deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-39878
Published: 2022-10-07
Description: Improper access control vulnerability in Samsung Checkout prior to version 5.0.55.3 allows attackers to access sensitive information via implicit intent broadcast.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-284
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=10; https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=10
CVE: CVE-2022-22480
Published: 2022-10-07
Description: IBM QRadar SIEM 7.4 and 7.5 data node rebalancing does not function correctly when using encrypted hosts which could result in information disclosure. IBM X-Force ID: 225889.
CVSS Score: 7.5 (HIGH)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/225889; https://www.ibm.com/support/pages/node/6826695; https://exchange.xforce.ibmcloud.com/vulnerabilities/225889
CVE: CVE-2022-22493
Published: 2022-10-07
Description: IBM WebSphere Automation for Cloud Pak for Watson AIOps 1.4.2 is vulnerable to cross-site request forgery, caused by improper cookie attribute setting. IBM X-Force ID: 226449.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/226449; https://www.ibm.com/support/pages/node/6826727; https://exchange.xforce.ibmcloud.com/vulnerabilities/226449
CVE: CVE-2022-30613
Published: 2022-10-07
Description: IBM QRadar SIEM 7.4 and 7.5 could disclose sensitive information via a local service to a privileged user. IBM X-Force ID: 227366.
CVSS Score: 5.5 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/227366; https://www.ibm.com/support/pages/node/6826693; https://exchange.xforce.ibmcloud.com/vulnerabilities/227366
CVE: CVE-2022-34308
Published: 2022-10-07
Description: IBM CICS TX 11.1 could allow a local user to cause a denial of service due to improper load handling. IBM X-Force ID: 229437.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-770
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/229437; https://www.ibm.com/support/pages/node/6826645; https://www.ibm.com/support/pages/node/6826647
CVE: CVE-2022-36772
Published: 2022-10-07
Description: IBM InfoSphere Information Server 11.7 could allow an authenticated user to obtain sensitive information that should only be available to a privileged user.
CVSS Score: 6.5 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/233299; https://www.ibm.com/support/pages/node/6612325; https://exchange.xforce.ibmcloud.com/vulnerabilities/233299
CVE: CVE-2022-41291
Published: 2022-10-07
Description: IBM InfoSphere Information Server 11.7 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 236699.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-613
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/236699; https://www.ibm.com/support/pages/node/6823109; https://exchange.xforce.ibmcloud.com/vulnerabilities/236699
CVE: CVE-2020-15855
Published: 2022-10-07
Description: Two cross-site scripting vulnerabilities were fixed in Bodhi 5.6.1.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://pyup.io/packages/pypi/bodhi/changelog#5.6.1; https://pyup.io/packages/pypi/bodhi/changelog#5.6.1
CVE: CVE-2021-40162
Published: 2022-10-07
Description: A maliciously crafted TIF, PICT, TGA, or RLC files in Autodesk Image Processing component may be forced to read beyond allocated boundaries when parsing the TIFF, PICT, TGA, or RLC files. This vulnerability may be exploited to execute arbitrary code.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2021-0011; https://www.autodesk.com/trust/security-advisories/adsk-sa-2021-0011
CVE: CVE-2021-40163
Published: 2022-10-07
Description: A Memory Corruption vulnerability may lead to code execution through maliciously crafted DLL files through Autodesk Image Processing component.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2021-0011; https://www.autodesk.com/trust/security-advisories/adsk-sa-2021-0011
CVE: CVE-2021-40164
Published: 2022-10-07
Description: A heap-based buffer overflow could occur while parsing TIFF, PICT, TGA, or RLC files. This vulnerability may be exploited to execute arbitrary code.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2021-0011; https://www.autodesk.com/trust/security-advisories/adsk-sa-2021-0011
CVE: CVE-2021-40165
Published: 2022-10-07
Description: A maliciously crafted TIFF, PICT, TGA, or RLC file in Autodesk Image Processing component may be used to write beyond the allocated buffer while parsing TIFF, PICT, TGA, or RLC files. This vulnerability may be exploited to execute arbitrary code.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2021-0011; https://www.autodesk.com/trust/security-advisories/adsk-sa-2021-0011
CVE: CVE-2021-40166
Published: 2022-10-07
Description: A maliciously crafted PNG file in Autodesk Image Processing component may be used to attempt to free an object that has already been freed while parsing them. This vulnerability may be exploited by attackers to execute arbitrary code.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2021-0011; https://www.autodesk.com/trust/security-advisories/adsk-sa-2021-0011
CVE: CVE-2022-21936
Published: 2022-10-07
Description: On Metasys ADX Server version 12.0 running MVE, an Active Directory user could execute validated actions without providing a valid password when using MVE SMP UI.
