deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-37298
Published: 2022-10-20
Description: Shinken Solutions Shinken Monitoring Version 2.4.3 affected is vulnerable to Incorrect Access Control. The SafeUnpickler class found in shinken/safepickle.py implements a weak authentication scheme when unserializing objects passed from monitoring nodes to the Shinken monitoring server.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287, CWE-287
References: https://github.com/dbyio/cve-2022-37298; https://github.com/naparuba/shinken/commit/2dae40fd1e713aec9e1966a0ab7a580b9180cff2; https://github.com/dbyio/cve-2022-37298
CVE: CVE-2022-37598
Published: 2022-10-20
Description: Prototype pollution vulnerability in function DEFNODE in ast.js in mishoo UglifyJS 3.13.2 via the name variable in ast.js. NOTE: the vendor considers this an invalid report.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1321
References: https://github.com/mishoo/UglifyJS/blob/352a944868b09c9ce3121a49d4a0bf0afe370a35/lib/ast.js#L46; https://github.com/mishoo/UglifyJS/blob/352a944868b09c9ce3121a49d4a0bf0afe370a35/lib/ast.js#L79; https://github.com/mishoo/UglifyJS/issues/5699
CVE: CVE-2022-31366
Published: 2022-10-20
Description: An arbitrary file upload vulnerability in the apiImportLabs function in api_labs.php of EVE-NG 2.0.3-112 Community allows attackers to execute arbitrary code via a crafted UNL file.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434, CWE-434
References: http://eve-ng.com; https://erpaciocco.github.io/2022/eve-ng-rce/; http://eve-ng.com
CVE: CVE-2022-42197
Published: 2022-10-20
Description: In Simple Exam Reviewer Management System v1.0 the User List function has improper access control that allows low privileged users to modify user permissions to higher privileges.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-425, CWE-425
References: https://github.com/ciph0x01/Simple-Exam-Reviewer-Management-System-CVE/blob/main/CVE-2022-42197.md; https://www.sourcecodester.com/php/15160/simple-exam-reviewer-management-system-phpoop-free-source-code.html; https://github.com/ciph0x01/Simple-Exam-Reviewer-Management-System-CVE/blob/main/CVE-2022-42197.md
CVE: CVE-2022-42198
Published: 2022-10-20
Description: In Simple Exam Reviewer Management System v1.0 the User List function suffers from insecure file upload.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434, CWE-434
References: https://github.com/ciph0x01/Simple-Exam-Reviewer-Management-System-CVE/blob/main/CVE-2022-42198.md; https://www.sourcecodester.com/php/15160/simple-exam-reviewer-management-system-phpoop-free-source-code.html; https://github.com/ciph0x01/Simple-Exam-Reviewer-Management-System-CVE/blob/main/CVE-2022-42198.md
CVE: CVE-2022-42199
Published: 2022-10-20
Description: Simple Exam Reviewer Management System v1.0 is vulnerable to Cross Site Request Forgery (CSRF) via the Exam List.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://github.com/ciph0x01/Simple-Exam-Reviewer-Management-System-CVE/blob/main/CVE-2022-42199.md; https://github.com/ciph0x01/poc/blob/main/poc.html; https://www.sourcecodester.com/php/15160/simple-exam-reviewer-management-system-phpoop-free-source-code.html
CVE: CVE-2022-42200
Published: 2022-10-20
Description: Simple Exam Reviewer Management System v1.0 is vulnerable to Stored Cross Site Scripting (XSS) via the Exam List.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/ciph0x01/Simple-Exam-Reviewer-Management-System-CVE/blob/main/CVE-2022-42200.md; https://www.sourcecodester.com/php/15160/simple-exam-reviewer-management-system-phpoop-free-source-code.html; https://github.com/ciph0x01/Simple-Exam-Reviewer-Management-System-CVE/blob/main/CVE-2022-42200.md
CVE: CVE-2022-42201
Published: 2022-10-20
Description: Simple Exam Reviewer Management System v1.0 is vulnerable to Insecure file upload.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434, CWE-434
References: https://github.com/ciph0x01/Simple-Exam-Reviewer-Management-System-CVE/blob/main/CVE-2022-42201.md; https://www.sourcecodester.com/php/15160/simple-exam-reviewer-management-system-phpoop-free-source-code.html; https://github.com/ciph0x01/Simple-Exam-Reviewer-Management-System-CVE/blob/main/CVE-2022-42201.md
CVE: CVE-2022-40084
Published: 2022-10-20
Description: OpenCRX before v5.2.2 was discovered to be vulnerable to password enumeration due to the difference in error messages received during a password reset which could enable an attacker to determine if a username, email or ID is valid.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-203, CWE-203
References: https://cwe.mitre.org/data/definitions/204.html#:~:text=User%20enumeration%20via%20discrepancies%20in%20error%20messages.%2C-CVE-2004-0294&text=Bulletin%20Board%20displays%20different%20error%2Cbrute%20force%20password%20guessing%20attack.; https://github.com/ciph0x01/OpenCRX-CVE/blob/main/CVE-2022-40084.md; https://cwe.mitre.org/data/definitions/204.html#:~:text=User%20enumeration%20via%20discrepancies%20in%20error%20messages.%2C-CVE-2004-0294&text=Bulletin%20Board%20displays%20different%20error%2Cbrute%20force%20password%20guessing%20attack.
