deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-26284
Published: 2022-03-21
Description: Simple Client Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter in the manage_client endpoint. This vulnerability allows attackers to dump the application's database via crafted HTTP requests.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/Dir0x/SQLi-exploit---Simple-Client-Management-System/blob/main/manage_client_sqli.py; https://github.com/Dir0x/SQLi-exploit---Simple-Client-Management-System/blob/main/manage_client_sqli.py
CVE: CVE-2022-26285
Published: 2022-03-21
Description: Simple Subscription Website v1.0 was discovered to contain a SQL injection vulnerability via the id parameter in the apply endpoint. This vulnerability allows attackers to dump the application's database via crafted HTTP requests.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/Dir0x/Multiple-SQLi-in-Simple-Subscription-Company/blob/main/apply_sqli.py; https://github.com/Dir0x/Multiple-SQLi-in-Simple-Subscription-Company/blob/main/apply_sqli.py
CVE: CVE-2022-27607
Published: 2022-03-21
Description: Bento4 1.6.0-639 has a heap-based buffer over-read in the AP4_HvccAtom class, a different issue than CVE-2018-14531.
CVSS Score: 8.1 (HIGH)
CWE: CWE-125
References: https://github.com/axiomatic-systems/Bento4/issues/677; https://github.com/axiomatic-systems/Bento4/issues/677
CVE: CVE-2022-0386
Published: 2022-03-22
Description: A post-auth SQL injection vulnerability in the Mail Manager potentially allows an authenticated attacker to execute code in Sophos UTM before version 9.710.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://www.sophos.com/en-us/security-advisories/sophos-sa-20220321-utm-9710; https://www.sophos.com/en-us/security-advisories/sophos-sa-20220321-utm-9710
CVE: CVE-2022-0652
Published: 2022-03-22
Description: Confd log files contain local users', including root’s, SHA512crypt password hashes with insecure access permissions. This allows a local attacker to attempt off-line brute-force attacks against these password hashes in Sophos UTM before version 9.710.
CVSS Score: 3.3 (LOW)
CWE: CWE-532, CWE-732
References: https://www.sophos.com/en-us/security-advisories/sophos-sa-20220321-utm-9710; https://www.sophos.com/en-us/security-advisories/sophos-sa-20220321-utm-9710
CVE: CVE-2022-1034
Published: 2022-03-22
Description: There is a Unrestricted Upload of File vulnerability in ShowDoc v2.10.3 in GitHub repository star7th/showdoc prior to 2.10.4.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434, CWE-434
References: https://github.com/star7th/showdoc/commit/bd792a89c0325836fbd64784f4c4117c0171416b; https://huntr.dev/bounties/d205c489-3266-4ac4-acb7-c8ee570887f7; https://github.com/star7th/showdoc/commit/bd792a89c0325836fbd64784f4c4117c0171416b
CVE: CVE-2021-45809
Published: 2022-03-22
Description: GlobalProtect-openconnect versions prior to 1.4.3 are affected by incorrect access control in GPService through DBUS, GUI Application. The way GlobalProtect-Openconnect is set up enables arbitrary users to execute commands as root by submitting the `--script=<script>` parameter.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/yuezk/GlobalProtect-openconnect/issues/113; https://github.com/yuezk/GlobalProtect-openconnect/issues/113
CVE: CVE-2021-45810
Published: 2022-03-22
Description: GlobalProtect-openconnect versions prior to 2.0.0 (exclusive) are affected by incorrect access control in GPService through DBUS, GUI. The way GlobalProtect-Openconnect is set up enables arbitrary users to start a VPN connection to arbitrary servers. By hosting an openconnect compatible server, the attack can redirect the entire host's traffic via their own server.
