deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-26639
Published: 2022-08-17
Description: This vulnerability is caused by the lack of validation of input values for specific functions if WISA Smart Wing CMS. Remote attackers can use this vulnerability to leak all files in the server without logging in system.
CVSS Score: 8.1 (HIGH)
CWE: CWE-20, CWE-494, CWE-20, CWE-494
References: https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=66875; https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=66875
CVE: CVE-2022-1069
Published: 2022-08-17
Description: A crafted HTTP packet with a large content-length header can create a denial-of-service condition in Softing Secure Integration Server V1.22.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://industrial.softing.com/fileadmin/psirt/downloads/syt-2022-4.html; https://www.cisa.gov/uscert/ics/advisories/icsa-22-228-04; https://industrial.softing.com/fileadmin/psirt/downloads/syt-2022-4.html
CVE: CVE-2022-1373
Published: 2022-08-17
Description: The “restore configuration” feature of Softing Secure Integration Server V1.22 is vulnerable to a directory traversal vulnerability when processing zip files. An attacker can craft a zip file to load an arbitrary dll and execute code. Using the "restore configuration" feature to upload a zip file containing a path traversal file may cause a file to be created and executed upon touching the disk.
CVSS Score: 7.2 (HIGH)
CWE: CWE-23, CWE-22
References: https://industrial.softing.com/fileadmin/psirt/downloads/syt-2022-5.html; https://www.cisa.gov/uscert/ics/advisories/icsa-22-228-04; https://industrial.softing.com/fileadmin/psirt/downloads/syt-2022-5.html
CVE: CVE-2022-1748
Published: 2022-08-17
Description: Softing OPC UA C++ Server SDK, Secure Integration Server, edgeConnector, edgeAggregator, OPC Suite, and uaGate are affected by a NULL pointer dereference vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476, CWE-476
References: https://industrial.softing.com/fileadmin/psirt/downloads/syt-2022-7.html; https://www.cisa.gov/uscert/ics/advisories/icsa-22-228-04; https://industrial.softing.com/fileadmin/psirt/downloads/syt-2022-7.html
CVE: CVE-2022-23747
Published: 2022-08-17
Description: In Sony Xperia series 1, 5, and Pro, an out of bound memory access can occur due to lack of validation of the number of frames being passed during music playback.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120, CWE-120
References: https://cpr-zero.checkpoint.com/vulns/cprid-2191/; https://research.checkpoint.com/2022/bad-alac-one-codec-to-hack-the-whole-world/; https://cpr-zero.checkpoint.com/vulns/cprid-2191/
CVE: CVE-2022-23764
Published: 2022-08-17
Description: The vulnerability causing from insufficient verification procedures for downloaded files during WebCube update. Remote attackers can bypass this verification logic to update both digitally signed and unauthorized files, enabling remote code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-346, CWE-346
References: https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=66876; https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=66876
CVE: CVE-2022-23765
Published: 2022-08-17
Description: This vulnerability occured by sending a malicious POST request to a specific page while logged in random user from some family of IPTIME NAS. Remote attackers can steal root privileges by changing the password of the root through a POST request.
CVSS Score: 8.0 (HIGH)
CWE: CWE-352, CWE-352
References: https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=66877; https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=66877
CVE: CVE-2022-2334
Published: 2022-08-17
Description: The application searches for a library dll that is not found. If an attacker can place a dll with this name, then the attacker can leverage it to execute arbitrary code on the targeted Softing Secure Integration Server V1.22.
CVSS Score: 7.2 (HIGH)
CWE: CWE-427
References: https://industrial.softing.com/fileadmin/psirt/downloads/syt-2022-5.html; https://www.cisa.gov/uscert/ics/advisories/icsa-22-228-04; https://industrial.softing.com/fileadmin/psirt/downloads/syt-2022-5.html
CVE: CVE-2022-2335
Published: 2022-08-17
Description: A crafted HTTP packet with a -1 content-length header can create a denial-of-service condition in Softing Secure Integration Server V1.22.