CVSS Score: 8.1 (HIGH)
CWE: CWE-287
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-277-01; https://www.johnsoncontrols.com/cyber-solutions/security-advisories; https://www.cisa.gov/uscert/ics/advisories/icsa-22-277-01
CVE: CVE-2022-37885
Published: 2022-10-07
Description: There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba Networks AP management protocol) UDP port (8211). Successful exploitation of these vulnerabilities results in the ability to execute arbitrary code as a privileged user on the underlying operating system of Aruba InstantOS 6.4.x: 6.4.4.8-4.2.4.20 and below; Aruba InstantOS 6.5.x: 6.5.4.23 and below; Aruba InstantOS 8.6.x: 8.6.0.18 and below; Aruba InstantOS 8.7.x: 8.7.1.9 and below; Aruba InstantOS 8.10.x: 8.10.0.1 and below; ArubaOS 10.3.x: 10.3.1.0 and below; Aruba has released upgrades for Aruba InnstantOS that address these security vulnerabilities.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://cert-portal.siemens.com/productcert/pdf/ssa-506569.pdf; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-014.txt; https://cert-portal.siemens.com/productcert/pdf/ssa-506569.pdf
CVE: CVE-2022-37886
Published: 2022-10-07
Description: There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba Networks AP management protocol) UDP port (8211). Successful exploitation of these vulnerabilities results in the ability to execute arbitrary code as a privileged user on the underlying operating system of Aruba InstantOS 6.4.x: 6.4.4.8-4.2.4.20 and below; Aruba InstantOS 6.5.x: 6.5.4.23 and below; Aruba InstantOS 8.6.x: 8.6.0.18 and below; Aruba InstantOS 8.7.x: 8.7.1.9 and below; Aruba InstantOS 8.10.x: 8.10.0.1 and below; ArubaOS 10.3.x: 10.3.1.0 and below; Aruba has released upgrades for Aruba InnstantOS that address these security vulnerabilities.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://cert-portal.siemens.com/productcert/pdf/ssa-506569.pdf; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-014.txt; https://cert-portal.siemens.com/productcert/pdf/ssa-506569.pdf
CVE: CVE-2022-37887
Published: 2022-10-07
Description: There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba Networks AP management protocol) UDP port (8211). Successful exploitation of these vulnerabilities results in the ability to execute arbitrary code as a privileged user on the underlying operating system of Aruba InstantOS 6.4.x: 6.4.4.8-4.2.4.20 and below; Aruba InstantOS 6.5.x: 6.5.4.23 and below; Aruba InstantOS 8.6.x: 8.6.0.18 and below; Aruba InstantOS 8.7.x: 8.7.1.9 and below; Aruba InstantOS 8.10.x: 8.10.0.1 and below; ArubaOS 10.3.x: 10.3.1.0 and below; Aruba has released upgrades for Aruba InnstantOS that address these security vulnerabilities.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://cert-portal.siemens.com/productcert/pdf/ssa-506569.pdf; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-014.txt; https://cert-portal.siemens.com/productcert/pdf/ssa-506569.pdf
CVE: CVE-2022-37889
Published: 2022-10-07
Description: There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba Networks AP management protocol) UDP port (8211). Successful exploitation of these vulnerabilities results in the ability to execute arbitrary code as a privileged user on the underlying operating system of Aruba InstantOS 6.4.x: 6.4.4.8-4.2.4.20 and below; Aruba InstantOS 6.5.x: 6.5.4.23 and below; Aruba InstantOS 8.6.x: 8.6.0.18 and below; Aruba InstantOS 8.7.x: 8.7.1.9 and below; Aruba InstantOS 8.10.x: 8.10.0.1 and below; ArubaOS 10.3.x: 10.3.1.0 and below; Aruba has released upgrades for Aruba InnstantOS that address these security vulnerabilities.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://cert-portal.siemens.com/productcert/pdf/ssa-506569.pdf; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-014.txt; https://cert-portal.siemens.com/productcert/pdf/ssa-506569.pdf
CVE: CVE-2022-37890
Published: 2022-10-07