CVSS Score: 7.5 (HIGH)
References: https://github.com/yuezk/GlobalProtect-openconnect/issues/114; https://github.com/yuezk/GlobalProtect-openconnect/issues/114#issuecomment[PII_REDACTED]; https://github.com/yuezk/GlobalProtect-openconnect/issues/114
CVE: CVE-2022-0667
Published: 2022-03-22
Description: When the vulnerability is triggered the BIND process will exit. BIND 9.18.0
CVSS Score: 7.5 (HIGH)
CWE: CWE-617
References: https://kb.isc.org/v1/docs/cve-2022-0667; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://kb.isc.org/v1/docs/cve-2022-0667
CVE: CVE-2022-1036
Published: 2022-03-22
Description: Able to create an account with long password leads to memory corruption / Integer Overflow in GitHub repository microweber/microweber prior to 1.2.12.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190, CWE-190
References: https://github.com/microweber/microweber/commit/82be4f0b4729be870ccefdae99a04833f134aa6a; https://huntr.dev/bounties/db615581-d5a9-4ca5-a3e9-7a39eceaa424; https://github.com/microweber/microweber/commit/82be4f0b4729be870ccefdae99a04833f134aa6a
CVE: CVE-2021-43650
Published: 2022-03-22
Description: WebRun 3.6.0.42 is vulnerable to SQL Injection via the P_0 parameter used to set the username during the login process.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.exploit-db.com/exploits/50542; https://www.exploit-db.com/exploits/50542
CVE: CVE-2022-21718
Published: 2022-03-22
Description: Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. A vulnerability in versions prior to `17.0.0-alpha.6`, `16.0.6`, `15.3.5`, `14.2.4`, and `13.6.6` allows renderers to obtain access to a bluetooth device via the web bluetooth API if the app has not configured a custom `select-bluetooth-device` event handler. This has been patched and Electron versions `17.0.0-alpha.6`, `16.0.6`, `15.3.5`, `14.2.4`, and `13.6.6` contain the fix. Code from the GitHub Security Advisory can be added to the app to work around the issue.
CVSS Score: 3.4 (LOW)
CWE: CWE-668, CWE-862
References: https://github.com/electron/electron/pull/32178; https://github.com/electron/electron/pull/32240; https://github.com/electron/electron/security/advisories/GHSA-3p22-ghq8-v749
CVE: CVE-2022-24764
Published: 2022-03-22
Description: PJSIP is a free and open source multimedia communication library written in C. Versions 2.12 and prior contain a stack buffer overflow vulnerability that affects PJSUA2 users or users that call the API `pjmedia_sdp_print(), pjmedia_sdp_media_print()`. Applications that do not use PJSUA2 and do not directly call `pjmedia_sdp_print()` or `pjmedia_sdp_media_print()` should not be affected. A patch is available on the `master` branch of the `pjsip/pjproject` GitHub repository. There are currently no known workarounds.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-121, CWE-787
References: https://github.com/pjsip/pjproject/commit/560a1346f87aabe126509bb24930106dea292b00; https://github.com/pjsip/pjproject/security/advisories/GHSA-f5qg-pqcg-765m; https://lists.debian.org/debian-lts-announce/2022/03/msg00035.html
CVE: CVE-2022-24774
Published: 2022-03-22
Description: CycloneDX BOM Repository Server is a bill of materials (BOM) repository server for distributing CycloneDX BOMs. CycloneDX BOM Repository Server before version 2.0.1 has an improper input validation vulnerability leading to path traversal. A malicious user may potentially exploit this vulnerability to create arbitrary directories or a denial of service by deleting arbitrary directories. The vulnerability is resolved in version 2.0.1. The vulnerability is not exploitable with the default configuration with the post and delete methods disabled. This can be configured by modifying the `appsettings.json` file, or alternatively, setting the environment variables `ALLOWEDMETHODS__POST` and `ALLOWEDMETHODS__DELETE` to `false`.
