deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-30317
Published: 2022-08-31
Description: Honeywell Experion LX through 2022-05-06 has Missing Authentication for a Critical Function. According to FSCT-2022-0055, there is a Honeywell Experion LX Control Data Access (CDA) EpicMo protocol with unauthenticated functionality issue. The affected components are characterized as: Honeywell Control Data Access (CDA) EpicMo (55565/TCP). The potential impact is: Firmware manipulation, Denial of service. The Honeywell Experion LX Distributed Control System (DCS) utilizes the Control Data Access (CDA) EpicMo protocol (55565/TCP) for device diagnostics and maintenance purposes. This protocol does not have any authentication features, allowing any attacker capable of communicating with the ports in question to invoke (a subset of) desired functionality. There is no authentication functionality on the protocol in question. An attacker capable of invoking the protocols' functionalities could issue firmware download commands potentially allowing for firmware manipulation and reboot devices causing denial of service.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-306
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-242-07; https://www.forescout.com/blog/; https://www.cisa.gov/uscert/ics/advisories/icsa-22-242-07
CVE: CVE-2022-30318
Published: 2022-08-31
Description: Honeywell ControlEdge through R151.1 uses Hard-coded Credentials. According to FSCT-2022-0056, there is a Honeywell ControlEdge hardcoded credentials issue. The affected components are characterized as: SSH. The potential impact is: Remote code execution, manipulate configuration, denial of service. The Honeywell ControlEdge PLC and RTU product line exposes an SSH service on port 22/TCP. Login as root to this service is permitted and credentials for the root user are hardcoded without automatically changing them upon first commissioning. The credentials for the SSH service are hardcoded in the firmware. The credentials grant an attacker access to a root shell on the PLC/RTU, allowing for remote code execution, configuration manipulation and denial of service.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-242-06; https://www.forescout.com/blog/; https://www.cisa.gov/uscert/ics/advisories/icsa-22-242-06
CVE: CVE-2022-37122
Published: 2022-08-31
Description: Carel pCOWeb HVAC BACnet Gateway 2.1.0, Firmware: A2.1.0 - B2.1.0, Application Software: 2.15.4A Software v16 13020200 suffers from an unauthenticated arbitrary file disclosure vulnerability. Input passed through the 'file' GET parameter through the 'logdownload.cgi' Bash script is not properly verified before being used to download log files. This can be exploited to disclose the contents of arbitrary and sensitive files via directory traversal attacks.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://packetstormsecurity.com/files/167684/; https://www.zeroscience.mk/codes/carelpco_dir.txt; https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5709.php
CVE: CVE-2022-3028
Published: 2022-08-31
Description: A race condition was found in the Linux kernel's IP framework for transforming packets (XFRM subsystem) when multiple calls to xfrm_probe_algs occurred simultaneously. This flaw could allow a local attacker to potentially trigger an out-of-bounds write or leak kernel heap memory by performing an out-of-bounds read and copying it into a socket.
CVSS Score: 7.0 (HIGH)
CWE: CWE-667, CWE-362, CWE-787
References: https://github.com/torvalds/linux/commit/ba953a9d89a00c078b85f4b190bc1dde66fe16b5; https://lists.debian.org/debian-lts-announce/2022/10/msg00000.html; https://lists.debian.org/debian-lts-announce/2022/11/msg00001.html
CVE: CVE-2022-38152
Published: 2022-08-31
Description: An issue was discovered in wolfSSL before 5.5.0. When a TLS 1.3 client connects to a wolfSSL server and SSL_clear is called on its session, the server crashes with a segmentation fault. This occurs in the second session, which is created through TLS session resumption and reuses the initial struct WOLFSSL. If the server reuses the previous session structure (struct WOLFSSL) by calling wolfSSL_clear(WOLFSSL* ssl) on it, the next received Client Hello (that resumes the previous session) crashes the server. Note that this bug is only triggered when resuming sessions using TLS session resumption. Only servers that use wolfSSL_clear instead of the recommended SSL_free; SSL_new sequence are affected. Furthermore, wolfSSL_clear is part of wolfSSL's compatibility layer and is not enabled by default. It is not part of wolfSSL's native API.
