deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-26645
Published: 2022-03-30
Description: A remote code execution (RCE) vulnerability in Online Banking System Protect v1.0 allows attackers to execute arbitrary code via a crafted PHP file uploaded through the Upload Image function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: http://online.com; https://github.com/erik-451/CVE/tree/main/CVE-2022-26645; http://online.com
CVE: CVE-2022-26646
Published: 2022-03-30
Description: Online Banking System Protect v1.0 was discovered to contain a local file inclusion (LFI) vulnerability via the pages parameter.
CVSS Score: 9.8 (CRITICAL)
References: http://online.com; https://github.com/erik-451/CVE/blob/main/CVE-2022-26646/README.md; http://online.com
CVE: CVE-2021-43661
Published: 2022-03-31
Description: totolink EX300_v2 V4.0.3c.140_B20210429 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /home.asp.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/chibataiki/iot-vuls/blob/main/totolink/xss-vulnerability.md; https://github.com/chibataiki/iot-vuls/blob/main/totolink/xss-vulnerability.md
CVE: CVE-2021-43662
Published: 2022-03-31
Description: totolink EX300_v2, ver V4.0.3c.140_B20210429 and A720R ,ver V4.1.5cu.470_B20200911 have an issue which causes uncontrolled resource consumption.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-770
References: https://github.com/chibataiki/iot-vuls/blob/main/totolink/dos.md; https://github.com/chibataiki/iot-vuls/blob/main/totolink/dos.md
CVE: CVE-2021-43663
Published: 2022-03-31
Description: totolink EX300_v2 V4.0.3c.140_B20210429 was discovered to contain a command injection vulnerability via the component cloudupdate_check.
CVSS Score: 7.5 (HIGH)
CWE: CWE-77
References: https://github.com/chibataiki/iot-vuls/blob/main/totolink/command-injection1.md; https://github.com/chibataiki/iot-vuls/blob/main/totolink/command-injection1.md
CVE: CVE-2021-20729
Published: 2022-03-31
Description: Cross-site scripting vulnerability in pfSense CE and pfSense Plus (pfSense CE software versions 2.5.2 and earlier, and pfSense Plus software versions 21.05 and earlier) allows a remote attacker to inject an arbitrary script via a malicious URL.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://docs.netgate.com/downloads/pfSense-SA-21_02.captiveportal.asc; https://jvn.jp/en/jp/JVN87751554/index.html; https://docs.netgate.com/downloads/pfSense-SA-21_02.captiveportal.asc
CVE: CVE-2022-22986
Published: 2022-03-31
Description: Netcommunity OG410X and OG810X series (Netcommunity OG410Xa, OG410Xi, OG810Xa, and OG810Xi firmware Ver.2.28 and earlier) allow an attacker on the adjacent network to execute an arbitrary OS command via a specially crafted config file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://business.ntt-east.co.jp/topics/2022/03_22.html; https://jvn.jp/en/vu/JVNVU94900322/index.html; https://www.ntt-west.co.jp/smb/kiki_info/info/220322.html
CVE: CVE-2022-23183
Published: 2022-03-31
Description: Missing authorization vulnerability in Advanced Custom Fields versions prior to 5.12.1 and Advanced Custom Fields Pro versions prior to 5.12.1 allows a remote authenticated attacker to view the information on the database without the access permission.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://jvn.jp/en/jp/JVN42543427/index.html; https://wordpress.org/plugins/advanced-custom-fields/; https://www.advancedcustomfields.com/
CVE: CVE-2022-24299
Published: 2022-03-31
Description: Improper input validation vulnerability in pfSense CE and pfSense Plus (pfSense CE software versions prior to 2.6.0 and pfSense Plus software versions prior to 22.01) allows a remote attacker with the privilege to change OpenVPN client or server settings to execute an arbitrary command.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: https://docs.netgate.com/downloads/pfSense-SA-22_03.webgui.asc; https://jvn.jp/en/jp/JVN87751554/index.html; https://docs.netgate.com/downloads/pfSense-SA-22_03.webgui.asc
