deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-3492
Published: 2022-10-13
Description: A vulnerability classified as critical was found in SourceCodester Human Resource Management System 1.0. This vulnerability affects unknown code of the component Profile Photo Handler. The manipulation of the argument parameter leads to os command injection. The attack can be initiated remotely. The identifier of this vulnerability is VDB-210772.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-707, CWE-78
References: https://vuldb.com/?id.210772; https://vuldb.com/?id.210772
CVE: CVE-2022-3493
Published: 2022-10-13
Description: A vulnerability, which was classified as problematic, has been found in SourceCodester Human Resource Management System 1.0. This issue affects some unknown processing of the component Add Employee Handler. The manipulation of the argument First Name/Middle Name/Last Name leads to cross site scripting. The attack may be initiated remotely. The identifier VDB-210773 was assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-707, CWE-79
References: https://vuldb.com/?id.210773; https://vuldb.com/?id.210773
CVE: CVE-2020-26839
Published: 2022-10-13
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none.
CVE: CVE-2020-26840
Published: 2022-10-13
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none.
CVE: CVE-2020-26841
Published: 2022-10-13
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none.
CVE: CVE-2020-26842
Published: 2022-10-13
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none.
CVE: CVE-2020-26843
Published: 2022-10-13
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none.
CVE: CVE-2020-26844
Published: 2022-10-13
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none.
CVE: CVE-2020-26845
Published: 2022-10-13
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none.
CVE: CVE-2020-26846
Published: 2022-10-13
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none.
CVE: CVE-2020-26847
Published: 2022-10-13
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none.
CVE: CVE-2020-26848
Published: 2022-10-13
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none.
CVE: CVE-2020-26849
Published: 2022-10-13
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none.
CVE: CVE-2020-26850
Published: 2022-10-13
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none.
CVE: CVE-2020-26851
Published: 2022-10-13
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none.
CVE: CVE-2020-26852
Published: 2022-10-13
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none.
CVE: CVE-2020-26853
Published: 2022-10-13
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none.
CVE: CVE-2020-26854
Published: 2022-10-13
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none.
CVE: CVE-2020-26855
Published: 2022-10-13
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none.
CVE: CVE-2020-26856
Published: 2022-10-13
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none.
CVE: CVE-2020-26857
Published: 2022-10-13
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none.
CVE: CVE-2020-26858
Published: 2022-10-13
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none.
CVE: CVE-2020-26859
Published: 2022-10-13
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none.
CVE: CVE-2020-26860
Published: 2022-10-13
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none.
CVE: CVE-2020-26861
Published: 2022-10-13
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none.
CVE: CVE-2020-26862
Published: 2022-10-13
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none.
CVE: CVE-2020-26863
Published: 2022-10-13
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none.
CVE: CVE-2020-26864
Published: 2022-10-13
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none.
CVE: CVE-2020-26865
Published: 2022-10-13
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none.
CVE: CVE-2020-26866
Published: 2022-10-13
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none.
