deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-46368
Published: 2023-01-12
Description: Rumpus - FTP server version 9.0.7.1 Cross-site request forgery (CSRF) – vulnerability may allow unauthorized action on behalf of authenticated users.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://www.gov.il/en/Departments/faq/cve_advisories; https://www.gov.il/en/Departments/faq/cve_advisories
CVE: CVE-2022-46369
Published: 2023-01-12
Description: Rumpus - FTP server version 9.0.7.1 Persistent cross-site scripting (PXSS) – vulnerability may allow inserting scripts into unspecified input fields.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.gov.il/en/Departments/faq/cve_advisories; https://www.gov.il/en/Departments/faq/cve_advisories
CVE: CVE-2022-46370
Published: 2023-01-12
Description: Rumpus - FTP server version 9.0.7.1 Improper Token Verification– vulnerability may allow bypassing identity verification.
CVSS Score: 7.3 (HIGH)
CWE: CWE-345, CWE-345
References: https://www.gov.il/en/Departments/faq/cve_advisories; https://www.gov.il/en/Departments/faq/cve_advisories
CVE: CVE-2022-46371
Published: 2023-01-12
Description: Alotcer - AR7088H-A firmware version 16.10.3 Information disclosure. Unspecified error message contains the default administrator user name.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200, CWE-209
References: https://www.gov.il/en/Departments/faq/cve_advisories; https://www.gov.il/en/Departments/faq/cve_advisories
CVE: CVE-2022-46372
Published: 2023-01-12
Description: Alotcer - AR7088H-A firmware version 16.10.3 Command execution Improper validation of unspecified input field may allow Authenticated command execution.
CVSS Score: 7.2 (HIGH)
CWE: CWE-20, CWE-20
References: https://www.gov.il/en/Departments/faq/cve_advisories; https://www.gov.il/en/Departments/faq/cve_advisories
CVE: CVE-2022-40983
Published: 2023-01-12
Description: An integer overflow vulnerability exists in the QML QtScript Reflect API of Qt Project Qt 6.3.2. A specially-crafted javascript code can trigger an integer overflow during memory allocation, which can lead to arbitrary code execution. Target application would need to access a malicious web page to trigger this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-190
References: https://talosintelligence.com/vulnerability_reports/TALOS-2022-1617; https://talosintelligence.com/vulnerability_reports/TALOS-2022-1617; https://www.talosintelligence.com/vulnerability_reports/TALOS-2022-1617
CVE: CVE-2022-43591
Published: 2023-01-12
Description: A buffer overflow vulnerability exists in the QML QtScript Reflect API of Qt Project Qt 6.3.2. A specially-crafted javascript code can trigger an out-of-bounds memory access, which can lead to arbitrary code execution. Target application would need to access a malicious web page to trigger this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-122
References: https://talosintelligence.com/vulnerability_reports/TALOS-2022-1650; https://talosintelligence.com/vulnerability_reports/TALOS-2022-1650; https://www.talosintelligence.com/vulnerability_reports/TALOS-2022-1650
CVE: CVE-2023-0247
Published: 2023-01-12
Description: Uncontrolled Search Path Element in GitHub repository bits-and-blooms/bloom prior to 3.3.1.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://github.com/bits-and-blooms/bloom/commit/658f1393d4c52254a3d22f5f64f217405ec5fefb; https://huntr.dev/bounties/cab50e44-0995-4ac1-a5d5-889293b9704f; https://github.com/bits-and-blooms/bloom/commit/658f1393d4c52254a3d22f5f64f217405ec5fefb
CVE: CVE-2023-0254
Published: 2023-01-12
Description: The Simple Membership WP user Import plugin for WordPress is vulnerable to SQL Injection via the ‘orderby’ parameter in versions up to, and including, 1.7 due to insufficient escaping on the user supplied parameter. This makes it possible for authenticated attackers with administrative privileges to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2829005%40simple-membership-wp-user-import&new=2829005%40simple-membership-wp-user-import&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/6f781533-b633-4452-95bd-c32ed0de2ea9?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2829005%40simple-membership-wp-user-import&new=2829005%40simple-membership-wp-user-import&sfp_email=&sfph_mail=
CVE: CVE-2022-3145
Published: 2023-01-12
Description: An open redirect vulnerability exists in Okta OIDC Middleware prior to version 5.0.0 allowing an attacker to redirect a user to an arbitrary URL.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-601, CWE-601
References: https://github.com/okta/okta-oidc-middleware/security/advisories/GHSA-58h4-9m7m-j9m4; https://github.com/okta/okta-oidc-middleware/security/advisories/GHSA-58h4-9m7m-j9m4
CVE: CVE-2022-3628
Published: 2023-01-12
Description: A buffer overflow flaw was found in the Linux kernel Broadcom Full MAC Wi-Fi driver. This issue occurs when a user connects to a malicious USB device. This can allow a local user to crash the system or escalate their privileges.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-119, CWE-120
References: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/patch/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c?id=6788ba8aed4e28e90f72d68a9d794e34eac17295; https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/patch/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c?id=6788ba8aed4e28e90f72d68a9d794e34eac17295
CVE: CVE-2022-3977
Published: 2023-01-12