CVE: CVE-2022-25348
Published: 2022-03-31
Description: Untrusted search path vulnerability in AttacheCase ver.4.0.2.7 and earlier allows an attacker to gain privileges and execute arbitrary code via a Trojan horse DLL in an unspecified directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://hibara.org/software/attachecase/?lang=en; https://jvn.jp/en/jp/JVN10140834/index.html; https://hibara.org/software/attachecase/?lang=en
CVE: CVE-2022-26019
Published: 2022-03-31
Description: Improper access control vulnerability in pfSense CE and pfSense Plus (pfSense CE software versions prior to 2.6.0 and pfSense Plus software versions prior to 22.01) allows a remote attacker with the privilege to change NTP GPS settings to rewrite existing files on the file system, which may result in arbitrary command execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22
References: https://docs.netgate.com/downloads/pfSense-SA-22_01.webgui.asc; https://jvn.jp/en/jp/JVN87751554/index.html; https://docs.netgate.com/downloads/pfSense-SA-22_01.webgui.asc
CVE: CVE-2022-27496
Published: 2022-03-31
Description: Cross-site scripting vulnerability in Zero-channel BBS Plus v0.7.4 and earlier allows a remote attacker to inject an arbitrary script via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://jvn.jp/en/jp/JVN59576930/index.html; https://osdn.net/projects/zerochplus/releases/77053; https://jvn.jp/en/jp/JVN59576930/index.html
CVE: CVE-2022-28128
Published: 2022-03-31
Description: Untrusted search path vulnerability in AttacheCase ver.3.6.1.0 and earlier allows an attacker to gain privileges and execute arbitrary code via a Trojan horse DLL in an unspecified directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://hibara.org/software/attachecase/?lang=en; https://jvn.jp/en/jp/JVN10140834/index.html; https://hibara.org/software/attachecase/?lang=en
CVE: CVE-2022-1191
Published: 2022-03-31
Description: SSRF on index.php/cobrowse/proxycss/ in GitHub repository livehelperchat/livehelperchat prior to 3.96.
CVSS Score: 8.1 (HIGH)
CWE: CWE-918
References: https://github.com/livehelperchat/livehelperchat/commit/c41f283a2c1b46c42dd2af16ecbeaedd2fe1f5df; https://huntr.dev/bounties/7264a2e1-17e7-4244-93e4-49ec14f282b3; https://github.com/livehelperchat/livehelperchat/commit/c41f283a2c1b46c42dd2af16ecbeaedd2fe1f5df
CVE: CVE-2022-25915
Published: 2022-03-31
Description: Improper access control vulnerability in ELECOM LAN routers (WRC-1167GST2 firmware v1.25 and prior, WRC-1167GST2A firmware v1.25 and prior, WRC-1167GST2H firmware v1.25 and prior, WRC-2533GS2-B firmware v1.52 and prior, WRC-2533GS2-W firmware v1.52 and prior, WRC-1750GS firmware v1.03 and prior, WRC-1750GSV firmware v2.11 and prior, WRC-1900GST firmware v1.03 and prior, WRC-2533GST firmware v1.03 and prior, WRC-2533GSTA firmware v1.03 and prior, WRC-2533GST2 firmware v1.25 and prior, WRC-2533GST2SP firmware v1.25 and prior, WRC-2533GST2-G firmware v1.25 and prior, and EDWRC-2533GST2 firmware v1.25 and prior) allows a network-adjacent authenticated attacker to bypass access restriction and to access the management screen of the product via unspecified vectors.
CVSS Score: 8.8 (HIGH)
References: https://jvn.jp/en/jp/JVN88993473/; https://www.elecom.co.jp/news/security/20211130-01/; https://jvn.jp/en/jp/JVN88993473/
CVE: CVE-2022-1176
Published: 2022-03-31
Description: Loose comparison causes IDOR on multiple endpoints in GitHub repository livehelperchat/livehelperchat prior to 3.96.
