deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-20522
Published: 2023-01-11
Description: Insufficient input validation in ASP may allow an attacker with a malicious BIOS to potentially cause a denial of service.

CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-20
References: https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-1032; https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-1032
CVE: CVE-2023-20523
Published: 2023-01-11
Description: TOCTOU in the ASP may allow a physical attacker to write beyond the buffer bounds, potentially leading to a loss of integrity or denial of service.

CVSS Score: 5.7 (MEDIUM)
CWE: CWE-367, CWE-367
References: https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-1032; https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-1032
CVE: CVE-2023-20525
Published: 2023-01-11
Description: Insufficient syscall input validation in the ASP Bootloader may allow a privileged attacker to read memory outside the bounds of a mapped register potentially leading to a denial of service.

CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20, CWE-20
References: https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-1032; https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-1032
CVE: CVE-2023-20527
Published: 2023-01-11
Description: Improper syscall input validation in the ASP Bootloader may allow a privileged attacker to read memory out-of-bounds, potentially leading to a denial-of-service.

CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20, CWE-20
References: https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-1032; https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-1032
CVE: CVE-2023-20528
Published: 2023-01-11
Description: Insufficient input validation in the SMU may allow a physical attacker to exfiltrate SMU memory contents over the I2C bus potentially leading to a loss of confidentiality.

CVSS Score: 2.4 (LOW)
CWE: CWE-20, CWE-20
References: https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-1032; https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-1032
CVE: CVE-2023-20529
Published: 2023-01-11
Description: Insufficient bound checks in the SMU may allow an attacker to update the from/to address space to an invalid value potentially resulting in a denial of service.

CVSS Score: 7.5 (HIGH)
CWE: CWE-119, CWE-119
References: https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-1032; https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-1032
CVE: CVE-2023-20530
Published: 2023-01-11
Description: Insufficient input validation of BIOS mailbox messages in SMU may result in out-of-bounds memory reads potentially resulting in a denial of service.

CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-20
References: https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-1032; https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-1032
CVE: CVE-2023-20531
Published: 2023-01-11
Description: Insufficient bound checks in the SMU may allow an attacker to update the SRAM from/to address space to an invalid value potentially resulting in a denial of service.

CVSS Score: 7.5 (HIGH)
CWE: CWE-119, CWE-119
References: https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-1032; https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-1032
CVE: CVE-2023-20532
Published: 2023-01-11
Description: Insufficient input validation in the SMU may allow an attacker to improperly lock resources, potentially resulting in a denial of service.

CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20, CWE-20
References: https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-1032; https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-1032
CVE: CVE-2023-22885
Published: 2023-01-11
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none.
CVE: CVE-2022-34440
Published: 2023-01-11
Description: Dell EMC SCG Policy Manager, versions from 5.10 to 5.12, contain(s) a contain a Hard-coded Cryptographic Key vulnerability. An attacker with the knowledge of the hard-coded sensitive information, could potentially exploit this vulnerability to login to the system to gain admin privileges.


CVSS Score: 8.4 (HIGH)
CWE: CWE-321, CWE-798
References: https://www.dell.com/support/kbdoc/en-us/000204995/dsa-2022-273-dell-secure-connect-gateway-policy-manager-security-update-for-multiple-proprietary-code-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000204995/dsa-2022-273-dell-secure-connect-gateway-policy-manager-security-update-for-multiple-proprietary-code-vulnerabilities
CVE: CVE-2023-22952
Published: 2023-01-11
Description: In SugarCRM before 12.0. Hotfix 91155, a crafted request can inject custom PHP code through the EmailTemplates because of missing input validation.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20, CWE-94
References: http://packetstormsecurity.com/files/171320/SugarCRM-12.x-Remote-Code-Execution-Shell-Upload.html; https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2023-001/; http://packetstormsecurity.com/files/171320/SugarCRM-12.x-Remote-Code-Execution-Shell-Upload.html
CVE: CVE-2022-34441
Published: 2023-01-11
Description: 
Dell EMC SCG Policy Manager, versions from 5.10 to 5.12, contain(s) a contain a Hard-coded Cryptographic Key vulnerability. An attacker with the knowledge of the hard-coded sensitive information, could potentially exploit this vulnerability to login to the system to gain admin privileges.


