deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-48196
Published: 2022-12-30
Description: Certain NETGEAR devices are affected by a buffer overflow by an unauthenticated attacker. This affects RAX40 before 1.0.2.60, RAX35 before 1.0.2.60, R6400v2 before 1.0.4.122, R6700v3 before 1.0.4.122, R6900P before 1.3.3.152, R7000P before 1.3.3.152, R7000 before 1.0.11.136, R7960P before 1.4.4.94, and R8000P before 1.4.4.94.
CVSS Score: 7.4 (HIGH)
CWE: CWE-120, CWE-120
References: https://kb.netgear.com/000065495/Security-Advisory-for-Pre-Authentication-Buffer-Overflow-on-Some-Routers-PSV-2019-0208; https://www.bleepingcomputer.com/news/security/netgear-warns-users-to-patch-recently-fixed-wifi-router-bug/; https://kb.netgear.com/000065495/Security-Advisory-for-Pre-Authentication-Buffer-Overflow-on-Some-Routers-PSV-2019-0208
CVE: CVE-2022-4855
Published: 2022-12-30
Description: A vulnerability, which was classified as critical, was found in SourceCodester Lead Management System 1.0. Affected is an unknown function of the file login.php. The manipulation of the argument username leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-217020.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://github.com/joinia/webray.com.cn/blob/main/lead-management-system/leadmanasql.md; https://vuldb.com/?ctiid.217020; https://vuldb.com/?id.217020
CVE: CVE-2022-4856
Published: 2022-12-30
Description: A vulnerability has been found in Modbus Tools Modbus Slave up to 7.5.1 and classified as critical. Affected by this vulnerability is an unknown functionality of the file mbslave.exe of the component mbs File Handler. The manipulation leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-217021 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-120
References: https://github.com/Durian1546/vul/blob/main/webray.com.cn/Modbus%20Slave/Modbus%20Slave%20(version%207.5.1%20and%20earlier)%20mbs%20file%20has%20a%20buffer%20overflow%20vulnerability.md; https://github.com/Durian1546/vul/blob/main/webray.com.cn/Modbus%20Slave/poc/poc.mbs; https://vuldb.com/?ctiid.217021
CVE: CVE-2022-4857
Published: 2022-12-30
Description: A vulnerability was found in Modbus Tools Modbus Poll up to 9.10.0 and classified as critical. Affected by this issue is some unknown functionality of the file mbpoll.exe of the component mbp File Handler. The manipulation leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-217022 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-120
References: https://github.com/Durian1546/vul/blob/main/webray.com.cn/Modbus%20Poll/Modbus%20Poll%20(version%209.10.0%20and%20earlier)%20mbp%20file%20has%20a%20buffer%20overflow%20vulnerability.md; https://github.com/Durian1546/vul/blob/main/webray.com.cn/Modbus%20Poll/poc/poc.mbp; https://vuldb.com/?ctiid.217022
CVE: CVE-2018-25059
Published: 2022-12-30
Description: A vulnerability was found in pastebinit up to 0.2.2 and classified as problematic. Affected by this issue is the function pasteHandler of the file server.go. The manipulation of the argument r.URL.Path leads to path traversal. Upgrading to version 0.2.3 is able to address this issue. The name of the patch is 1af2facb6d95976c532b7f8f82747d454a092272. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-217040.
CVSS Score: 3.5 (LOW)
CWE: CWE-22
References: https://github.com/jessfraz/pastebinit/commit/1af2facb6d95976c532b7f8f82747d454a092272; https://github.com/jessfraz/pastebinit/pull/3; https://github.com/jessfraz/pastebinit/releases/tag/v0.2.3
CVE: CVE-2022-43396
Published: 2022-12-30
Description: In the fix for CVE-2022-24697, a blacklist is used to filter user input commands. But there is a risk of being bypassed. The user can control the command by controlling the kylin.engine.spark-cmd parameter of conf.
