deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-43309
Published: 2022-08-24
Description: An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the uri-template-lite npm package, when an attacker is able to supply arbitrary input to the "URI.expand" method
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-1333, CWE-1333
References: https://github.com/litejs/uri-template-lite/compare/v22.1.0...v22.9.0; https://research.jfrog.com/vulnerabilities/uri-template-lite-redos-xray-211351/; https://github.com/litejs/uri-template-lite/compare/v22.1.0...v22.9.0
CVE: CVE-2021-4028
Published: 2022-08-24
Description: A flaw in the Linux kernel's implementation of RDMA communications manager listener code allowed an attacker with local access to setup a socket to listen on a high port allowing for a list element to be used after free. Given the ability to execute code, a local attacker could leverage this use-after-free to crash the system or possibly escalate privileges on the system.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://access.redhat.com/security/cve/CVE-2021-4028; https://bugzilla.redhat.com/show_bug.cgi?id=2027201; https://bugzilla.suse.com/show_bug.cgi?id=1193167#c0
CVE: CVE-2021-4037
Published: 2022-08-24
Description: A vulnerability was found in the fs/inode.c:inode_init_owner() function logic of the LInux kernel that allows local users to create files for the XFS file-system with an unintended group ownership and with group execution and SGID permission bits set, in a scenario where a directory is SGID and belongs to a certain group and is writable by a user who is not a member of this group. This can lead to excessive permissions granted in case when they should not. This vulnerability is similar to the previous CVE-2018-13405 and adds the missed fix for the XFS.
CVSS Score: 7.8 (HIGH)
CWE: CWE-284
References: https://access.redhat.com/security/cve/CVE-2021-4037; https://bugzilla.redhat.com/show_bug.cgi?id=2004810; https://bugzilla.redhat.com/show_bug.cgi?id=2027239
CVE: CVE-2021-4040
Published: 2022-08-24
Description: A flaw was found in AMQ Broker. This issue can cause a partial interruption to the availability of AMQ Broker via an Out of memory (OOM) condition. This flaw allows an attacker to partially disrupt availability to the broker through a sustained attack of maliciously crafted messages. The highest threat from this vulnerability is system availability.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-400, CWE-787
References: https://access.redhat.com/security/cve/CVE-2021-4040; https://bugzilla.redhat.com/show_bug.cgi?id=2028254; https://github.com/apache/activemq-artemis/pull/3871/commits
CVE: CVE-2021-4041
Published: 2022-08-24
Description: A flaw was found in ansible-runner. An improper escaping of the shell command, while calling the ansible_runner.interface.run_command, can lead to parameters getting executed as host's shell command. A developer could unintentionally write code that gets executed in the host rather than the virtual environment.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20, CWE-116
References: https://access.redhat.com/security/cve/CVE-2021-4041; https://bugzilla.redhat.com/show_bug.cgi?id=2028074; https://github.com/ansible/ansible-runner/commit/3533f265f4349a3f2a0283158cd01b59a6bbc7bd
CVE: CVE-2021-4122
Published: 2022-08-24
Description: It was found that a specially crafted LUKS header could trick cryptsetup into disabling encryption during the recovery of the device. An attacker with physical access to the medium, such as a flash disk, could use this flaw to force a user into permanently disabling the encryption layer of that medium.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-345, CWE-345
References: https://access.redhat.com/security/cve/CVE-2021-4122; https://bugzilla.redhat.com/show_bug.cgi?id=2031859; https://bugzilla.redhat.com/show_bug.cgi?id=2032401
CVE: CVE-2021-4125
Published: 2022-08-24
Description: It was found that the original fix for log4j CVE-2021-44228 and CVE-2021-45046 in the OpenShift metering hive containers was incomplete, as not all JndiLookup.class files were removed. This CVE only applies to the OpenShift Metering hive container images, shipped in OpenShift 4.8, 4.7 and 4.6.
