deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-26310
Published: 2022-08-01
Description: Pandora FMS v7.0NG.760 and below allows an improper authorization in User Management where any authenticated user with access to the User Management module could create, modify or delete any user with full admin privilege. The impact could lead to a vertical privilege escalation to access the privileges of a higher-level user or typically an admin user.
CVSS Score: 7.3 (HIGH)
CWE: CWE-285
References: https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/; https://www.incibe.es/en/cve-assignment-publication/coordinated-cves; https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/
CVE: CVE-2022-2170
Published: 2022-08-01
Description: The Microsoft Advertising Universal Event Tracking (UET) WordPress plugin before 1.0.4 does not sanitise and escape its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. Due to the nature of this plugin, well crafted XSS can also leak into the frontpage.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/6eaef938-ce98-4d57-8a1d-fa9d1ae3d6ed; https://wpscan.com/vulnerability/6eaef938-ce98-4d57-8a1d-fa9d1ae3d6ed
CVE: CVE-2022-2171
Published: 2022-08-01
Description: The Progressive License WordPress plugin through 1.1.0 is lacking any CSRF check when saving its settings, which could allow attackers to make a logged in admin change them. Furthermore, as the plugin allows arbitrary HTML to be inserted in one of the settings, this could lead to Stored XSS issue which will be triggered in the frontend as well.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/11937296-7ecf-4b94-b274-06f7990dbede; https://wpscan.com/vulnerability/11937296-7ecf-4b94-b274-06f7990dbede
CVE: CVE-2022-2181
Published: 2022-08-01
Description: The Advanced WordPress Reset WordPress plugin before 1.6 does not escape some generated URLs before outputting them back in href attributes of admin dashboard pages, leading to Reflected Cross-Site Scripting
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/68ddf343-6e69-44a7-bd33-72004053d41e; https://wpscan.com/vulnerability/68ddf343-6e69-44a7-bd33-72004053d41e
CVE: CVE-2022-2184
Published: 2022-08-01
Description: The CAPTCHA 4WP WordPress plugin before 7.1.0 lets user input reach a sensitive require_once call in one of its admin-side templates. This can be abused by attackers, via a Cross-Site Request Forgery attack to run arbitrary code on the server.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22, CWE-352
References: https://wpscan.com/vulnerability/e777784f-5ba0-4966-be27-e0a0cbbfe056; https://wpscan.com/vulnerability/e777784f-5ba0-4966-be27-e0a0cbbfe056
CVE: CVE-2022-2215
Published: 2022-08-01
Description: The GiveWP WordPress plugin before 2.21.3 does not properly sanitise and escape the currency settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/daa9b6c1-1ee1-434c-9f88-fd273b7e20bb; https://wpscan.com/vulnerability/daa9b6c1-1ee1-434c-9f88-fd273b7e20bb
CVE: CVE-2022-2241
Published: 2022-08-01
Description: The Featured Image from URL (FIFU) WordPress plugin before 4.0.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack. Furthermore, due to the lack of validation, sanitisation and escaping in some of them, it could also lead to Stored XSS issues
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-116
References: https://wpscan.com/vulnerability/8670d196-972b-491b-8d9b-25994a345f57; https://wpscan.com/vulnerability/8670d196-972b-491b-8d9b-25994a345f57
CVE: CVE-2022-2245
Published: 2022-08-01
Description: The Counter Box WordPress plugin before 1.2.1 is lacking CSRF check when activating and deactivating counters, which could allow attackers to make a logged in admin perform such actions via CSRF attacks
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://wpscan.com/vulnerability/33705003-1f82-4b0c-9b4b-d4de75da309c; https://wpscan.com/vulnerability/33705003-1f82-4b0c-9b4b-d4de75da309c
CVE: CVE-2022-2260
Published: 2022-08-01
Description: The GiveWP WordPress plugin before 2.21.3 does not have CSRF in place when exporting data, and does not validate the exporting parameters such as dates, which could allow attackers to make a logged in admin DoS the web server via a CSRF attack as the plugin will try to retrieve data from the database many times which leads to overwhelm the target's CPU.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/831b3afa-8fa3-4cb7-8374-36d0c368292f; https://wpscan.com/vulnerability/831b3afa-8fa3-4cb7-8374-36d0c368292f
CVE: CVE-2022-2273
Published: 2022-08-01
Description: The Simple Membership WordPress plugin before 4.1.3 does not properly validate the membership_level parameter when editing a profile, allowing members to escalate to a higher membership level by using a crafted POST request.
