deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-4078
Published: 2022-11-20
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2022-4079
Published: 2022-11-20
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2022-4080
Published: 2022-11-20
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2022-4081
Published: 2022-11-20
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2022-4082
Published: 2022-11-20
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2022-4083
Published: 2022-11-20
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2022-4084
Published: 2022-11-20
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2022-4085
Published: 2022-11-20
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2022-4086
Published: 2022-11-20
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2022-4093
Published: 2022-11-21
Description: SQL injection attacks can result in unauthorized access to sensitive data, such as passwords, credit card details, or personal user information. Many high-profile data breaches in recent years have been the result of SQL injection attacks, leading to reputational damage and regulatory fines. In some cases, an attacker can obtain a persistent backdoor into an organization's systems, leading to a long-term compromise that can go unnoticed for an extended period. This affect 16.0.1 and 16.0.2 only. 16.0.0 or lower, and 16.0.3 or higher are not affected
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/dolibarr/dolibarr/commit/7c1eac9774bd1fed0b7b4594159f2ac2d12a4011; https://huntr.dev/bounties/677ca8ee-ffbc-4b39-b294-2ce81bd56788; https://github.com/dolibarr/dolibarr/commit/7c1eac9774bd1fed0b7b4594159f2ac2d12a4011
CVE: CVE-2022-4087
Published: 2022-11-21
Description: A vulnerability was found in iPXE. It has been declared as problematic. This vulnerability affects the function tls_new_ciphertext of the file src/net/tls.c of the component TLS. The manipulation of the argument pad_len leads to information exposure through discrepancy. The name of the patch is 186306d6199096b7a7c4b4574d4be8cdb8426729. It is recommended to apply a patch to fix this issue. VDB-214054 is the identifier assigned to this vulnerability.
CVSS Score: 2.6 (LOW)
CWE: CWE-284, CWE-203
References: https://github.com/ipxe/ipxe/commit/186306d6199096b7a7c4b4574d4be8cdb8426729; https://vuldb.com/?id.214054; https://github.com/ipxe/ipxe/commit/186306d6199096b7a7c4b4574d4be8cdb8426729
CVE: CVE-2022-3589
Published: 2022-11-21
Description: An API Endpoint used by Miele's "AppWash" MobileApp in all versions was vulnerable to an authorization bypass. A low privileged, remote attacker would have been able to gain read and partial write access to other users data by modifying a small part of a HTTP request sent to the API. Reading or changing the password of another user was not possible, thus no impact to Availability.
CVSS Score: 8.1 (HIGH)
CWE: CWE-639, CWE-639
References: https://cert.vde.com/de/advisories/VDE-2022-052/; https://cert.vde.com/de/advisories/VDE-2022-052/
CVE: CVE-2022-45146
Published: 2022-11-21
Description: An issue was discovered in the FIPS Java API of Bouncy Castle BC-FJA before 1.0.2.4. Changes to the JVM garbage collector in Java 13 and later trigger an issue in the BC-FJA FIPS modules where it is possible for temporary keys used by the module to be zeroed out while still in use by the module, resulting in errors or potential information loss. NOTE: FIPS compliant users are unaffected because the FIPS certification is only for Java 7, 8, and 11.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416
References: https://github.com/bcgit/bc-java/wiki/CVE-2022-45146; https://mvnrepository.com/artifact/org.bouncycastle/bc-fips; https://www.bouncycastle.org/latest_releases.html
CVE: CVE-2021-24649
Published: 2022-11-21
Description: The WP User Frontend WordPress plugin before 3.5.29 uses a user supplied argument called urhidden in its registration form, which contains the role for the account to be created with, encrypted via wpuf_encryption(). This could allow an attacker having access to the AUTH_KEY and AUTH_SALT constant (via an arbitrary file access issue for example, or if the blog is using the default keys) to create an account with any role they want, such as admin
CVSS Score: 9.8 (CRITICAL)
References: https://wpscan.com/vulnerability/9486744e-ab24-44e4-b06e-9e0b4be132e2; https://wpscan.com/vulnerability/9486744e-ab24-44e4-b06e-9e0b4be132e2
CVE: CVE-2022-0421
Published: 2022-11-21
Description: The Five Star Restaurant Reservations WordPress plugin before 2.4.12 does not have authorisation when changing whether a payment was successful or failed, allowing unauthenticated users to change the payment status of arbitrary bookings. Furthermore, due to the lack of sanitisation and escaping, attackers could perform Cross-Site Scripting attacks against a logged in admin viewing the failed payments
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-116
References: https://wpscan.com/vulnerability/145e8d3c-cd6f-4827-86e5-ea2d395a80b9; https://wpscan.com/vulnerability/145e8d3c-cd6f-4827-86e5-ea2d395a80b9
CVE: CVE-2022-1578
Published: 2022-11-21
Description: The My wpdb WordPress plugin before 2.5 is missing CSRF check when running SQL queries, which could allow attacker to make a logged in admin run arbitrary SQL query via a CSRF attack
CVSS Score: 8.8 (HIGH)
References: https://wpscan.com/vulnerability/c280da92-4ac2-43ea-93a2-6c583b79b98b; https://wpscan.com/vulnerability/c280da92-4ac2-43ea-93a2-6c583b79b98b
CVE: CVE-2022-1579
Published: 2022-11-21
Description: The function check_is_login_page() uses headers for the IP check, which can be easily spoofed.