CVSS Score: 8.1 (HIGH)
CWE: CWE-20, CWE-502
References: https://access.redhat.com/security/cve/CVE-2021-4125; https://access.redhat.com/security/cve/CVE-2021-44228; https://access.redhat.com/security/cve/CVE-2021-45046
CVE: CVE-2021-4142
Published: 2022-08-24
Description: The Candlepin component of Red Hat Satellite was affected by an improper authentication flaw. Few factors could allow an attacker to use the SCA (simple content access) certificate for authentication with Candlepin.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-639, CWE-287, CWE-639
References: https://access.redhat.com/security/cve/CVE-2021-4142; https://bugzilla.redhat.com/show_bug.cgi?id=2034346; https://github.com/candlepin/candlepin/pull/3197
CVE: CVE-2021-4155
Published: 2022-08-24
Description: A data leak flaw was found in the way XFS_IOC_ALLOCSP IOCTL in the XFS filesystem allowed for size increase of files with unaligned size. A local attacker could use this flaw to leak data on the XFS filesystem otherwise not accessible to them.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-131, CWE-131
References: https://access.redhat.com/security/cve/CVE-2021-4155; https://bugzilla.redhat.com/show_bug.cgi?id=2034813; https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=983d8e60f50806f90534cc5373d0ce867e5aaf79
CVE: CVE-2021-4158
Published: 2022-08-24
Description: A NULL pointer dereference issue was found in the ACPI code of QEMU. A malicious, privileged user within the guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://access.redhat.com/security/cve/CVE-2021-4158; https://bugzilla.redhat.com/show_bug.cgi?id=2035002; https://gitlab.com/qemu-project/qemu/-/commit/9bd6565ccee68f72d5012e24646e12a1c662827e
CVE: CVE-2021-4159
Published: 2022-08-24
Description: A vulnerability was found in the Linux kernel's EBPF verifier when handling internal data structures. Internal memory locations could be returned to userspace. A local attacker with the permissions to insert eBPF code to the kernel can use this to leak internal kernel memory details defeating some of the exploit mitigations in place for the kernel.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-202
References: https://access.redhat.com/security/cve/CVE-2021-4159; https://bugzilla.redhat.com/show_bug.cgi?id=2036024; https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=294f2fc6da27620a506e6c[PII_REDACTED]59ccd6bd
CVE: CVE-2021-4178
Published: 2022-08-24
Description: A arbitrary code execution flaw was found in the Fabric 8 Kubernetes client affecting versions 5.0.0-beta-1 and above. Due to an improperly configured YAML parsing, this will allow a local and privileged attacker to supply malicious YAML.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-502, CWE-502
References: https://access.redhat.com/security/cve/CVE-2021-4178; https://bugzilla.redhat.com/show_bug.cgi?id=2034388; https://github.com/advisories/GHSA-98g7-rxmf-rrxm
CVE: CVE-2021-4189
Published: 2022-08-24
Description: A flaw was found in Python, specifically in the FTP (File Transfer Protocol) client library in PASV (passive) mode. The issue is how the FTP client trusts the host from the PASV response by default. This flaw allows an attacker to set up a malicious FTP server that can trick FTP clients into connecting back to a given IP address and port. This vulnerability could lead to FTP client scanning ports, which otherwise would not have been possible.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-252, CWE-252
References: https://access.redhat.com/security/cve/CVE-2021-4189; https://bugs.python.org/issue43285; https://bugzilla.redhat.com/show_bug.cgi?id=2036020
CVE: CVE-2021-4204
Published: 2022-08-24
Description: An out-of-bounds (OOB) memory access flaw was found in the Linux kernel's eBPF due to an Improper Input Validation. This flaw allows a local attacker with a special privilege to crash the system or leak internal information.
CVSS Score: 7.1 (HIGH)
CWE: CWE-20, CWE-119
References: https://access.redhat.com/security/cve/CVE-2021-4204; https://bugzilla.redhat.com/show_bug.cgi?id=2039178; https://security-tracker.debian.org/tracker/CVE-2021-4204
CVE: CVE-2021-4209
Published: 2022-08-24
Description: A NULL pointer dereference flaw was found in GnuTLS. As Nettle's hash update functions internally call memcpy, providing zero-length input may cause undefined behavior. This flaw leads to a denial of service after authentication in rare circumstances.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://access.redhat.com/security/cve/CVE-2021-4209; https://bugzilla.redhat.com/show_bug.cgi?id=2044156; https://gitlab.com/gnutls/gnutls/-/commit/3db352734472d851318944db13be73da61300568
CVE: CVE-2021-4213
Published: 2022-08-24
Description: A flaw was found in JSS, where it did not properly free up all memory. Over time, the wasted memory builds up in the server memory, saturating the server’s RAM. This flaw allows an attacker to force the invocation of an out-of-memory process, causing a denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-401, CWE-401
References: https://access.redhat.com/security/cve/CVE-2021-4213; https://bugzilla.redhat.com/show_bug.cgi?id=2042900; https://github.com/dogtagpki/jss/commit/3aabe0e9d59b0a42e68ac8cd0468f9c5179967d2
CVE: CVE-2021-4214
Published: 2022-08-24
Description: A heap overflow flaw was found in libpngs' pngimage.c program. This flaw allows an attacker with local network access to pass a specially crafted PNG file to the pngimage utility, causing an application to crash, leading to a denial of service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-120, CWE-787
References: https://access.redhat.com/security/cve/CVE-2021-4214; https://bugzilla.redhat.com/show_bug.cgi?id=2043393; https://github.com/glennrp/libpng/issues/302
CVE: CVE-2021-4217
Published: 2022-08-24
Description: A flaw was found in unzip. The vulnerability occurs due to improper handling of Unicode strings, which can lead to a null pointer dereference. This flaw allows an attacker to input a specially crafted zip file, leading to a crash or code execution.