CVSS Score: 7.5 (HIGH)
CWE: CWE-843
References: https://github.com/livehelperchat/livehelperchat/commit/72c0df160bfe9838c618652facef29af99392ce3; https://huntr.dev/bounties/3e30171b-c9bf-415c-82f1-6f55a44d09d3; https://github.com/livehelperchat/livehelperchat/commit/72c0df160bfe9838c618652facef29af99392ce3
CVE: CVE-2022-24136
Published: 2022-03-31
Description: Hospital Management System v1.0 is affected by an unrestricted upload of dangerous file type vulerability in treatmentrecord.php. To exploit, an attacker can upload any PHP file, and then execute it.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://github.com/kabirkhyrul/HMS/discussions/6; https://github.com/kabirkhyrul/HMS/discussions/6
CVE: CVE-2021-34257
Published: 2022-03-31
Description: Multiple Remote Code Execution (RCE) vulnerabilities exist in WPanel 4 4.3.1 and below via a malicious PHP file upload to (1) Dashboard's Avatar image, (2) Posts Folder image, (3) Pages Folder image and (4) Gallery Folder image.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://github.com/Sentinal920/WPanel4-Authenticated-RCE; https://latestpcsolution.wordpress.com/2021/06/05/wpanel4-cms-authenticated-rce/; https://github.com/Sentinal920/WPanel4-Authenticated-RCE
CVE: CVE-2022-0350
Published: 2022-03-31
Description: Cross-site Scripting (XSS) - Stored in GitHub repository vanessa219/vditor prior to 3.8.13.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/vanessa219/vditor/commit/e912e36ea98251d700499b1ac7702708d3398476; https://huntr.dev/bounties/8202aa06-4b49-45ff-aa0f-00982f62005c; https://github.com/vanessa219/vditor/commit/e912e36ea98251d700499b1ac7702708d3398476
CVE: CVE-2021-43505
Published: 2022-03-31
Description: Multiple Cross Site Scripting (XSS) vulnerabilities exist in Ssourcecodester Simple Client Management System v1 via (1) Add new Client and (2) Add new invoice.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://raw.githubusercontent.com/Sentinal920/Findings/main/Simple%20Client%20Management%20System/xss.txt; https://raw.githubusercontent.com/Sentinal920/Findings/main/Simple%20Client%20Management%20System/xss.txt
CVE: CVE-2021-43506
Published: 2022-03-31
Description: An SQL Injection vulnerability exists in Sourcecodester Simple Client Management System 1.0 via the password parameter in Login.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://raw.githubusercontent.com/Sentinal920/Findings/main/Simple%20Client%20Management%20System/sql.txt; https://raw.githubusercontent.com/Sentinal920/Findings/main/Simple%20Client%20Management%20System/sql.txt
CVE: CVE-2021-36625
Published: 2022-03-31
Description: An SQL Injection vulnerability exists in Dolibarr ERP/CRM 13.0.2 (fixed version is 14.0.0) via a POST request to the country_id parameter in an UPDATE statement.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/Dolibarr/dolibarr/commit/abb1ad6bf0469eccd2b58beb20bdabc18fc36e22; https://github.com/Dolibarr/dolibarr/commit/abb1ad6bf0469eccd2b58beb20bdabc18fc36e22
CVE: CVE-2021-42866
Published: 2022-03-31
Description: A Cross Site Scripting vulnerabilty exists in Pixelimity 1.0 via the Site Description field in pixelimity/admin/setting.php
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: http://rlsec.xyz/vulns/CVE_2021_42866.html; http://rlsec.xyz/vulns/CVE_2021_42866.html
CVE: CVE-2021-42867
Published: 2022-03-31
Description: A Cross Site Scripting (XSS) vulnerability exists in DanPros htmly 2.8.1 via the Description field in (1) admin/config, and (2) index.php pages.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: http://rlsec.xyz/vulns/CVE_2021_42867.html; https://rlsec.xyz/vulns/; http://rlsec.xyz/vulns/CVE_2021_42867.html
CVE: CVE-2021-42868
Published: 2022-03-31
Description: A Cross Site Scripting (XSS) vulnerability exists in Chikista Patient Management Software 2.0.2 in the first_name parameter in (1) patient/insert, (2) patient_report, (3) appointment_report, (4) visit_report, and (5) bill_detail_report pages. .
