deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-32545
Published: 2022-06-16
Description: A vulnerability was found in ImageMagick, causing an outside the range of representable values of type 'unsigned char' at coders/psd.c, when crafted or untrusted input is processed. This leads to a negative impact to application availability or other problems related to undefined behavior.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190, CWE-190
References: https://bugzilla.redhat.com/show_bug.cgi?id=2091811; https://github.com/ImageMagick/ImageMagick/commit/9c9a84cec4ab28ee0b57c2b9266d6fbe68183512; https://github.com/ImageMagick/ImageMagick6/commit/450949ed017f009b399c937cf362f0058eacc5fa
CVE: CVE-2022-32546
Published: 2022-06-16
Description: A vulnerability was found in ImageMagick, causing an outside the range of representable values of type 'unsigned long' at coders/pcl.c, when crafted or untrusted input is processed. This leads to a negative impact to application availability or other problems related to undefined behavior.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190, CWE-190
References: https://bugzilla.redhat.com/show_bug.cgi?id=2091812; https://github.com/ImageMagick/ImageMagick/commit/f221ea0fa3171f0f4fdf74ac9d81b203b9534c23; https://github.com/ImageMagick/ImageMagick6/commit/29c8abce0da56b536542f76a9ddfebdaab5b2943
CVE: CVE-2022-32547
Published: 2022-06-16
Description: In ImageMagick, there is load of misaligned address for type 'double', which requires 8 byte alignment and for type 'float', which requires 4 byte alignment at MagickCore/property.c. Whenever crafted or untrusted input is processed by ImageMagick, this causes a negative impact to application availability or other problems related to undefined behavior.
CVSS Score: 7.8 (HIGH)
CWE: CWE-704
References: https://bugzilla.redhat.com/show_bug.cgi?id=2091813; https://github.com/ImageMagick/ImageMagick/commit/eac8ce4d873f28bb6a46aa3a662fb196b49b95d0; https://github.com/ImageMagick/ImageMagick6/commit/dc070da861a015d3c97488fdcca6063b44d47a7b
CVE: CVE-2020-35597
Published: 2022-06-16
Description: Victor CMS 1.0 is vulnerable to SQL injection via c_id parameter of admin_edit_comment.php, p_id parameter of admin_edit_post.php, u_id parameter of admin_edit_user.php, and edit parameter of admin_update_categories.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://cxsecurity.com/issue/WLB[PII_REDACTED]; https://github.com/VictorAlagwu/CMSsite/issues/16; https://www.exploit-db.com/exploits/49282
CVE: CVE-2022-24562
Published: 2022-06-16
Description: In IOBit IOTransfer 4.3.1.1561, an unauthenticated attacker can send GET and POST requests to Airserv and gain arbitrary read/write access to the entire file-system (with admin privileges) on the victim's endpoint, which can result in data theft and remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: http://iobit.com; http://iotransfer.com; http://packetstormsecurity.com/files/167775/IOTransfer-4.0-Remote-Code-Execution.html
CVE: CVE-2022-27511
Published: 2022-06-16
Description: Corruption of the system by a remote, unauthenticated user. The impact of this can include the reset of the administrator password at the next device reboot, allowing an attacker with ssh access to connect with the default administrator credentials after the device has rebooted.
CVSS Score: 8.1 (HIGH)
CWE: CWE-284
References: https://support.citrix.com/article/CTX460016/citrix-application-delivery-management-security-bulletin-for-cve202227511-and-cve202227512; https://support.citrix.com/article/CTX460016/citrix-application-delivery-management-security-bulletin-for-cve202227511-and-cve202227512
CVE: CVE-2022-27512
Published: 2022-06-16
Description: Temporary disruption of the ADM license service. The impact of this includes preventing new licenses from being issued or renewed by Citrix ADM.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-664, CWE-416
References: https://support.citrix.com/article/CTX460016/citrix-application-delivery-management-security-bulletin-for-cve202227511-and-cve202227512; https://support.citrix.com/article/CTX460016/citrix-application-delivery-management-security-bulletin-for-cve202227511-and-cve202227512
CVE: CVE-2022-31464
Published: 2022-06-16
Description: Insecure permissions configuration in Adaware Protect v1.2.439.4251 allows attackers to escalate privileges via changing the service binary path.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: https://r0h1rr1m.medium.com/adaware-protect-local-privilege-escalation-through-insecure-service-permissions-44d0eeb6c933; https://www.adaware.com/; https://r0h1rr1m.medium.com/adaware-protect-local-privilege-escalation-through-insecure-service-permissions-44d0eeb6c933
CVE: CVE-2022-31295
Published: 2022-06-16
Description: An issue in the delete_post() function of Online Discussion Forum Site 1 allows unauthenticated attackers to arbitrarily delete posts.