CVSS Score: 8.8 (HIGH)
CWE: CWE-184
References: https://lists.apache.org/thread/ob2ks04zl5ms0r44cd74y1xdl1rzfd1r; https://lists.apache.org/thread/ob2ks04zl5ms0r44cd74y1xdl1rzfd1r
CVE: CVE-2022-44621
Published: 2022-12-30
Description: Diagnosis Controller miss parameter validation, so user may attacked by command injection via HTTP Request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-77
References: https://lists.apache.org/thread/7ctchj24dofgsj9g1rg1245cms9myb34; https://lists.apache.org/thread/7ctchj24dofgsj9g1rg1245cms9myb34
CVE: CVE-2017-20151
Published: 2022-12-30
Description: A vulnerability classified as problematic was found in iText RUPS. This vulnerability affects unknown code of the file src/main/java/com/itextpdf/rups/model/XfaFile.java. The manipulation leads to xml external entity reference. The patch is identified as ac[PII_REDACTED]ef810018a6b60fec216eee54fb32. It is recommended to apply a patch to fix this issue. VDB-217054 is the identifier assigned to this vulnerability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-611
References: https://github.com/itext/rups/commit/ac[PII_REDACTED]ef810018a6b60fec216eee54fb32; https://vuldb.com/?ctiid.217054; https://vuldb.com/?id.217054
CVE: CVE-2017-20152
Published: 2022-12-30
Description: A vulnerability, which was classified as problematic, was found in aerouk imageserve. Affected is an unknown function of the file public/viewer.php of the component File Handler. The manipulation of the argument filelocation leads to path traversal. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The name of the patch is bd23c784f0e5cb12f66d15c100248449f87d72e2. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-217056.
CVSS Score: 3.1 (LOW)
CWE: CWE-22
References: https://github.com/aerouk/imageserve/commit/bd23c784f0e5cb12f66d15c100248449f87d72e2; https://github.com/aerouk/imageserve/pull/27; https://vuldb.com/?ctiid.217056
CVE: CVE-2017-20153
Published: 2022-12-30
Description: A vulnerability has been found in aerouk imageserve and classified as problematic. Affected by this vulnerability is an unknown functionality. The manipulation of the argument REQUEST_URI leads to cross site scripting. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The identifier of the patch is 2ac3cd4f90b4df66874fab171376ca26868604c4. It is recommended to apply a patch to fix this issue. The identifier VDB-217057 was assigned to this vulnerability.
CVSS Score: 2.6 (LOW)
CWE: CWE-79
References: https://github.com/aerouk/imageserve/commit/2ac3cd4f90b4df66874fab171376ca26868604c4; https://github.com/aerouk/imageserve/pull/27; https://vuldb.com/?ctiid.217057
CVE: CVE-2018-25060
Published: 2022-12-30
Description: A vulnerability was found in Macaron csrf and classified as problematic. Affected by this issue is some unknown functionality of the file csrf.go. The manipulation of the argument Generate leads to sensitive cookie without secure attribute. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The patch is identified as dadd1711a617000b70e5e408a76531b73187031c. It is recommended to apply a patch to fix this issue. VDB-217058 is the identifier assigned to this vulnerability.