CVSS Score: 7.5 (HIGH)
CWE: CWE-191
References: https://industrial.softing.com/fileadmin/psirt/downloads/syt-2022-4.html; https://www.cisa.gov/uscert/ics/advisories/icsa-22-228-04; https://industrial.softing.com/fileadmin/psirt/downloads/syt-2022-4.html
CVE: CVE-2022-2336
Published: 2022-08-17
Description: Softing Secure Integration Server, edgeConnector, and edgeAggregator software ships with the default administrator credentials as `admin` and password as `admin`. This allows Softing to log in to the server directly to perform administrative functions. Upon installation or upon first login, the application does not ask the user to change the `admin` password. There is no warning or prompt to ask the user to change the default password, and to change the password, many steps are required.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://industrial.softing.com/fileadmin/psirt/downloads/syt-2022-6.html; https://www.cisa.gov/uscert/ics/advisories/icsa-22-228-04; https://industrial.softing.com/fileadmin/psirt/downloads/syt-2022-6.html
CVE: CVE-2022-2337
Published: 2022-08-17
Description: A crafted HTTP packet with a missing HTTP URI can create a denial-of-service condition in Softing Secure Integration Server V1.22.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://industrial.softing.com/fileadmin/psirt/downloads/syt-2022-4.html; https://www.cisa.gov/uscert/ics/advisories/icsa-22-228-04; https://industrial.softing.com/fileadmin/psirt/downloads/syt-2022-4.html
CVE: CVE-2022-2338
Published: 2022-08-17
Description: Softing Secure Integration Server V1.22 is vulnerable to authentication bypass via a machine-in-the-middle attack. The default the administration interface is accessible via plaintext HTTP protocol, facilitating the attack. The HTTP request may contain the session cookie in the request, which may be captured for use in authenticating to the server.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-319
References: https://industrial.softing.com/fileadmin/psirt/downloads/syt-2022-5.html; https://www.cisa.gov/uscert/ics/advisories/icsa-22-228-04; https://industrial.softing.com/fileadmin/psirt/downloads/syt-2022-5.html
CVE: CVE-2022-2547
Published: 2022-08-17
Description: A crafted HTTP packet without a content-type header can create a denial-of-service condition in Softing Secure Integration Server V1.22.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://industrial.softing.com/fileadmin/psirt/downloads/syt-2022-4.html; https://www.cisa.gov/uscert/ics/advisories/icsa-22-228-04; https://industrial.softing.com/fileadmin/psirt/downloads/syt-2022-4.html
CVE: CVE-2022-35122
Published: 2022-08-17
Description: An access control issue in Ecowitt GW1100 Series Weather Stations <=GW1100B_v2.1.5 allows unauthenticated attackers to access sensitive information including device and local WiFi passwords.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-306
References: https://www.pizzapower.me/2022/06/30/the-incredibly-insecure-weather-station/; https://www.pizzapower.me/2022/06/30/the-incredibly-insecure-weather-station/
CVE: CVE-2022-35133
Published: 2022-08-17
Description: A cross-site scripting (XSS) vulnerability in CherryTree v0.99.30 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name text field when creating a node.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://drive.google.com/file/d/1Pidkh2MAQkue81dS7SI-d16Vun_s5tot/view?usp=sharing; https://drive.google.com/file/d/1Pidkh2MAQkue81dS7SI-d16Vun_s5tot/view?usp=sharing
CVE: CVE-2022-35147
Published: 2022-08-17
Description: DoraCMS v2.18 and earlier allows attackers to bypass login authentication via a crafted HTTP request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-200
References: https://github.com/doramart/DoraCMS/issues/256; https://github.com/doramart/DoraCMS/issues/256
CVE: CVE-2022-35148
Published: 2022-08-17
Description: maccms10 v2021.1000.1081 to v2022.1000.3031 was discovered to contain a SQL injection vulnerability via the table parameter at database/columns.html.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/magicblack/maccms10/issues/931; https://github.com/magicblack/maccms10/issues/931
CVE: CVE-2022-28751
Published: 2022-08-17
Description: The Zoom Client for Meetings for MacOS (Standard and for IT Admin) before version 5.11.3 contains a vulnerability in the package signature validation during the update process. A local low-privileged user could exploit this vulnerability to escalate their privileges to root.