CVSS Score: 7.5 (HIGH)
CWE: CWE-754
References: http://packetstormsecurity.com/files/170604/wolfSSL-Session-Resumption-Denial-Of-Service.html; http://seclists.org/fulldisclosure/2023/Jan/7; https://blog.trailofbits.com/2023/01/12/wolfssl-vulnerabilities-tlspuffin-fuzzing-ssh/
CVE: CVE-2022-36566
Published: 2022-08-31
Description: Rengine v1.3.0 was discovered to contain a command injection vulnerability via the scan engine function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/zongdeiqianxing/rengine/issues/2; https://github.com/zongdeiqianxing/rengine/issues/2
CVE: CVE-2022-37183
Published: 2022-08-31
Description: Piwigo 12.3.0 is vulnerable to Cross Site Scripting (XSS) via /search/1940/created-monthly-list.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/Piwigo/2022/12.3.0; https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/Piwigo/2022/12.3.0
CVE: CVE-2022-37184
Published: 2022-08-31
Description: The application manage_website.php on Garage Management System 1.0 is vulnerable to Shell File Upload. The already authenticated malicious user, can upload a dangerous RCE or LCE exploit file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/mayuri_k/2022/Garage-Management-System-1.0-SFU; https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/mayuri_k/2022/Garage-Management-System-1.0-SFU
CVE: CVE-2022-38153
Published: 2022-08-31
Description: An issue was discovered in wolfSSL before 5.5.0 (when --enable-session-ticket is used); however, only version 5.3.0 is exploitable. Man-in-the-middle attackers or a malicious server can crash TLS 1.2 clients during a handshake. If an attacker injects a large ticket (more than 256 bytes) into a NewSessionTicket message in a TLS 1.2 handshake, and the client has a non-empty session cache, the session cache frees a pointer that points to unallocated memory, causing the client to crash with a "free(): invalid pointer" message. NOTE: It is likely that this is also exploitable during TLS 1.3 handshakes between a client and a malicious server. With TLS 1.3, it is not possible to exploit this as a man-in-the-middle.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-770
References: http://packetstormsecurity.com/files/170605/wolfSSL-5.3.0-Denial-Of-Service.html; http://seclists.org/fulldisclosure/2023/Jan/8; https://blog.trailofbits.com/2023/01/12/wolfssl-vulnerabilities-tlspuffin-fuzzing-ssh/
CVE: CVE-2022-38812
Published: 2022-08-31
Description: AeroCMS 0.1.1 is vulnerable to SQL Injection via the author parameter.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/MegaTKC/2021/AeroCMS-v0.0.1-SQLi; https://www.nu11secur1ty.com/2022/08/aerocms-v001-sqli.html; https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/MegaTKC/2021/AeroCMS-v0.0.1-SQLi
CVE: CVE-2022-36046
Published: 2022-08-31
Description: Next.js is a React framework that can provide building blocks to create web applications. All of the following must be true to be affected by this CVE: Next.js version 12.2.3, Node.js version above v15.0.0 being used with strict `unhandledRejection` exiting AND using next start or a [custom server](https://nextjs.org/docs/advanced-features/custom-server). Deployments on Vercel ([vercel.com](https://vercel.com/)) are not affected along with similar environments where `next-server` isn't being shared across requests.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-248, CWE-754
References: https://github.com/vercel/next.js/releases/tag/v12.2.4; https://github.com/vercel/next.js/security/advisories/GHSA-wff4-fpwg-qqv3; https://github.com/vercel/next.js/releases/tag/v12.2.4
CVE: CVE-2022-37128
Published: 2022-08-31
Description: In D-Link DIR-816 A2_v1.10CNB04.img the network can be initialized without authentication via /goform/wizard_end.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-665
References: https://github.com/z1r00/IOT_Vul/blob/main/dlink/Dir816/wizard_end/readme.md; https://www.dlink.com/en/security-bulletin/; https://github.com/z1r00/IOT_Vul/blob/main/dlink/Dir816/wizard_end/readme.md
CVE: CVE-2022-1841
Published: 2022-08-31
Description: In subsys/net/ip/tcp.c , function tcp_flags , when the incoming parameter flags is ECN or CWR , the buf will out-of-bounds write a byte zero.