CVSS Score: 7.5 (HIGH)
References: https://wpscan.com/vulnerability/6f3d40fa-458b-44f0-9407-763e80b29668; https://wpscan.com/vulnerability/6f3d40fa-458b-44f0-9407-763e80b29668
CVE: CVE-2022-1581
Published: 2022-11-21
Description: The WP-Polls WordPress plugin before 2.76.0 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDR, which makes it possible to bypass IP-based limitations to vote in certain situations.
CVSS Score: 5.3 (MEDIUM)
References: https://wpscan.com/vulnerability/c1896ab9-9585-40e2-abbf-ef5153b3c6b2; https://www.hightechdad.com/2009/12/21/warning-wp-polls-wordpress-poll-plugin-can-be-exploited/; https://wpscan.com/vulnerability/c1896ab9-9585-40e2-abbf-ef5153b3c6b2
CVE: CVE-2022-3336
Published: 2022-11-21
Description: The Event Monster WordPress plugin before 1.2.0 does not have CSRF check when deleting visitors, which could allow attackers to make logged in admin delete arbitrary visitors via a CSRF attack
CVSS Score: 4.3 (MEDIUM)
References: https://wpscan.com/vulnerability/57bc6633-1aeb-4c20-a2a5-9b3fa10ba95d; https://wpscan.com/vulnerability/57bc6633-1aeb-4c20-a2a5-9b3fa10ba95d
CVE: CVE-2022-3600
Published: 2022-11-21
Description: The Easy Digital Downloads WordPress plugin before 3.1.0.2 does not validate data when its output in a CSV file, which could lead to CSV injection.
CVSS Score: 9.8 (CRITICAL)
References: https://wpscan.com/vulnerability/16e2d970-19d0-42d1-8fb1-e7cb14ace1d0; https://wpscan.com/vulnerability/16e2d970-19d0-42d1-8fb1-e7cb14ace1d0
CVE: CVE-2022-3618
Published: 2022-11-21
Description: The Spacer WordPress plugin before 3.0.7 does not sanitize and escapes some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example, in multisite setup).
CVSS Score: 4.8 (MEDIUM)
References: https://wpscan.com/vulnerability/2011dc7b-8e8c-4190-ab34-de288e14685b; https://wpscan.com/vulnerability/2011dc7b-8e8c-4190-ab34-de288e14685b
CVE: CVE-2022-3634
Published: 2022-11-21
Description: The Contact Form 7 Database Addon WordPress plugin before 1.2.6.5 does not validate data when output it back in a CSV file, which could lead to CSV injection
CVSS Score: 9.8 (CRITICAL)
References: https://wpscan.com/vulnerability/b5eeefb0-fb5e-4ca6-a6f0-67f4be4a2b10; https://wpscan.com/vulnerability/b5eeefb0-fb5e-4ca6-a6f0-67f4be4a2b10
CVE: CVE-2022-3688
Published: 2022-11-21
Description: The WPQA Builder WordPress plugin before 5.9 does not have CSRF check when following and unfollowing users, which could allow attackers to make logged in users perform such actions via CSRF attacks
CVSS Score: 8.8 (HIGH)
References: https://wpscan.com/vulnerability/03b2c6e6-b86e-4143-a84a-7a99060c4848; https://wpscan.com/vulnerability/03b2c6e6-b86e-4143-a84a-7a99060c4848
CVE: CVE-2022-3690
Published: 2022-11-21
Description: The Popup Maker WordPress plugin before 1.16.11 does not sanitise and escape some of its Popup options, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks, which could be used against admins
CVSS Score: 4.8 (MEDIUM)
References: https://wpscan.com/vulnerability/725f6ae4-7ec5-4d7c-9533-c9b61b59cc2b; https://wpscan.com/vulnerability/725f6ae4-7ec5-4d7c-9533-c9b61b59cc2b
CVE: CVE-2022-3691
Published: 2022-11-21
Description: The DeepL Pro API translation plugin WordPress plugin before 1.7.5 discloses sensitive information (including the DeepL API key) in files that are publicly accessible to an external, unauthenticated visitor.