CVSS Score: 8.8 (HIGH)
CWE: CWE-347, CWE-347
References: https://explore.zoom.us/en/trust/security/security-bulletin/; https://explore.zoom.us/en/trust/security/security-bulletin/
CVE: CVE-2022-28752
Published: 2022-08-17
Description: Zoom Rooms for Conference Rooms for Windows versions before 5.11.0 are susceptible to a Local Privilege Escalation vulnerability. A local low-privileged malicious user could exploit this vulnerability to escalate their privileges to the SYSTEM user.
CVSS Score: 8.8 (HIGH)
CWE: CWE-347
References: https://explore.zoom.us/en/trust/security/security-bulletin/; https://explore.zoom.us/en/trust/security/security-bulletin/
CVE: CVE-2022-2867
Published: 2022-08-17
Description: libtiff's tiffcrop utility has a uint32_t underflow that can lead to out of bounds read and write. An attacker who supplies a crafted file to tiffcrop (likely via tricking a user to run tiffcrop on it with certain parameters) could cause a crash or in some cases, further exploitation.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-191, CWE-125, CWE-787
References: https://bugzilla.redhat.com/show_bug.cgi?id=2118847; https://lists.debian.org/debian-lts-announce/2023/01/msg00018.html; https://www.debian.org/security/2023/dsa-5333
CVE: CVE-2022-2868
Published: 2022-08-17
Description: libtiff's tiffcrop utility has a improper input validation flaw that can lead to out of bounds read and ultimately cause a crash if an attacker is able to supply a crafted file to tiffcrop.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20, CWE-1284
References: https://bugzilla.redhat.com/show_bug.cgi?id=2118863; https://lists.debian.org/debian-lts-announce/2023/01/msg00018.html; https://www.debian.org/security/2023/dsa-5333
CVE: CVE-2022-2869
Published: 2022-08-17
Description: libtiff's tiffcrop tool has a uint32_t underflow which leads to out of bounds read and write in the extractContigSamples8bits routine. An attacker who supplies a crafted file to tiffcrop could trigger this flaw, most likely by tricking a user into opening the crafted file with tiffcrop. Triggering this flaw could cause a crash or potentially further exploitation.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-191, CWE-125, CWE-787
References: https://bugzilla.redhat.com/show_bug.cgi?id=2118869; https://lists.debian.org/debian-lts-announce/2023/01/msg00018.html; https://www.debian.org/security/2023/dsa-5333
CVE: CVE-2022-35151
Published: 2022-08-17
Description: kkFileView v4.1.0 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities via the urls and currentUrl parameters at /controller/OnlinePreviewController.java.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/kekingcn/kkFileView/issues/366; https://github.com/kekingcn/kkFileView/issues/366
CVE: CVE-2022-35598
Published: 2022-08-18
Description: A SQL injection vulnerability in ConnectionFactoryDAO.java in sazanrjb InventoryManagementSystem 1.0 allows attackers to execute arbitrary SQL commands via parameter username.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/sazanrjb/InventoryManagementSystem; https://github.com/sazanrjb/InventoryManagementSystem/issues/14; https://github.com/sazanrjb/InventoryManagementSystem