CVSS Score: 7.5 (HIGH)
CWE: CWE-639
References: https://github.com/bigzooooz/CVE-2022-31295; https://www.sourcecodester.com/php/15337/online-discussion-forum-site-phpoop-free-source-code.html; https://github.com/bigzooooz/CVE-2022-31295
CVE: CVE-2020-25459
Published: 2022-06-16
Description: An issue was discovered in function sync_tree in hetero_decision_tree_guest.py in WeBank FATE (Federated AI Technology Enabler) 0.1 through 1.4.2 allows attackers to read sensitive information during the training process of machine learning joint modeling.
CVSS Score: 7.5 (HIGH)
CWE: CWE-668
References: https://github.com/FederatedAI/FATE/commit/6feccf6d752184a6f9365d56a76fe627983e7139; https://github.com/FederatedAI/FATE/commit/6feccf6d752184a6f9365d56a76fe627983e7139
CVE: CVE-2020-28865
Published: 2022-06-16
Description: An issue was discovered in PowerJob through 3.2.2, allows attackers to change arbitrary user passwords via the id parameter to /appinfo/save.
CVSS Score: 7.5 (HIGH)
CWE: CWE-522
References: https://github.com/KFCFans/PowerJob/issues/99; https://github.com/KFCFans/PowerJob/issues/99
CVE: CVE-2021-33295
Published: 2022-06-16
Description: Cross Site Scripting (XSS) vulnerability in Joplin Desktop App before 1.8.5 allows attackers to execute aribrary code due to improper sanitizing of html.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/laurent22/joplin/commit/9c20d5947d1fa4678a8b640792ff3d31224f0adf; https://github.com/laurent22/joplin/releases/tag/v1.8.5; https://the-it-wonders.blogspot.com/2021/05/joplin-app-desktop-version-vulnerable.html
CVE: CVE-2021-36608
Published: 2022-06-16
Description: Cross Site Scripting (XSS) vulnerability in webTareas 2.2p1 via the Name field to /projects/editproject.php.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://sourceforge.net/p/webtareas/tickets/44/; https://sourceforge.net/p/webtareas/tickets/44/
CVE: CVE-2021-36609
Published: 2022-06-16
Description: Cross Site Scripting (XSS) vulnerability in webTareas 2.2p1 via the Name field to /linkedcontent/editfolder.php.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://sourceforge.net/p/webtareas/tickets/43/; https://sourceforge.net/p/webtareas/tickets/43/
CVE: CVE-2021-37764
Published: 2022-06-16
Description: Arbitrary File Deletion vulnerability in XOS-Shop xos_shop_system 1.0.9 via current_manufacturer_image parameter to /shop/admin/manufacturers.php.
CVSS Score: 8.1 (HIGH)
CWE: CWE-862
References: https://github.com/XOS-Shop/xos_shop_system/issues/1; https://github.com/XOS-Shop/xos_shop_system/issues/1
CVE: CVE-2021-46820
Published: 2022-06-16
Description: Arbitrary File Deletion vulnerability in XOS-Shop xos_shop_system 1.0.9 via current_manufacturer_image parameter to /shop/admin/categories.php
CVSS Score: 8.1 (HIGH)
CWE: CWE-862
References: https://github.com/XOS-Shop/xos_shop_system/issues/1; https://github.com/XOS-Shop/xos_shop_system/issues/1
CVE: CVE-2018-18907
Published: 2022-06-16
Description: An issue was discovered on D-Link DIR-850L 1.21WW devices. A partially completed WPA handshake is sufficient for obtaining full access to the wireless network. A client can access the network by sending packets on Data Frames to the AP without encryption.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://us.dlink.com/security-advisories/; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10097; https://www.synopsys.com/blogs/software-security/wpa2-encryption-bypass-defensics-fuzzing/
CVE: CVE-2022-26173
Published: 2022-06-16
Description: JForum v2.8.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via http://target_host:port/jforum-2.8.0/jforum.page, which allows attackers to arbitrarily add admin accounts.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://jforum.com; https://community.jforum.net/posts/list/248.page; https://github.com/WULINPIN/CVE/blob/main/JForum/poc.html
CVE: CVE-2022-31299
Published: 2022-06-16
Description: Haraj v3.7 was discovered to contain a reflected cross-site scripting (XSS) vulnerability in the User Upgrade Form.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://angtech.org; https://angtech.org/product/view/3; https://github.com/bigzooooz/CVE-2022-31299
CVE: CVE-2022-33739
Published: 2022-06-16
Description: CA Clarity 15.8 and below and 15.9.0 contain an insecure XML parsing vulnerability that could allow a remote attacker to potentially view the contents of any file on the system.