CVSS Score: 7.1 (HIGH)
CWE: CWE-20, CWE-35, CWE-22
References: https://github.com/CycloneDX/cyclonedx-bom-repo-server/commit/001a3278b5572e52c0ecac0bd1157bf2599502b7; https://github.com/CycloneDX/cyclonedx-bom-repo-server/releases/tag/v2.0.1; https://github.com/CycloneDX/cyclonedx-bom-repo-server/security/advisories/GHSA-6c74-9588-wq9j
CVE: CVE-2022-25484
Published: 2022-03-22
Description: tcpprep v4.4.1 has a reachable assertion (assert(l2len > 0)) in packet2tree() at tree.c in tcpprep v4.4.1.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-617
References: https://github.com/appneta/tcpreplay/issues/715; https://github.com/appneta/tcpreplay/issues/715
CVE: CVE-2021-41736
Published: 2022-03-22
Description: Faust v2.35.0 was discovered to contain a heap-buffer overflow in the function realPropagate() at propagate.cpp.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/grame-cncm/faust/issues/653; https://github.com/grame-cncm/faust/issues/653
CVE: CVE-2022-27228
Published: 2022-03-22
Description: In the vote (aka "Polls, Votes") module before 21.0.100 of Bitrix Site Manager, a remote unauthenticated attacker can execute arbitrary code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: https://helpdesk.bitrix24.com/open/15536776/; https://helpdesk.bitrix24.com/open/15536776/
CVE: CVE-2022-25517
Published: 2022-03-22
Description: MyBatis plus v3.4.3 was discovered to contain a SQL injection vulnerability via the Column parameter in /core/conditions/AbstractWrapper.java. NOTE: the vendor's position is that the reported execution of a SQL statement was intended behavior.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/HaHarden/mybatis-plus-sql-Injection; https://github.com/baomidou/mybatis-plus/issues/4407; https://github.com/HaHarden/mybatis-plus-sql-Injection
CVE: CVE-2022-26260
Published: 2022-03-22
Description: Simple-Plist v1.3.0 was discovered to contain a prototype pollution vulnerability via .parse().
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1321
References: https://github.com/wollardj/simple-plist/issues/60; https://github.com/wollardj/simple-plist/issues/60
CVE: CVE-2022-1031
Published: 2022-03-22
Description: Use After Free in op_is_set_bp in GitHub repository radareorg/radare2 prior to 5.6.6.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://github.com/radareorg/radare2/commit/a7ce29647fcb38386d[PII_REDACTED]e16e093d6acb; https://huntr.dev/bounties/37da2cd6-0b46-4878-a32e-acbfd8f6f457; https://github.com/radareorg/radare2/commit/a7ce29647fcb38386d[PII_REDACTED]e16e093d6acb
CVE: CVE-2021-33961
Published: 2022-03-22
Description: A Cross Site Scripting (XSS) vulnerabililty exists in enhanced-github v5.0.11 via the file name parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/softvar/enhanced-github/issues/96; https://github.com/softvar/enhanced-github/issues/96
CVE: CVE-2022-26186
Published: 2022-03-22
Description: TOTOLINK N600R V4.3.0cu.7570_B20200620 was discovered to contain a command injection vulnerability via the exportOvpn interface at cstecgi.cgi.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://doudoudedi.github.io/2022/02/21/TOTOLINK-N600R-Command-Injection/; https://doudoudedi.github.io/2022/02/21/TOTOLINK-N600R-Command-Injection/
CVE: CVE-2022-26187
Published: 2022-03-22
Description: TOTOLINK N600R V4.3.0cu.7570_B20200620 was discovered to contain a command injection vulnerability via the pingCheck function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://doudoudedi.github.io/2022/02/21/TOTOLINK-N600R-Command-Injection/; https://doudoudedi.github.io/2022/02/21/TOTOLINK-N600R-Command-Injection/
CVE: CVE-2022-26188
Published: 2022-03-22