CVE: CVE-2022-35599
Published: 2022-08-18
Description: A SQL injection vulnerability in Stocks.java in sazanrjb InventoryManagementSystem 1.0 allows attackers to execute arbitrary SQL commands via parameter productcode.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/sazanrjb/InventoryManagementSystem; https://github.com/sazanrjb/InventoryManagementSystem/issues/14; https://github.com/sazanrjb/InventoryManagementSystem
CVE: CVE-2022-35601
Published: 2022-08-18
Description: A SQL injection vulnerability in SupplierDAO.java in sazanrjb InventoryManagementSystem 1.0 allows attackers to execute arbitrary SQL commands via parameter searchTxt.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/sazanrjb/InventoryManagementSystem; https://github.com/sazanrjb/InventoryManagementSystem/issues/14; https://github.com/sazanrjb/InventoryManagementSystem
CVE: CVE-2022-35602
Published: 2022-08-18
Description: A SQL injection vulnerability in UserDAO.java in sazanrjb InventoryManagementSystem 1.0 allows attackers to execute arbitrary SQL commands via parameter user.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/sazanrjb/InventoryManagementSystem; https://github.com/sazanrjb/InventoryManagementSystem/issues/14; https://github.com/sazanrjb/InventoryManagementSystem
CVE: CVE-2022-35603
Published: 2022-08-18
Description: A SQL injection vulnerability in CustomerDAO.java in sazanrjb InventoryManagementSystem 1.0 allows attackers to execute arbitrary SQL commands via parameter searchTxt.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/sazanrjb/InventoryManagementSystem; https://github.com/sazanrjb/InventoryManagementSystem/issues/14; https://github.com/sazanrjb/InventoryManagementSystem
CVE: CVE-2022-35604
Published: 2022-08-18
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2022-35601. Reason: This candidate is a duplicate of CVE-2022-35601. Notes: All CVE users should reference CVE-2022-35601 instead of this candidate.
CVE: CVE-2022-35605
Published: 2022-08-18
Description: A SQL injection vulnerability in UserDAO.java in sazanrjb InventoryManagementSystem 1.0 allows attackers to execute arbitrary SQL commands via the parameters such as 'users', 'pass', etc.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/sazanrjb/InventoryManagementSystem; https://github.com/sazanrjb/InventoryManagementSystem/issues/14; https://github.com/sazanrjb/InventoryManagementSystem
CVE: CVE-2022-35606
Published: 2022-08-18
Description: A SQL injection vulnerability in CustomerDAO.java in sazanrjb InventoryManagementSystem 1.0 allows attackers to execute arbitrary SQL commands via the parameter 'customerCode.'
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/sazanrjb/InventoryManagementSystem; https://github.com/sazanrjb/InventoryManagementSystem/issues/14; https://github.com/sazanrjb/InventoryManagementSystem
CVE: CVE-2021-30070
Published: 2022-08-18
Description: An issue was discovered in HestiaCP before v1.3.5. Attackers are able to arbitrarily install packages due to values taken from the pgk [] parameter in the update request being transmitted to the operating system's package manager.