Description: A use-after-free flaw was found in the Linux kernel MCTP (Management Component Transport Protocol) functionality. This issue occurs when a user simultaneously calls DROPTAG ioctl and socket close happens, which could allow a local user to crash the system or potentially escalate their privileges on the system.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=3a732b46736cd8a29092e4b0b1a9ba83e672bf89; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=3a732b46736cd8a29092e4b0b1a9ba83e672bf89
CVE: CVE-2022-4743
Published: 2023-01-12
Description: A potential memory leak issue was discovered in SDL2 in GLES_CreateTexture() function in SDL_render_gles.c. The vulnerability allows an attacker to cause a denial of service attack. The vulnerability affects SDL2 v2.0.4 and above. SDL-1.x are not affected.
CVSS Score: 7.5 (HIGH)
CWE: CWE-401, CWE-401
References: https://access.redhat.com/security/cve/CVE-2022-4743; https://bugzilla.redhat.com/show_bug.cgi?id=2156290; https://github.com/libsdl-org/SDL/commit/00b67f55727bc0944c3266e2b875440da132ce4b
CVE: CVE-2022-4842
Published: 2023-01-12
Description: A flaw NULL Pointer Dereference in the Linux kernel NTFS3 driver function attr_punch_hole() was found. A local user could use this flaw to crash the system.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://lore.kernel.org/ntfs3/784f82c4-de71-b8c3-afd6-468869a369af%40paragon-software.com/T/#t; https://lore.kernel.org/ntfs3/784f82c4-de71-b8c3-afd6-468869a369af%40paragon-software.com/T/#t
CVE: CVE-2023-23456
Published: 2023-01-12
Description: A heap-based buffer overflow issue was discovered in UPX in PackTmt::pack() in p_tmt.cpp file. The flow allows an attacker to cause a denial of service (abort) via a crafted file.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://bugzilla.redhat.com/show_bug.cgi?id=2160381; https://github.com/upx/upx/commit/510505a85cbe45e51fbd470f1aa8b02157c429d4; https://github.com/upx/upx/issues/632
CVE: CVE-2023-23457
Published: 2023-01-12
Description: A Segmentation fault was found in UPX in PackLinuxElf64::invert_pt_dynamic() in p_lx_elf.cpp. An attacker with a crafted input file allows invalid memory address access that could lead to a denial of service.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-119, CWE-119
References: https://bugzilla.redhat.com/show_bug.cgi?id=2160382; https://github.com/upx/upx/commit/779b648c5f6aa9b33f4728f79dd4d0efec0bf860; https://github.com/upx/upx/issues/631
CVE: CVE-2023-22488
Published: 2023-01-12
Description: Flarum is a forum software for building communities. Using the notifications feature, one can read restricted/private content and bypass access checks that would be in place for such content. The notification-sending component does not check that the subject of the notification can be seen by the receiver, and proceeds to send notifications through their different channels. The alerts do not leak data despite this as they are listed based on a visibility check, however, emails are still sent out. This means that, for extensions which restrict access to posts, any actor can bypass the restriction by subscribing to the discussion if the Subscriptions extension is enabled. The attack allows the leaking of some posts in the forum database, including posts awaiting approval, posts in tags the user has no access to if they could subscribe to a discussion before it becomes private, and posts restricted by third-party extensions. All Flarum versions prior to v1.6.3 are affected. The vulnerability has been fixed and published as flarum/core v1.6.3. All communities running Flarum should upgrade as soon as possible to v1.6.3. As a workaround, disable the Flarum Subscriptions extension or disable email notifications altogether. There are no other supported workarounds for this issue for Flarum versions below 1.6.3.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-862
References: https://github.com/flarum/framework/commit/d0a2b95dca57d3dae9a0d77b610b1cb1d0b1766a; https://github.com/flarum/framework/security/advisories/GHSA-8gcg-vwmw-rxj4; https://github.com/flarum/framework/commit/d0a2b95dca57d3dae9a0d77b610b1cb1d0b1766a
CVE: CVE-2022-46472
Published: 2023-01-12
Description: Helmet Store Showroom Site v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /hss/classes/Users.php?f=delete.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/MAO-qi/bug_report/blob/main/vendors/oretnom23/helmet-store-showroom-site/SQLi-1.md; https://github.com/MAO-qi/bug_report/blob/main/vendors/oretnom23/helmet-store-showroom-site/SQLi-1.md
CVE: CVE-2017-5242
Published: 2023-01-12
Description: Nexpose and InsightVM virtual appliances downloaded between April 5th, 2017 and May 3rd, 2017 contain identical SSH host keys. Normally, a unique SSH host key should be generated the first time a virtual appliance boots.
CVSS Score: 7.7 (HIGH)
CWE: CWE-321, CWE-330
References: https://www.rapid7.com/blog/post/2017/05/17/rapid7-nexpose-virtual-appliance-duplicate-ssh-host-key-cve-2017-5242/; https://www.rapid7.com/blog/post/2017/05/17/rapid7-nexpose-virtual-appliance-duplicate-ssh-host-key-cve-2017-5242/
CVE: CVE-2022-45728
Published: 2023-01-12
Description: Doctor Appointment Management System v1.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/sudoninja-noob/CVE-2022-45728/blob/main/CVE-2022-45728; https://github.com/sudoninja-noob/CVE-2022-45728/blob/main/CVE-2022-45728
CVE: CVE-2022-45729
Published: 2023-01-12
Description: A cross-site scripting (XSS) vulnerability in Doctor Appointment Management System v1.0.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Employee ID parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/sudoninja-noob/CVE-2022-45729/blob/main/CVE-2022-45729; https://github.com/sudoninja-noob/CVE-2022-45729/blob/main/CVE-2022-45729
