deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-21577
Published: 2022-07-19
Description: Vulnerability in the Oracle FLEXCUBE Universal Banking product of Oracle Financial Services Applications (component: Infrastructure). Supported versions that are affected are 12.1-12.4, 14.0-14.3 and 14.5. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Universal Banking. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle FLEXCUBE Universal Banking accessible data as well as unauthorized access to critical data or complete access to all Oracle FLEXCUBE Universal Banking accessible data. CVSS 3.1 Base Score 6.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N).
CVSS Score: 6.4 (MEDIUM)
References: https://www.oracle.com/security-alerts/cpujul2022.html; https://www.oracle.com/security-alerts/cpujul2022.html
CVE: CVE-2022-21578
Published: 2022-07-19
Description: Vulnerability in the Oracle FLEXCUBE Universal Banking product of Oracle Financial Services Applications (component: Infrastructure). Supported versions that are affected are 12.1-12.4, 14.0-14.3 and 14.5. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Universal Banking. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle FLEXCUBE Universal Banking accessible data as well as unauthorized access to critical data or complete access to all Oracle FLEXCUBE Universal Banking accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle FLEXCUBE Universal Banking. CVSS 3.1 Base Score 6.7 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L).
CVSS Score: 6.7 (MEDIUM)
References: https://www.oracle.com/security-alerts/cpujul2022.html; https://www.oracle.com/security-alerts/cpujul2022.html
CVE: CVE-2022-21579
Published: 2022-07-19
Description: Vulnerability in the Oracle FLEXCUBE Universal Banking product of Oracle Financial Services Applications (component: Infrastructure). Supported versions that are affected are 12.1-12.4, 14.0-14.3 and 14.5. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Universal Banking. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle FLEXCUBE Universal Banking accessible data as well as unauthorized access to critical data or complete access to all Oracle FLEXCUBE Universal Banking accessible data. CVSS 3.1 Base Score 6.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N).
CVSS Score: 6.4 (MEDIUM)
References: https://www.oracle.com/security-alerts/cpujul2022.html; https://www.oracle.com/security-alerts/cpujul2022.html
CVE: CVE-2022-21580
Published: 2022-07-19
Description: Vulnerability in the Oracle Financial Services Revenue Management and Billing product of Oracle Financial Services Applications (component: Infrastructure). Supported versions that are affected are 2.9.0.0.0, 2.9.0.1.0, 3.0.0.0.0-3.2.0.0.0 and 4.0.0.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Financial Services Revenue Management and Billing. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Financial Services Revenue Management and Billing accessible data as well as unauthorized update, insert or delete access to some of Oracle Financial Services Revenue Management and Billing accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Financial Services Revenue Management and Billing. CVSS 3.1 Base Score 5.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:L).
CVSS Score: 5.9 (MEDIUM)
References: https://www.oracle.com/security-alerts/cpujul2022.html; https://www.oracle.com/security-alerts/cpujul2022.html
CVE: CVE-2022-21581
Published: 2022-07-19
Description: Vulnerability in the Oracle Banking Trade Finance product of Oracle Financial Services Applications (component: Infrastructure). The supported version that is affected is 14.5. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Banking Trade Finance. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Banking Trade Finance accessible data as well as unauthorized read access to a subset of Oracle Banking Trade Finance accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Banking Trade Finance. CVSS 3.1 Base Score 5.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:H/A:L).
CVSS Score: 5.9 (MEDIUM)
References: https://www.oracle.com/security-alerts/cpujul2022.html; https://www.oracle.com/security-alerts/cpujul2022.html
CVE: CVE-2022-21582
Published: 2022-07-19
Description: Vulnerability in the Oracle Banking Trade Finance product of Oracle Financial Services Applications (component: Infrastructure). The supported version that is affected is 14.5. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Banking Trade Finance. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Banking Trade Finance accessible data as well as unauthorized access to critical data or complete access to all Oracle Banking Trade Finance accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Banking Trade Finance. CVSS 3.1 Base Score 6.7 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L).