Description: TOTOLINK N600R V4.3.0cu.7570_B20200620 was discovered to contain a command injection vulnerability via /setting/NTPSyncWithHost.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://doudoudedi.github.io/2022/02/21/TOTOLINK-N600R-Command-Injection/; https://doudoudedi.github.io/2022/02/21/TOTOLINK-N600R-Command-Injection/
CVE: CVE-2022-26189
Published: 2022-03-22
Description: TOTOLINK N600R V4.3.0cu.7570_B20200620 was discovered to contain a command injection vulnerability via the langType parameter in the login interface.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://doudoudedi.github.io/2022/02/21/TOTOLINK-N600R-Command-Injection/; https://doudoudedi.github.io/2022/02/21/TOTOLINK-N600R-Command-Injection/
CVE: CVE-2022-25518
Published: 2022-03-22
Description: In CMDBuild from version 3.0 to 3.3.2 payload requests are saved in a temporary log table, which allows attackers with database access to read the password of the users who login to the application by querying the database table.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-532
References: https://www.cmdbuild.org/en/reference/news/cmdbuild-3-3-3-intermediate-release-vulnerability-patch; https://www.cmdbuild.org/en/reference/news/cmdbuild-3-3-3-intermediate-release-vulnerability-patch
CVE: CVE-2022-27666
Published: 2022-03-23
Description: A heap buffer overflow flaw was found in IPsec ESP transformation code in net/ipv4/esp4.c and net/ipv6/esp6.c. This flaw allows a local attacker with a normal user privilege to overwrite kernel heap objects and may cause a local privilege escalation threat.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://bugzilla.redhat.com/show_bug.cgi?id=2061633; https://github.com/torvalds/linux/commit/ebe48d368e97d007bfeb76fcb065d6cfc4c96645; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2022-1033
Published: 2022-03-23
Description: Unrestricted Upload of File with Dangerous Type in GitHub repository crater-invoice/crater prior to 6.0.6.
CVSS Score: 7.8 (HIGH)
CWE: CWE-434, CWE-434
References: https://github.com/crater-invoice/crater/commit/88035ea49082f7053a37ef07bf3587e09d9d22b4; https://huntr.dev/bounties/4d7d4fc9-e0cf-42d3-b89c-6ea57a769045; https://github.com/crater-invoice/crater/commit/88035ea49082f7053a37ef07bf3587e09d9d22b4
CVE: CVE-2021-45756
Published: 2022-03-23
Description: Asus RT-AC68U <3.0.0.4.385.20633 and RT-AC5300 <3.0.0.4.384.82072 are affected by a buffer overflow in blocking_request.cgi.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: http://asus.com; http://rt-ac68u.com; https://github.com/IBUILI/Asus
CVE: CVE-2021-45757
Published: 2022-03-23
Description: ASUS AC68U <=3.0.0.4.385.20852 is affected by a buffer overflow in blocking.cgi, which may cause a denial of service (DoS).
CVSS Score: 7.5 (HIGH)
CWE: CWE-120
References: http://ac68u.com; http://asus.com; https://github.com/IBUILI/Asus
CVE: CVE-2022-0396
Published: 2022-03-23
Description: BIND 9.16.11 -> 9.16.26, 9.17.0 -> 9.18.0 and versions 9.16.11-S1 -> 9.16.26-S1 of the BIND Supported Preview Edition. Specifically crafted TCP streams can cause connections to BIND to remain in CLOSE_WAIT status for an indefinite period of time, even after the client has terminated the connection.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-404
References: https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf; https://kb.isc.org/v1/docs/cve-2022-0396; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NYD7US4HZRFUGAJ66ZTHFBYVP5N3OQBY/
CVE: CVE-2022-0635
Published: 2022-03-23
Description: Versions affected: BIND 9.18.0 When a vulnerable version of named receives a series of specific queries, the named process will eventually terminate due to a failed assertion check.