CVE: CVE-2022-46622
Published: 2023-01-12
Description: A cross-site scripting (XSS) vulnerability in Judging Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the firstname parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/sudoninja-noob/CVE-2022-46622/blob/main/CVE-2022-46622; https://github.com/sudoninja-noob/CVE-2022-46622/blob/main/CVE-2022-46622
CVE: CVE-2022-46623
Published: 2023-01-12
Description: Judging Management System v1.0.0 was discovered to contain a SQL injection vulnerability via the username parameter.
CVSS Score: 7.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/sudoninja-noob/CVE-2022-46623/blob/main/CVE-2022-46623; https://github.com/sudoninja-noob/CVE-2022-46623/blob/main/CVE-2022-46623
CVE: CVE-2022-47102
Published: 2023-01-12
Description: A cross-site scripting (XSS) vulnerability in Student Study Center Management System V 1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the name parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/sudoninja-noob/CVE-2022-47102/blob/main/CVE-2022-47102; https://github.com/sudoninja-noob/CVE-2022-47102/blob/main/CVE-2022-47102
CVE: CVE-2023-0256
Published: 2023-01-12
Description: A vulnerability was found in SourceCodester Online Food Ordering System 2.0. It has been classified as critical. Affected is an unknown function of the file /fos/admin/ajax.php?action=login of the component Login Page. The manipulation of the argument Username leads to sql injection. It is possible to launch the attack remotely. The identifier of this vulnerability is VDB-218184.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://vuldb.com/?ctiid.218184; https://vuldb.com/?id.218184; https://vuldb.com/?ctiid.218184
CVE: CVE-2023-0257
Published: 2023-01-12
Description: A vulnerability was found in SourceCodester Online Food Ordering System 2.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /fos/admin/index.php?page=menu of the component Menu Form. The manipulation of the argument Image with the input <?php system($_GET['c']); ?> leads to unrestricted upload. The attack can be launched remotely. The identifier VDB-218185 was assigned to this vulnerability.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-434, CWE-434
References: https://vuldb.com/?ctiid.218185; https://vuldb.com/?id.218185; https://vuldb.com/?ctiid.218185
CVE: CVE-2023-0258
Published: 2023-01-12
Description: A vulnerability was found in SourceCodester Online Food Ordering System 2.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the component Category List Handler. The manipulation of the argument Reason with the input "><script>prompt(1)</script> leads to cross site scripting. The attack may be launched remotely. VDB-218186 is the identifier assigned to this vulnerability.
CVSS Score: 2.4 (LOW)
CWE: CWE-79
References: https://vuldb.com/?ctiid.218186; https://vuldb.com/?id.218186; https://vuldb.com/?ctiid.218186
CVE: CVE-2022-25026
Published: 2023-01-12
Description: A Server-Side Request Forgery (SSRF) in Rocket TRUfusion Portal v7.9.2.1 allows remote attackers to gain access to sensitive resources on the internal network via a crafted HTTP request to /trufusionPortal/upDwModuleProxy.
CVSS Score: 7.5 (HIGH)
CWE: CWE-918, CWE-918
References: https://labs.nettitude.com/blog/cve-2022-25026-cve-2022-25027-vulnerabilities-in-rocket-trufusion-enterprise/; https://labs.nettitude.com/blog/cve-2022-25026-cve-2022-25027-vulnerabilities-in-rocket-trufusion-enterprise/
CVE: CVE-2022-25027
Published: 2023-01-12
Description: The Forgotten Password functionality of Rocket TRUfusion Portal v7.9.2.1 allows remote attackers to bypass authentication and access restricted pages by validating the user's session token when the "Password forgotten?" button is clicked.
CVSS Score: 7.5 (HIGH)
CWE: CWE-640, CWE-287
References: https://labs.nettitude.com/blog/cve-2022-25026-cve-2022-25027-vulnerabilities-in-rocket-trufusion-enterprise/; https://labs.nettitude.com/blog/cve-2022-25026-cve-2022-25027-vulnerabilities-in-rocket-trufusion-enterprise/
CVE: CVE-2022-42272
Published: 2023-01-12
Description: NVIDIA BMC contains a vulnerability in IPMI handler, where an authorized attacker can cause a buffer overflow, which may lead to code execution, denial of service or escalation of privileges.
CVSS Score: 8.1 (HIGH)
CWE: CWE-120, CWE-120
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5435; https://nvidia.custhelp.com/app/answers/detail/a_id/5435
CVE: CVE-2022-42273
Published: 2023-01-12
Description: NVIDIA BMC contains a vulnerability in libwebsocket, where an authorized attacker can cause a buffer overflow and cause a denial of service or gain code execution.
CVSS Score: 8.1 (HIGH)
CWE: CWE-120, CWE-120
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5435; https://nvidia.custhelp.com/app/answers/detail/a_id/5435
CVE: CVE-2022-45148
Published: 2023-01-12
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2023-22597
Published: 2023-01-12
Description: 
InHand Networks InRouter 302, prior to version IR302 V3.5.56, and InRouter 615, prior to version InRouter6XX-S-V2.3.0.r5542, contain vulnerability CWE-319: Cleartext Transmission of Sensitive Information. They use an unsecured channel to communicate with the cloud platform by default. An unauthorized user could intercept this communication and steal sensitive information such as configuration information and MQTT credentials; this could allow MQTT command injection. 