CVSS Score: 8.0 (HIGH)
CWE: CWE-321, CWE-798
References: https://www.dell.com/support/kbdoc/en-us/000204995/dsa-2022-273-dell-secure-connect-gateway-policy-manager-security-update-for-multiple-proprietary-code-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000204995/dsa-2022-273-dell-secure-connect-gateway-policy-manager-security-update-for-multiple-proprietary-code-vulnerabilities
CVE: CVE-2022-42967
Published: 2023-01-11
Description: Caret is vulnerable to an XSS attack when the user opens a crafted Markdown file when preview mode is enabled. This directly leads to client-side code execution.
CVSS Score: 7.5 (HIGH)
CWE: CWE-79, CWE-79
References: https://research.jfrog.com/vulnerabilities/caret-xss-rce/; https://research.jfrog.com/vulnerabilities/caret-xss-rce/
CVE: CVE-2022-4696
Published: 2023-01-11
Description: There exists a use-after-free vulnerability in the Linux kernel through io_uring and the IORING_OP_SPLICE operation. If IORING_OP_SPLICE is missing the IO_WQ_WORK_FILES flag, which signals that the operation won't use current->nsproxy, so its reference counter is not increased. This assumption is not always true as calling io_splice on specific files will call the get_uts function which will use current->nsproxy leading to invalidly decreasing its reference counter later causing the use-after-free vulnerability. We recommend upgrading to version 5.10.160 or above