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: http://chikista.com; http://rlsec.xyz/vulns/CVE_2021_42868.html; http://chikista.com
CVE: CVE-2021-42869
Published: 2022-03-31
Description: A Cross Site Scripting (XSS) vulnerability exists in Chikista Patient Management Software 2.0.2 via the last_name parameter in the (1) patient/insert, (2) patient_report, (3) /appointment_report, (4) visit_report, and (5) /bill_detail_report pages.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: http://rlsec.xyz/vulns/CVE_2021_42869.html; https://rlsec.xyz/vulns/; http://rlsec.xyz/vulns/CVE_2021_42869.html
CVE: CVE-2021-42946
Published: 2022-03-31
Description: A Cross Site Scripting (XSS) vulnerability exists in htmly.2.8.1 via the Copyright field in the /admin/config page.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: http://rlsec.xyz/vulns/CVE_2021_42946.html; http://rlsec.xyz/vulns/CVE_2021_42946.html
CVE: CVE-2022-22311
Published: 2022-03-31
Description: IBM Security Verify Access could allow a user, using man in the middle techniques, to obtain sensitive information or possibly change some information due to improper validiation of JWT tokens.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/217226; https://www.ibm.com/support/pages/node/6568043; https://exchange.xforce.ibmcloud.com/vulnerabilities/217226
CVE: CVE-2021-37517
Published: 2022-03-31
Description: An Access Control vulnerability exists in Dolibarr ERP/CRM 13.0.2, fixed version is 14.0.0,in the forgot-password function becuase the application allows email addresses as usernames, which can cause a Denial of Service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-863
References: https://github.com/Dolibarr/dolibarr/commit/b57eb8284e830e30eefb26e3c5ede076ea24037c; https://github.com/Dolibarr/dolibarr/commit/b57eb8284e830e30eefb26e3c5ede076ea24037c
CVE: CVE-2021-43478
Published: 2022-03-31
Description: A vulnerability exists in Hoosk 1.8.0 in /install/index.php, due to a failure to check if config.php already exists in the root directory, which could let a malicious user reinstall the website.
CVSS Score: 5.4 (MEDIUM)
References: https://github.com/kr0za/bugs/issues/1; https://github.com/kr0za/bugs/issues/1
CVE: CVE-2021-43484
Published: 2022-03-31
Description: A Remote Code Execution (RCE) vulnerability exists in Simple Client Management System 1.0 in create.php due to the failure to validate the extension of the file being sent in a request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.exploit-db.com/exploits/50094; https://www.exploit-db.com/exploits/50094
CVE: CVE-2021-43479
Published: 2022-03-31
Description: A Remote Code Execution (RCE) vulnerability exists in The-Secretary 2.5 via install.php.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/mikaelstaer/The-Secretary/issues/10; https://github.com/mikaelstaer/The-Secretary/issues/10
CVE: CVE-2021-43707
Published: 2022-03-31
Description: Cross Site Scripting (XSS) vulnerability exists in Maccms v10 via link_Name parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/maccmspro/maccms10/issues/18; https://github.com/maccmspro/maccms10/issues/18
CVE: CVE-2021-43722
Published: 2022-03-31
Description: D-Link DIR-645 1.03 A1 is vulnerable to Buffer Overflow. The hnap_main function in the cgibin handler uses sprintf to format the soapaction header onto the stack and has no limit on the size.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/luqiut/iot/blob/main/DIR-645%20Stack%20overflow.md; https://www.dlink.com/en/security-bulletin/; https://github.com/luqiut/iot/blob/main/DIR-645%20Stack%20overflow.md
CVE: CVE-2022-26546
Published: 2022-03-31
Description: Hospital Management System v1.0 was discovered to lack an authorization component, allowing attackers to access sensitive information and obtain the admin password.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-862
References: https://github.com/kabirkhyrul/HMS; https://github.com/kabirkhyrul/HMS/discussions/12; https://github.com/kabirkhyrul/HMS
CVE: CVE-2021-46439
Published: 2022-03-31
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation sho
CVE: CVE-2022-24758
Published: 2022-03-31
Description: The Jupyter notebook is a web-based notebook environment for interactive computing. Prior to version 6.4.9, unauthorized actors can access sensitive information from server logs. Anytime a 5xx error is triggered, the auth cookie and other header values are recorded in Jupyter server logs by default. Considering these logs do not require root access, an attacker can monitor these logs, steal sensitive auth/cookie information, and gain access to the Jupyter server. Jupyter notebook version 6.4.x contains a patch for this issue. There are currently no known workarounds.