CVSS Score: 6.5 (MEDIUM)
CWE: CWE-319
References: https://www.cisa.gov/uscert/ics/advisories/icsa-23-012-03; https://www.cisa.gov/uscert/ics/advisories/icsa-23-012-03
CVE: CVE-2023-22598
Published: 2023-01-12
Description: 
InHand Networks InRouter 302, prior to version IR302 V3.5.56, and InRouter 615, prior to version InRouter6XX-S-V2.3.0.r5542, contain vulnerability CWE-78:  Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'). 

An unauthorized user with privileged access to the local web interface or the cloud account managing the affected devices could push a specially crafted configuration update file to gain root access. This could lead to remote code execution with root privileges. 

 

 


CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://www.cisa.gov/uscert/ics/advisories/icsa-23-012-03; https://www.cisa.gov/uscert/ics/advisories/icsa-23-012-03
CVE: CVE-2023-22599
Published: 2023-01-12
Description: 
InHand Networks InRouter 302, prior to version IR302 V3.5.56, and InRouter 615, prior to version InRouter6XX-S-V2.3.0.r5542, contain vulnerability CWE-760: Use of a One-way Hash with a Predictable Salt. They 

send MQTT credentials in response to HTTP/HTTPS requests from the cloud platform. These credentials are encoded using a hardcoded string into an MD5 hash. This string could be easily calculated by an unauthorized user who spoofed sending an HTTP/HTTPS request to the devices. This could result in the affected devices being temporarily disconnected from the cloud platform and allow the user to receive MQTT commands with potentially sensitive information. 