CVSS Score: 7.5 (HIGH)
CWE: CWE-91
References: https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/20645; https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/20645
CVE: CVE-2022-33750
Published: 2022-06-16
Description: CA Automic Automation 12.2 and 12.3 contain an authentication error vulnerability in the Automic agent that could allow a remote attacker to potentially execute arbitrary commands.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/20629; https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/20629
CVE: CVE-2022-33751
Published: 2022-06-16
Description: CA Automic Automation 12.2 and 12.3 contain an insecure memory handling vulnerability in the Automic agent that could allow a remote attacker to potentially access sensitive data.
CVSS Score: 7.5 (HIGH)
References: https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/20629; https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/20629
CVE: CVE-2022-33752
Published: 2022-06-16
Description: CA Automic Automation 12.2 and 12.3 contain an insufficient input validation vulnerability in the Automic agent that could allow a remote attacker to potentially execute arbitrary code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/20629; https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/20629
CVE: CVE-2022-33753
Published: 2022-06-16
Description: CA Automic Automation 12.2 and 12.3 contain an insecure file creation and handling vulnerability in the Automic agent that could allow a user to potentially elevate privileges.
CVSS Score: 8.8 (HIGH)
References: https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/20629; https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/20629
CVE: CVE-2022-33754
Published: 2022-06-16
Description: CA Automic Automation 12.2 and 12.3 contain an insufficient input validation vulnerability in the Automic agent that could allow a remote attacker to potentially execute arbitrary code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/20629; https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/20629
CVE: CVE-2022-33755
Published: 2022-06-16
Description: CA Automic Automation 12.2 and 12.3 contain an insecure input handling vulnerability in the Automic Agent that could allow a remote attacker to potentially enumerate users.
CVSS Score: 5.3 (MEDIUM)
References: https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/20629; https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/20629
CVE: CVE-2022-33756
Published: 2022-06-16
Description: CA Automic Automation 12.2 and 12.3 contain an entropy weakness vulnerability in the Automic AutomationEngine that could allow a remote attacker to potentially access sensitive data.
CVSS Score: 7.5 (HIGH)
CWE: CWE-331
References: https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/20629; https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/20629
CVE: CVE-2022-30325
Published: 2022-06-16
Description: An issue was found on TRENDnet TEW-831DR 1.0 601.130.1.1356 devices. The default pre-shared key for the Wi-Fi networks is the same for every router except for the last four digits. The device default pre-shared key for both 2.4 GHz and 5 GHz networks can be guessed or brute-forced by an attacker within range of the Wi-Fi network.
CVSS Score: 8.8 (HIGH)
CWE: CWE-521
References: https://research.nccgroup.com/2022/06/10/technical-advisory-multiple-vulnerabilities-in-trendnet-tew-831dr-wifi-router-cve-2022-30325-cve-2022-30326-cve-2022-30327-cve-2022-30328-cve-2022-30329/; https://research.nccgroup.com/?research=Technical+advisories; https://research.nccgroup.com/2022/06/10/technical-advisory-multiple-vulnerabilities-in-trendnet-tew-831dr-wifi-router-cve-2022-30325-cve-2022-30326-cve-2022-30327-cve-2022-30328-cve-2022-30329/
CVE: CVE-2022-30326
Published: 2022-06-16
Description: An issue was found on TRENDnet TEW-831DR 1.0 601.130.1.1356 devices. The network pre-shared key field on the web interface is vulnerable to XSS. An attacker can use a simple XSS payload to crash the basic.config page of the web interface.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://research.nccgroup.com/2022/06/10/technical-advisory-multiple-vulnerabilities-in-trendnet-tew-831dr-wifi-router-cve-2022-30325-cve-2022-30326-cve-2022-30327-cve-2022-30328-cve-2022-30329/; https://research.nccgroup.com/?research=Technical+advisories; https://research.nccgroup.com/2022/06/10/technical-advisory-multiple-vulnerabilities-in-trendnet-tew-831dr-wifi-router-cve-2022-30325-cve-2022-30326-cve-2022-30327-cve-2022-30328-cve-2022-30329/
