deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-19277
Published: 2023-04-04
Description: Cross Site Scripting vulnerability found in Phachon mm-wiki v.0.1.2 allows a remote attacker to execute arbitrary code via javascript code in the markdown editor.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/phachon/mm-wiki/issues/68; https://github.com/phachon/mm-wiki/issues/68
CVE: CVE-2020-19278
Published: 2023-04-04
Description: Cross Site Request Forgery vulnerability found in Phachon mm-wiki v.0.1.2 allows a remote attacker to execute arbitrary code via the system/user/save parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://github.com/phachon/mm-wiki/issues/68; https://imgur.com/EABvnwz; https://github.com/phachon/mm-wiki/issues/68
CVE: CVE-2020-19279
Published: 2023-04-04
Description: Directory Traversal vulnerability found in B3log Wide allows a an attacker to escalate privileges via symbolic links.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22, CWE-22
References: https://github.com/b3log/wide/issues/355; https://github.com/advisories/GHSA-g277-4m9p-49hv; https://github.com/b3log/wide/issues/355
CVE: CVE-2020-19692
Published: 2023-04-04
Description: Buffer Overflow vulnerabilty found in Nginx NJS v.0feca92 allows a remote attacker to execute arbitrary code via the njs_module_read in the njs_module.c file.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://github.com/nginx/njs/issues/187; https://github.com/nginx/njs/issues/187
CVE: CVE-2020-19693
Published: 2023-04-04
Description: An issue found in Espruino Espruino 6ea4c0a allows an attacker to execute arbitrrary code via oldFunc parameter of the jswrap_object.c:jswrap_function_replacewith endpoint.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/espruino/Espruino/issues/1684; https://github.com/espruino/Espruino/issues/1684
CVE: CVE-2020-19695
Published: 2023-04-04
Description: Buffer Overflow found in Nginx NJS allows a remote attacker to execute arbitrary code via the njs_object_property parameter of the njs/njs_vm.c function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120, CWE-120
References: https://github.com/nginx/njs/issues/188; https://github.com/nginx/njs/issues/188
CVE: CVE-2020-19697
Published: 2023-04-04
Description: Cross Site Scripting vulnerability found in Pandao Editor.md v.1.5.0 allows a remote attacker to execute arbitrary code via a crafted script in the <iframe>src parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/pandao/editor.md/issues/701; https://github.com/pandao/editor.md/issues/701
CVE: CVE-2020-19698
Published: 2023-04-04
Description: Cross Site Scripting vulnerability found in Pandao Editor.md v.1.5.0 allows a remote attacker to execute arbitrary code via a crafted script to the editor parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/pandao/editor.md/issues/700; https://github.com/pandao/editor.md/issues/700
CVE: CVE-2020-19699
Published: 2023-04-04
Description: Cross Site Scripting vulnerability found in KOHGYLW Kiftd v.1.0.18 allows a remote attacker to execute arbitrary code via the <ifram> tag in the upload file page.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/KOHGYLW/kiftd/issues/32#issuecomment-509868583; https://kohgylw.gitee.io/; https://github.com/KOHGYLW/kiftd/issues/32#issuecomment-509868583
CVE: CVE-2020-19850
Published: 2023-04-04
Description: An issue found in Directus API v.2.2.0 allows a remote attacker to cause a denial of service via a great amount of HTTP requests.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400, CWE-400
References: https://github.com/directus/api/issues/982; https://github.com/directus/api/issues/982
CVE: CVE-2020-20521
Published: 2023-04-04
Description: Cross Site Scripting vulnerability found in KiteCMS v.1.1 allows a remote attacker to execute arbitrary code via the comment parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/Kitesky/KiteCMS/issues/1; https://github.com/Kitesky/KiteCMS/issues/1
CVE: CVE-2020-20522
Published: 2023-04-04
Description: Cross Site Scripting vulnerability found in KiteCMS v.1.1 allows a remote attacker to execute arbitrary code via the registering user parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/Kitesky/KiteCMS/issues/1; https://github.com/Kitesky/KiteCMS/issues/1