 

 

 


CVSS Score: 7.0 (HIGH)
CWE: CWE-760
References: https://www.cisa.gov/uscert/ics/advisories/icsa-23-012-03; https://www.cisa.gov/uscert/ics/advisories/icsa-23-012-03
CVE: CVE-2023-22600
Published: 2023-01-12
Description: 
InHand Networks InRouter 302, prior to version IR302 V3.5.56, and InRouter 615, prior to version InRouter6XX-S-V2.3.0.r5542, contain vulnerability CWE-284: Improper Access Control. They allow unauthenticated devices to subscribe to MQTT topics on the same network as the device manager. An unauthorized user who knows of an existing topic name could send and receive messages to and from that topic. This includes the ability to send GET/SET configuration commands, reboot commands, and push firmware updates. 

 

 

 

 


CVSS Score: 10.0 (CRITICAL)
CWE: CWE-284
References: https://www.cisa.gov/uscert/ics/advisories/icsa-23-012-03; https://www.cisa.gov/uscert/ics/advisories/icsa-23-012-03
CVE: CVE-2023-22601
Published: 2023-01-12
Description: 
InHand Networks InRouter 302, prior to version IR302 V3.5.56, and InRouter 615, prior to version InRouter6XX-S-V2.3.0.r5542, contain vulnerability CWE-330: Use of Insufficiently Random Values. They do not properly randomize MQTT ClientID parameters. An unauthorized user could calculate this parameter and use it to gather additional information about other InHand devices managed on the same cloud platform. 

 

 

 

 

 


CVSS Score: 10.0 (CRITICAL)
CWE: CWE-330
References: https://www.cisa.gov/uscert/ics/advisories/icsa-23-012-03; https://www.cisa.gov/uscert/ics/advisories/icsa-23-012-03
CVE: CVE-2022-41778
Published: 2023-01-13
Description: 
Delta Electronics InfraSuite Device Master versions 00.00.01a and prior deserialize user-supplied data provided through the Device-DataCollect service port without proper verification. An attacker could provide malicious serialized objects to execute arbitrary code upon deserialization. 


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-298-07; https://www.cisa.gov/uscert/ics/advisories/icsa-22-298-07
CVE: CVE-2022-42704
Published: 2023-01-13
Description: A cross-site scripting (XSS) vulnerability in Employee Service Center (esc) and Service Portal (sp) in ServiceNow Quebec, Rome, and San Diego allows remote attackers to inject arbitrary web script via the Standard Ticket Conversations widget.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1216141; https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1216141
CVE: CVE-2022-46438
Published: 2023-01-13
Description: A cross-site scripting (XSS) vulnerability in the /admin/article_category.php component of DouPHP v1.7 20221118 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the description parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.yuque.com/ni4n/yesa2m/fem0pgtvgogay3lv; https://www.yuque.com/ni4n/yesa2m/fem0pgtvgogay3lv
CVE: CVE-2022-46463
Published: 2023-01-13
Description: An access control issue in Harbor v1.X.X to v2.5.3 allows attackers to access public and private image repositories without authentication. NOTE: the vendor's position is that this "is clearly described in the documentation as a feature."
CVSS Score: 7.5 (HIGH)
CWE: CWE-306, CWE-306
References: https://github.com/Vad1mo; https://github.com/lanqingaa/123/blob/main/README.md; https://github.com/lanqingaa/123/tree/bb48caa844d88b0e41e69157f2a2734311abf02d
CVE: CVE-2022-4616
Published: 2023-01-13
Description: The webserver in Delta DX-3021 versions prior to 1.24 is vulnerable to 
command injection through the network diagnosis page. This vulnerability
 could allow a remote unauthenticated user to add files, delete files, 
and change file permissions.


CVSS Score: 7.2 (HIGH)
CWE: CWE-77
References: https://downloadcenter.deltaww.com/en-US/DownloadCenter?v=1&CID=06&itemID=060308&downloadID=DX&dataType=12&sort_expr=cdate&sort_dir=DESC; https://www.cisa.gov/uscert/ics/advisories/icsa-22-354-05; https://downloadcenter.deltaww.com/en-US/DownloadCenter?v=1&CID=06&itemID=060308&downloadID=DX&dataType=12&sort_expr=cdate&sort_dir=DESC