CVSS Score: 6.7 (MEDIUM)
References: https://www.oracle.com/security-alerts/cpujul2022.html; https://www.oracle.com/security-alerts/cpujul2022.html
CVE: CVE-2022-21583
Published: 2022-07-19
Description: Vulnerability in the Oracle Banking Trade Finance product of Oracle Financial Services Applications (component: Infrastructure). The supported version that is affected is 14.5. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Banking Trade Finance. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Banking Trade Finance accessible data as well as unauthorized update, insert or delete access to some of Oracle Banking Trade Finance accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Banking Trade Finance. CVSS 3.1 Base Score 6.4 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L).
CVSS Score: 6.4 (MEDIUM)
References: https://www.oracle.com/security-alerts/cpujul2022.html; https://www.oracle.com/security-alerts/cpujul2022.html
CVE: CVE-2022-21584
Published: 2022-07-19
Description: Vulnerability in the Oracle Banking Trade Finance product of Oracle Financial Services Applications (component: Infrastructure). The supported version that is affected is 14.5. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Banking Trade Finance. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Banking Trade Finance accessible data as well as unauthorized access to critical data or complete access to all Oracle Banking Trade Finance accessible data. CVSS 3.1 Base Score 6.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N).
CVSS Score: 6.4 (MEDIUM)
References: https://www.oracle.com/security-alerts/cpujul2022.html; https://www.oracle.com/security-alerts/cpujul2022.html
CVE: CVE-2022-21585
Published: 2022-07-19
Description: Vulnerability in the Oracle Banking Trade Finance product of Oracle Financial Services Applications (component: Infrastructure). The supported version that is affected is 14.5. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Banking Trade Finance. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Banking Trade Finance accessible data as well as unauthorized access to critical data or complete access to all Oracle Banking Trade Finance accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Banking Trade Finance. CVSS 3.1 Base Score 6.7 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L).
CVSS Score: 6.7 (MEDIUM)
References: https://www.oracle.com/security-alerts/cpujul2022.html; https://www.oracle.com/security-alerts/cpujul2022.html
CVE: CVE-2022-21586
Published: 2022-07-19
Description: Vulnerability in the Oracle Banking Trade Finance product of Oracle Financial Services Applications (component: Infrastructure). The supported version that is affected is 14.5. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Banking Trade Finance. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Banking Trade Finance accessible data as well as unauthorized access to critical data or complete access to all Oracle Banking Trade Finance accessible data. CVSS 3.1 Base Score 6.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N).
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-284
References: https://www.oracle.com/security-alerts/cpujul2022.html; https://www.oracle.com/security-alerts/cpujul2022.html
CVE: CVE-2022-32456
Published: 2022-07-20
Description: Digiwin BPM’s function has insufficient validation for user input. An unauthenticated remote attacker can inject arbitrary SQL command to access, modify, delete database or disrupt service.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://www.chtsecurity.com/news/09757883-fea6-4aff-9e22-8ae8c4f8f7bb; https://www.twcert.org.tw/tw/cp-132-6286-3030a-1.html; https://www.chtsecurity.com/news/09757883-fea6-4aff-9e22-8ae8c4f8f7bb
CVE: CVE-2022-32457
Published: 2022-07-20
Description: Digiwin BPM has inadequate filtering for URL parameter. An unauthenticated remote attacker can perform Blind SSRF attack to discover internal network topology base on URL error response.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-918, CWE-918
References: https://www.chtsecurity.com/news/09757883-fea6-4aff-9e22-8ae8c4f8f7bb; https://www.twcert.org.tw/tw/cp-132-6287-20ef0-1.html; https://www.chtsecurity.com/news/09757883-fea6-4aff-9e22-8ae8c4f8f7bb
CVE: CVE-2022-32458
Published: 2022-07-20
Description: Digiwin BPM has a XML External Entity Injection (XXE) vulnerability due to insufficient validation for user input. An unauthenticated remote attacker can perform XML injection attack to access arbitrary system files.