CVE: CVE-2022-30327
Published: 2022-06-16
Description: An issue was found on TRENDnet TEW-831DR 1.0 601.130.1.1356 devices. The web interface is vulnerable to CSRF. An attacker can change the pre-shared key of the Wi-Fi router if the interface's IP address is known.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://research.nccgroup.com/2022/06/10/technical-advisory-multiple-vulnerabilities-in-trendnet-tew-831dr-wifi-router-cve-2022-30325-cve-2022-30326-cve-2022-30327-cve-2022-30328-cve-2022-30329/; https://research.nccgroup.com/?research=Technical+advisories; https://research.nccgroup.com/2022/06/10/technical-advisory-multiple-vulnerabilities-in-trendnet-tew-831dr-wifi-router-cve-2022-30325-cve-2022-30326-cve-2022-30327-cve-2022-30328-cve-2022-30329/
CVE: CVE-2022-30328
Published: 2022-06-16
Description: An issue was found on TRENDnet TEW-831DR 1.0 601.130.1.1356 devices. The username and password setup for the web interface does not require entering the existing password. A malicious user can change the username and password of the interface.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://research.nccgroup.com/2022/06/10/technical-advisory-multiple-vulnerabilities-in-trendnet-tew-831dr-wifi-router-cve-2022-30325-cve-2022-30326-cve-2022-30327-cve-2022-30328-cve-2022-30329/; https://research.nccgroup.com/?research=Technical+advisories; https://research.nccgroup.com/2022/06/10/technical-advisory-multiple-vulnerabilities-in-trendnet-tew-831dr-wifi-router-cve-2022-30325-cve-2022-30326-cve-2022-30327-cve-2022-30328-cve-2022-30329/
CVE: CVE-2022-30329
Published: 2022-06-16
Description: An issue was found on TRENDnet TEW-831DR 1.0 601.130.1.1356 devices. An OS injection vulnerability exists within the web interface, allowing an attacker with valid credentials to execute arbitrary shell commands.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://research.nccgroup.com/2022/06/10/technical-advisory-multiple-vulnerabilities-in-trendnet-tew-831dr-wifi-router-cve-2022-30325-cve-2022-30326-cve-2022-30327-cve-2022-30328-cve-2022-30329/; https://research.nccgroup.com/?research=Technical+advisories; https://research.nccgroup.com/2022/06/10/technical-advisory-multiple-vulnerabilities-in-trendnet-tew-831dr-wifi-router-cve-2022-30325-cve-2022-30326-cve-2022-30327-cve-2022-30328-cve-2022-30329/
CVE: CVE-2018-25040
Published: 2022-06-17
Description: A vulnerability was found in uTorrent Web. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the component HTTP RPC Server. The manipulation leads to privilege escalation. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-269
References: https://bugs.chromium.org/p/project-zero/issues/detail?id=1524; https://vuldb.com/?id.113803; https://www.scmagazineuk.com/utorrent-apps-vulnerable-to-remote-code-execution-information-disclosure/article/746248/
CVE: CVE-2018-25041
Published: 2022-06-17
Description: A vulnerability was found in uTorrent. It has been rated as critical. Affected by this issue is some unknown functionality of the component JSON RPC Server. The manipulation leads to privilege escalation. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-269
References: http://lock.cmpxchg8b.com/Moer0kae.html; https://bugs.chromium.org/p/project-zero/issues/detail?id=1524; https://vuldb.com/?id.113804
CVE: CVE-2018-25042
Published: 2022-06-17
Description: A vulnerability classified as critical has been found in uTorrent. This affects an unknown part. The manipulation leads to memory corruption. It is possible to initiate the attack remotely. It is recommended to upgrade the affected component.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119, CWE-787
References: https://bugs.chromium.org/p/project-zero/issues/detail?id=1524; https://vuldb.com/?id.113805; https://www.scmagazineuk.com/utorrent-apps-vulnerable-to-remote-code-execution-information-disclosure/article/746248/
CVE: CVE-2018-25043
Published: 2022-06-17
Description: A vulnerability classified as critical was found in uTorrent. This vulnerability affects unknown code of the component PRNG. The manipulation leads to weak authentication. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-287, CWE-287
References: http://www.math.sci.hiroshima-u.ac.jp/~m-mat/MT/efaq.html; https://bugs.chromium.org/p/project-zero/issues/detail?id=1524; https://vuldb.com/?id.113806
CVE: CVE-2018-25044
Published: 2022-06-17