CVSS Score: 3.7 (LOW)
CWE: CWE-614, CWE-311
References: https://github.com/go-macaron/csrf/commit/dadd1711a617000b70e5e408a76531b73187031c; https://github.com/go-macaron/csrf/pull/7; https://vuldb.com/?ctiid.217058
CVE: CVE-2020-36637
Published: 2022-12-30
Description: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in Chris92de AdminServ. It has been declared as problematic. This vulnerability affects unknown code of the file resources/core/adminserv.php. The manipulation of the argument text leads to cross site scripting. The attack can be initiated remotely. The patch is identified as 3ed17dab3b4d6e8bf1c82ddfbf882314365e9cd7. It is recommended to apply a patch to fix this issue. VDB-217042 is the identifier assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-79
References: https://github.com/Chris92de/AdminServ/commit/3ed17dab3b4d6e8bf1c82ddfbf882314365e9cd7; https://github.com/Chris92de/AdminServ/pull/7; https://vuldb.com/?ctiid.217042
CVE: CVE-2020-36638
Published: 2022-12-30
Description: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in Chris92de AdminServ. It has been rated as problematic. This issue affects some unknown processing of the file resources/core/adminserv.php. The manipulation of the argument error leads to cross site scripting. The attack may be initiated remotely. The patch is named 9a[PII_REDACTED]5de6fb3a3fe38f[PII_REDACTED]4da1. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217043. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/Chris92de/AdminServ/commit/9a[PII_REDACTED]5de6fb3a3fe38f[PII_REDACTED]4da1; https://github.com/Chris92de/AdminServ/pull/6; https://vuldb.com/?ctiid.217043
CVE: CVE-2022-4858
Published: 2022-12-30
Description: Insertion of Sensitive Information into Log Files in M-Files Server before 22.10.11846.0 could allow to obtain sensitive tokens from logs, if specific configurations were set.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-532, CWE-532
References: https://empower.m-files.com/security-advisories/CVE-2022-4858; https://product.m-files.com/security-advisories/cve-2022-4858/; https://www.m-files.com/about/trust-center/security-advisories/cve-2022-4858/
CVE: CVE-2022-4859
Published: 2022-12-30
Description: A vulnerability, which was classified as problematic, has been found in Joget up to 7.0.33. This issue affects the function submitForm of the file wflow-core/src/main/java/org/joget/plugin/enterprise/UserProfileMenu.java of the component User Profile Menu. The manipulation of the argument firstName/lastName leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 7.0.34 is able to address this issue. The patch is named 9a77f508a2bf8cf661d588f37a4cc29ecaea4fc8. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-217055.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-79
References: https://github.com/jogetworkflow/jw-community/commit/9a77f508a2bf8cf661d588f37a4cc29ecaea4fc8; https://github.com/jogetworkflow/jw-community/releases/tag/7.0.34; https://vuldb.com/?ctiid.217055
CVE: CVE-2022-4860
Published: 2022-12-30
Description: A vulnerability was found in KBase Metrics. It has been classified as critical. This affects the function upload_user_data of the file source/daily_cron_jobs/methods_upload_user_stats.py. The manipulation leads to sql injection. The patch is named 959dfb6b05991e30b0fa972a1ecdcaae8e1dae6d. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217059.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://github.com/kbase/metrics/commit/959dfb6b05991e30b0fa972a1ecdcaae8e1dae6d; https://github.com/kbase/metrics/pull/77; https://vuldb.com/?ctiid.217059
CVE: CVE-2022-4861
Published: 2022-12-30
Description: Incorrect implementation in authentication protocol in M-Files Client before 22.5.11356.0 allows high privileged user to get other users tokens to another resource.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-303, CWE-287
References: https://empower.m-files.com/security-advisories/CVE-2022-4861; https://product.m-files.com/security-advisories/cve-2022-4861/; https://www.m-files.com/about/trust-center/security-advisories/cve-2022-4861/
CVE: CVE-2022-4863
Published: 2022-12-30
Description: Improper Handling of Insufficient Permissions or Privileges in GitHub repository usememos/memos prior to 0.9.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-280
References: https://github.com/usememos/memos/commit/3556ae4e651d9443dc3bb8a170dd3cc726517a53; https://huntr.dev/bounties/42751929-e511-49a9-888d-d5b610da2a45; https://github.com/usememos/memos/commit/3556ae4e651d9443dc3bb8a170dd3cc726517a53
CVE: CVE-2022-39159
Published: 2022-12-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none.
CVE: CVE-2017-12073
Published: 2022-12-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none.
CVE: CVE-2017-20154
Published: 2022-12-30
Description: A vulnerability was found in ghostlander Phoenixcoin. It has been classified as problematic. Affected is the function CTxMemPool::accept of the file src/main.cpp. The manipulation leads to denial of service. Upgrading to version 0.6.6.1-pxc is able to address this issue. The name of the patch is 987dd68f71a7d8276cef3b6c3d578fd4845b5699. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-217068.
CVSS Score: 3.5 (LOW)
CWE: CWE-404
References: https://github.com/ghostlander/Phoenixcoin/commit/987dd68f71a7d8276cef3b6c3d578fd4845b5699; https://github.com/ghostlander/Phoenixcoin/releases/tag/v0.6.6.1-pxc; https://vuldb.com/?ctiid.217068
CVE: CVE-2022-3905
Published: 2022-12-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none.