CVE: CVE-2022-39293
Published: 2022-10-13
Description: Azure RTOS USBX is a high-performance USB host, device, and on-the-go (OTG) embedded stack, that is fully integrated with Azure RTOS ThreadX. The case is, in [_ux_host_class_pima_read](https://github.com/azure-rtos/usbx/blob/master/common/usbx_host_classes/src/ux_host_class_pima_read.c), there is data length from device response, returned in the very first packet, and read by [L165 code](https://github.com/azure-rtos/usbx/blob/082fd9db09a3669eca3358f10b8837a5c1635c0b/common/usbx_host_classes/src/ux_host_class_pima_read.c#L165), as header_length. Then in [L178 code](https://github.com/azure-rtos/usbx/blob/082fd9db09a3669eca3358f10b8837a5c1635c0b/common/usbx_host_classes/src/ux_host_class_pima_read.c#L178), there is a “if” branch, which check the expression of “(header_length - UX_HOST_CLASS_PIMA_DATA_HEADER_SIZE) > data_length” where if header_length is smaller than UX_HOST_CLASS_PIMA_DATA_HEADER_SIZE, calculation could overflow and then [L182 code](https://github.com/azure-rtos/usbx/blob/082fd9db09a3669eca3358f10b8837a5c1635c0b/common/usbx_host_classes/src/ux_host_class_pima_read.c#L182) the calculation of data_length is also overflow, this way the later [while loop start from L192](https://github.com/azure-rtos/usbx/blob/082fd9db09a3669eca3358f10b8837a5c1635c0b/common/usbx_host_classes/src/ux_host_class_pima_read.c#L192) can move data_pointer to unexpected address and cause write buffer overflow. The fix has been included in USBX release [6.1.12](https://github.com/azure-rtos/usbx/releases/tag/v6.1.12_rel). The following can be used as a workaround: Add check of `header_length`: 1. It must be greater than `UX_HOST_CLASS_PIMA_DATA_HEADER_SIZE`. 1. It should be greater or equal to the current returned data length (`transfer_request -> ux_transfer_request_actual_length`).
CVSS Score: 8.6 (HIGH)
CWE: CWE-191
References: https://github.com/azure-rtos/usbx/releases/tag/v6.1.12_rel; https://github.com/azure-rtos/usbx/security/advisories/GHSA-gg76-h537-xq48; https://github.com/azure-rtos/usbx/releases/tag/v6.1.12_rel
CVE: CVE-2022-41480
Published: 2022-10-13
Description: Tenda AC1200 US_AC6V2.0RTL_V15.03.06.51_multi_TDE01 was discovered to contain a buffer overflow in the 0x475dc function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-120
References: https://github.com/Davidteeri/Bug-Report/blob/main/tenda-AC6-%200x47c5dc%20-%20name.md; https://www.tendacn.com/download/detail-3794.html; https://github.com/Davidteeri/Bug-Report/blob/main/tenda-AC6-%200x47c5dc%20-%20name.md
CVE: CVE-2022-41481
Published: 2022-10-13
Description: Tenda AC1200 US_AC6V2.0RTL_V15.03.06.51_multi_TDE01 was discovered to contain a buffer overflow in the 0x47de1c function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-120
References: https://github.com/Davidteeri/Bug-Report/blob/main/tenda-AC6-%200x47de1c.md; https://www.tendacn.com/download/detail-3794.html; https://github.com/Davidteeri/Bug-Report/blob/main/tenda-AC6-%200x47de1c.md
CVE: CVE-2022-41482
Published: 2022-10-13
Description: Tenda AC1200 US_AC6V2.0RTL_V15.03.06.51_multi_TDE01 was discovered to contain a buffer overflow in the 0x47c5dc function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-120
References: https://github.com/Davidteeri/Bug-Report/blob/main/tenda-AC6-%200x47c5dc_value.md; https://www.tendacn.com/download/detail-3794.html; https://github.com/Davidteeri/Bug-Report/blob/main/tenda-AC6-%200x47c5dc_value.md
CVE: CVE-2022-41483
Published: 2022-10-13
Description: Tenda AC1200 US_AC6V2.0RTL_V15.03.06.51_multi_TDE01 was discovered to contain a buffer overflow in the 0x4a12cc function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-120
References: https://github.com/Davidteeri/Bug-Report/blob/main/tenda-AC6-%200x4212cc.md; https://www.tendacn.com/download/detail-3794.html; https://github.com/Davidteeri/Bug-Report/blob/main/tenda-AC6-%200x4212cc.md
CVE: CVE-2022-41484
Published: 2022-10-13