CVSS Score: 7.5 (HIGH)
CWE: CWE-552
References: https://wpscan.com/vulnerability/4248a0af-1b7e-4e29-8129-3f40c1d0c560; https://wpscan.com/vulnerability/4248a0af-1b7e-4e29-8129-3f40c1d0c560
CVE: CVE-2022-3720
Published: 2022-11-21
Description: The Event Monster WordPress plugin before 1.2.0 does not validate and escape some parameters before using them in SQL statements, which could lead to SQL Injection exploitable by high privilege users
CVSS Score: 7.2 (HIGH)
References: https://wpscan.com/vulnerability/0139a23c-4896-4aef-ab56-dcf7f07f01e5; https://wpscan.com/vulnerability/0139a23c-4896-4aef-ab56-dcf7f07f01e5
CVE: CVE-2022-3750
Published: 2022-11-21
Description: The  has a CSRF vulnerability that allows the deletion of a post without using a nonce or prompting for confirmation.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/5019db80-0356-497d-b488-a26a5de78676; https://wpscan.com/vulnerability/5019db80-0356-497d-b488-a26a5de78676
CVE: CVE-2022-3753
Published: 2022-11-21
Description: The Evaluate WordPress plugin through 1.0 does not sanitize and escapes some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example, in multisite setup).
CVSS Score: 4.8 (MEDIUM)
References: https://wpscan.com/vulnerability/8e88a5b9-6f1d-40de-99fc-8e1e66646c2b; https://wpscan.com/vulnerability/8e88a5b9-6f1d-40de-99fc-8e1e66646c2b
CVE: CVE-2022-3762
Published: 2022-11-21
Description: The Booster for WooCommerce WordPress plugin before 5.6.7, Booster Plus for WooCommerce WordPress plugin before 5.6.5, Booster Elite for WooCommerce WordPress plugin before 1.1.7 do not validate files to download in some of its modules, which could allow ShopManager and Admin to download arbitrary files from the server even when they are not supposed to be able to (for example in multisite)
CVSS Score: 6.5 (MEDIUM)
References: https://wpscan.com/vulnerability/96ef4bb8-a054-48ae-b29c-b3060acd01ac; https://wpscan.com/vulnerability/96ef4bb8-a054-48ae-b29c-b3060acd01ac
CVE: CVE-2022-3763
Published: 2022-11-21
Description: The Booster for WooCommerce WordPress plugin before 5.6.7, Booster Plus for WooCommerce WordPress plugin before 5.6.5, Booster Elite for WooCommerce WordPress plugin before 1.1.7 do not have CSRF check in place when deleting files uploaded at the checkout, allowing attackers to make a logged in shop manager or admin delete them via a CSRF attack
CVSS Score: 8.1 (HIGH)
References: https://wpscan.com/vulnerability/7ab15530-8321-487d-97a5-1469b51fcc3f; https://wpscan.com/vulnerability/7ab15530-8321-487d-97a5-1469b51fcc3f
CVE: CVE-2022-3861
Published: 2022-11-21
Description: The Betheme theme for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 26.5.1.4 via deserialization of untrusted input supplied via the import, mfn-items-import-page, and mfn-items-import parameters passed through the mfn_builder_import, mfn_builder_import_page, importdata, importsinglepage, and importfromclipboard functions.  This makes it possible for authenticated attackers, with subscriber level permissions and above to inject a PHP Object. The additional presence of a POP chain would make it possible for attackers to execute code, retrieve sensitive data, delete files, etc..