Description: Unauthenticated buffer overflow vulnerabilities exist within the Aruba InstantOS and ArubaOS 10 web management interface. Successful exploitation results in the execution of arbitrary commands on the underlying operating system of Aruba InstantOS 6.4.x: 6.4.4.8-4.2.4.20 and below; Aruba InstantOS 6.5.x: 6.5.4.23 and below; Aruba InstantOS 8.6.x: 8.6.0.18 and below; Aruba InstantOS 8.7.x: 8.7.1.9 and below; Aruba InstantOS 8.10.x: 8.10.0.1 and below; ArubaOS 10.3.x: 10.3.1.0 and below; Aruba has released upgrades for Aruba InnstantOS that address these security vulnerabilities.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://cert-portal.siemens.com/productcert/pdf/ssa-506569.pdf; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-014.txt; https://cert-portal.siemens.com/productcert/pdf/ssa-506569.pdf
CVE: CVE-2022-37891
Published: 2022-10-07
Description: Unauthenticated buffer overflow vulnerabilities exist within the Aruba InstantOS and ArubaOS 10 web management interface. Successful exploitation results in the execution of arbitrary commands on the underlying operating system of Aruba InstantOS 6.4.x: 6.4.4.8-4.2.4.20 and below; Aruba InstantOS 6.5.x: 6.5.4.23 and below; Aruba InstantOS 8.6.x: 8.6.0.18 and below; Aruba InstantOS 8.7.x: 8.7.1.9 and below; Aruba InstantOS 8.10.x: 8.10.0.1 and below; ArubaOS 10.3.x: 10.3.1.0 and below; Aruba has released upgrades for Aruba InnstantOS that address these security vulnerabilities.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://cert-portal.siemens.com/productcert/pdf/ssa-506569.pdf; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-014.txt; https://cert-portal.siemens.com/productcert/pdf/ssa-506569.pdf
CVE: CVE-2022-37892
Published: 2022-10-07
Description: A vulnerability in the Aruba InstantOS and ArubaOS 10 web management interface could allow an unauthenticated remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface. A successful exploit could allow an attacker to execute arbitrary script code in a victim’s browser in the context of the affected interface of Aruba InstantOS 6.4.x: 6.4.4.8-4.2.4.20 and below; Aruba InstantOS 6.5.x: 6.5.4.23 and below; Aruba InstantOS 8.6.x: 8.6.0.18 and below; Aruba InstantOS 8.7.x: 8.7.1.9 and below; Aruba InstantOS 8.10.x: 8.10.0.1 and below; ArubaOS 10.3.x: 10.3.1.0 and below; Aruba has released upgrades for Aruba InnstantOS that address this security vulnerability.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://cert-portal.siemens.com/productcert/pdf/ssa-506569.pdf; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-014.txt; https://cert-portal.siemens.com/productcert/pdf/ssa-506569.pdf
CVE: CVE-2022-41414
Published: 2022-10-07
Description: An insecure default in the component auth.login.prompt.enabled of Liferay Portal v7.0.0 through v7.4.2 allows attackers to enumerate usernames, site names, and pages.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-276
References: https://portal.liferay.dev/learn/security/known-vulnerabilities; https://portal.liferay.dev/learn/security/known-vulnerabilities
CVE: CVE-2022-41512
Published: 2022-10-07
Description: An arbitrary file upload vulnerability in the component /php_action/editFile.php of Online Diagnostic Lab Management System v1.0 allows attackers to execute arbitrary code via a crafted PHP file.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: https://github.com/TGAyouman/bug_report/blob/main/vendors/mayuri_k/online-diagnostic-lab-management-system/RCE-1.md; https://github.com/TGAyouman/bug_report/blob/main/vendors/mayuri_k/online-diagnostic-lab-management-system/RCE-1.md
CVE: CVE-2022-41513
Published: 2022-10-07
Description: Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /diagnostic/edittest.php.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/TGAyouman/bug_report/blob/main/vendors/mayuri_k/online-diagnostic-lab-management-system/SQLi-1.md; https://github.com/TGAyouman/bug_report/blob/main/vendors/mayuri_k/online-diagnostic-lab-management-system/SQLi-1.md