CVSS Score: 3.3 (LOW)
CWE: CWE-476, CWE-476
References: https://access.redhat.com/security/cve/CVE-2021-4217; https://bugs.launchpad.net/ubuntu/+source/unzip/+bug/1957077; https://bugzilla.redhat.com/show_bug.cgi?id=2044583
CVE: CVE-2021-4218
Published: 2022-08-24
Description: A flaw was found in the Linux kernel’s implementation of reading the SVC RDMA counters. Reading the counter sysctl panics the system. This flaw allows a local attacker with local access to cause a denial of service while the system reboots. The issue is specific to CentOS/RHEL.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-665, CWE-665
References: https://access.redhat.com/security/cve/CVE-2021-4218; https://bugs.centos.org/view.php?id=18395; https://bugzilla.redhat.com/show_bug.cgi?id=2048359
CVE: CVE-2022-2234
Published: 2022-08-24
Description: An authenticated mySCADA myPRO 8.26.0 user may be able to modify parameters to run commands directly in the operating system.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-77, CWE-78
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-235-03; https://www.cisa.gov/uscert/ics/advisories/icsa-22-235-03
CVE: CVE-2022-2569
Published: 2022-08-24
Description: The affected device stores sensitive information in cleartext, which may allow an authenticated user to access session data stored in the OAuth database belonging to legitimate users
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-312
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-235-01-0; https://www.cisa.gov/uscert/ics/advisories/icsa-22-235-01-0
CVE: CVE-2022-2978
Published: 2022-08-24
Description: A flaw use after free in the Linux kernel NILFS file system was found in the way user triggers function security_inode_alloc to fail with following call to function nilfs_mdt_destroy. A local user could use this flaw to crash the system or potentially escalate their privileges on the system.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://lists.debian.org/debian-lts-announce/2022/12/msg00034.html; https://lore.kernel.org/linux-fsdevel/[PII_REDACTED]0859.659129-1-dzm91%40hust.edu.cn/T/#u; https://lists.debian.org/debian-lts-announce/2022/12/msg00034.html
CVE: CVE-2022-34836
Published: 2022-08-24
Description: Relative Path Traversal vulnerability in ABB Zenon 8.20 allows the user to access files on the Zenon system and user also can add own log messages and e.g., flood the log entries. An attacker who successfully exploit the vulnerability could access the Zenon runtime activities such as the start and stop of various activity and the last error code etc.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-23, CWE-22
References: https://search.abb.com/library/Download.aspx?DocumentID=2NGA001479&LanguageCode=en&DocumentPartId=&Action=Launch; https://search.abb.com/library/Download.aspx?DocumentID=2NGA001479&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2022-34837
Published: 2022-08-24
Description: Storing Passwords in a Recoverable Format vulnerability in ABB Zenon 8.20 allows an attacker who successfully exploit the vulnerability may add more network clients that may monitor various activities of the Zenon.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-257, CWE-522
References: https://search.abb.com/library/Download.aspx?DocumentID=2NGA001479&LanguageCode=en&DocumentPartId=&Action=Launch; https://search.abb.com/library/Download.aspx?DocumentID=2NGA001479&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2022-34838
Published: 2022-08-24
Description: Storing Passwords in a Recoverable Format vulnerability in ABB Zenon 8.20 allows an attacker who successfully exploit the vulnerability may add or alter data points and corresponding attributes. Once such engineering data is used the data visualization will be altered for the end user.