CVE: CVE-2022-42021
Published: 2022-10-20
Description: Best Student Result Management System v1.0 is vulnerable to SQL Injection via /upresult/upresult/notice-details.php?nid=.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/623085881/bug_report/blob/main/vendors/mayuri_k/Best%20Student%20Result%20Management%20System/SQLi-1.md; https://github.com/623085881/bug_report/blob/main/vendors/mayuri_k/Best%20Student%20Result%20Management%20System/SQLi-1.md
CVE: CVE-2022-42176
Published: 2022-10-20
Description: In PCTechSoft PCSecure V5.0.8.xw, use of Hard-coded Credentials in configuration files leads to admin panel access.
CVSS Score: 7.8 (HIGH)
CWE: CWE-798, CWE-798
References: https://github.com/soy-oreocato/CVE-2022-42176; https://github.com/soy-oreocato/CVE-Advisories/tree/main/PapiQuieroPollo00; https://github.com/soy-oreocato/CVE-2022-42176
CVE: CVE-2020-9285
Published: 2022-10-20
Description: Some versions of Sonos One (1st and 2nd generation) allow partial or full memory access via attacker controlled hardware that can be attached to the Mini-PCI Express slot on the motherboard that hosts the WiFi card on the device.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-1191
References: https://tnpitsecurity.com/blog/gaining-root-on-sonos-speakers/; https://tnpitsecurity.com/blog/gaining-root-on-sonos-speakers/
CVE: CVE-2022-2069
Published: 2022-10-20
Description: The APDFL.dll in Siemens JT2Go prior to V13.3.0.5 and Siemens Teamcenter Visualization prior to V14.0.0.2 contains an out of bounds write past the fixed-length heap-based buffer while parsing specially crafted PDF files. This could allow an attacker to execute code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: https://cert-portal.siemens.com/productcert/pdf/ssa-829738.pdf; https://www.cisa.gov/uscert/ics/advisories/icsa-22-195-07; https://cert-portal.siemens.com/productcert/pdf/ssa-829738.pdf
CVE: CVE-2022-3577
Published: 2022-10-20
Description: An out-of-bounds memory write flaw was found in the Linux kernel’s Kid-friendly Wired Controller driver. This flaw allows a local user to crash or potentially escalate their privileges on the system. It is in bigben_probe of drivers/hid/hid-bigbenff.c. The reason is incorrect assumption - bigben devices all have inputs. However, malicious devices can break this assumption, leaking to out-of-bound write.
CVSS Score: 7.8 (HIGH)
CWE: CWE-401, CWE-787
References: https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git/commit/?h=char-misc-next&id=9d64d2405f7d30d49818f6682acd0392348f0fdb; https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=945a9a8e448b65bec055d37eba58f711b39f66f0; https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=fc4ef9d[PII_REDACTED]bfa5ebed181dba6de3a56db
CVE: CVE-2022-42233
Published: 2022-10-20
Description: Tenda 11N with firmware version V5.07.33_cn suffers from an Authentication Bypass vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287, CWE-287
References: https://github.com/D0ngsec/vulns/blob/main/Tenda/Tenda_11N_Authentication_Bypass.md; https://github.com/D0ngsec/vulns/blob/main/Tenda/Tenda_11N_Authentication_Bypass.md
CVE: CVE-2022-42344
Published: 2022-10-20
Description: Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an Incorrect Authorization vulnerability. An authenticated attacker can exploit this vulnerability to achieve information exposure and privilege escalation.