CVE: CVE-2022-41514
Published: 2022-10-07
Description: Open Source SACCO Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /sacco_shield/ajax.php?action=delete_loan.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/TGAyouman/bug_report/blob/main/vendors/mayuri_k/open-source-sacco-management-system/SQLi-1.md; https://github.com/TGAyouman/bug_report/blob/main/vendors/mayuri_k/open-source-sacco-management-system/SQLi-1.md
CVE: CVE-2022-41515
Published: 2022-10-07
Description: Open Source SACCO Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /sacco_shield/ajax.php?action=delete_payment.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/TGAyouman/bug_report/blob/main/vendors/mayuri_k/open-source-sacco-management-system/SQLi-2.md; https://github.com/TGAyouman/bug_report/blob/main/vendors/mayuri_k/open-source-sacco-management-system/SQLi-2.md
CVE: CVE-2022-42092
Published: 2022-10-07
Description: Backdrop CMS 1.22.0 has Unrestricted File Upload vulnerability via 'themes' that allows attackers to Remote Code Execution. Note: Third parties dispute this and argue that advanced permissions are required.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: https://grimthereaperteam.medium.com/backdrop-cms-1-22-0-unrestricted-file-upload-themes-ad42a599561c; https://grimthereaperteam.medium.com/backdrop-cms-1-22-0-unrestricted-file-upload-themes-ad42a599561c
CVE: CVE-2022-37893
Published: 2022-10-07
Description: An authenticated command injection vulnerability exists in the Aruba InstantOS and ArubaOS 10 command line interface. Successful exploitation of this vulnerability results in the ability to execute arbitrary commands as a privileged user on the underlying operating system of Aruba InstantOS 6.4.x: 6.4.4.8-4.2.4.20 and below; Aruba InstantOS 6.5.x: 6.5.4.23 and below; Aruba InstantOS 8.6.x: 8.6.0.18 and below; Aruba InstantOS 8.7.x: 8.7.1.9 and below; Aruba InstantOS 8.10.x: 8.10.0.1 and below; ArubaOS 10.3.x: 10.3.1.0 and below; Aruba has released upgrades for Aruba InstantOS that address this security vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-78
References: https://cert-portal.siemens.com/productcert/pdf/ssa-506569.pdf; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-014.txt; https://cert-portal.siemens.com/productcert/pdf/ssa-506569.pdf
CVE: CVE-2022-37894
Published: 2022-10-07
Description: An unauthenticated Denial of Service (DoS) vulnerability exists in the handling of certain SSID strings by Aruba InstantOS and ArubaOS 10. Successful exploitation of this vulnerability results in the ability to interrupt the normal operation of the affected AP of Aruba InstantOS 6.4.x: 6.4.4.8-4.2.4.20 and below; Aruba InstantOS 6.5.x: 6.5.4.23 and below; Aruba InstantOS 8.6.x: 8.6.0.18 and below; Aruba InstantOS 8.7.x: 8.7.1.9 and below; Aruba InstantOS 8.10.x: 8.10.0.1 and below; ArubaOS 10.3.x: 10.3.1.0 and below; Aruba has released upgrades for Aruba InstantOS that address this security vulnerability.
CVSS Score: 6.5 (MEDIUM)
References: https://cert-portal.siemens.com/productcert/pdf/ssa-506569.pdf; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-014.txt; https://cert-portal.siemens.com/productcert/pdf/ssa-506569.pdf
CVE: CVE-2022-37895
Published: 2022-10-07
Description: An unauthenticated Denial of Service (DoS) vulnerability exists in the handling of certain SSID strings by Aruba InstantOS and ArubaOS 10. Successful exploitation of this vulnerability results in the ability to interrupt the normal operation of the affected AP of Aruba InstantOS 6.4.x: 6.4.4.8-4.2.4.20 and below; Aruba InstantOS 6.5.x: 6.5.4.23 and below; Aruba InstantOS 8.6.x: 8.6.0.18 and below; Aruba InstantOS 8.7.x: 8.7.1.9 and below; Aruba InstantOS 8.10.x: 8.10.0.1 and below; ArubaOS 10.3.x: 10.3.1.0 and below; Aruba has released upgrades for Aruba InstantOS that address this security vulnerability.