CVSS Score: 7.5 (HIGH)
References: https://github.com/hestiacp/hestiacp/commit/27556a9a43aeaf308b33be224c2e70f2011574e6; https://github.com/hestiacp/hestiacp/commit/9a1fccd37f2842fdf96ffb48895c4bfa9788c469; https://github.com/hestiacp/hestiacp/commit/27556a9a43aeaf308b33be224c2e70f2011574e6
CVE: CVE-2021-30071
Published: 2022-08-18
Description: A cross-site scripting (XSS) vulnerability in /admin/list_key.html of HestiaCP before v1.3.5 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/hestiacp/hestiacp/commit/706314c12872c7607e96a73dfc77dbbddad2875e; https://github.com/hestiacp/hestiacp/commit/706314c12872c7607e96a73dfc77dbbddad2875e
CVE: CVE-2022-35153
Published: 2022-08-18
Description: FusionPBX 5.0.1 was discovered to contain a command injection vulnerability via /fax/fax_send.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-116
References: https://github.com/fusionpbx/fusionpbx/commit/07679fe80dadb08ca23d0fc16c0f832348bfec78; https://github.com/fusionpbx/fusionpbx/commit/de22a9121a091e7fedddff22329dd6149dc5ab28; https://github.com/fusionpbx/fusionpbx/commit/07679fe80dadb08ca23d0fc16c0f832348bfec78
CVE: CVE-2022-35154
Published: 2022-08-18
Description: Shopro Mall System v1.3.8 was discovered to contain a SQL injection vulnerability via the value parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/secf0ra11/secf0ra11.github.io/blob/main/Shopro_SQL_injection.md; https://github.com/secf0ra11/secf0ra11.github.io/blob/main/Shopro_SQL_injection.md
CVE: CVE-2022-35164
Published: 2022-08-18
Description: LibreDWG v0.12.4.4608 & commit f2dea29 was discovered to contain a heap use-after-free via bit_copy_chain.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: https://github.com/LibreDWG/libredwg/issues/497; https://github.com/LibreDWG/libredwg/issues/497
CVE: CVE-2022-35165
Published: 2022-08-18
Description: An issue in AP4_SgpdAtom::AP4_SgpdAtom() of Bento4-1.6.0-639 allows attackers to cause a Denial of Service (DoS) via a crafted mp4 input.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-835
References: https://github.com/axiomatic-systems/Bento4/issues/712; https://github.com/axiomatic-systems/Bento4/issues/712
CVE: CVE-2022-35166
Published: 2022-08-18
Description: libjpeg commit 842c7ba was discovered to contain an infinite loop via the component JPEG::ReadInternal.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-835
References: https://github.com/thorfdbg/libjpeg/issues/76; https://github.com/thorfdbg/libjpeg/issues/76
CVE: CVE-2022-35173
Published: 2022-08-18
Description: An issue was discovered in Nginx NJS v0.7.5. The JUMP offset for a break instruction was not set to a correct offset during code generation, leading to a segmentation violation.
CVSS Score: 7.5 (HIGH)
CWE: CWE-754
References: http://hg.nginx.org/njs/rev/b7c4e0f714a9; https://github.com/nginx/njs/commit/[PII_REDACTED]92b8f5f429dc8852d15784a59d8d3e; https://github.com/nginx/njs/issues/553
CVE: CVE-2022-35198
Published: 2022-08-18
Description: Contract Management System v2.0 contains a weak default password which gives attackers to access database connection information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: https://laolisafe.com/contract-management-system2-0; https://laolisafe.com/contract-management-system2-0
CVE: CVE-2022-25986
Published: 2022-08-18
Description: Browse restriction bypass vulnerability in Scheduler of Cybozu Office 10.0.0 to 10.8.5 allows a remote authenticated attacker to obtain the data of Scheduler.
CVSS Score: 4.3 (MEDIUM)
References: https://cs.cybozu.co.jp/2022/007584.html; https://jvn.jp/en/jp/JVN20573662/index.html; https://cs.cybozu.co.jp/2022/007584.html
CVE: CVE-2022-28715
Published: 2022-08-18
Description: Cross-site scripting vulnerability in the specific parameters of Cybozu Office 10.0.0 to 10.8.5 allows a remote attacker to inject an arbitrary script via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://cs.cybozu.co.jp/2022/007584.html; https://jvn.jp/en/jp/JVN20573662/index.html; https://cs.cybozu.co.jp/2022/007584.html
CVE: CVE-2022-29487
Published: 2022-08-18