CVSS Score: 8.8 (HIGH)
CWE: CWE-269
References: https://wpscan.com/vulnerability/724729d9-1c4a-485c-9c90-a27664c47c84; https://wpscan.com/vulnerability/724729d9-1c4a-485c-9c90-a27664c47c84
CVE: CVE-2022-2278
Published: 2022-08-01
Description: The Featured Image from URL (FIFU) WordPress plugin before 4.0.1 does not validate, sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/4481731d-4dbf-4bfa-b4cc-64f10bb7e7bf; https://wpscan.com/vulnerability/4481731d-4dbf-4bfa-b4cc-64f10bb7e7bf
CVE: CVE-2022-2305
Published: 2022-08-01
Description: The WordPress Popup WordPress plugin through 1.9.3.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/ea0180cd-e018-43ea-88b9-fa8e71bf34bf; https://wpscan.com/vulnerability/ea0180cd-e018-43ea-88b9-fa8e71bf34bf
CVE: CVE-2022-2317
Published: 2022-08-01
Description: The Simple Membership WordPress plugin before 4.1.3 allows user to change their membership at the registration stage due to insufficient checking of a user supplied parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-269
References: https://wpscan.com/vulnerability/77b7ca19-294c-4480-8f57-6fddfc67fffb; https://wpscan.com/vulnerability/77b7ca19-294c-4480-8f57-6fddfc67fffb
CVE: CVE-2022-2325
Published: 2022-08-01
Description: The Invitation Based Registrations WordPress plugin through 2.2.84 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/c8dcd7a7-5ad4-452c-a6a5[PII_REDACTED]e4; https://wpscan.com/vulnerability/c8dcd7a7-5ad4-452c-a6a5[PII_REDACTED]e4
CVE: CVE-2022-2328
Published: 2022-08-01
Description: The Flexi Quote Rotator WordPress plugin through 0.9.4 does not sanitise and escape its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/dbac391b-fc48-4e5e-b63a-2b3ddb0d5552; https://wpscan.com/vulnerability/dbac391b-fc48-4e5e-b63a-2b3ddb0d5552
CVE: CVE-2022-2369
Published: 2022-08-01
Description: The YaySMTP WordPress plugin before 2.2.1 does not have capability check in an AJAX action, allowing any logged in users, such as subscriber to view the Logs of the plugin
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://wpscan.com/vulnerability/9ec8d318-9d25-4868-94c6-7c16444c275d; https://wpscan.com/vulnerability/9ec8d318-9d25-4868-94c6-7c16444c275d
CVE: CVE-2022-2370
Published: 2022-08-01
Description: The YaySMTP WordPress plugin before 2.2.1 does not have capability check before displaying the Mailer Credentials in JS code for the settings, allowing any authenticated users, such as subscriber to retrieve them
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://wpscan.com/vulnerability/bedda2a9-6c52-478e-b17a-7a[PII_REDACTED]; https://wpscan.com/vulnerability/bedda2a9-6c52-478e-b17a-7a[PII_REDACTED]
CVE: CVE-2022-21788
Published: 2022-08-01
Description: In scp, there is a possible undefined behavior due to incorrect error handling. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06988728; Issue ID: ALPS06988728.