CVSS Score: 4.9 (MEDIUM)
References: https://cert-portal.siemens.com/productcert/pdf/ssa-506569.pdf; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-014.txt; https://cert-portal.siemens.com/productcert/pdf/ssa-506569.pdf
CVE: CVE-2022-37896
Published: 2022-10-07
Description: A vulnerability in the Aruba InstantOS and ArubaOS 10 web management interface could allow a remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the interface. A successful exploit could allow an attacker to execute arbitrary script code in a victim’s browser in the context of the affected interface of Aruba InstantOS 6.4.x: 6.4.4.8-4.2.4.20 and below; Aruba InstantOS 6.5.x: 6.5.4.23 and below; Aruba InstantOS 8.6.x: 8.6.0.18 and below; Aruba InstantOS 8.7.x: 8.7.1.9 and below; Aruba InstantOS 8.10.x: 8.10.0.1 and below; ArubaOS 10.3.x: 10.3.1.0 and below; Aruba has released upgrades for Aruba InstantOS that address this security vulnerability.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://cert-portal.siemens.com/productcert/pdf/ssa-506569.pdf; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-014.txt; https://cert-portal.siemens.com/productcert/pdf/ssa-506569.pdf
CVE: CVE-2022-41377
Published: 2022-10-07
Description: Online Pet Shop We App v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /pet_shop/admin/?page=maintenance/manage_category.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/hegeoo/bug_report/blob/main/vendors/oretnom23/online-pet-shop-we-app/SQLi-2.md; https://github.com/hegeoo/bug_report/blob/main/vendors/oretnom23/online-pet-shop-we-app/SQLi-2.md
CVE: CVE-2022-41378
Published: 2022-10-07
Description: Online Pet Shop We App v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /pet_shop/admin/?page=inventory/manage_inventory.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/hegeoo/bug_report/blob/main/vendors/oretnom23/online-pet-shop-we-app/SQLi-1.md; https://github.com/hegeoo/bug_report/blob/main/vendors/oretnom23/online-pet-shop-we-app/SQLi-1.md
CVE: CVE-2022-41379
Published: 2022-10-07
Description: An arbitrary file upload vulnerability in the component /leave_system/classes/Users.php?f=save of Online Leave Management System v1.0 allows attackers to execute arbitrary code via a crafted PHP file.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: https://github.com/hegeoo/bug_report/blob/main/vendors/oretnom23/online-leave-management-system/RCE-1.md; https://github.com/hegeoo/bug_report/blob/main/vendors/oretnom23/online-leave-management-system/RCE-1.md
CVE: CVE-2022-41392
Published: 2022-10-07
Description: A cross-site scripting (XSS) vulnerability in TotalJS commit 8c2c8909 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Website name text field under Main Settings.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/totaljs/cms/issues/38; https://www.edoardoottavianelli.it/CVE-2022-41392/; https://www.youtube.com/watch?v=BOPLYnveBqk
CVE: CVE-2022-42073
Published: 2022-10-07
Description: Online Diagnostic Lab Management System v1.0 is vulnerable to SQL Injection via /diagnostic/editclient.php?id=.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/f0w4rD/bug_report/blob/main/vendors/mayuri_k/online-diagnostic-lab-management-system/SQLi-1.md; https://github.com/f0w4rD/bug_report/blob/main/vendors/mayuri_k/online-diagnostic-lab-management-system/SQLi-1.md
CVE: CVE-2022-42074
Published: 2022-10-07
Description: Online Diagnostic Lab Management System v1.0 is vulnerable to SQL Injection via /diagnostic/editcategory.php?id=.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/f0w4rD/bug_report/blob/main/vendors/mayuri_k/online-diagnostic-lab-management-system/SQLi-2.md; https://github.com/f0w4rD/bug_report/blob/main/vendors/mayuri_k/online-diagnostic-lab-management-system/SQLi-2.md
CVE: CVE-2022-42075
Published: 2022-10-07
Description: Wedding Planner v1.0 is vulnerable to arbitrary code execution.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/f0w4rD/bug_report/blob/main/vendors/pushpam02/wedding-planner/RCE-1.md; https://www.github.com; https://github.com/f0w4rD/bug_report/blob/main/vendors/pushpam02/wedding-planner/RCE-1.md
CVE: CVE-2022-26452
Published: 2022-10-07
Description: In isp, there is a possible use after free due to improper locking. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07262305; Issue ID: ALPS07262305.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-667
References: https://corp.mediatek.com/product-security-bulletin/October-2022; https://corp.mediatek.com/product-security-bulletin/October-2022
CVE: CVE-2022-26471
Published: 2022-10-07
Description: In telephony, there is a possible escalation of privilege due to a parcel format mismatch. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07319121; Issue ID: ALPS07319121.
CVSS Score: 7.8 (HIGH)
CWE: CWE-502
References: https://corp.mediatek.com/product-security-bulletin/October-2022; https://corp.mediatek.com/product-security-bulletin/October-2022
CVE: CVE-2022-26472
Published: 2022-10-07
Description: In ims, there is a possible escalation of privilege due to a parcel format mismatch. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07319095; Issue ID: ALPS07319095.
CVSS Score: 7.8 (HIGH)
CWE: CWE-502
References: https://corp.mediatek.com/product-security-bulletin/October-2022; https://corp.mediatek.com/product-security-bulletin/October-2022