CVSS Score: 7.2 (HIGH)
CWE: CWE-787, CWE-787
References: http://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-5c3j-p8cr-2pgh; http://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-5c3j-p8cr-2pgh
CVE: CVE-2022-31233
Published: 2022-08-31
Description: Unisphere for PowerMax versions before 9.2.3.15 contain a privilege escalation vulnerability. An adjacent malicious user may potentially exploit this vulnerability to escalate their privileges and access functionalities they do not have access to.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-602, CWE-669
References: https://www.dell.com/support/kbdoc/000200975; https://www.dell.com/support/kbdoc/000200975
CVE: CVE-2022-34373
Published: 2022-08-31
Description: Dell Command | Integration Suite for System Center, versions prior to 6.2.0, contains arbitrary file write vulnerability. A locally authenticated malicious user could potentially exploit this vulnerability in order to perform an arbitrary write as system.
CVSS Score: 7.3 (HIGH)
CWE: CWE-22
References: https://www.dell.com/support/kbdoc/000201877; https://www.dell.com/support/kbdoc/000201877
CVE: CVE-2022-34383
Published: 2022-08-31
Description: Dell Edge Gateway 5200 (EGW) versions before 1.03.10 contain an operating system command injection vulnerability. A local malicious user may potentially exploit this vulnerability by using an SMI to bypass PMC mitigation and gain arbitrary code execution during SMM.
CVSS Score: 8.1 (HIGH)
CWE: CWE-77, CWE-78
References: https://www.dell.com/support/kbdoc/en-us/000202711; https://www.dell.com/support/kbdoc/en-us/000202711
CVE: CVE-2022-36048
Published: 2022-08-31
Description: Zulip is an open-source team collaboration tool with topic-based threading that combines email and chat. When displaying messages with embedded remote images, Zulip normally loads the image preview via a go-camo proxy server. However, an attacker who can send messages could include a crafted URL that tricks the server into embedding a remote image reference directly. This could allow the attacker to infer the viewer’s IP address and browser fingerprinting information. This vulnerability is fixed in Zulip Server 5.6. Zulip organizations with image and link previews [disabled](https://zulip.com/help/allow-image-link-previews) are not affected.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-436
References: https://github.com/zulip/zulip/security/advisories/GHSA-vg5m-mf9x-j452; https://github.com/zulip/zulip/security/advisories/GHSA-vg5m-mf9x-j452
CVE: CVE-2022-36568
Published: 2022-08-31
Description: Tenda AC9 V15.03.05.19 was discovered to contain a stack overflow via the list parameter at /goform/setPptpUserList.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://github.com/CyberUnicornIoT/IoTvuln/blob/main/Tenda_ac9/3/tenda_ac9_setPptpUserList.md; https://github.com/CyberUnicornIoT/IoTvuln/blob/main/Tenda_ac9/3/tenda_ac9_setPptpUserList.md
CVE: CVE-2022-36569
Published: 2022-08-31
Description: Tenda AC9 V15.03.05.19 was discovered to contain a stack overflow via the deviceList parameter at /goform/setMacFilterCfg.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://github.com/CyberUnicornIoT/IoTvuln/blob/main/Tenda_ac9/4/tenda_ac9_setMacFilterCfg.md; https://github.com/CyberUnicornIoT/IoTvuln/blob/main/Tenda_ac9/4/tenda_ac9_setMacFilterCfg.md
CVE: CVE-2022-36570
Published: 2022-08-31
Description: Tenda AC9 V15.03.05.19 was discovered to contain a stack overflow via the time parameter at /goform/SetLEDCfg.