Description: Tenda AC1900 AP500(US)_V1_180320(Beta) was discovered to contain a buffer overflow in the 0x32384 function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-120
References: https://github.com/Davidteeri/Bug-Report/blob/main/tplink-AC1900%20.md; https://www.tp-link.com/us/support/download/ap500/#Firmware; https://github.com/Davidteeri/Bug-Report/blob/main/tplink-AC1900%20.md
CVE: CVE-2022-41485
Published: 2022-10-13
Description: Tenda AC1200 US_AC6V2.0RTL_V15.03.06.51_multi_TDE01 was discovered to contain a buffer overflow in the 0x47ce00 function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-120
References: https://github.com/Davidteeri/Bug-Report/blob/main/tenda-AC6-%200x47ce00.md; https://www.tendacn.com/download/detail-3794.html; https://github.com/Davidteeri/Bug-Report/blob/main/tenda-AC6-%200x47ce00.md
CVE: CVE-2022-42156
Published: 2022-10-13
Description: D-Link COVR 1200,1203 v1.08 was discovered to contain a command injection vulnerability via the tomography_ping_number parameter at function SetNetworkTomographySettings.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77, CWE-77
References: https://github.com/14isnot40/vul_discovery/blob/master/D-Link%20COVR%2012xx%20.pdf; https://www.dlink.com/en/security-bulletin/; https://github.com/14isnot40/vul_discovery/blob/master/D-Link%20COVR%2012xx%20.pdf
CVE: CVE-2022-42159
Published: 2022-10-13
Description: D-Link COVR 1200,1202,1203 v1.08 was discovered to have a predictable seed in a Pseudo-Random Number Generator.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-335, CWE-335
References: https://github.com/14isnot40/vul_discovery/blob/master/D-Link%20COVR%2012xx%20.pdf; https://www.dlink.com/en/security-bulletin/; https://github.com/14isnot40/vul_discovery/blob/master/D-Link%20COVR%2012xx%20.pdf
CVE: CVE-2022-42160
Published: 2022-10-13
Description: D-Link COVR 1200,1202,1203 v1.08 was discovered to contain a command injection vulnerability via the system_time_timezone parameter at function SetNTPServerSettings.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77, CWE-77
References: https://github.com/14isnot40/vul_discovery/blob/master/D-Link%20COVR%2012xx%20.pdf; https://www.dlink.com/en/security-bulletin/; https://github.com/14isnot40/vul_discovery/blob/master/D-Link%20COVR%2012xx%20.pdf
CVE: CVE-2022-42161
Published: 2022-10-13
Description: D-Link COVR 1200,1202,1203 v1.08 was discovered to contain a command injection vulnerability via the /SetTriggerWPS/PIN parameter at function SetTriggerWPS.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77, CWE-77
References: https://github.com/14isnot40/vul_discovery/blob/master/D-Link%20COVR%2012xx%20.pdf; https://www.dlink.com/en/security-bulletin/; https://github.com/14isnot40/vul_discovery/blob/master/D-Link%20COVR%2012xx%20.pdf
CVE: CVE-2022-3456
Published: 2022-10-13
Description: Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.5.0.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-770
References: https://github.com/ikus060/rdiffweb/commit/b78ec09f4582e363f6f449df6f987127e126c311; https://huntr.dev/bounties/b34412ca-50c5-4615-b7e3-5d07d33acfce; https://github.com/ikus060/rdiffweb/commit/b78ec09f4582e363f6f449df6f987127e126c311
CVE: CVE-2022-3457
Published: 2022-10-13
Description: Origin Validation Error in GitHub repository ikus060/rdiffweb prior to 2.5.0a5.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-346
References: https://github.com/ikus060/rdiffweb/commit/afc1bdfab5161c74012ff2590a6ec49cc0d8fde0; https://huntr.dev/bounties/cfcab02e-d6ad-4dcf-b1b0-da90434bc55b; https://github.com/ikus060/rdiffweb/commit/afc1bdfab5161c74012ff2590a6ec49cc0d8fde0
CVE: CVE-2022-41495
Published: 2022-10-13
Description: ClipperCMS 1.3.3 was discovered to contain a Server-Side Request Forgery (SSRF) via the rss_url_news parameter at /manager/index.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-918, CWE-918
References: https://github.com/jayus0821/insight/blob/master/ClipperCMS%20SSRF2.md; https://github.com/jayus0821/insight/blob/master/ClipperCMS%20SSRF2.md