CVSS Score: 7.5 (HIGH)
CWE: CWE-617
References: https://kb.isc.org/v1/docs/cve-2022-0635; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://kb.isc.org/v1/docs/cve-2022-0635
CVE: CVE-2021-25220
Published: 2022-03-23
Description: BIND 9.11.0 -> 9.11.36 9.12.0 -> 9.16.26 9.17.0 -> 9.18.0 BIND Supported Preview Editions: 9.11.4-S1 -> 9.11.36-S1 9.16.8-S1 -> 9.16.26-S1 Versions of BIND 9 earlier than those shown - back to 9.1.0, including Supported Preview Editions - are also believed to be affected but have not been tested as they are EOL. The cache could become poisoned with incorrect records leading to queries being made to the wrong servers, which might also result in false information being returned to clients.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-444
References: https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf; https://kb.isc.org/v1/docs/cve-2021-25220; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2SXT7247QTKNBQ67MNRGZD23ADXU6E5U/
CVE: CVE-2021-44040
Published: 2022-03-23
Description: Improper Input Validation vulnerability in request line parsing of Apache Traffic Server allows an attacker to send invalid requests. This issue affects Apache Traffic Server 8.0.0 to 8.1.3 and 9.0.0 to 9.1.1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-20
References: https://lists.apache.org/thread/zblwzcfs9ryhwjr89wz4osw55pxm6dx6; https://www.debian.org/security/2022/dsa-5153; https://lists.apache.org/thread/zblwzcfs9ryhwjr89wz4osw55pxm6dx6
CVE: CVE-2021-44759
Published: 2022-03-23
Description: Improper Authentication vulnerability in TLS origin validation of Apache Traffic Server allows an attacker to create a man in the middle attack. This issue affects Apache Traffic Server 8.0.0 to 8.1.0.
CVSS Score: 8.1 (HIGH)
CWE: CWE-287, CWE-287
References: https://lists.apache.org/thread/zblwzcfs9ryhwjr89wz4osw55pxm6dx6; https://www.debian.org/security/2022/dsa-5153; https://lists.apache.org/thread/zblwzcfs9ryhwjr89wz4osw55pxm6dx6
CVE: CVE-2022-0842
Published: 2022-03-23
Description: A blind SQL injection vulnerability in McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13 allows a remote authenticated attacker to potentially obtain information from the ePO database. The data obtained is dependent on the privileges the attacker has and to obtain sensitive data the attacker would require administrator privileges.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10379; https://kc.mcafee.com/corporate/index?page=content&id=SB10379
CVE: CVE-2022-0886
Published: 2022-03-23
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2022-27666. Reason: This candidate is a reservation duplicate of CVE-2022-27666. Notes: All CVE users should reference CVE-2022-27666 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2022-0857
Published: 2022-03-23
Description: A reflected cross-site scripting (XSS) vulnerability in McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13 allows a remote attacker to potentially obtain access to an ePO administrator's session by convincing the attacker to click on a carefully crafted link. This would lead to limited access to sensitive information and limited ability to alter some information in ePO due to the area of the User Interface the vulnerability is present in.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10379; https://kc.mcafee.com/corporate/index?page=content&id=SB10379
CVE: CVE-2022-0858
Published: 2022-03-23
Description: A cross-site scripting (XSS) vulnerability in McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13 allows a remote attacker to potentially obtain access to an ePO administrator's session by convincing the attacker to click on a carefully crafted link. This would lead to limited ability to alter some information in ePO due to the area of the User Interface the vulnerability is present in.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10379; https://kc.mcafee.com/corporate/index?page=content&id=SB10379
CVE: CVE-2022-0859
Published: 2022-03-23
Description: McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13 allows a local attacker to point an ePO server to an arbitrary SQL server during the restoration of the ePO server. To achieve this the attacker would have to be logged onto the server hosting the ePO server (restricted to administrators) and to know the SQL server password.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-522, CWE-522
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10379; https://kc.mcafee.com/corporate/index?page=content&id=SB10379
CVE: CVE-2022-0861
Published: 2022-03-23
Description: A XML Extended entity vulnerability in McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13 allows a remote administrator attacker to upload a malicious XML file through the extension import functionality. The impact is limited to some access to confidential information and some ability to alter data.