CVE: CVE-2022-46580
Published: 2022-12-30
Description: TRENDnet TEW755AP 1.13B01 was discovered to contain a stack overflow via the user_edit_page parameter in the wifi_captive_portal function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://brief-nymphea-813.notion.site/Vul6-TEW755-bof-wifi_captive_portal-d2b3d37344564ed4b3948a471d1eeb11; https://brief-nymphea-813.notion.site/Vul6-TEW755-bof-wifi_captive_portal-d2b3d37344564ed4b3948a471d1eeb11
CVE: CVE-2022-46581
Published: 2022-12-30
Description: TRENDnet TEW755AP 1.13B01 was discovered to contain a stack overflow via the cameo.cameo.nslookup_target parameter in the tools_nslookup function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://brief-nymphea-813.notion.site/Vul5-TEW755-bof-tools_nslookup-c83bac14fe0f4f[PII_REDACTED]59479fd1; https://brief-nymphea-813.notion.site/Vul5-TEW755-bof-tools_nslookup-c83bac14fe0f4f[PII_REDACTED]59479fd1
CVE: CVE-2022-46582
Published: 2022-12-30
Description: TRENDnet TEW755AP 1.13B01 was discovered to contain a stack overflow via the login_name parameter in the do_graph_auth (sub_4061E0) function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://brief-nymphea-813.notion.site/Vul1-TEW755-bof-do_graph_auth-06984af9eb224f7fbcd27dbb6d7d2a2d; https://brief-nymphea-813.notion.site/Vul1-TEW755-bof-do_graph_auth-06984af9eb224f7fbcd27dbb6d7d2a2d
CVE: CVE-2022-46583
Published: 2022-12-30
Description: TRENDnet TEW755AP 1.13B01 was discovered to contain a stack overflow via the reboot_type parameter in the wizard_ipv6 (sub_41C380) function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://brief-nymphea-813.notion.site/Vul2-TEW755-bof-wizard_ipv6-7ed96443609f4640b5f0f3bd6ce23b83; https://brief-nymphea-813.notion.site/Vul2-TEW755-bof-wizard_ipv6-7ed96443609f4640b5f0f3bd6ce23b83
CVE: CVE-2022-46584
Published: 2022-12-30
Description: TRENDnet TEW755AP 1.13B01 was discovered to contain a stack overflow via the qcawifi.wifi%d_vap%d.maclist parameter in the kick_ban_wifi_mac_deny (sub_415D7C) function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://brief-nymphea-813.notion.site/Vul4-TEW755-bof-kick_ban_wifi_mac_deny-a[PII_REDACTED]848d9a313c35b081e0793; https://brief-nymphea-813.notion.site/Vul4-TEW755-bof-kick_ban_wifi_mac_deny-a[PII_REDACTED]848d9a313c35b081e0793
CVE: CVE-2022-46585
Published: 2022-12-30
Description: TRENDnet TEW755AP 1.13B01 was discovered to contain a stack overflow via the REMOTE_USER parameter in the get_access (sub_45AC2C) function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://brief-nymphea-813.notion.site/Vul7-TEW755-bof-create_folder[PII_REDACTED]de4b1e9d2aee28386bdc04; https://brief-nymphea-813.notion.site/Vul7-TEW755-bof-create_folder[PII_REDACTED]de4b1e9d2aee28386bdc04
CVE: CVE-2022-46586
Published: 2022-12-30
Description: TRENDnet TEW755AP 1.13B01 was discovered to contain a stack overflow via the qcawifi.wifi%d_vap%d.maclist parameter in the kick_ban_wifi_mac_allow (sub_415B00) function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://brief-nymphea-813.notion.site/Vul3-TEW755-bof-kick_ban_wifi_mac_allow-4624d89edfc54084ada1f4c8dbfa452d; https://brief-nymphea-813.notion.site/Vul3-TEW755-bof-kick_ban_wifi_mac_allow-4624d89edfc54084ada1f4c8dbfa452d
CVE: CVE-2022-46588
Published: 2022-12-30