CVSS Score: 7.5 (HIGH)
CWE: CWE-611, CWE-611
References: https://www.chtsecurity.com/news/09757883-fea6-4aff-9e22-8ae8c4f8f7bb; https://www.twcert.org.tw/tw/cp-132-6288-49e01-1.html; https://www.chtsecurity.com/news/09757883-fea6-4aff-9e22-8ae8c4f8f7bb
CVE: CVE-2022-32958
Published: 2022-07-20
Description: A remote attacker with general user privilege can send a message to Teamplus Pro’s chat group that exceeds message size limit, to terminate other recipients’ Teamplus Pro chat process.
CVSS Score: 7.7 (HIGH)
CWE: CWE-770, CWE-770
References: https://www.twcert.org.tw/tw/cp-132-6289-a5524-1.html; https://www.twcert.org.tw/tw/cp-132-6289-a5524-1.html
CVE: CVE-2022-32959
Published: 2022-07-20
Description: HiCOS’ client-side citizen digital certificate component has a stack-based buffer overflow vulnerability when reading IC card due to insufficient parameter length validation for OS information. An unauthenticated physical attacker can exploit this vulnerability to execute arbitrary code, manipulate system data or terminate service.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-787
References: https://www.twcert.org.tw/tw/cp-132-6290-738fe-1.html; https://www.twcert.org.tw/tw/cp-132-6290-738fe-1.html
CVE: CVE-2022-32960
Published: 2022-07-20
Description: HiCOS’ client-side citizen digital certificate component has a stack-based buffer overflow vulnerability when reading IC card due to insufficient parameter length validation for card number. An unauthenticated physical attacker can exploit this vulnerability to execute arbitrary code, manipulate system data or terminate service.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://www.twcert.org.tw/tw/cp-132-6291-f58b5-1.html; https://www.twcert.org.tw/tw/cp-132-6291-f58b5-1.html
CVE: CVE-2022-32961
Published: 2022-07-20
Description: HICOS’ client-side citizen digital certificate component has a stack-based buffer overflow vulnerability when reading IC card due to insufficient parameter length validation for token information. An unauthenticated physical attacker can exploit this vulnerability to execute arbitrary code, manipulate system data or terminate service.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://www.twcert.org.tw/tw/cp-132-6292-fb267-1.html; https://www.twcert.org.tw/tw/cp-132-6292-fb267-1.html
CVE: CVE-2022-32962
Published: 2022-07-20
Description: HiCOS’ client-side citizen certificate component has a double free vulnerability. An unauthenticated physical attacker can exploit this vulnerability to corrupt memory and execute arbitrary code, manipulate system data or terminate service.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-415, CWE-415
References: https://www.twcert.org.tw/tw/cp-132-6293-86576-1.html; https://www.twcert.org.tw/tw/cp-132-6293-86576-1.html
CVE: CVE-2021-46828
Published: 2022-07-20
Description: In libtirpc before 1.3.3rc1, remote attackers could exhaust the file descriptors of a process that uses libtirpc because idle TCP connections are mishandled. This can, in turn, lead to an svc_run infinite loop without accepting new connections.
