using a tool like responder) for code execution (or captured for hash cracking).
CVSS Score: 8.8 (HIGH)
CWE: CWE-346
References: https://github.com/Dreamacro/clash/issues/910; https://github.com/Dreamacro/clash/issues/910