Description: TRENDnet TEW755AP 1.13B01 was discovered to contain a stack overflow via the sys_service parameter in the setup_wizard_mydlink (sub_4104B8) function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://brief-nymphea-813.notion.site/Vul7-TEW755-bof-setup_wizard_mydlink-7bb35b55f74a4d57bc5bc5d411ef8831; https://brief-nymphea-813.notion.site/Vul7-TEW755-bof-setup_wizard_mydlink-7bb35b55f74a4d57bc5bc5d411ef8831
CVE: CVE-2022-46589
Published: 2022-12-30
Description: TRENDnet TEW755AP 1.13B01 was discovered to contain a stack overflow via the cameo.cameo.netstat_option parameter in the tools_netstat (sub_41E730) function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://brief-nymphea-813.notion.site/Vul3-TEW755-bof-tools_netstat-30ffd80903384bc5bbadae07ff6612f1; https://brief-nymphea-813.notion.site/Vul3-TEW755-bof-tools_netstat-30ffd80903384bc5bbadae07ff6612f1
CVE: CVE-2022-46590
Published: 2022-12-30
Description: TRENDnet TEW755AP 1.13B01 was discovered to contain a stack overflow via the cameo.cameo.netstat_rsname parameter in the tools_netstat (sub_41E730) function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://brief-nymphea-813.notion.site/Vul4-TEW755-bof-tools_netstat-2804b2eab6e14846af539fce8d90b564; https://brief-nymphea-813.notion.site/Vul4-TEW755-bof-tools_netstat-2804b2eab6e14846af539fce8d90b564
CVE: CVE-2022-46591
Published: 2022-12-30
Description: TRENDnet TEW755AP 1.13B01 was discovered to contain a stack overflow via the reject_url parameter in the reject (sub_41BD60) function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://brief-nymphea-813.notion.site/Vul2-TEW755-bof-reject-0ed4829f416d4d2b86a3bce6792cab95; https://brief-nymphea-813.notion.site/Vul2-TEW755-bof-reject-0ed4829f416d4d2b86a3bce6792cab95
CVE: CVE-2022-46592
Published: 2022-12-30
Description: TRENDnet TEW755AP 1.13B01 was discovered to contain a stack overflow via the wps_sta_enrollee_pin parameter in the set_sta_enrollee_pin_5g function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://brief-nymphea-813.notion.site/Vul8-TEW755-bof-set_sta_enrollee_pin_5g-60fb8f382256478dbe8d4c9c35e8dd60; https://brief-nymphea-813.notion.site/Vul8-TEW755-bof-set_sta_enrollee_pin_5g-60fb8f382256478dbe8d4c9c35e8dd60
CVE: CVE-2022-46593
Published: 2022-12-30
Description: TRENDnet TEW755AP 1.13B01 was discovered to contain a stack overflow via the wps_sta_enrollee_pin parameter in the do_sta_enrollee_wifi function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://brief-nymphea-813.notion.site/Vul6-TEW755-bof-do_sta_enrollee_wifi-11ba97191f944eeb88f495091926b7a9; https://brief-nymphea-813.notion.site/Vul6-TEW755-bof-do_sta_enrollee_wifi-11ba97191f944eeb88f495091926b7a9
CVE: CVE-2022-46594
Published: 2022-12-30
Description: TRENDnet TEW755AP 1.13B01 was discovered to contain a stack overflow via the update_file_name parameter in the auto_up_fw (sub_420A04) function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://brief-nymphea-813.notion.site/Vul1-TEW755-bof-auto_up_fw-1359a9e4b8ee4ad6b8632cc4a3e6eec1; https://brief-nymphea-813.notion.site/Vul1-TEW755-bof-auto_up_fw-1359a9e4b8ee4ad6b8632cc4a3e6eec1
CVE: CVE-2022-46596
Published: 2022-12-30
Description: TRENDnet TEW755AP 1.13B01 was discovered to contain a stack overflow via the del_num parameter in the icp_delete_img (sub_41DEDC) function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://brief-nymphea-813.notion.site/Vul6-TEW755-bof-icp_delete_img-ed2df4b6b4f74520bda8adead2d0d651; https://brief-nymphea-813.notion.site/Vul6-TEW755-bof-icp_delete_img-ed2df4b6b4f74520bda8adead2d0d651