CVSS Score: 8.1 (HIGH)
CWE: CWE-257, CWE-522
References: https://search.abb.com/library/Download.aspx?DocumentID=2NGA001479&LanguageCode=en&DocumentPartId=&Action=Launch; https://search.abb.com/library/Download.aspx?DocumentID=2NGA001479&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2022-37178
Published: 2022-08-24
Description: An issue was discovered in 72crm 9.0. There is a SQL Injection vulnerability in View the task calendar.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/72wukong/72crm-9.0-PHP/issues/34; https://github.com/72wukong/72crm-9.0-PHP/issues/34
CVE: CVE-2022-37181
Published: 2022-08-24
Description: 72crm 9.0 has an Arbitrary file upload vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://github.com/72wukong/72crm-9.0-PHP/issues/35; https://github.com/72wukong/72crm-9.0-PHP/issues/35
CVE: CVE-2018-14519
Published: 2022-08-24
Description: An issue was discovered in Kirby 2.5.12. The delete page functionality suffers from a CSRF flaw. A remote attacker can craft a malicious CSRF page and force the user to delete a page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: http://zaranshaikh.blogspot.com; https://www.exploit-db.com/exploits/45090; http://zaranshaikh.blogspot.com
CVE: CVE-2018-14520
Published: 2022-08-24
Description: An issue was discovered in Kirby 2.5.12. The application allows malicious HTTP requests to be sent in order to trick a user into adding web pages.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://zaranshaikh.blogspot.com/2018/07/cross-site-request-forgery-kirby-cms.html; https://www.exploit-db.com/exploits/45068; http://zaranshaikh.blogspot.com/2018/07/cross-site-request-forgery-kirby-cms.html
CVE: CVE-2022-32793
Published: 2022-08-24
Description: Multiple out-of-bounds write issues were addressed with improved bounds checking. This issue is fixed in macOS Monterey 12.5, watchOS 8.7, tvOS 15.6, iOS 15.6 and iPadOS 15.6. An app may be able to disclose kernel memory.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-787
References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7SETAAXEPGNBMYKTUDFEZHS5LGSQ64QL/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YKJGV2EXVMYQW3OAJNI4WUTKKVMD2YYK/; https://support.apple.com/en-us/HT213340
CVE: CVE-2022-32810
Published: 2022-08-24
Description: The issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.5, watchOS 8.7, iOS 15.6 and iPadOS 15.6. An app may be able to execute arbitrary code with kernel privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://support.apple.com/en-us/HT213340; https://support.apple.com/en-us/HT213345; https://support.apple.com/en-us/HT213346
CVE: CVE-2022-32811
Published: 2022-08-24
Description: A memory corruption vulnerability was addressed with improved locking. This issue is fixed in macOS Monterey 12.5, macOS Big Sur 11.6.8, Security Update 2022-005 Catalina. An app may be able to execute arbitrary code with kernel privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-667, CWE-667
References: https://support.apple.com/en-us/HT213343; https://support.apple.com/en-us/HT213344; https://support.apple.com/en-us/HT213345
CVE: CVE-2022-32812
Published: 2022-08-24
Description: The issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.5, macOS Big Sur 11.6.8, Security Update 2022-005 Catalina. An app may be able to execute arbitrary code with kernel privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://support.apple.com/en-us/HT213343; https://support.apple.com/en-us/HT213344; https://support.apple.com/en-us/HT213345
CVE: CVE-2022-32813
Published: 2022-08-24
Description: The issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.5, macOS Big Sur 11.6.8, Security Update 2022-005 Catalina, iOS 15.6 and iPadOS 15.6, tvOS 15.6, watchOS 8.7. An app with root privileges may be able to execute arbitrary code with kernel privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://support.apple.com/en-us/HT213340; https://support.apple.com/en-us/HT213342; https://support.apple.com/en-us/HT213343
CVE: CVE-2022-32834
Published: 2022-08-24
Description: An access issue was addressed with improvements to the sandbox. This issue is fixed in macOS Monterey 12.5, macOS Big Sur 11.6.8, Security Update 2022-005 Catalina. An app may be able to access sensitive user information.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-284
References: https://support.apple.com/en-us/HT213343; https://support.apple.com/en-us/HT213344; https://support.apple.com/en-us/HT213345
CVE: CVE-2022-32837
Published: 2022-08-24