CVSS Score: 3.5 (LOW)
CWE: CWE-611, CWE-611
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10379; https://kc.mcafee.com/corporate/index?page=content&id=SB10379
CVE: CVE-2022-0862
Published: 2022-03-23
Description: A lack of password change protection vulnerability in a depreciated API of McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13 allows a remote attacker to change the password of a compromised session without knowing the existing user's password. This functionality was removed from the User Interface in ePO 10 and the API has now been disabled. Other protection is in place to reduce the likelihood of this being successful through sending a link to a logged in user.
CVSS Score: 3.1 (LOW)
CWE: CWE-522, CWE-287
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10379; https://kc.mcafee.com/corporate/index?page=content&id=SB10379
CVE: CVE-2021-43735
Published: 2022-03-23
Description: CmsWing 1.3.7 is affected by a SQLi vulnerability via parameter: behavior rule.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/arterli/CmsWing/issues/55; https://github.com/arterli/CmsWing/issues/55
CVE: CVE-2021-43736
Published: 2022-03-23
Description: CmsWing CMS 1.3.7 is affected by a Remote Code Execution (RCE) vulnerability via parameter: log rule
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-88
References: https://github.com/arterli/CmsWing/issues/56; https://github.com/arterli/CmsWing/issues/56
CVE: CVE-2021-43738
Published: 2022-03-23
Description: An issue was discovered in xiaohuanxiong CMS 5.0.17. There is a CSRF vulnerability that can that can add the administrator account.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/hiliqi/xiaohuanxiong/issues/28; https://github.com/hiliqi/xiaohuanxiong/issues/28
CVE: CVE-2022-23242
Published: 2022-03-23
Description: TeamViewer Linux versions before 15.28 do not properly execute a deletion command for the connection password in case of a process crash. Knowledge of the crash event and the TeamViewer ID as well as either possession of the pre-crash connection password or local authenticated access to the machine would have allowed to establish a remote connection by reusing the not properly deleted connection password.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-404
References: https://www.teamviewer.com/en/trust-center/security-bulletins/TV-2022-1001/; https://www.teamviewer.com/en/trust-center/security-bulletins/TV-2022-1001/
CVE: CVE-2021-43737
Published: 2022-03-23
Description: An issus was discovered in xiaohuanxiong CMS 5.0.17. There is a CSRF vulnerability that can modify administrator account's password.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://github.com/hiliqi/xiaohuanxiong/issues/28; https://github.com/hiliqi/xiaohuanxiong/issues/28
CVE: CVE-2021-44139
Published: 2022-03-23
Description: Sentinel 1.8.2 is vulnerable to Server-side request forgery (SSRF).
CVSS Score: 7.5 (HIGH)
CWE: CWE-918
References: https://github.com/alibaba/Sentinel/issues/2451; https://github.com/alibaba/Sentinel/issues/2451
CVE: CVE-2022-22316
Published: 2022-03-23
Description: IBM MQ Appliance 9.2 CD and 9.2 LTS could allow an authenticated and authorized user to cause a denial of service due to incorrectly configured authorization checks. IBM X-Force ID: 218276.
CVSS Score: 6.5 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/218276; https://www.ibm.com/support/pages/node/6560040; https://exchange.xforce.ibmcloud.com/vulnerabilities/218276
CVE: CVE-2021-46064
Published: 2022-03-23
Description: IrfanView 4.59 is vulnerable to buffer overflow via the function at address 0x413c70 (in 32bit version of the binary). The vulnerability triggers when the user opens malicious .tiff image.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: http://irfan.com; http://irfanview.com; https://www.irfanview.info/main_history.htm