CVE: CVE-2022-46597
Published: 2022-12-30
Description: TRENDnet TEW755AP 1.13B01 was discovered to contain a command injection vulnerability via the sys_service parameter in the setup_wizard_mydlink (sub_4104B8) function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://brief-nymphea-813.notion.site/Vul1-TEW755-command-injection-setup_wizard_mydlink-dccea20f75e[PII_REDACTED]3126612feba; https://brief-nymphea-813.notion.site/Vul1-TEW755-command-injection-setup_wizard_mydlink-dccea20f75e[PII_REDACTED]3126612feba
CVE: CVE-2022-46598
Published: 2022-12-30
Description: TRENDnet TEW755AP 1.13B01 was discovered to contain a command injection vulnerability via the wps_sta_enrollee_pin parameter in the action set_sta_enrollee_pin_5g function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://brief-nymphea-813.notion.site/Vul3-TEW755-injection-set_sta_enrollee_pin_5g-b903e73d59b940c8a79bf4425dfdf992; https://brief-nymphea-813.notion.site/Vul3-TEW755-injection-set_sta_enrollee_pin_5g-b903e73d59b940c8a79bf4425dfdf992
CVE: CVE-2022-46599
Published: 2022-12-30
Description: TRENDnet TEW755AP 1.13B01 was discovered to contain a stack overflow via the setlogo_num parameter in the icp_setlogo_img (sub_41DBF4) function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://brief-nymphea-813.notion.site/Vul5-TEW755-bof-icp_setlogo_img-692484d9166046e481afc08a8f50e757; https://brief-nymphea-813.notion.site/Vul5-TEW755-bof-icp_setlogo_img-692484d9166046e481afc08a8f50e757
CVE: CVE-2022-46600
Published: 2022-12-30
Description: TRENDnet TEW755AP 1.13B01 was discovered to contain a stack overflow via the wps_sta_enrollee_pin parameter in the action set_sta_enrollee_pin_24g function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://brief-nymphea-813.notion.site/Vul4-TEW755-injection-set_sta_enrollee_pin_24g-f91b4c03489146af804fe59a3f44d0d3; https://brief-nymphea-813.notion.site/Vul4-TEW755-injection-set_sta_enrollee_pin_24g-f91b4c03489146af804fe59a3f44d0d3
CVE: CVE-2022-46601
Published: 2022-12-30
Description: TRENDnet TEW755AP 1.13B01 was discovered to contain a stack overflow via the setbg_num parameter in the icp_setbg_img (sub_41DD68) function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://brief-nymphea-813.notion.site/Vul7-TEW755-bof-icp_setbg_img-455dda602d934577a16fbed88251ab26; https://brief-nymphea-813.notion.site/Vul7-TEW755-bof-icp_setbg_img-455dda602d934577a16fbed88251ab26
CVE: CVE-2022-47115
Published: 2022-12-30
Description: Tenda A15 V15.13.07.13 was discovered to contain a stack overflow via the wepauth parameter at /goform/WifiBasicSet.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://brief-nymphea-813.notion.site/Vul5-A15-bof-WifiBasicSet-wepauth-e1b6244caaf44f1a940b7aa861859828; https://brief-nymphea-813.notion.site/Vul5-A15-bof-WifiBasicSet-wepauth-e1b6244caaf44f1a940b7aa861859828
CVE: CVE-2022-47116
Published: 2022-12-30
Description: Tenda A15 V15.13.07.13 was discovered to contain a stack overflow via the SYSPS parameter at /goform/SysToolChangePwd.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-787
References: https://brief-nymphea-813.notion.site/Vul1-A15-bof-SysToolChangePwd-6a66d9f7a7e748deb8ebed544931bd29; https://brief-nymphea-813.notion.site/Vul1-A15-bof-SysToolChangePwd-6a66d9f7a7e748deb8ebed544931bd29