CVSS Score: 7.5 (HIGH)
CWE: CWE-755, CWE-835, CWE-755
References: http://git.linux-nfs.org/?p=steved/libtirpc.git%3Ba=commit%3Bh=[PII_REDACTED]0cef4c73fb9b9c4104fdc510f701ed; https://lists.debian.org/debian-lts-announce/2022/08/msg00004.html; https://security.gentoo.org/glsa/202210-33
CVE: CVE-2022-33967
Published: 2022-07-20
Description: squashfs filesystem implementation of U-Boot versions from v2020.10-rc2 to v2022.07-rc5 contains a heap-based buffer overflow vulnerability due to a defect in the metadata reading process. Loading a specially crafted squashfs image may lead to a denial-of-service (DoS) condition or arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://jvn.jp/en/vu/JVNVU97846460/index.html; https://lists.denx.de/pipermail/u-boot/2022-June/487467.html; https://source.denx.de/u-boot/u-boot/-/commit/7f7fb9937c6cb49dd35153bd6708872b390b0a44
CVE: CVE-2022-34866
Published: 2022-07-20
Description: Passage Drive versions v1.4.0 to v1.5.1.0 and Passage Drive for Box version v1.0.0 contain an insufficient data verification vulnerability for interprocess communication. By running a malicious program, an arbitrary OS command may be executed with LocalSystem privilege of the Windows system where the product is running.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://jvn.jp/en/jp/JVN23766146/index.html; https://www.yrl.com/fwp_support/info/a1hrbt[PII_REDACTED].html; https://jvn.jp/en/jp/JVN23766146/index.html
CVE: CVE-2022-31250
Published: 2022-07-20
Description: A UNIX Symbolic Link (Symlink) Following vulnerability in keylime of openSUSE Tumbleweed allows local attackers to escalate from the keylime user to root. This issue affects: openSUSE Tumbleweed keylime versions prior to 6.4.2-1.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-59, CWE-59
References: https://bugzilla.suse.com/show_bug.cgi?id=1200885; https://bugzilla.suse.com/show_bug.cgi?id=1200885
CVE: CVE-2022-2486
Published: 2022-07-20
Description: A vulnerability, which was classified as critical, was found in WAVLINK WN535K2 and WN535K3. This affects an unknown part of the file /cgi-bin/mesh.cgi?page=upgrade. The manipulation of the argument key leads to os command injection. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.0 (HIGH)
CWE: CWE-78, CWE-78
References: https://github.com/1angx/webray.com.cn/blob/main/Wavlink/Wavlink%20mesh.cgi.md; https://vuldb.com/?id.204537; https://github.com/1angx/webray.com.cn/blob/main/Wavlink/Wavlink%20mesh.cgi.md
CVE: CVE-2022-2487
Published: 2022-07-20
Description: A vulnerability has been found in WAVLINK WN535K2 and WN535K3 and classified as critical. This vulnerability affects unknown code of the file /cgi-bin/nightled.cgi. The manipulation of the argument start_hour leads to os command injection. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.0 (HIGH)
CWE: CWE-78, CWE-78
References: https://github.com/1angx/webray.com.cn/blob/main/Wavlink/Wavlink%20nightled.cgi%20.md; https://vuldb.com/?id.204538; https://github.com/1angx/webray.com.cn/blob/main/Wavlink/Wavlink%20nightled.cgi%20.md
CVE: CVE-2022-2488
Published: 2022-07-20
Description: A vulnerability was found in WAVLINK WN535K2 and WN535K3 and classified as critical. This issue affects some unknown processing of the file /cgi-bin/touchlist_sync.cgi. The manipulation of the argument IP leads to os command injection. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.0 (HIGH)
CWE: CWE-78, CWE-78
References: https://github.com/1angx/webray.com.cn/blob/main/Wavlink/Wavlink%20touchlist_sync.cgi.md; https://vuldb.com/?id.204539; https://github.com/1angx/webray.com.cn/blob/main/Wavlink/Wavlink%20touchlist_sync.cgi.md
CVE: CVE-2022-2489
Published: 2022-07-20