CVE: CVE-2020-20913
Published: 2023-04-04
Description: SQL Injection vulnerability found in Ming-Soft MCMS v.4.7.2 allows a remote attacker to execute arbitrary code via basic_title parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/ming-soft/MCMS/issues/27; https://github.com/ming-soft/MCMS/issues/27
CVE: CVE-2020-20914
Published: 2023-04-04
Description: SQL Injection vulnerability found in San Luan PublicCMS v.4.0 allows a remote attacker to execute arbitrary code via the sql parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/sanluan/PublicCMS/issues/29; https://github.com/sanluan/PublicCMS/issues/29
CVE: CVE-2020-20915
Published: 2023-04-04
Description: SQL Injection vulnerability found in PublicCMS v.4.0 allows a remote attacker to execute arbitrary code via sql parameter of the the SysSiteAdminControl.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/sanluan/PublicCMS/issues/29; https://github.com/sanluan/PublicCMS/issues/29
CVE: CVE-2020-21060
Published: 2023-04-04
Description: SQL injection vulnerability found in PHPMyWind v.5.6 allows a remote attacker to gain privileges via the delete function of the administrator management page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/gaozhifeng/PHPMyWind/issues/10; https://github.com/gaozhifeng/PHPMyWind/issues/10
CVE: CVE-2020-21487
Published: 2023-04-04
Description: Cross Site Scripting vulnerability found in Netgate pfSense 2.4.4 and ACME package v.0.6.3 allows attackers to execute arbitrary code via the RootFolder field of acme_certificates.php.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-79, CWE-79
References: https://github.com/pfsense/FreeBSD-ports/commit/a6f443cde51e7fcf17e51f16014d[PII_REDACTED]d8; https://redmine.pfsense.org/issues/9888; https://github.com/pfsense/FreeBSD-ports/commit/a6f443cde51e7fcf17e51f16014d[PII_REDACTED]d8
CVE: CVE-2020-21514
Published: 2023-04-04
Description: An issue was discovered in Fluent-ui v.1.2.2 allows attackers to gain escalated privileges and execute arbitrary code due to a default password.
CVSS Score: 8.8 (HIGH)
CWE: CWE-276
References: https://github.com/fluent/fluentd-ui/issues/295; https://github.com/fluent/fluentd/issues/2722; https://github.com/fluent/fluentd/issues/2722
CVE: CVE-2020-22533
Published: 2023-04-04
Description: Cross Site Scripting vulnerability found in Zentao allows a remote attacker to execute arbitrary code via the lang parameter
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/liuyusjs/zentao/issues/1; https://github.com/liuyusjs/zentao/issues/1
CVE: CVE-2020-23257
Published: 2023-04-04
Description: Buffer Overflow vulnerability found in Espruino 2v05.41 allows an attacker to cause a denial of service via the function jsvGarbageCollectMarkUsed in file src/jsvar.c.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-120
References: http://www.espruino.com/; https://github.com/espruino/Espruino/issues/1820; http://www.espruino.com/
CVE: CVE-2020-23258
Published: 2023-04-04
Description: An issue found in Jsish v.3.0.11 allows a remote attacker to cause a denial of service via the Jsi_ValueIsNumber function in ./src/jsiValue.c file.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-787
References: https://github.com/pcmacdon/jsish/issues/12; https://jsish.org/fossil/jsi2/tktview?name=2ba1d89d32; https://github.com/pcmacdon/jsish/issues/12
CVE: CVE-2020-23259
Published: 2023-04-04
Description: An issue found in Jsish v.3.0.11 and before allows an attacker to cause a denial of service via the Jsi_Strlen function in the src/jsiChar.c file.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476, CWE-476
References: https://github.com/pcmacdon/jsish/issues/13; https://jsish.org/fossil/jsi2/tktview?name=b6bb078e00; https://github.com/pcmacdon/jsish/issues/13
CVE: CVE-2020-23260
Published: 2023-04-04
Description: An issue found in Jsish v.3.0.11 and before allows an attacker to cause a denial of service via the StringReplaceCmd function in the src/jsiChar.c file.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://github.com/pcmacdon/jsish/issues/14; https://jsish.org/fossil/jsi2/tktview?name=3e211e44b1; https://github.com/pcmacdon/jsish/issues/14