CVSS Score: 7.2 (HIGH)
CWE: CWE-787
References: https://github.com/CyberUnicornIoT/IoTvuln/blob/main/Tenda_ac9/1/tenda_ac9_SetLEDCfg.md; https://github.com/CyberUnicornIoT/IoTvuln/blob/main/Tenda_ac9/1/tenda_ac9_SetLEDCfg.md
CVE: CVE-2022-36571
Published: 2022-08-31
Description: Tenda AC9 V15.03.05.19 was discovered to contain a stack overflow via the mask parameter at /goform/WanParameterSetting.
CVSS Score: 7.2 (HIGH)
CWE: CWE-787
References: https://github.com/CyberUnicornIoT/IoTvuln/blob/main/Tenda_ac9/2/tenda_ac9_WanParameterSetting.md; https://github.com/CyberUnicornIoT/IoTvuln/blob/main/Tenda_ac9/2/tenda_ac9_WanParameterSetting.md
CVE: CVE-2022-36580
Published: 2022-08-31
Description: An arbitrary file upload vulnerability in the component /admin/products/controller.php?action=add of Online Ordering System v2.3.2 allows attackers to execute arbitrary code via a crafted PHP file.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: https://github.com/zerrr0/Zerrr0_Vulnerability/blob/main/Online-Ordering-System/Arbitrary-File-Upload-Vulnerability.md; https://github.com/zerrr0/Zerrr0_Vulnerability/blob/main/Online-Ordering-System/Arbitrary-File-Upload-Vulnerability.md
CVE: CVE-2022-36581
Published: 2022-08-31
Description: Online Ordering System v2.3.2 was discovered to contain a SQL injection vulnerability via the user_email parameter at /admin/login.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://github.com/zerrr0/Zerrr0_Vulnerability/blob/main/Online-Ordering-System/SQL-Injection-Vulnerability.md; https://github.com/zerrr0/Zerrr0_Vulnerability/blob/main/Online-Ordering-System/SQL-Injection-Vulnerability.md
CVE: CVE-2022-36582
Published: 2022-08-31
Description: An arbitrary file upload vulnerability in the component /php_action/createProduct.php of Garage Management System v1.0 allows attackers to execute arbitrary code via a crafted PHP file.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: https://github.com/zerrr0/Zerrr0_Vulnerability/blob/main/Garage-Management-System/Arbitrary-File-Upload-Vulnerability.md; https://github.com/zerrr0/Zerrr0_Vulnerability/blob/main/Garage-Management-System/Arbitrary-File-Upload-Vulnerability.md
CVE: CVE-2022-2892
Published: 2022-08-31
Description: Measuresoft ScadaPro Server (Versions prior to 6.8.0.1) uses an unmaintained ActiveX control, which may allow an out-of-bounds write condition while processing a specific project file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-235-05; https://www.cisa.gov/uscert/ics/advisories/icsa-22-235-05
CVE: CVE-2022-2894
Published: 2022-08-31
Description: Measuresoft ScadaPro Server (All Versions) uses unmaintained ActiveX controls. The controls may allow seven untrusted pointer deference instances while processing a specific project file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-822
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-235-06; https://www.cisa.gov/uscert/ics/advisories/icsa-22-235-06
CVE: CVE-2022-2895
Published: 2022-08-31
Description: Measuresoft ScadaPro Server (All Versions) uses unmaintained ActiveX controls. These controls may allow two stack-based buffer overflow instances while processing a specific project file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-235-06; https://www.cisa.gov/uscert/ics/advisories/icsa-22-235-06
CVE: CVE-2022-2896
Published: 2022-08-31
Description: Measuresoft ScadaPro Server (All Versions) allows use after free while processing a specific project file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121, CWE-416
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-235-06; https://www.cisa.gov/uscert/ics/advisories/icsa-22-235-06
CVE: CVE-2022-2897
Published: 2022-08-31
Description: Measuresoft ScadaPro Server and Client (All Versions) do not properly resolve links before file access; this could allow privilege escalation..