Description: Cross-site scripting vulnerability in Cybozu Office 10.0.0 to 10.8.5 allows a remote attacker to inject an arbitrary script via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://cs.cybozu.co.jp/2022/007584.html; https://jvn.jp/en/jp/JVN20573662/index.html; https://cs.cybozu.co.jp/2022/007584.html
CVE: CVE-2022-29891
Published: 2022-08-18
Description: Browse restriction bypass vulnerability in Custom Ap of Cybozu Office 10.0.0 to 10.8.5 allows a remote authenticated attacker to obtain the data of Custom App via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
References: https://cs.cybozu.co.jp/2022/007584.html; https://jvn.jp/en/jp/JVN20573662/index.html; https://cs.cybozu.co.jp/2022/007584.html
CVE: CVE-2022-2876
Published: 2022-08-18
Description: A vulnerability, which was classified as critical, was found in SourceCodester Student Management System. Affected is an unknown function of the file index.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-206634 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/beicheng-maker/vulns/issues/4; https://vuldb.com/?id.206634; https://github.com/beicheng-maker/vulns/issues/4
CVE: CVE-2022-30604
Published: 2022-08-18
Description: Cross-site scripting vulnerability in the specific parameters of Cybozu Office 10.0.0 to 10.8.5 allows a remote attacker to inject an arbitrary script via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://cs.cybozu.co.jp/2022/007584.html; https://jvn.jp/en/jp/JVN20573662/index.html; https://cs.cybozu.co.jp/2022/007584.html
CVE: CVE-2022-30693
Published: 2022-08-18
Description: Information disclosure vulnerability in the system configuration of Cybozu Office 10.0.0 to 10.8.5 allows a remote attacker to obtain the data of the product via unspecified vectors.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://cs.cybozu.co.jp/2022/007584.html; https://jvn.jp/en/jp/JVN20573662/index.html; https://cs.cybozu.co.jp/2022/007584.html
CVE: CVE-2022-32283
Published: 2022-08-18
Description: Browse restriction bypass vulnerability in Cabinet of Cybozu Office 10.0.0 to 10.8.5 allows a remote authenticated attacker to obtain the data of Cabinet via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
References: https://cs.cybozu.co.jp/2022/007584.html; https://jvn.jp/en/jp/JVN20573662/index.html; https://cs.cybozu.co.jp/2022/007584.html
CVE: CVE-2022-32453
Published: 2022-08-18
Description: HTTP header injection vulnerability in Cybozu Office 10.0.0 to 10.8.5 may allow a remote attacker to obtain and/or alter the data of the product via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-74
References: https://cs.cybozu.co.jp/2022/007584.html; https://jvn.jp/en/jp/JVN20573662/index.html; https://cs.cybozu.co.jp/2022/007584.html
CVE: CVE-2022-32544
Published: 2022-08-18
Description: Operation restriction bypass vulnerability in Project of Cybozu Office 10.0.0 to 10.8.5 allows a remote authenticated attacker to alter the data of Project via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
References: https://cs.cybozu.co.jp/2022/007584.html; https://jvn.jp/en/jp/JVN20573662/index.html; https://cs.cybozu.co.jp/2022/007584.html
CVE: CVE-2022-32583
Published: 2022-08-18
Description: Operation restriction bypass vulnerability in Scheduler of Cybozu Office 10.0.0 to 10.8.5 allows a remote authenticated attacker to alter the data of Scheduler via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
References: https://cs.cybozu.co.jp/2022/007584.html; https://jvn.jp/en/jp/JVN20573662/index.html; https://cs.cybozu.co.jp/2022/007584.html
CVE: CVE-2022-33151
Published: 2022-08-18
Description: Cross-site scripting vulnerability in the specific parameters of Cybozu Office 10.0.0 to 10.8.5 allows remote attackers to inject an arbitrary script via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://cs.cybozu.co.jp/2022/007584.html; https://jvn.jp/en/jp/JVN20573662/index.html; https://cs.cybozu.co.jp/2022/007584.html
CVE: CVE-2022-33311
Published: 2022-08-18
Description: Browse restriction bypass vulnerability in Address Book of Cybozu Office 10.0.0 to 10.8.5 allows a remote authenticated attacker to obtain the data of Address Book via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
References: https://cs.cybozu.co.jp/2022/007584.html; https://jvn.jp/en/jp/JVN20573662/index.html; https://cs.cybozu.co.jp/2022/007584.html