CVE: CVE-2020-23327
Published: 2023-04-04
Description: Cross Site Scripting vulnerability found in ZblogCN ZblogPHP v.1.0 allows a local attacker to execute arbitrary code via a crafted payload in title parameter of the module management model.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/zblogcn/zblogphp/issues/262; https://github.com/zblogcn/zblogphp/issues/262
CVE: CVE-2020-29312
Published: 2023-04-04
Description: An issue found in Zend Framework v.3.1.3 and before allow a remote attacker to execute arbitrary code via the unserialize function. Note: This has been disputed by third parties as incomplete and incorrect. The framework does not have a version that surpasses 2.x.x and was deprecated in early 2020.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: http://zend.com; https://cowtransfer.com/s/f9684f004d7149; https://github.com/zendframework/zendframework
CVE: CVE-2021-28235
Published: 2023-04-04
Description: Authentication vulnerability found in Etcd-io v.3.4.10 allows remote attackers to escalate privileges via the debug function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: http://etcd.com; https://github.com/etcd-io/etcd; https://github.com/etcd-io/etcd/pull/15648
CVE: CVE-2021-31707
Published: 2023-04-04
Description: Permissions vulnerability found in KiteCMS allows a remote attacker to execute arbitrary code via the upload file type.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://github.com/Kitesky/KiteCMS/issues/8; https://vuldb.com/?id.224929; https://github.com/Kitesky/KiteCMS/issues/8
CVE: CVE-2021-3267
Published: 2023-04-04
Description: File Upload vulnerability found in KiteCMS v.1.1 allows a remote attacker to execute arbitrary code via the uploadFile function.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: https://github.com/Kitesky/KiteCMS/issues/6; https://github.com/Kitesky/KiteCMS/issues/6
CVE: CVE-2022-48221
Published: 2023-04-04
Description: An issue was discovered in Acuant AcuFill SDK before 10.22.02.03. Multiple MSI's get executed out of a standard-user writable directory. Through a race condition and OpLock manipulation, these files can be overwritten by a standard user. They then get executed by the elevated installer. This gives a standard user full SYSTEM code execution (elevation of privileges).
CVSS Score: 7.5 (HIGH)
CWE: CWE-362
References: https://acuant.com; https://hackandpwn.com/disclosures/CVE-2022-48221.pdf; https://acuant.com
CVE: CVE-2022-48225
Published: 2023-04-04
Description: An issue was discovered in Acuant AcuFill SDK before 10.22.02.03. It is used to install drivers from several different vendors. The Gemalto Document Reader child installation process is vulnerable to DLL hijacking, because it attempts to execute (with elevated privileges) multiple non-existent DLLs out of a non-existent standard-user writable location.
CVSS Score: 7.3 (HIGH)
CWE: CWE-427
References: https://acuant.com; https://hackandpwn.com/disclosures/CVE-2022-48225.pdf; https://acuant.com
CVE: CVE-2022-48226
Published: 2023-04-04
Description: An issue was discovered in Acuant AcuFill SDK before 10.22.02.03. During installation, an EXE gets executed out of C:\Windows\Temp. A standard user can create the path file ahead of time and obtain elevated code execution. Permissions need to be modified to prevent manipulation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269, CWE-269
References: https://acuant.com; https://hackandpwn.com/disclosures/CVE-2022-48226.pdf; https://acuant.com
CVE: CVE-2022-48228
Published: 2023-04-04
Description: An issue was discovered in Acuant AsureID Sentinel before 5.2.149. It uses the root of the C: drive for the i-Dentify and Sentinel Installer log files, aka CORE-7362.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-532, CWE-532
References: https://acuant.com; https://hackandpwn.com/disclosures/CVE-2022-48228.pdf; https://acuant.com
CVE: CVE-2023-26437
Published: 2023-04-04
Description: Denial of service vulnerability in PowerDNS Recursor allows authoritative servers to be marked unavailable.This issue affects Recursor: through 4.6.5, through 4.7.4 , through 4.8.3.