CVE: CVE-2022-41496
Published: 2022-10-13
Description: iCMS v7.0.16 was discovered to contain a Server-Side Request Forgery (SSRF) via the url parameter at admincp.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-918, CWE-918
References: https://github.com/jayus0821/insight/blob/master/iCMS%20SSRF.md; https://github.com/jayus0821/insight/blob/master/iCMS%20SSRF.md
CVE: CVE-2022-41497
Published: 2022-10-13
Description: ClipperCMS 1.3.3 was discovered to contain a Server-Side Request Forgery (SSRF) via the pkg_url parameter at /manager/index.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-918, CWE-918
References: https://github.com/jayus0821/insight/blob/master/ClipperCMS%20SSRF.md; https://github.com/jayus0821/insight/blob/master/ClipperCMS%20SSRF.md
CVE: CVE-2022-41533
Published: 2022-10-13
Description: Online Diagnostic Lab Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via the component /php_action/editProductImage.php. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434, CWE-434
References: https://github.com/xuewawa/bug_report/blob/main/vendors/mayuri_k/online-diagnostic-lab-management-system/RCE-1.md; https://github.com/xuewawa/bug_report/blob/main/vendors/mayuri_k/online-diagnostic-lab-management-system/RCE-1.md
CVE: CVE-2022-41534
Published: 2022-10-13
Description: Online Diagnostic Lab Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via the component /php_action/createOrder.php. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434, CWE-94
References: https://github.com/xuewawa/bug_report/blob/main/vendors/mayuri_k/online-diagnostic-lab-management-system/RCE-2.md; https://github.com/xuewawa/bug_report/blob/main/vendors/mayuri_k/online-diagnostic-lab-management-system/RCE-2.md
CVE: CVE-2022-31123
Published: 2022-10-13
Description: Grafana is an open source observability and data visualization platform. Versions prior to 9.1.8 and 8.5.14 are vulnerable to a bypass in the plugin signature verification. An attacker can convince a server admin to download and successfully run a malicious plugin even though unsigned plugins are not allowed. Versions 9.1.8 and 8.5.14 contain a patch for this issue. As a workaround, do not install plugins downloaded from untrusted sources.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-347
References: https://github.com/grafana/grafana/releases/tag/v9.1.8; https://github.com/grafana/grafana/security/advisories/GHSA-rhxj-gh46-jvw8; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2022-35944
Published: 2022-10-13
Description: October is a self-hosted Content Management System (CMS) platform based on the Laravel PHP Framework. This vulnerability only affects installations that rely on the safe mode restriction, commonly used when providing public access to the admin panel. Assuming an attacker has access to the admin panel and permission to open the "Editor" section, they can bypass the Safe Mode (`cms.safe_mode`) restriction to introduce new PHP code in a CMS template using a specially crafted request. The issue has been patched in versions 2.2.34 and 3.0.66.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-94
References: https://github.com/octobercms/october/security/advisories/GHSA-x4q7-m6fp-4v9v; https://github.com/octobercms/october/security/advisories/GHSA-x4q7-m6fp-4v9v
CVE: CVE-2022-39300
Published: 2022-10-13
Description: node SAML is a SAML 2.0 library based on the SAML implementation of passport-saml. A remote attacker may be able to bypass SAML authentication on a website using passport-saml. A successful attack requires that the attacker is in possession of an arbitrary IDP signed XML element. Depending on the IDP used, fully unauthenticated attacks (e.g without access to a valid user) might also be feasible if generation of a signed message can be triggered. Users should upgrade to node-saml version 4.0.0-beta5 or newer. Disabling SAML authentication may be done as a workaround.