Description: A vulnerability, which was classified as critical, has been found in uTorrent. This issue affects some unknown processing of the component Guest Account. The manipulation leads to privilege escalation. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-269, CWE-269
References: http://www.math.sci.hiroshima-u.ac.jp/~m-mat/MT/efaq.html; https://bugs.chromium.org/p/project-zero/issues/detail?id=1524; https://vuldb.com/?id.113807
CVE: CVE-2019-12352
Published: 2022-06-17
Description: An issue was discovered in zzcms 2019. There is a SQL injection Vulnerability in /dl/dl_sendmail.php (when the attacker has dls_print authority) via a dlid cookie.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/cby234/zzcms/issues/5; https://github.com/cby234/zzcms/issues/5
CVE: CVE-2019-12353
Published: 2022-06-17
Description: An issue was discovered in zzcms 2019. There is a SQL injection Vulnerability in /admin/dl_sendmail.php (when the attacker has admin authority) via the id parameter.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/cby234/zzcms/issues/5; https://github.com/cby234/zzcms/issues/5
CVE: CVE-2019-12354
Published: 2022-06-17
Description: An issue was discovered in zzcms 2019. There is a SQL injection Vulnerability in /admin/showbad.php (when the attacker has admin authority) via the id parameter.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/cby234/zzcms/issues/5; https://github.com/cby234/zzcms/issues/5
CVE: CVE-2019-12355
Published: 2022-06-17
Description: An issue was discovered in zzcms 2019. There is a SQL injection Vulnerability in /user/dls_print.php (when the attacker has dls_print authority) via the id parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/cby234/zzcms/issues/5; https://github.com/cby234/zzcms/issues/5
CVE: CVE-2019-12356
Published: 2022-06-17
Description: An issue was discovered in zzcms 2019. There is a SQL injection Vulnerability in /user/dls_download.php (when the attacker has dls_download authority) via the id parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/cby234/zzcms/issues/5; https://github.com/cby234/zzcms/issues/5
CVE: CVE-2019-12357
Published: 2022-06-17
Description: An issue was discovered in zzcms 2019. There is a SQL injection Vulnerability in /admin/deluser.php (when the attacker has admin authority) via the id parameter.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/cby234/zzcms/issues/5; https://github.com/cby234/zzcms/issues/5
CVE: CVE-2019-12358
Published: 2022-06-17
Description: An issue was discovered in zzcms 2019. There is a SQL injection Vulnerability in /dl/dl_sendsms.php (when the attacker has dls_print authority) via a dlid cookie.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/cby234/zzcms/issues/5; https://github.com/cby234/zzcms/issues/5
CVE: CVE-2019-12359
Published: 2022-06-17
Description: An issue was discovered in zzcms 2019. There is a SQL injection Vulnerability in /admin/ztliuyan_sendmail.php (when the attacker has admin authority) via the id parameter.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/cby234/zzcms/issues/5; https://github.com/cby234/zzcms/issues/5
CVE: CVE-2020-36547
Published: 2022-06-17
Description: A vulnerability was found in GE Voluson S8. It has been rated as critical. This issue affects the Service Browser which itroduces hard-coded credentials. Attacking locally is a requirement. It is recommended to change the configuration settings.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-798, CWE-798
References: https://vuldb.com/?id.129833; https://www.scip.ch/?news.20200701; https://vuldb.com/?id.129833
CVE: CVE-2020-36548
Published: 2022-06-17
Description: A vulnerability classified as problematic has been found in GE Voluson S8. Affected is the file /uscgi-bin/users.cgi of the Service Browser. The manipulation leads to improper authentication and elevated access possibilities. It is possible to launch the attack on the local host.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-287, CWE-287
References: https://vuldb.com/?id.129834; https://www.scip.ch/?news.20200701; https://vuldb.com/?id.129834
CVE: CVE-2020-36549
Published: 2022-06-17
Description: A vulnerability classified as critical was found in GE Voluson S8. Affected is the underlying Windows XP operating system. Missing patches might introduce an excessive attack surface. Access to the local network is required for this attack to succeed.
CVSS Score: 8.8 (HIGH)
CWE: CWE-269
References: https://vuldb.com/?id.129835; https://www.scip.ch/?news.20200701; https://vuldb.com/?id.129835