Description: A vulnerability was found in SourceCodester Simple E-Learning System 1.0. It has been rated as critical. This issue affects some unknown processing of the file classRoom.php. The manipulation of the argument classCode with the input 1'||(SELECT 0x6770715a WHERE 8795=8795 AND (SELECT 8342 FROM(SELECT COUNT(*),CONCAT(0x7171786b71,(SELECT (ELT(8342=8342,1))),0x717a7a7671,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a))||' leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://github.com/xiahao90/CVEproject/blob/main/xiahao.webray.com.cn/Simple-E-Learning-System.md; https://vuldb.com/?id.204551; https://github.com/xiahao90/CVEproject/blob/main/xiahao.webray.com.cn/Simple-E-Learning-System.md
CVE: CVE-2022-2490
Published: 2022-07-20
Description: A vulnerability classified as critical has been found in SourceCodester Simple E-Learning System 1.0. Affected is an unknown function of the file search.php. The manipulation of the argument classCode with the input 1'||(SELECT 0x74666264 WHERE 5610=5610 AND (SELECT 7504 FROM(SELECT COUNT(*),CONCAT(0x7171627a71,(SELECT (ELT(7504=7504,1))),0x71717a7071,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a))||' leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://github.com/xiahao90/CVEproject/blob/main/xiahao.webray.com.cn/Simple-E-Learning-System.md#search.php; https://vuldb.com/?id.204552; https://github.com/xiahao90/CVEproject/blob/main/xiahao.webray.com.cn/Simple-E-Learning-System.md#search.php
CVE: CVE-2022-2491
Published: 2022-07-20
Description: A vulnerability has been found in SourceCodester Library Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file lab.php. The manipulation of the argument Section with the input 1' UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,CONCAT(0x71716b7171,0x546e4444736b7743575a666d4873746a[PII_REDACTED]527a[PII_REDACTED][PII_REDACTED]664143694c6a4c,0x7162706b71),NULL,NULL,NULL,NULL# leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://github.com/xiahao90/CVEproject/blob/main/xiahao.webray.com.cn/Library-Management-System-with-QR-code-Attendance-and-Auto-Generate-Library-Card.md; https://vuldb.com/?id.204574; https://github.com/xiahao90/CVEproject/blob/main/xiahao.webray.com.cn/Library-Management-System-with-QR-code-Attendance-and-Auto-Generate-Library-Card.md
CVE: CVE-2022-2492
Published: 2022-07-20
Description: A vulnerability was found in SourceCodester Library Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /index.php. The manipulation of the argument RollNo with the input admin' AND (SELECT 2625 FROM (SELECT(SLEEP(5)))MdIL) AND 'KXmq'='KXmq&[CREDENTIAL_REDACTED] leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://github.com/xiahao90/CVEproject/blob/main/xiahao.webray.com.cn/Library-Management-System-with-QR-code-Attendance-and-Auto-Generate-Library-Card.md#index.php; https://vuldb.com/?id.204575; https://github.com/xiahao90/CVEproject/blob/main/xiahao.webray.com.cn/Library-Management-System-with-QR-code-Attendance-and-Auto-Generate-Library-Card.md#index.php
CVE: CVE-2021-31858
Published: 2022-07-20
Description: DotNetNuke (DNN) 9.9.1 CMS is vulnerable to a Stored Cross-Site Scripting vulnerability in the user profile biography section which allows remote authenticated users to inject arbitrary code via a crafted payload.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://labs.integrity.pt/advisories/cve-2021-31858/; https://www.dnnsoftware.com/community/security/security-center; https://labs.integrity.pt/advisories/cve-2021-31858/
CVE: CVE-2022-24657
Published: 2022-07-20
Description: Goldshell ASIC Miners v2.1.x was discovered to contain hardcoded credentials which allow attackers to remotely connect via the SSH protocol (port 22).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://github.com/goldshellminer/firmware; https://jamesachambers.com/cryptocurrency-asic-miners-security-and-hacking-audit/; https://github.com/goldshellminer/firmware
CVE: CVE-2022-24659
Published: 2022-07-20
Description: Goldshell ASIC Miners v2.2.1 and below was discovered to contain a path traversal vulnerability which allows unauthenticated attackers to retrieve arbitrary files from the device.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://github.com/goldshellminer/firmware; https://jamesachambers.com/cryptocurrency-asic-miners-security-and-hacking-audit/; https://github.com/goldshellminer/firmware