CVSS Score: 7.7 (HIGH)
CWE: CWE-347, CWE-347
References: https://github.com/node-saml/node-saml/commit/c1f275c289c01921e58f5c70ce0fdbc5287e5fbe; https://github.com/node-saml/node-saml/security/advisories/GHSA-5p8w-2mvw-38pv; https://github.com/node-saml/node-saml/commit/c1f275c289c01921e58f5c70ce0fdbc5287e5fbe
CVE: CVE-2022-31130
Published: 2022-10-13
Description: Grafana is an open source observability and data visualization platform. Versions of Grafana for endpoints prior to 9.1.8 and 8.5.14 could leak authentication tokens to some destination plugins under some conditions. The vulnerability impacts data source and plugin proxy endpoints with authentication tokens. The destination plugin could receive a user's Grafana authentication token. Versions 9.1.8 and 8.5.14 contain a patch for this issue. As a workaround, do not use API keys, JWT authentication, or any HTTP Header based authentication.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-200, CWE-522
References: https://github.com/grafana/grafana/commit/4dd56e4dabce10007bf4ba1059bf54178c35b177; https://github.com/grafana/grafana/commit/9da278c044ba605eb5a1886c48df9a2cb0d3885f; https://github.com/grafana/grafana/releases/tag/v9.1.8
CVE: CVE-2022-34021
Published: 2022-10-13
Description: Multiple Cross Site Scripting (XSS) vulnerabilities in ResIOT IOT Platform + LoRaWAN Network Server through 4.1.1000114 via the form fields.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://securityblog101.blogspot.com/2022/09/cve-id-cve-2022-34021.html; https://securityblog101.blogspot.com/2022/09/cve-id-cve-2022-34021.html
CVE: CVE-2022-34022
Published: 2022-10-13
Description: SQL injection vulnerability in ResIOT IOT Platform + LoRaWAN Network Server through 4.1.1000114 via a crafted POST request to /ResiotQueryDBActive.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://securityblog101.blogspot.com/2022/09/cve-id-cve-2022-34022.html; https://securityblog101.blogspot.com/2022/09/cve-id-cve-2022-34022.html
CVE: CVE-2022-35134
Published: 2022-10-13
Description: Boodskap IoT Platform v4.4.9-02 contains a cross-site scripting (XSS) vulnerability.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://securityblog101.blogspot.com/2022/10/cve-id-cve-2022-35134.html; https://securityblog101.blogspot.com/2022/10/cve-id-cve-2022-35134.html
CVE: CVE-2022-35135
Published: 2022-10-13
Description: Boodskap IoT Platform v4.4.9-02 allows attackers to escalate privileges via a crafted request sent to /api/user/upsert/<uuid>.
CVSS Score: 8.8 (HIGH)
CWE: CWE-287, CWE-287
References: https://securityblog101.blogspot.com/2022/10/cve-id-cve-2022-35135-cve-2022-35136.html; https://securityblog101.blogspot.com/2022/10/cve-id-cve-2022-35135-cve-2022-35136.html
CVE: CVE-2022-35136
Published: 2022-10-13
Description: Boodskap IoT Platform v4.4.9-02 allows attackers to make unauthenticated API requests.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-306, CWE-306
References: https://securityblog101.blogspot.com/2022/10/cve-id-cve-2022-35135-cve-2022-35136.html; https://securityblog101.blogspot.com/2022/10/cve-id-cve-2022-35135-cve-2022-35136.html
CVE: CVE-2022-35611
Published: 2022-10-13
Description: A Cross-Site Request Forgery (CSRF) in MQTTRoute v3.3 and below allows attackers to create and remove dashboards.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://securityblog101.blogspot.com/2022/10/cve-id-cve-2022-35611.html; https://securityblog101.blogspot.com/2022/10/cve-id-cve-2022-35611.html
CVE: CVE-2022-35612
Published: 2022-10-13
Description: A cross-site scripting (XSS) vulnerability in MQTTRoute v3.3 and below allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the dashboard name text field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://securityblog101.blogspot.com/2022/10/cve-id-cve-2022-35612.html; https://securityblog101.blogspot.com/2022/10/cve-id-cve-2022-35612.html