CVSS Score: 7.5 (HIGH)
CWE: CWE-532
References: https://github.com/jupyter/notebook/security/advisories/GHSA-m87f-39q9-6f55; https://github.com/jupyter/notebook/security/advisories/GHSA-m87f-39q9-6f55
CVE: CVE-2022-24791
Published: 2022-03-31
Description: Wasmtime is a standalone JIT-style runtime for WebAssembly, using Cranelift. There is a use after free vulnerability in Wasmtime when both running Wasm that uses externrefs and enabling epoch interruption in Wasmtime. If you are not explicitly enabling epoch interruption (it is disabled by default) then you are not affected. If you are explicitly disabling the Wasm reference types proposal (it is enabled by default) then you are also not affected. The use after free is caused by Cranelift failing to emit stack maps when there are safepoints inside cold blocks. Cold blocks occur when epoch interruption is enabled. Cold blocks are emitted at the end of compiled functions, and change the order blocks are emitted versus defined. This reordering accidentally caused Cranelift to skip emitting some stack maps because it expected to emit the stack maps in block definition order, rather than block emission order. When Wasmtime would eventually collect garbage, it would fail to find live references on the stack because of the missing stack maps, think that they were unreferenced garbage, and therefore reclaim them. Then after the collection ended, the Wasm code could use the reclaimed-too-early references, which is a use after free. Patches have been released in versions 0.34.2 and 0.35.2, which fix the vulnerability. All Wasmtime users are recommended to upgrade to these patched versions. If upgrading is not an option for you at this time, you can avoid the vulnerability by either: disabling the Wasm reference types proposal, config.wasm_reference_types(false); or by disabling epoch interruption if you were previously enabling it. config.epoch_interruption(false).
CVSS Score: 8.1 (HIGH)
CWE: CWE-416
References: https://github.com/bytecodealliance/wasmtime/commit/666c2554ea0e1728c35aa41178cf235920db888a; https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-gwc9-348x-qwv2; https://github.com/bytecodealliance/wasmtime/commit/666c2554ea0e1728c35aa41178cf235920db888a
CVE: CVE-2022-24794
Published: 2022-03-31
Description: Express OpenID Connect is an Express JS middleware implementing sign on for Express web apps using OpenID Connect. Users of the `requiresAuth` middleware, either directly or through the default `authRequired` option, are vulnerable to an Open Redirect when the middleware is applied to a catch all route. If all routes under `example.com` are protected with the `requiresAuth` middleware, a visit to `http://example.com//google.com` will be redirected to `google.com` after login because the original url reported by the Express framework is not properly sanitized. This vulnerability affects versions prior to 2.7.2. Users are advised to upgrade. There are no known workarounds.