CVSS Score: 7.8 (HIGH)
CWE: CWE-59
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-235-06; https://www.cisa.gov/uscert/ics/advisories/icsa-22-235-06
CVE: CVE-2022-2898
Published: 2022-08-31
Description: Measuresoft ScadaPro Server and Client (All Versions) do not properly resolve links before file access; this could allow a denial-of-service condition.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-59
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-235-06; https://www.cisa.gov/uscert/ics/advisories/icsa-22-235-06
CVE: CVE-2022-36201
Published: 2022-08-31
Description: Doctor’s Appointment System v1.0 is vulnerable to Blind SQLi via settings.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://packetstormsecurity.com/files/168212/Doctors-Appointment-System-1.0-SQL-Injection.html; https://github.com/aznull/CVEs; https://www.sourcecodester.com/hashenudara/simple-doctors-appointment-project.html
CVE: CVE-2022-36202
Published: 2022-08-31
Description: Doctor's Appointment System1.0 is vulnerable to Incorrect Access Control via edoc/patient/settings.php. The settings.php is affected by Broken Access Control (IDOR) via id= parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-639
References: http://hshnudr.com; https://github.com/aznull/CVEs; https://www.sourcecodester.com/hashenudara/simple-doctors-appointment-project.html
CVE: CVE-2022-36203
Published: 2022-08-31
Description: Doctor's Appointment System 1.0 is vulnerable to Cross Site Scripting (XSS) via the admin panel. In addition, it leads to takeover the administrator account by stealing the cookie via XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/168211/Doctors-Appointment-System-1.0-Cross-Site-Scripting.html; https://github.com/aznull/CVEs; https://www.sourcecodester.com/hashenudara/simple-doctors-appointment-project.html
CVE: CVE-2022-36620
Published: 2022-08-31
Description: D-link DIR-816 A2_v1.10CNB04, DIR-878 DIR_878_FW1.30B08.img is vulnerable to Buffer Overflow via /goform/addRouting.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1284
References: https://github.com/726232111/VulIoT/tree/main/D-Link/DIR-816%20A2_v1.10CNB05/addRouting; https://github.com/z1r00/IOT_Vul/blob/main/dlink/Dir816/addRouting/readme.md; https://www.dlink.com/en/security-bulletin/
CVE: CVE-2022-37125
Published: 2022-08-31
Description: D-link DIR-816 A2_v1.10CNB04.img is vulnerable to Command injection via /goform/NTPSyncWithHost.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://github.com/z1r00/IOT_Vul/tree/main/dlink/Dir816/form2systime_cgi; https://www.dlink.com/en/security-bulletin/; https://github.com/z1r00/IOT_Vul/tree/main/dlink/Dir816/form2systime_cgi
CVE: CVE-2022-36051
Published: 2022-08-31
Description: ZITADEL combines the ease of Auth0 and the versatility of Keycloak.**Actions**, introduced in ZITADEL **1.42.0** on the API and **1.56.0** for Console, is a feature, where users with role.`ORG_OWNER` are able to create Javascript Code, which is invoked by the system at certain points during the login. **Actions**, for example, allow creating authorizations (user grants) on newly created users programmatically. Due to a missing authorization check, **Actions** were able to grant authorizations for projects that belong to other organizations inside the same Instance. Granting authorizations via API and Console is not affected by this vulnerability. There is currently no known workaround, users should update.