CVSS Score: 6.7 (MEDIUM)
References: https://corp.mediatek.com/product-security-bulletin/August-2022; https://corp.mediatek.com/product-security-bulletin/August-2022
CVE: CVE-2022-21789
Published: 2022-08-01
Description: In audio ipi, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06478101; Issue ID: ALPS06478101.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-362
References: https://corp.mediatek.com/product-security-bulletin/August-2022; https://corp.mediatek.com/product-security-bulletin/August-2022
CVE: CVE-2022-21790
Published: 2022-08-01
Description: In camera isp, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06479306; Issue ID: ALPS06479306.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-125
References: https://corp.mediatek.com/product-security-bulletin/August-2022; https://corp.mediatek.com/product-security-bulletin/August-2022
CVE: CVE-2022-21791
Published: 2022-08-01
Description: In camera isp, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06478059; Issue ID: ALPS06478059.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-125
References: https://corp.mediatek.com/product-security-bulletin/August-2022; https://corp.mediatek.com/product-security-bulletin/August-2022
CVE: CVE-2022-21792
Published: 2022-08-01
Description: In camera isp, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07085410; Issue ID: ALPS07085410.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://corp.mediatek.com/product-security-bulletin/August-2022; https://corp.mediatek.com/product-security-bulletin/August-2022
CVE: CVE-2022-26426
Published: 2022-08-01
Description: In camera isp, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07085486; Issue ID: ALPS07085486.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://corp.mediatek.com/product-security-bulletin/August-2022; https://corp.mediatek.com/product-security-bulletin/August-2022
CVE: CVE-2022-26427
Published: 2022-08-01
Description: In camera isp, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07085540; Issue ID: ALPS07085540.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://corp.mediatek.com/product-security-bulletin/August-2022; https://corp.mediatek.com/product-security-bulletin/August-2022
CVE: CVE-2022-26428
Published: 2022-08-01
Description: In video codec, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06521260; Issue ID: ALPS06521260.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-362
References: https://corp.mediatek.com/product-security-bulletin/August-2022; https://corp.mediatek.com/product-security-bulletin/August-2022
CVE: CVE-2022-26429
Published: 2022-08-01
Description: In cta, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07025415; Issue ID: ALPS07025415.
CVSS Score: 7.8 (HIGH)
CWE: CWE-862
References: https://corp.mediatek.com/product-security-bulletin/August-2022; https://corp.mediatek.com/product-security-bulletin/August-2022
CVE: CVE-2022-26430
Published: 2022-08-01
Description: In mailbox, there is a possible out of bounds write due to type confusion. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07032521; Issue ID: ALPS07032521.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787, CWE-843
References: https://corp.mediatek.com/product-security-bulletin/August-2022; https://corp.mediatek.com/product-security-bulletin/August-2022
CVE: CVE-2022-26431
Published: 2022-08-01
Description: In mailbox, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07032553; Issue ID: ALPS07032553.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://corp.mediatek.com/product-security-bulletin/August-2022; https://corp.mediatek.com/product-security-bulletin/August-2022
CVE: CVE-2022-26432
Published: 2022-08-01
Description: In mailbox, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07032542; Issue ID: ALPS07032542.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://corp.mediatek.com/product-security-bulletin/August-2022; https://corp.mediatek.com/product-security-bulletin/August-2022
CVE: CVE-2022-26433
Published: 2022-08-01
Description: In mailbox, there is a possible out of bounds write due to type confusion. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07138400; Issue ID: ALPS07138400.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-843
References: https://corp.mediatek.com/product-security-bulletin/August-2022; https://corp.mediatek.com/product-security-bulletin/August-2022
CVE: CVE-2022-26434
Published: 2022-08-01
Description: In mailbox, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07138450; Issue ID: ALPS07138450.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://corp.mediatek.com/product-security-bulletin/August-2022; https://corp.mediatek.com/product-security-bulletin/August-2022
CVE: CVE-2022-26435
Published: 2022-08-01
Description: In mailbox, there is a possible out of bounds write due to type confusion. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07138435; Issue ID: ALPS07138435.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787, CWE-843
References: https://corp.mediatek.com/product-security-bulletin/August-2022; https://corp.mediatek.com/product-security-bulletin/August-2022
CVE: CVE-2022-26436
Published: 2022-08-01
Description: In emi mpu, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07023666; Issue ID: ALPS07023666.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-125
References: https://corp.mediatek.com/product-security-bulletin/August-2022; https://corp.mediatek.com/product-security-bulletin/August-2022
CVE: CVE-2022-26437
Published: 2022-08-01