CVSS Score: 3.4 (LOW)
CWE: CWE-400
References: https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2023-02.html; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CN7VMRYKZHG2UDUAK326LXD3JY7NO3LR/; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHPD6SIQOG7245GXFQHPUEI4AZ6Y3KD6/
CVE: CVE-2023-26733
Published: 2023-04-04
Description: Buffer Overflow vulnerability found in tinyTIFF v.3.0 allows a local attacker to cause a denial of service via the TinyTiffReader_readNextFrame function in tinytiffreader.c file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120, CWE-120
References: https://github.com/10cksYiqiyinHangzhouTechnology/Security-Issue-Report-of-TinyTIFF/blob/main/README.md; https://github.com/jkriege2/TinyTIFF/issues/19; https://github.com/10cksYiqiyinHangzhouTechnology/Security-Issue-Report-of-TinyTIFF/blob/main/README.md
CVE: CVE-2023-26750
Published: 2023-04-04
Description: SQL injection vulnerability found in Yii Framework Yii 2 Framework before v.2.0.47 allows the a remote attacker to execute arbitrary code via the runAction function. NOTE: the software maintainer's position is that the vulnerability is in third-party code, not in the framework.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-79
References: https://github.com/yiisoft/yii2/issues/19755; https://github.com/yiisoft/yii2/issues/19755#issuecomment[PII_REDACTED]; https://github.com/yiisoft/yii2/issues/19755#issuecomment[PII_REDACTED]
CVE: CVE-2023-26775
Published: 2023-04-04
Description: File Upload vulnerability found in Monitorr v.1.7.6 allows a remote attacker t oexecute arbitrary code via a crafted file upload to the assets/php/upload.php endpoint.
CVSS Score: 7.8 (HIGH)
CWE: CWE-434
References: http://packetstormsecurity.com/files/171705/Monitorr-1.7.6-Cross-Site-Scripting.html; https://github.com/Monitorr/; https://github.com/Monitorr/Monitorr
CVE: CVE-2023-26776
Published: 2023-04-04
Description: Cross Site Scripting vulnerability found in Monitorr v.1.7.6 allows a remote attacker to execute arbitrary code via the title parameter of the post_receiver-services.php file.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://packetstormsecurity.com/files/171705/Monitorr-1.7.6-Cross-Site-Scripting.html; https://github.com/Monitorr; https://github.com/Monitorr/Monitorr
CVE: CVE-2023-26777
Published: 2023-04-04
Description: Cross Site Scripting vulnerability found in : louislam Uptime Kuma v.1.19.6 and before allows a remote attacker to execute arbitrary commands via the description, title, footer, and incident creation parameter of the status_page.js endpoint.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://packetstormsecurity.com/files/171699/Uptime-Kuma-1.19.6-Cross-Site-Scripting.html; https://github.com/louislam/uptime-kuma/issues/2186; http://packetstormsecurity.com/files/171699/Uptime-Kuma-1.19.6-Cross-Site-Scripting.html
CVE: CVE-2023-26921
Published: 2023-04-04
Description: OS Command Injection vulnerability in quectel AG550QCN allows attackers to execute arbitrary commands via ql_atfwd.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://github.com/closethe/AG550QCN_CommandInjection_ql_atfwd/blob/main/README.md; https://github.com/closethe/AG550QCN_CommandInjection_ql_atfwd/blob/main/README.md
CVE: CVE-2023-26991
Published: 2023-04-04
Description: SWFTools v0.9.2 was discovered to contain a stack-use-after-scope in the swf_ReadSWF2 function in lib/rfxswf.c.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://github.com/matthiaskramm/swftools/issues/196; https://github.com/matthiaskramm/swftools/issues/196
CVE: CVE-2023-27734
Published: 2023-04-04
Description: An issue found in Eteran edb-debugger v.1.3.0 allows a local attacker to causea denial of service via the collect_symbols function in plugins/BinaryInfo/symbols.cpp.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-400