CVSS Score: 7.5 (HIGH)
CWE: CWE-601
References: https://github.com/auth0/express-openid-connect/commit/0947b92164a2c5f661ebcc183d37e7f21de719ad; https://github.com/auth0/express-openid-connect/security/advisories/GHSA-7p99-3798-f85c; https://github.com/auth0/express-openid-connect/commit/0947b92164a2c5f661ebcc183d37e7f21de719ad
CVE: CVE-2022-24796
Published: 2022-03-31
Description: RaspberryMatic is a free and open-source operating system for running a cloud-free smart-home using the homematicIP / HomeMatic hardware line of IoT devices. A Remote Code Execution (RCE) vulnerability in the file upload facility of the WebUI interface of RaspberryMatic exists. Missing input validation/sanitization in the file upload mechanism allows remote, unauthenticated attackers with network access to the WebUI interface to achieve arbitrary operating system command execution via shell metacharacters in the HTTP query string. Injected commands are executed as root, thus leading to a full compromise of the underlying system and all its components. Versions after `2.31.25.20180428` and prior to `3.63.8.20220330` are affected. Users are advised to update to version `3.63.8.20220330` or newer. There are currently no known workarounds to mitigate the security impact and users are advised to update to the latest version available.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-78
References: https://github.com/jens-maus/RaspberryMatic/commit/34854659a63e9fb3ad529bb413e96978c6450a53; https://github.com/jens-maus/RaspberryMatic/security/advisories/GHSA-g7vv-7rmf-mff7; https://github.com/jens-maus/RaspberryMatic/commit/34854659a63e9fb3ad529bb413e96978c6450a53
CVE: CVE-2022-24797
Published: 2022-03-31
Description: Pomerium is an identity-aware access proxy. In distributed service mode, Pomerium's Authenticate service exposes pprof debug and prometheus metrics handlers to untrusted traffic. This can leak potentially sensitive environmental information or lead to limited denial of service conditions. This issue is patched in version v0.17.1 Workarounds: Block access to `/debug` and `/metrics` paths on the authenticate service. This can be done with any L7 proxy, including Pomerium's own proxy service.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://github.com/pomerium/pomerium/commit/b435f73e2b54088da2aca5e8c3aa1808293d6903; https://github.com/pomerium/pomerium/pull/3212; https://github.com/pomerium/pomerium/security/advisories/GHSA-q98f-2x4p-prjr
CVE: CVE-2022-24798
Published: 2022-03-31
Description: Internet Routing Registry daemon version 4 is an IRR database server, processing IRR objects in the RPSL format. IRRd did not always filter password hashes in query responses relating to `mntner` objects and database exports. This may have allowed adversaries to retrieve some of these hashes, perform a brute-force search for the clear-text passphrase, and use these to make unauthorised changes to affected IRR objects. This issue only affected instances that process password hashes, which means it is limited to IRRd instances that serve authoritative databases. IRRd instances operating solely as mirrors of other IRR databases are not affected. This has been fixed in IRRd 4.2.3 and the main branch. Versions in the 4.1.x series never were affected. Users of the 4.2.x series are strongly recommended to upgrade. There are no known workarounds for this issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-212, CWE-212
References: https://github.com/irrdnet/irrd/commit/0e41bae8d3d27316381a2fc7b466597230e35ec6; https://github.com/irrdnet/irrd/commit/fdffaf8dd71713f06e99dff417e6aa1e6fa84b70; https://github.com/irrdnet/irrd/security/advisories/GHSA-cqxx-66wh-8pjw
CVE: CVE-2022-27049
Published: 2022-03-31
Description: Raidrive before v2021.12.35 allows attackers to arbitrarily move log files by pre-creating a mountpoint and log files before Raidrive is installed.
CVSS Score: 2.0 (LOW)
References: https://github.com/ycdxsb/Vuln/blob/main/RaiDrive-Arbitrary-File-Move/Raidrive%20Setup%20Arbitrary%20File%20Move.md; https://github.com/ycdxsb/Vuln/blob/main/RaiDrive-Arbitrary-File-Move/Raidrive%20Setup%20Arbitrary%20File%20Move.md
CVE: CVE-2022-27050
Published: 2022-03-31
Description: BitComet Service for Windows before version 1.8.6 contains an unquoted service path vulnerability which allows attackers to escalate privileges to the system level.
CVSS Score: 7.8 (HIGH)
CWE: CWE-428
References: https://github.com/ycdxsb/Vuln/tree/main/BitComet-Unquoted-Service-Path; https://github.com/ycdxsb/Vuln/tree/main/BitComet-Unquoted-Service-Path
CVE: CVE-2022-27052
Published: 2022-03-31
Description: FreeFtpd version 1.0.13 and below contains an unquoted service path vulnerability which allows local users to launch processes with elevated privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-428
References: https://github.com/ycdxsb/Vuln/tree/main/FreeFTPd-Unquoted-Service-Path; https://github.com/ycdxsb/Vuln/tree/main/FreeFTPd-Unquoted-Service-Path