CVSS Score: 8.8 (HIGH)
CWE: CWE-502, CWE-502
References: https://github.com/MrTuxracer/advisories/blob/master/CVEs/CVE-2022-3861.txt; https://muffingroup.com/betheme/; https://www.wordfence.com/threat-intel/vulnerabilities/id/f5e984d5-2537-4a4a-a071-084e0c1c3b5e?source=cve
CVE: CVE-2022-44167
Published: 2022-11-21
Description: Tenda AC15 V15.03.05.18 is avulnerable to Buffer Overflow via function formSetPPTPServer.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-787
References: https://drive.google.com/file/d/1Jq8Tm_2FDS4WDD_afdhg1LnA3VcvZdjS/view?usp=sharing; https://drive.google.com/file/d/1Jq8Tm_2FDS4WDD_afdhg1LnA3VcvZdjS/view?usp=sharing
CVE: CVE-2022-44168
Published: 2022-11-21
Description: Tenda AC15 V15.03.05.18 is vulnerable to Buffer Overflow via function fromSetRouteStatic..
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-787
References: https://github.com/RobinWang825/IoT_vuln/tree/main/Tenda/AC15/fromSetRouteStatic; https://github.com/RobinWang825/IoT_vuln/tree/main/Tenda/AC15/fromSetRouteStatic
CVE: CVE-2022-44169
Published: 2022-11-21
Description: Tenda AC15 V15.03.05.18 is vulnerable to Buffer Overflow via function formSetVirtualSer.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-787
References: https://github.com/RobinWang825/IoT_vuln/tree/main/Tenda/AC15/formSetVirtualSer; https://github.com/RobinWang825/IoT_vuln/tree/main/Tenda/AC15/formSetVirtualSer
CVE: CVE-2022-45012
Published: 2022-11-21
Description: A cross-site scripting (XSS) vulnerability in the Modify Page module of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Source field.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/WBCE/WBCE_CMS; https://github.com/gozan10/cve; https://github.com/gozan10/cve/issues/1
CVE: CVE-2022-45013
Published: 2022-11-21
Description: A cross-site scripting (XSS) vulnerability in the Show Advanced Option module of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Section Header field.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/WBCE/WBCE_CMS; https://github.com/gozan10; https://github.com/gozan10/cve/issues/2
CVE: CVE-2022-45014
Published: 2022-11-21
Description: A cross-site scripting (XSS) vulnerability in the Search Settings module of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Results Header field.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/WBCE/WBCE_CMS; https://github.com/gozan10; https://github.com/gozan10/cve/issues/3
CVE: CVE-2022-45015
Published: 2022-11-21
Description: A cross-site scripting (XSS) vulnerability in the Search Settings module of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Results Footer field.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/WBCE/WBCE_CMS; https://github.com/gozan10; https://github.com/gozan10/cve/issues/4
CVE: CVE-2022-45016
Published: 2022-11-21
Description: A cross-site scripting (XSS) vulnerability in the Search Settings module of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Footer field.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/WBCE/WBCE_CMS; https://github.com/gozan10; https://github.com/gozan10/cve/issues/5
CVE: CVE-2022-45017
Published: 2022-11-21
Description: A cross-site scripting (XSS) vulnerability in the Overview Page settings module of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Post Loop field.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/WBCE/WBCE_CMS; https://github.com/WBCE/WBCE_CMS/issues/525; https://github.com/gozan10
CVE: CVE-2022-4096
Published: 2022-11-21
Description: Server-Side Request Forgery (SSRF) in GitHub repository appsmithorg/appsmith prior to 1.8.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-918, CWE-918
References: https://github.com/appsmithorg/appsmith/commit/769719ccfe667f059fe0b107a19ec9feb90f2e40; https://huntr.dev/bounties/7969e834-5982-456e-9683-861a7a5e2d22; https://github.com/appsmithorg/appsmith/commit/769719ccfe667f059fe0b107a19ec9feb90f2e40
CVE: CVE-2022-32774
Published: 2022-11-21
Description: A use-after-free vulnerability exists in the JavaScript engine of Foxit Software's PDF Reader, version 12.0.1.12430. By prematurely deleting objects associated with pages, a specially-crafted PDF document can trigger the reuse of previously freed memory, which can lead to arbitrary code execution. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a specially-crafted, malicious site if the browser plugin extension is enabled.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://talosintelligence.com/vulnerability_reports/TALOS-2022-1600; https://talosintelligence.com/vulnerability_reports/TALOS-2022-1600