References: https://github.com/eteran/edb-debugger/pull/834/commits/32f325f4016e0090f[PII_REDACTED]3581860f090be; https://github.com/eteran/edb-debugger/pull/834/commits/32f325f4016e0090f[PII_REDACTED]3581860f090be
CVE: CVE-2023-27759
Published: 2023-04-04
Description: An issue found in Wondershare Technology Co, Ltd Edrawmind v.10.0.6 allows a remote attacker to executea arbitrary commands via the WindowsCodescs.dll file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426, CWE-426
References: https://github.com/liong007/Wondershare/issues/8; https://github.com/liong007/Wondershare/issues/8
CVE: CVE-2023-27760
Published: 2023-04-04
Description: An issue found in Wondershare Technology Co, Ltd Filmora v.12.0.9 allows a remote attacker to execute arbitrary commands via the filmora_setup_full846.exe.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426, CWE-426
References: https://github.com/liong007/Wondershare/issues/9; https://github.com/liong007/Wondershare/issues/9
CVE: CVE-2023-27761
Published: 2023-04-04
Description: An issue found in Wondershare Technology Co., Ltd UniConverter v.14.0.0 allows a remote attacker to execute arbitrary commands via the uniconverter14_64bit_setup_full14204.exe file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426, CWE-426
References: https://github.com/liong007/Wondershare/issues/1; https://github.com/liong007/Wondershare/issues/1
CVE: CVE-2023-27762
Published: 2023-04-04
Description: An issue found in Wondershare Technology Co., Ltd DemoCreator v.6.0.0 allows a remote attacker to execute arbitrary commands via the democreator_setup_full7743.exe file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426, CWE-426
References: https://github.com/liong007/Wondershare/issues/3; https://github.com/liong007/Wondershare/issues/3
CVE: CVE-2023-27763
Published: 2023-04-04
Description: An issue found in Wondershare Technology Co.,Ltd MobileTrans v.4.0.2 allows a remote attacker to execute arbitrary commands via the mobiletrans_setup_full5793.exe file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426, CWE-426
References: https://github.com/liong007/Wondershare/issues/5; https://github.com/liong007/Wondershare/issues/5
CVE: CVE-2023-27764
Published: 2023-04-04
Description: An issue found in Wondershare Technology Co.,Ltd Repairit v.3.5.4 allows a remote attacker to execute arbitrary commands via the repairit_setup_full5913.exe file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426, CWE-426
References: https://github.com/liong007/Wondershare/issues/4; https://github.com/liong007/Wondershare/issues/4
CVE: CVE-2023-27765
Published: 2023-04-04
Description: An issue found in Wondershare Technology Co.,Ltd Recoverit v.10.6.3 allows a remote attacker to execute arbitrary commands via the recoverit_setup_full4134.exe file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426, CWE-426
References: https://github.com/liong007/Wondershare/issues/7; https://github.com/liong007/Wondershare/issues/7
CVE: CVE-2023-27766
Published: 2023-04-04
Description: An issue found in Wondershare Technology Co.,Ltd Anireel 1.5.4 allows a remote attacker to execute arbitrary commands via the anireel_setup_full9589.exe file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426, CWE-426
References: https://github.com/liong007/Wondershare/issues/2; https://github.com/liong007/Wondershare/issues/2
CVE: CVE-2023-27767
Published: 2023-04-04
Description: An issue found in Wondershare Technology Co.,Ltd Dr.Fone v.12.4.9 allows a remote attacker to execute arbitrary commands via the drfone_setup_full3360.exe file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426, CWE-426
References: https://github.com/liong007/Wondershare/issues/6; https://github.com/liong007/Wondershare/issues/6
CVE: CVE-2023-27768
Published: 2023-04-04