CVSS Score: 8.8 (HIGH)
CWE: CWE-863, CWE-863
References: https://helpx.adobe.com/security/products/magento/apsb22-38.html; https://helpx.adobe.com/security/products/magento/apsb22-38.html
CVE: CVE-2022-3619
Published: 2022-10-20
Description: A vulnerability has been found in Linux Kernel and classified as problematic. This vulnerability affects the function l2cap_recv_acldata of the file net/bluetooth/l2cap_core.c of the component Bluetooth. The manipulation leads to memory leak. It is recommended to apply a patch to fix this issue. VDB-211918 is the identifier assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-404, CWE-401
References: https://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next.git/commit/?id=97097c85c088e11651146da32a4e1cdb9dfa6193; https://vuldb.com/?id.211918; https://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next.git/commit/?id=97097c85c088e11651146da32a4e1cdb9dfa6193
CVE: CVE-2022-3620
Published: 2022-10-20
Description: A vulnerability was found in Exim and classified as problematic. This issue affects the function dmarc_dns_lookup of the file dmarc.c of the component DMARC Handler. The manipulation leads to use after free. The attack may be initiated remotely. The name of the patch is 12fb3842f81bcbd4a4519d5728f2d7e0e3ca1445. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-211919.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-119, CWE-416
References: https://git.exim.org/exim.git/commit/12fb3842f81bcbd4a4519d5728f2d7e0e3ca1445; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/667V3ADXQ2MHUJMSXA3VZZEWLVSCIBEU/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EIH4W5R7SHTUEQFWWKB4TUO5YFZX64KV/
CVE: CVE-2022-3621
Published: 2022-10-20
Description: A vulnerability was found in Linux Kernel. It has been classified as problematic. Affected is the function nilfs_bmap_lookup_at_level of the file fs/nilfs2/inode.c of the component nilfs2. The manipulation leads to null pointer dereference. It is possible to launch the attack remotely. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-211920.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-404, CWE-476
References: https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next.git/commit/?id=21a87d88c2253350e115029f14fe2a10a7e6c856; https://lists.debian.org/debian-lts-announce/2022/11/msg00001.html; https://lists.debian.org/debian-lts-announce/2022/12/msg00034.html
CVE: CVE-2022-3623
Published: 2022-10-20
Description: A vulnerability was found in Linux Kernel. It has been declared as problematic. Affected by this vulnerability is the function follow_page_pte of the file mm/gup.c of the component BPF. The manipulation leads to race condition. The attack can be launched remotely. It is recommended to apply a patch to fix this issue. The identifier VDB-211921 was assigned to this vulnerability.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-362
References: https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next.git/commit/?id=fac35ba763ed07ba93154c95ffc0c4a55023707f; https://lists.debian.org/debian-lts-announce/2023/03/msg00000.html; https://vuldb.com/?id.211921
CVE: CVE-2022-36957
Published: 2022-10-20
Description: SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with Orion admin-level account access to SolarWinds Web Console to execute arbitrary commands.
CVSS Score: 7.2 (HIGH)
CWE: CWE-502, CWE-502
References: https://www.solarwinds.com/trust-center/security-advisories/CVE-2022-36957; https://www.zerodayinitiative.com/advisories/ZDI-CAN-17530; https://www.solarwinds.com/trust-center/security-advisories/CVE-2022-36957
CVE: CVE-2022-36958
Published: 2022-10-20
Description: SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with valid access to SolarWinds Web Console to execute arbitrary commands.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502, CWE-502
References: https://www.solarwinds.com/trust-center/security-advisories/CVE-2022-36958; https://www.zerodayinitiative.com/advisories/ZDI-CAN-17567; https://www.solarwinds.com/trust-center/security-advisories/CVE-2022-36958
CVE: CVE-2022-36966
Published: 2022-10-20
Description: Users with Node Management rights were able to view and edit all nodes due to Insufficient control on URL parameter causing insecure direct object reference (IDOR) vulnerability in SolarWinds Platform 2022.3 and previous.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-639, CWE-639
References: https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2022-4_release_notes.htm; https://www.solarwinds.com/trust-center/security-advisories/CVE-2022-36966; https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2022-4_release_notes.htm
CVE: CVE-2022-37453
Published: 2022-10-20
Description: An issue was discovered in Softing OPC UA C++ SDK before 6.10. A buffer overflow or an excess allocation happens due to unchecked array and matrix bounds in structure data types.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-787
References: https://industrial.softing.com/fileadmin/psirt/downloads/syt-2022-9.html; https://softing.com; https://industrial.softing.com/fileadmin/psirt/downloads/syt-2022-9.html
CVE: CVE-2022-38108
Published: 2022-10-20
Description: SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with Orion admin-level account access to SolarWinds Web Console to execute arbitrary commands.