CVE: CVE-2022-37332
Published: 2022-11-21
Description: A use-after-free vulnerability exists in the JavaScript engine of Foxit Software's PDF Reader, version 12.0.1.12430. A specially-crafted PDF document can trigger the reuse of previously freed memory via misusing media player API, which can lead to arbitrary code execution. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a specially-crafted, malicious site if the browser plugin extension is enabled.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://talosintelligence.com/vulnerability_reports/TALOS-2022-1602; https://talosintelligence.com/vulnerability_reports/TALOS-2022-1602
CVE: CVE-2022-38097
Published: 2022-11-21
Description: A use-after-free vulnerability exists in the JavaScript engine of Foxit Software's PDF Reader, version 12.0.1.12430. By prematurely destroying annotation objects, a specially-crafted PDF document can trigger the reuse of previously freed memory, which can lead to arbitrary code execution. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a specially-crafted, malicious site if the browser plugin extension is enabled.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://talosintelligence.com/vulnerability_reports/TALOS-2022-1601; https://talosintelligence.com/vulnerability_reports/TALOS-2022-1601
CVE: CVE-2022-38146
Published: 2022-11-21
Description: Silverstripe silverstripe/framework through 4.11 allows XSS (issue 2 of 3).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://forum.silverstripe.org/c/releases; https://www.silverstripe.org/blog/tag/release; https://www.silverstripe.org/download/security-releases/
CVE: CVE-2022-38148
Published: 2022-11-21
Description: Silverstripe silverstripe/framework through 4.11 allows SQL Injection.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://forum.silverstripe.org/c/releases; https://www.silverstripe.org/blog/tag/release; https://www.silverstripe.org/download/security-releases/
CVE: CVE-2022-40129
Published: 2022-11-21
Description: A use-after-free vulnerability exists in the JavaScript engine of Foxit Software's PDF Reader, version 12.0.1.12430. A specially-crafted PDF document can trigger the reuse of previously freed memory via misusing Optional Content Group API, which can lead to arbitrary code execution. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a specially-crafted, malicious site if the browser plugin extension is enabled.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://talosintelligence.com/vulnerability_reports/TALOS-2022-1614; https://talosintelligence.com/vulnerability_reports/TALOS-2022-1614
CVE: CVE-2022-40470
Published: 2022-11-21
Description: Phpgurukul Blood Donor Management System 1.0 allows Cross Site Scripting via Add Blood Group Name Feature.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://drive.google.com/file/d/1UDuez2CTscdWXYzyXLi3x8CMs9IWLL11/view?usp=sharing; https://drive.google.com/file/d/1UDuez2CTscdWXYzyXLi3x8CMs9IWLL11/view?usp=sharing
CVE: CVE-2022-44156
Published: 2022-11-21
Description: Tenda AC15 V15.03.05.19 is vulnerable to Buffer Overflow via function formSetIpMacBind.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-787
References: https://drive.google.com/file/d/1dbMwByl40uqMiSv_DOEW8pFjRhGX-j97/view?usp=sharing; https://drive.google.com/file/d/1dbMwByl40uqMiSv_DOEW8pFjRhGX-j97/view?usp=sharing
CVE: CVE-2022-44158
Published: 2022-11-21
Description: Tenda AC21 V16.03.08.15 is vulnerable to Buffer Overflow via function via set_device_name.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-787
References: https://drive.google.com/file/d/11PSsUpLmLCl0-eO565TLbVavzfP5aWdG/view?usp=sharing; https://drive.google.com/file/d/11PSsUpLmLCl0-eO565TLbVavzfP5aWdG/view?usp=sharing
CVE: CVE-2022-44163
Published: 2022-11-21
Description: Tenda AC21 V16.03.08.15 is vulnerable to Buffer Overflow via function formSetMacFilterCfg.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-787
References: https://drive.google.com/file/d/1jmwNxVKc-HfsiuDNApgX_exbYtCalSSK/view?usp=sharing; https://drive.google.com/file/d/1jmwNxVKc-HfsiuDNApgX_exbYtCalSSK/view?usp=sharing
CVE: CVE-2022-45470
Published: 2022-11-21
Description: missing input validation in Apache Hama may cause information disclosure through path traversal and XSS. Since Apache Hama is EOL, we do not expect these issues to be fixed.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-20
References: http://www.openwall.com/lists/oss-security/2022/11/21/1; https://lists.apache.org/thread/ztvoshd4kxvp5vlro52mpgpfxct4ft8l; http://www.openwall.com/lists/oss-security/2022/11/21/1