Description: This issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.5, tvOS 15.6, iOS 15.6 and iPadOS 15.6. An app may be able to cause unexpected system termination or write kernel memory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://support.apple.com/en-us/HT213342; https://support.apple.com/en-us/HT213345; https://support.apple.com/en-us/HT213346
CVE: CVE-2022-32838
Published: 2022-08-24
Description: A logic issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.5, macOS Big Sur 11.6.8, Security Update 2022-005 Catalina, iOS 15.6 and iPadOS 15.6. An app may be able to read arbitrary files.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-285
References: https://support.apple.com/en-us/HT213343; https://support.apple.com/en-us/HT213344; https://support.apple.com/en-us/HT213345
CVE: CVE-2022-32839
Published: 2022-08-24
Description: The issue was addressed with improved bounds checks. This issue is fixed in macOS Monterey 12.5, macOS Big Sur 11.6.8, Security Update 2022-005 Catalina, iOS 15.6 and iPadOS 15.6, tvOS 15.6, watchOS 8.7. A remote user may cause an unexpected app termination or arbitrary code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: https://support.apple.com/en-us/HT213340; https://support.apple.com/en-us/HT213342; https://support.apple.com/en-us/HT213343
CVE: CVE-2022-32840
Published: 2022-08-24
Description: This issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.5, watchOS 8.7, iOS 15.6 and iPadOS 15.6. An app may be able to execute arbitrary code with kernel privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://support.apple.com/en-us/HT213340; https://support.apple.com/en-us/HT213345; https://support.apple.com/en-us/HT213346
CVE: CVE-2022-32857
Published: 2022-08-24
Description: This issue was addressed by using HTTPS when sending information over the network. This issue is fixed in macOS Monterey 12.5, macOS Big Sur 11.6.8, Security Update 2022-005 Catalina, iOS 15.6 and iPadOS 15.6, tvOS 15.6, watchOS 8.7. A user in a privileged network position can track a user’s activity.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-319
References: https://support.apple.com/en-us/HT213340; https://support.apple.com/en-us/HT213342; https://support.apple.com/en-us/HT213343
CVE: CVE-2022-32893
Published: 2022-08-24
Description: An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 15.6.1 and iPadOS 15.6.1, macOS Monterey 12.5.1, Safari 15.6.1. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: http://seclists.org/fulldisclosure/2022/Aug/16; http://seclists.org/fulldisclosure/2022/Oct/49; http://www.openwall.com/lists/oss-security/2022/08/25/5
CVE: CVE-2022-32894
Published: 2022-08-24
Description: An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 15.6.1 and iPadOS 15.6.1, macOS Monterey 12.5.1. An application may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may have been actively exploited.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: http://seclists.org/fulldisclosure/2022/Aug/16; http://seclists.org/fulldisclosure/2022/Oct/45; http://seclists.org/fulldisclosure/2022/Oct/49
CVE: CVE-2022-32427
Published: 2022-08-25
Description: PrinterLogic Windows Client through 25.0.0.676 allows attackers to execute directory traversal. Authenticated users with prior knowledge of the driver filename could exploit this to escalate privileges or distribute malicious content. This issue has been resolved in PrinterLogic Windows Client 25.0.0688 and all affected are advised to upgrade.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22
References: https://docs.printercloud.com/1-Printerlogic/Release_Notes/Client_Release_Notes.htm?tocpath=_____9; https://www.printerlogic.com/security-bulletin/; https://docs.printercloud.com/1-Printerlogic/Release_Notes/Client_Release_Notes.htm?tocpath=_____9
CVE: CVE-2022-34960
Published: 2022-08-25
Description: The container package in MikroTik RouterOS 7.4beta4 allows an attacker to create mount points pointing to symbolic links, which resolve to locations on the host device. This allows the attacker to mount any arbitrary file to any location on the host.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-59
References: https://nns.ee/blog/2022/06/21/routeros-container-rce.html; https://nns.ee/blog/2022/08/05/routeros-container-rce.html; https://nns.ee/blog/2022/06/21/routeros-container-rce.html
CVE: CVE-2022-2957
Published: 2022-08-25
Description: A vulnerability classified as critical was found in SourceCodester Simple and Nice Shopping Cart Script. Affected by this vulnerability is an unknown functionality of the file /mkshop/Men/profile.php. The manipulation of the argument mem_id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-207001 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://s1.ax1x.com/2022/08/14/vUSruD.png; https://vuldb.com/?id.207001; https://s1.ax1x.com/2022/08/14/vUSruD.png