CVSS Score: 7.2 (HIGH)
CWE: CWE-502, CWE-502
References: http://packetstormsecurity.com/files/171567/SolarWinds-Information-Service-SWIS-Remote-Command-Execution.html; https://www.solarwinds.com/trust-center/security-advisories/CVE-2022-38108; https://www.zerodayinitiative.com/advisories/ZDI-CAN-17531
CVE: CVE-2022-39823
Published: 2022-10-20
Description: An issue was discovered in Softing OPC UA C++ SDK 5.66 through 6.x before 6.10. An OPC/UA browse request exceeding the server limit on continuation points may cause a use-after-free error
CVSS Score: 7.5 (HIGH)
CWE: CWE-416, CWE-416
References: https://industrial.softing.com/fileadmin/psirt/downloads/syt-2022-8.html; https://www.softing.com; https://industrial.softing.com/fileadmin/psirt/downloads/syt-2022-8.html
CVE: CVE-2022-37454
Published: 2022-10-21
Description: The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute arbitrary code or eliminate expected cryptographic properties. This occurs in the sponge function interface.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190, CWE-190
References: https://csrc.nist.gov/projects/hash-functions/sha-3-project; https://eprint.iacr.org/2023/331; https://github.com/XKCP/XKCP/security/advisories/GHSA-6w4m-2xhg-2658
CVE: CVE-2022-3624
Published: 2022-10-21
Description: A vulnerability was found in Linux Kernel and classified as problematic. Affected by this issue is the function rlb_arp_xmit of the file drivers/net/bonding/bond_alb.c of the component IPsec. The manipulation leads to memory leak. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-211928.
CVSS Score: 3.5 (LOW)
CWE: CWE-404, CWE-401
References: https://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next.git/commit/?id=4f5d33f4f798b1c6d92b613f0087f639d9836971; https://vuldb.com/?id.211928; https://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next.git/commit/?id=4f5d33f4f798b1c6d92b613f0087f639d9836971
CVE: CVE-2022-3625
Published: 2022-10-21
Description: A vulnerability was found in Linux Kernel. It has been classified as critical. This affects the function devlink_param_set/devlink_param_get of the file net/core/devlink.c of the component IPsec. The manipulation leads to use after free. It is recommended to apply a patch to fix this issue. The identifier VDB-211929 was assigned to this vulnerability.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-119, CWE-416
References: https://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next.git/commit/?id=6b4db2e528f650c7fb712961aac36455468d5902; https://lists.debian.org/debian-lts-announce/2022/11/msg00001.html; https://vuldb.com/?id.211929
CVE: CVE-2022-3629
Published: 2022-10-21
Description: A vulnerability was found in Linux Kernel. It has been declared as problematic. This vulnerability affects the function vsock_connect of the file net/vmw_vsock/af_vsock.c. The manipulation leads to memory leak. The complexity of an attack is rather high. The exploitation appears to be difficult. It is recommended to apply a patch to fix this issue. VDB-211930 is the identifier assigned to this vulnerability.
CVSS Score: 2.6 (LOW)
CWE: CWE-401, CWE-401
References: https://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next.git/commit/?id=7e97cfed9929eaabc41829c395eb0d1350fccb9d; https://vuldb.com/?ctiid.211930; https://vuldb.com/?id.211930
CVE: CVE-2022-3630
Published: 2022-10-21
Description: A vulnerability was found in Linux Kernel. It has been rated as problematic. This issue affects some unknown processing of the file fs/fscache/cookie.c of the component IPsec. The manipulation leads to memory leak. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-211931.
CVSS Score: 3.1 (LOW)
CWE: CWE-404, CWE-401
References: https://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next.git/commit/?id=fb24771faf72a2fd62b3b6287af3c610c3ec9cf1; https://vuldb.com/?id.211931; https://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next.git/commit/?id=fb24771faf72a2fd62b3b6287af3c610c3ec9cf1
CVE: CVE-2021-42553
Published: 2022-10-21
Description: A buffer overflow vulnerability in stm32_mw_usb_host of STMicroelectronics in versions before 3.5.1 allows an attacker to execute arbitrary code when the descriptor contains more endpoints than USBH_MAX_NUM_ENDPOINTS. The library is typically integrated when using a RTOS such as FreeRTOS on STM32 MCUs.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-120, CWE-120
References: https://github.com/STMicroelectronics/stm32_mw_usb_host; https://github.com/STMicroelectronics/stm32_mw_usb_host/pull/4; https://github.com/STMicroelectronics/stm32_mw_usb_host
CVE: CVE-2022-3633
Published: 2022-10-21
Description: A vulnerability classified as problematic has been found in Linux Kernel. Affected is the function j1939_session_destroy of the file net/can/j1939/transport.c. The manipulation leads to memory leak. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-211932.