Description: In httpclient, there is a possible out of bounds write due to uninitialized data. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WSAP00103831; Issue ID: WSAP00103831.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-908
References: https://corp.mediatek.com/product-security-bulletin/August-2022; https://corp.mediatek.com/product-security-bulletin/August-2022
CVE: CVE-2022-26438
Published: 2022-08-01
Description: In wifi driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: GN[PII_REDACTED]3; Issue ID: GN[PII_REDACTED]3.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://corp.mediatek.com/product-security-bulletin/August-2022; https://corp.mediatek.com/product-security-bulletin/August-2022
CVE: CVE-2022-26439
Published: 2022-08-01
Description: In wifi driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: GN[PII_REDACTED]0; Issue ID: GN[PII_REDACTED]0.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://corp.mediatek.com/product-security-bulletin/August-2022; https://corp.mediatek.com/product-security-bulletin/August-2022
CVE: CVE-2022-26440
Published: 2022-08-01
Description: In wifi driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: GN[PII_REDACTED]7; Issue ID: GN[PII_REDACTED]7.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://corp.mediatek.com/product-security-bulletin/August-2022; https://corp.mediatek.com/product-security-bulletin/August-2022
CVE: CVE-2022-26441
Published: 2022-08-01
Description: In wifi driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: GN[PII_REDACTED]4; Issue ID: GN[PII_REDACTED]4.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://corp.mediatek.com/product-security-bulletin/August-2022; https://corp.mediatek.com/product-security-bulletin/August-2022
CVE: CVE-2022-26442
Published: 2022-08-01
Description: In wifi driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: GN[PII_REDACTED]1; Issue ID: GN[PII_REDACTED]1.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://corp.mediatek.com/product-security-bulletin/August-2022; https://corp.mediatek.com/product-security-bulletin/August-2022
CVE: CVE-2022-26443
Published: 2022-08-01
Description: In wifi driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: GN[PII_REDACTED]8; Issue ID: GN[PII_REDACTED]8.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://corp.mediatek.com/product-security-bulletin/August-2022; https://corp.mediatek.com/product-security-bulletin/August-2022
CVE: CVE-2022-26444
Published: 2022-08-01
Description: In wifi driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: GN[PII_REDACTED]5; Issue ID: GN[PII_REDACTED]5.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://corp.mediatek.com/product-security-bulletin/August-2022; https://corp.mediatek.com/product-security-bulletin/August-2022
CVE: CVE-2022-26445
Published: 2022-08-01
Description: In wifi driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: GN[PII_REDACTED]8; Issue ID: GN[PII_REDACTED]8.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://corp.mediatek.com/product-security-bulletin/August-2022; https://corp.mediatek.com/product-security-bulletin/August-2022
CVE: CVE-2022-2509
Published: 2022-08-01
Description: A vulnerability found in gnutls. This security flaw happens because of a double free error occurs during verification of pkcs7 signatures in gnutls_pkcs7_verify function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-415, CWE-415
References: https://access.redhat.com/security/cve/CVE-2022-2509; https://lists.debian.org/debian-lts-announce/2022/08/msg00002.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6FL27JS3VM74YEQU7PGB62USO3KSBYZX/
CVE: CVE-2022-34154
Published: 2022-08-01
Description: Authenticated (author or higher user role) Arbitrary File Upload vulnerability in ideasToCode Enable SVG, WebP & ICO Upload plugin <= 1.0.1 at WordPress.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434, CWE-434
References: https://patchstack.com/database/vulnerability/enable-svg-webp-ico-upload/wordpress-enable-svg-webp-ico-upload-plugin-1-0-1-authenticated-arbitrary-file-upload-vulnerability; https://wordpress.org/plugins/enable-svg-webp-ico-upload/#developers; https://patchstack.com/database/vulnerability/enable-svg-webp-ico-upload/wordpress-enable-svg-webp-ico-upload-plugin-1-0-1-authenticated-arbitrary-file-upload-vulnerability
CVE: CVE-2022-34567
Published: 2022-08-01
Description: An issue in \Roaming\Mango\Plugins of University of Texas Multi-image Analysis GUI (Mango) 4.1 allows attackers to escalate privileges via crafted plugins.
CVSS Score: 8.8 (HIGH)
References: https://ric.uthscsa.edu/mango/develop.html; https://ric.uthscsa.edu/mango/index.html; https://ric.uthscsa.edu/mango/mango.html
CVE: CVE-2022-36301
Published: 2022-08-01
Description: BF-OS version 3.x up to and including 3.83 do not enforce strong passwords which may allow a remote attacker to brute-force the device password.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-521, CWE-521
References: https://psirt.bosch.com/security-advisories/bosch-sa-013924-bt.html; https://psirt.bosch.com/security-advisories/bosch-sa-013924-bt.html
CVE: CVE-2022-36302
Published: 2022-08-01
Description: File path manipulation vulnerability in BF-OS version 3.00 up to and including 3.83 allows an attacker to modify the file path to access different resources, which may contain sensitive information.
CVSS Score: 8.8 (HIGH)
CWE: CWE-641, CWE-74
References: https://psirt.bosch.com/security-advisories/bosch-sa-013924-bt.html; https://psirt.bosch.com/security-advisories/bosch-sa-013924-bt.html