CVSS Score: 7.8 (HIGH)
CWE: CWE-763, CWE-416
References: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=linux-5.10.y&id=75454b4bbfc7e6a4dd8338556f36ea9107ddf61a; https://kernel.dance/#75454b4bbfc7e6a4dd8338556f36ea9107ddf61a; https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=linux-5.10.y&id=75454b4bbfc7e6a4dd8338556f36ea9107ddf61a
CVE: CVE-2018-25073
Published: 2023-01-11
Description: A vulnerability has been found in Newcomer1989 TSN-Ranksystem up to 1.2.6 and classified as problematic. This vulnerability affects the function getlog of the file webinterface/bot.php. The manipulation leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 1.2.7 is able to address this issue. The patch is identified as b3a3cd8efe2cd3bd3c5b3b7abf2fe80dbee51b77. It is recommended to upgrade the affected component. VDB-218002 is the identifier assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-79
References: https://github.com/Newcomer1989/TSN-Ranksystem/commit/b3a3cd8efe2cd3bd3c5b3b7abf2fe80dbee51b77; https://github.com/Newcomer1989/TSN-Ranksystem/pull/467; https://github.com/Newcomer1989/TSN-Ranksystem/releases/tag/1.2.7
CVE: CVE-2022-47865
Published: 2023-01-11
Description: Lead Management System v1.0 is vulnerable to SQL Injection via the id parameter in removeOrder.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/xiumulty/CVE/blob/main/Lead%20management%20system%20v1.0/sql%20in%20removeOrder.php.md; https://www.sourcecodester.com/php/15933/lead-management-system-php-open-source-free-download.html; https://github.com/xiumulty/CVE/blob/main/Lead%20management%20system%20v1.0/sql%20in%20removeOrder.php.md
CVE: CVE-2022-47866
Published: 2023-01-11
Description: Lead management system v1.0 is vulnerable to SQL Injection via the id parameter in removeBrand.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/xiumulty/CVE/blob/main/Lead%20management%20system%20v1.0/sql%20in%20removeBrand.php.md; https://www.sourcecodester.com/php/15933/lead-management-system-php-open-source-free-download.html; https://github.com/xiumulty/CVE/blob/main/Lead%20management%20system%20v1.0/sql%20in%20removeBrand.php.md
CVE: CVE-2014-125074
Published: 2023-01-11
Description: A vulnerability was found in Nayshlok Voyager. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file Voyager/src/models/DatabaseAccess.java. The manipulation leads to sql injection. The identifier of the patch is f1249f438cd8c39e7ef2f6c8f2ab76b239a02fae. It is recommended to apply a patch to fix this issue. The identifier VDB-218005 was assigned to this vulnerability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/Nayshlok/Voyager/commit/f1249f438cd8c39e7ef2f6c8f2ab76b239a02fae; https://vuldb.com/?ctiid.218005; https://vuldb.com/?id.218005
CVE: CVE-2017-20168
Published: 2023-01-11
Description: A vulnerability was found in jfm-so piWallet. It has been rated as critical. Affected by this issue is some unknown functionality of the file api.php. The manipulation of the argument key leads to sql injection. The patch is identified as b420f8c4cbe7f06a34d1b05e90ee5cdfe0aa83bb. It is recommended to apply a patch to fix this issue. VDB-218006 is the identifier assigned to this vulnerability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://github.com/jfm-so/piWallet/commit/b420f8c4cbe7f06a34d1b05e90ee5cdfe0aa83bb; https://github.com/jfm-so/piWallet/pull/23; https://vuldb.com/?ctiid.218006
CVE: CVE-2018-25074
Published: 2023-01-11
Description: A vulnerability was found in Prestaul skeemas and classified as problematic. This issue affects some unknown processing of the file validators/base.js. The manipulation of the argument uri leads to inefficient regular expression complexity. The patch is named 65e94eda62dc8dc148ab3e59aa2ccc086ac448fd. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-218003.
CVSS Score: 3.5 (LOW)
CWE: CWE-1333, CWE-1333
References: https://github.com/Prestaul/skeemas/commit/65e94eda62dc8dc148ab3e59aa2ccc086ac448fd; https://vuldb.com/?ctiid.218003; https://vuldb.com/?id.218003
CVE: CVE-2020-36649
Published: 2023-01-11
Description: A vulnerability was found in mholt PapaParse up to 5.1.x. It has been classified as problematic. Affected is an unknown function of the file papaparse.js. The manipulation leads to inefficient regular expression complexity. Upgrading to version 5.2.0 is able to address this issue. The name of the patch is 235a12758cd77266d2e98fd715f53536b34ad621. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-218004.
CVSS Score: 3.5 (LOW)
CWE: CWE-1333
References: https://github.com/mholt/PapaParse/commit/235a12758cd77266d2e98fd715f53536b34ad621; https://github.com/mholt/PapaParse/issues/777; https://github.com/mholt/PapaParse/pull/779
CVE: CVE-2022-47859
Published: 2023-01-11
Description: Lead Management System v1.0 is vulnerable to SQL Injection via the user_id parameter in changePassword.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/xiumulty/CVE/blob/main/Lead%20management%20system%20v1.0/sql%20in%20changePassword.php.md; https://www.sourcecodester.com/php/15933/lead-management-system-php-open-source-free-download.html; https://github.com/xiumulty/CVE/blob/main/Lead%20management%20system%20v1.0/sql%20in%20changePassword.php.md
CVE: CVE-2022-47860
Published: 2023-01-11
Description: Lead Management System v1.0 is vulnerable to SQL Injection via the id parameter in removeProduct.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/xiumulty/CVE/blob/main/Lead%20management%20system%20v1.0/sql%20in%20removeProduct.php.md; https://www.sourcecodester.com/php/15933/lead-management-system-php-open-source-free-download.html; https://github.com/xiumulty/CVE/blob/main/Lead%20management%20system%20v1.0/sql%20in%20removeProduct.php.md
CVE: CVE-2022-47861
Published: 2023-01-11
Description: Lead Management System v1.0 is vulnerable to SQL Injection via the id parameter in removeLead.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/xiumulty/CVE/blob/main/Lead%20management%20system%20v1.0/sql%20in%20removeLead.php.md; https://www.sourcecodester.com/php/15933/lead-management-system-php-open-source-free-download.html; https://github.com/xiumulty/CVE/blob/main/Lead%20management%20system%20v1.0/sql%20in%20removeLead.php.md
CVE: CVE-2022-47862
Published: 2023-01-11
Description: Lead Management System v1.0 is vulnerable to SQL Injection via the customer_id parameter in ajax_represent.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/xiumulty/CVE/blob/main/Lead%20management%20system%20v1.0/sql%20in%20ajax_represent.php%20.md; https://www.sourcecodester.com/php/15933/lead-management-system-php-open-source-free-download.html; https://github.com/xiumulty/CVE/blob/main/Lead%20management%20system%20v1.0/sql%20in%20ajax_represent.php%20.md
CVE: CVE-2022-47864
Published: 2023-01-11
Description: Lead Management System v1.0 is vulnerable to SQL Injection via the id parameter in removeCategories.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/xiumulty/CVE/blob/main/Lead%20management%20system%20v1.0/sql%20in%20removeCategories.php.md; https://www.sourcecodester.com/php/15933/lead-management-system-php-open-source-free-download.html; https://github.com/xiumulty/CVE/blob/main/Lead%20management%20system%20v1.0/sql%20in%20removeCategories.php.md
CVE: CVE-2022-4415
Published: 2023-01-11
Description: A vulnerability was found in systemd. This security flaw can cause a local information leak due to systemd-coredump not respecting the fs.suid_dumpable kernel setting.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://github.com/systemd/systemd/commit/b[PII_REDACTED]243c09473cd8fb3aef2c0d4a3eb9c; https://www.openwall.com/lists/oss-security/2022/12/21/3; http://seclists.org/fulldisclosure/2025/Jun/9
CVE: CVE-2022-4543
Published: 2023-01-11
Description: A flaw named "EntryBleed" was found in the Linux Kernel Page Table Isolation (KPTI). This issue could allow a local attacker to leak KASLR base via prefetch side-channels based on TLB timing for Intel systems.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200, CWE-203
References: https://www.openwall.com/lists/oss-security/2022/12/16/3; https://www.willsroot.io/2022/12/entrybleed.html; https://www.openwall.com/lists/oss-security/2022/12/16/3
CVE: CVE-2013-10010
Published: 2023-01-11
Description: A vulnerability classified as problematic has been found in zerochplus. This affects the function PrintResList of the file test/mordor/thread.res.pl. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The patch is named 9ddf9ecca8565341d8d26a3b2f64540bde4fa273. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-218007.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://github.com/zerochplus/zerochplus/commit/9ddf9ecca8565341d8d26a3b2f64540bde4fa273; https://vuldb.com/?ctiid.218007; https://vuldb.com/?id.218007
CVE: CVE-2022-34335
Published: 2023-01-11
Description: 
IBM Sterling Partner Engagement Manager 6.1.2, 6.2.0, and 6.2.1 could allow an authenticated user to exhaust server resources which could lead to a denial of service. IBM X-Force ID: 229705.


CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400, CWE-400
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/229705; https://www.ibm.com/support/pages/node/6854331; https://exchange.xforce.ibmcloud.com/vulnerabilities/229705
CVE: CVE-2022-40615
Published: 2023-01-11
Description: 
IBM Sterling Partner Engagement Manager 6.1, 6.2, and 6.2.1 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 236208.


CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/236208; https://www.ibm.com/support/pages/node/6854333; https://exchange.xforce.ibmcloud.com/vulnerabilities/236208
CVE: CVE-2022-4428
Published: 2023-01-11
Description: support_uri parameter in the WARP client local settings file (mdm.xml) lacked proper validation which allowed for privilege escalation and launching an arbitrary executable on the local machine upon clicking on the "Send feedback" option. An attacker with access to the local file system could use a crafted XML config file pointing to a malicious file or set a local path to the executable using Cloudflare Zero Trust Dashboard (for Zero Trust enrolled clients).

CVSS Score: 8.9 (HIGH)
CWE: CWE-20, CWE-20
References: https://github.com/cloudflare/advisories/security/advisories/GHSA-h3j3-fhqg-66rh; https://github.com/cloudflare/advisories/security/advisories/GHSA-h3j3-fhqg-66rh
CVE: CVE-2022-4457
Published: 2023-01-11
Description: Due to a misconfiguration in the manifest file of the WARP client for Android, it was possible to a perform a task hijacking attack. An attacker could create a malicious mobile application which could hijack legitimate app and steal potentially sensitive information when installed on the victim's device.


CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://github.com/cloudflare/advisories/security/advisories/GHSA-35f7-fqrc-4hhj; https://github.com/cloudflare/advisories/security/advisories/GHSA-35f7-fqrc-4hhj
CVE: CVE-2020-36650
Published: 2023-01-11
Description: A vulnerability, which was classified as critical, was found in IonicaBizau node-gry up to 5.x. This affects an unknown part. The manipulation leads to command injection. Upgrading to version 6.0.0 is able to address this issue. The patch is named 5108446c1e23960d65e8b973f1d9486f9f9dbd6c. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-218019.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-77, CWE-77
References: https://github.com/IonicaBizau/node-gry/commit/5108446c1e23960d65e8b973f1d9486f9f9dbd6c; https://github.com/IonicaBizau/node-gry/pull/22; https://github.com/IonicaBizau/node-gry/releases/tag/6.0.0
CVE: CVE-2022-4885
Published: 2023-01-11
Description: A vulnerability has been found in sviehb jefferson up to 0.3 and classified as critical. This vulnerability affects unknown code of the file src/scripts/jefferson. The manipulation leads to path traversal. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. Upgrading to version 0.4 is able to address this issue. The name of the patch is 53b3f2fc34af0bb32afbcee29d18213e61471d87. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-218020.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://github.com/sviehb/jefferson/commit/53b3f2fc34af0bb32afbcee29d18213e61471d87; https://github.com/sviehb/jefferson/pull/36; https://github.com/sviehb/jefferson/releases/tag/v0.4
CVE: CVE-2014-125075
Published: 2023-01-11
Description: A vulnerability was found in gmail-servlet and classified as critical. This issue affects the function search of the file src/Model.java. The manipulation leads to sql injection. The identifier of the patch is 5d72753c2e95bb373aa[PII_REDACTED]7dc25f679ea. It is recommended to apply a patch to fix this issue. The identifier VDB-218021 was assigned to this vulnerability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/ChrisMcMStone/gmail-servlet/commit/5d72753c2e95bb373aa[PII_REDACTED]7dc25f679ea; https://vuldb.com/?ctiid.218021; https://vuldb.com/?id.218021
CVE: CVE-2014-125076
Published: 2023-01-11
Description: A vulnerability was found in NoxxieNl Criminals. It has been classified as critical. Affected is an unknown function of the file ingame/roulette.php. The manipulation of the argument gambleMoney leads to sql injection. The patch is identified as 0a60b31271d4cbf8babe4be993d2a3a1617f0897. It is recommended to apply a patch to fix this issue. VDB-218022 is the identifier assigned to this vulnerability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/NoxxieNl/Criminals/commit/0a60b31271d4cbf8babe4be993d2a3a1617f0897; https://vuldb.com/?ctiid.218022; https://vuldb.com/?id.218022
CVE: CVE-2015-10038
Published: 2023-01-11
Description: A vulnerability was found in nym3r0s pplv2. It has been declared as critical. Affected by this vulnerability is an unknown functionality. The manipulation leads to sql injection. The patch is named 28f8b[PII_REDACTED]da09f[PII_REDACTED]7c59f85b00. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-218023.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://github.com/nym3r0s/pplv2/commit/28f8b[PII_REDACTED]da09f[PII_REDACTED]7c59f85b00; https://vuldb.com/?ctiid.218023; https://vuldb.com/?id.218023
CVE: CVE-2015-10039
Published: 2023-01-11
Description: A vulnerability was found in dobos domino. It has been rated as critical. Affected by this issue is some unknown functionality in the library src/Complex.Domino.Lib/Lib/EntityFactory.cs. The manipulation leads to sql injection. Upgrading to version 0.1.5524.38553 is able to address this issue. The name of the patch is 16f039073709a21a76526110d773a6cce0ce753a. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-218024.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/dobos/domino/commit/16f039073709a21a76526110d773a6cce0ce753a; https://github.com/dobos/domino/releases/tag/v0.1.5524.38553; https://vuldb.com/?ctiid.218024
CVE: CVE-2022-4499
Published: 2023-01-11
Description: TP-Link routers, Archer C5 and WR710N-V1, using the latest software, the strcmp function used for checking credentials in httpd, is susceptible to a side-channel attack. By measuring the response time of the httpd process, an attacker could guess each byte of the username and password.
CVSS Score: 7.5 (HIGH)
CWE: CWE-203
References: https://kb.cert.org/vuls/id/572615; https://kb.cert.org/vuls/id/572615; https://www.kb.cert.org/vuls/id/572615