CVSS Score: 3.5 (LOW)
CWE: CWE-401, CWE-401
References: https://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next.git/commit/?id=8c21c54a53ab21842f5050fa090f26b03c0313d6; https://vuldb.com/?ctiid.211932; https://vuldb.com/?id.211932
CVE: CVE-2022-3635
Published: 2022-10-21
Description: A vulnerability, which was classified as critical, has been found in Linux Kernel. Affected by this issue is the function tst_timer of the file drivers/atm/idt77252.c of the component IPsec. The manipulation leads to use after free. It is recommended to apply a patch to fix this issue. VDB-211934 is the identifier assigned to this vulnerability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119, CWE-362
References: https://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next.git/commit/?id=3f4093e2bf4673f218c0bf17d8362337c400e77b; https://lists.debian.org/debian-lts-announce/2022/11/msg00001.html; https://vuldb.com/?id.211934
CVE: CVE-2022-3636
Published: 2022-10-21
Description: A vulnerability, which was classified as critical, was found in Linux Kernel. This affects the function __mtk_ppe_check_skb of the file drivers/net/ethernet/mediatek/mtk_ppe.c of the component Ethernet Handler. The manipulation leads to use after free. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-211935.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119, CWE-416
References: https://git.kernel.org/pub/scm/linux/kernel/git/pabeni/net-next.git/commit/?id=17a5f6a78dc7b8db385de346092d7d9f9dc24df6; https://vuldb.com/?id.211935; https://www.debian.org/security/2023/dsa-5333
CVE: CVE-2022-3637
Published: 2022-10-21
Description: A vulnerability has been found in Linux Kernel and classified as problematic. This vulnerability affects the function jlink_init of the file monitor/jlink.c of the component BlueZ. The manipulation leads to denial of service. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-211936.
CVSS Score: 2.6 (LOW)
CWE: CWE-404
References: https://git.kernel.org/pub/scm/bluetooth/bluez.git/commit/?id=1d6cfb8e625a[PII_REDACTED]14c1802bc1e1fc6c4f; https://vuldb.com/?id.211936; https://git.kernel.org/pub/scm/bluetooth/bluez.git/commit/?id=1d6cfb8e625a[PII_REDACTED]14c1802bc1e1fc6c4f
CVE: CVE-2022-3638
Published: 2022-10-21
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2022-36122
Published: 2022-10-21
Description: The Automox Agent before 40 on Windows incorrectly sets permissions on key files.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732, CWE-732
References: https://automox.com; https://www.automox.com/security/security-bulletin; https://automox.com
CVE: CVE-2022-41575
Published: 2022-10-21
Description: A credential-exposure vulnerability in the support-bundle mechanism in Gradle Enterprise 2022.3 through 2022.3.3 allows remote attackers to access a subset of application data (e.g., cleartext credentials). This is fixed in 2022.3.3.
CVSS Score: 7.5 (HIGH)
CWE: CWE-522, CWE-522
References: https://security.gradle.com; https://security.gradle.com/advisory/2022-13; https://security.gradle.com
CVE: CVE-2022-42189
Published: 2022-10-21
Description: Emlog Pro 1.6.0 plugins upload suffers from a remote code execution (RCE) vulnerability.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434, CWE-434
References: https://github.com/wszdhf/cms_vul/blob/main/emlog_pro_1.6.0_rce.md; https://github.com/wszdhf/cms_vul/blob/main/emlog_pro_1.6.0_rce.md
CVE: CVE-2022-3203
Published: 2022-10-21
Description: On ORing net IAP-420(+) with FW version 2.0m a telnet server is enabled by default and cannot permanently be disabled. You can connect to the device via LAN or WiFi with hardcoded credentials and get an administrative shell. These credentials are reset to defaults with every reboot.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-912
References: https://mads.uniud.it/2022/09/lord-of-the-orings/; https://mads.uniud.it/2022/09/lord-of-the-orings/
CVE: CVE-2022-42205
Published: 2022-10-21
Description: PHPGurukul Hospital Management System In PHP V 4.0 is vulnerable to Cross Site Scripting (XSS) via add-patient.php.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://sisl.lab.uic.edu/projects/chess/cross-site-scripting-in-hms2/; https://sisl.lab.uic.edu/projects/chess/cross-site-scripting-in-hms2/
CVE: CVE-2022-42206
Published: 2022-10-21
Description: PHPGurukul Hospital Management System In PHP V 4.0 is vulnerable to Cross Site Scripting (XSS) via doctor/view-patient.php, admin/view-patient.php, and view-medhistory.php.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://sisl.lab.uic.edu/projects/chess/cross-site-scripting-in-hms3/; https://sisl.lab.uic.edu/projects/chess/cross-site-scripting-in-hms3/