CVSS Score: 8.7 (HIGH)
CWE: CWE-436, CWE-863
References: https://github.com/zitadel/zitadel/releases/tag/v1.87.1; https://github.com/zitadel/zitadel/releases/tag/v2.2.0; https://github.com/zitadel/zitadel/security/advisories/GHSA-c8fj-4pm8-mp2c
CVE: CVE-2022-36619
Published: 2022-08-31
Description: In D-link DIR-816 A2_v1.10CNB04.img,the network can be reset without authentication via /goform/setMAC.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306
References: https://github.com/z1r00/IOT_Vul/blob/main/dlink/Dir816/setmac/readme.md; https://www.dlink.com/en/security-bulletin/; https://github.com/z1r00/IOT_Vul/blob/main/dlink/Dir816/setmac/readme.md
CVE: CVE-2022-37123
Published: 2022-08-31
Description: D-link DIR-816 A2_v1.10CNB04.img is vulnerable to Command injection via /goform/form2userconfig.cgi.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://github.com/z1r00/IOT_Vul/blob/main/dlink/Dir816/form2userconfig_cgi/readme.md; https://www.dlink.com/en/security-bulletin/; https://github.com/z1r00/IOT_Vul/blob/main/dlink/Dir816/form2userconfig_cgi/readme.md
CVE: CVE-2022-37129
Published: 2022-08-31
Description: D-Link DIR-816 A2_v1.10CNB04.img is vulnerable to Command Injection via /goform/SystemCommand. After the user passes in the command parameter, it will be spliced into byte_4836B0 by snprintf, and finally doSystem(&byte_4836B0); will be executed, resulting in a command injection.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://github.com/z1r00/IOT_Vul/blob/main/dlink/Dir816/SystemCommand/readme.md; https://www.dlink.com/en/security-bulletin/; https://github.com/z1r00/IOT_Vul/blob/main/dlink/Dir816/SystemCommand/readme.md
CVE: CVE-2022-37130
Published: 2022-08-31
Description: In D-Link DIR-816 A2_v1.10CNB04, DIR-878 DIR_878_FW1.30B08.img a command injection vulnerability occurs in /goform/Diagnosis, after the condition is met, setnum will be spliced into v10 by snprintf, and the system will be executed, resulting in a command injection vulnerability
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/726232111/VulIoT/tree/main/D-Link/DIR-816%20A2_v1.10CNB05/Diagnosis; https://github.com/z1r00/IOT_Vul/blob/main/dlink/Dir816/Diagnosis/readme.md; https://www.dlink.com/en/security-bulletin/
CVE: CVE-2022-36130
Published: 2022-09-01
Description: HashiCorp Boundary up to 0.10.1 did not properly perform data integrity checks to ensure the resources were associated with the correct scopes, allowing potential privilege escalation for authorized users of another scope. Fixed in Boundary 0.10.2.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-345
References: https://discuss.hashicorp.com; https://discuss.hashicorp.com/t/hcsec-2022017-boundary-allowed-access-to-host-sets-and-credential-sources-for-authorized-users-of-another-scope/43493; https://discuss.hashicorp.com
CVE: CVE-2022-36449
Published: 2022-09-01
Description: An issue was discovered in the Arm Mali GPU Kernel Driver. A non-privileged user can make improper GPU processing operations to gain access to already freed memory, write a limited amount outside of buffer bounds, or to disclose details of memory mappings. This affects Midgard r4p0 through r32p0, Bifrost r0p0 through r38p0 and r39p0 before r38p1, and Valhall r19p0 through r38p0 and r39p0 before r38p1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-416
References: http://packetstormsecurity.com/files/168431/Arm-Mali-Released-Buffer-Use-After-Free.html; http://packetstormsecurity.com/files/168432/Arm-Mali-Physical-Address-Exposure.html; http://packetstormsecurity.com/files/168433/Arm-Mali-Race-Condition.html
CVE: CVE-2022-36671
Published: 2022-09-01
Description: Novel-Plus v3.6.2 was discovered to contain an arbitrary file download vulnerability via the background file download API.
CVSS Score: 7.5 (HIGH)
CWE: CWE-494
References: https://www.mesec.cn/archives/291; https://www.mesec.cn/archives/291
CVE: CVE-2022-36672
Published: 2022-09-01
Description: Novel-Plus v3.6.2 was discovered to contain a hard-coded JWT key located in the project config file. This vulnerability allows attackers to create a custom user session.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://www.mesec.cn/archives/296; https://www.mesec.cn/archives/296