Description: An issue found in Wondershare Technology Co.,Ltd PDFelement v9.1.1 allows a remote attacker to execute arbitrary commands via the pdfelement-pro_setup_full5239.exe file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426, CWE-426
References: https://github.com/liong007/Wondershare/issues/12; https://github.com/liong007/Wondershare/issues/12
CVE: CVE-2023-27769
Published: 2023-04-04
Description: An issue found in Wondershare Technology Co.,Ltd PDF Reader v.1.0.1 allows a remote attacker to execute arbitrary commands via the pdfreader_setup_full13143.exe file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426, CWE-426
References: https://github.com/liong007/Wondershare/issues/11; https://github.com/liong007/Wondershare/issues/11
CVE: CVE-2023-27770
Published: 2023-04-04
Description: An issue found in Wondershare Technology Co.,Ltd Edraw-max v.12.0.4 allows a remote attacker to execute arbitrary commands via the edraw-max_setup_full5371.exe file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426, CWE-94
References: https://github.com/liong007/Wondershare/issues/10; https://github.com/liong007/Wondershare/issues/10
CVE: CVE-2023-27771
Published: 2023-04-04
Description: An issue found in Wondershare Technology Co.,Ltd Creative Centerr v.1.0.8 allows a remote attacker to execute arbitrary commands via the wondershareCC_setup_full10819.exe file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426, CWE-426
References: https://github.com/liong007/Wondershare/issues/13; https://github.com/liong007/Wondershare/issues/13
CVE: CVE-2022-48222
Published: 2023-04-04
Description: An issue was discovered in Acuant AcuFill SDK before 10.22.02.03. During SDK installation, certutil.exe is called by the Acuant installer to install certificates. This window is not hidden, and is running with elevated privileges. A standard user can break out of this window, obtaining a full SYSTEM command prompt window. This results in complete compromise via arbitrary SYSTEM code execution (elevation of privileges).
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://acuant.com; https://hackandpwn.com/disclosures/CVE-2022-48222.pdf; https://acuant.com
CVE: CVE-2022-48223
Published: 2023-04-04
Description: An issue was discovered in Acuant AcuFill SDK before 10.22.02.03. During SDK repair, certutil.exe is called by the Acuant installer to repair certificates. This call is vulnerable to DLL hijacking due to a race condition and insecure permissions on the executing directory.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-427
References: https://acuant.com; https://hackandpwn.com/disclosures/CVE-2022-48223.pdf; https://acuant.com
CVE: CVE-2022-48224
Published: 2023-04-04
Description: An issue was discovered in Acuant AcuFill SDK before 10.22.02.03. It is installed with insecure permissions (full write access within Program Files). Standard users can replace files within this directory that get executed with elevated privileges, leading to a complete arbitrary code execution (elevation of privileges).
CVSS Score: 7.3 (HIGH)
CWE: CWE-427
References: https://acuant.com; https://hackandpwn.com/disclosures/CVE-2022-48224.pdf; https://acuant.com
CVE: CVE-2022-48227
Published: 2023-04-04
Description: An issue was discovered in Acuant AsureID Sentinel before 5.2.149. It allows elevation of privileges because it opens Notepad after the installation of AssureID, Identify x64, and Identify x86, aka CORE-7361.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269, CWE-269
References: https://acuant.com; https://hackandpwn.com/disclosures/CVE-2022-48227.pdf; https://acuant.com
CVE: CVE-2023-26974
Published: 2023-04-04
Description: Irfanview v4.62 allows a user-mode write access violation via a crafted JPEG 2000 file starting at JPEG2000+0x[PII_REDACTED]001bf0.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119, CWE-119
References: https://github.com/overXsky/IrfanviewPoc; https://github.com/overXsky/IrfanviewPoc