deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-1433
Published: 2022-05-11
Description: An issue has been discovered in GitLab affecting all versions starting from 14.4 before 14.8.6, all versions starting from 14.9 before 14.9.4, all versions starting from 14.10 before 14.10.1. Missing invalidation of Markdown caching causes potential payloads from a previously exploitable XSS vulnerability (CVE-2022-1175) to persist and execute.
CVSS Score: 2.6 (LOW)
CWE: CWE-79
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1433.json; https://gitlab.com/gitlab-org/gitlab/-/issues/357930; https://hackerone.com/reports/1528829
CVE: CVE-2022-1460
Published: 2022-05-11
Description: An issue has been discovered in GitLab affecting all versions starting from 9.2 before 14.8.6, all versions starting from 14.9 before 14.9.4, all versions starting from 14.10 before 14.10.1. GitLab was not performing correct authorizations on scheduled pipelines allowing a malicious user to run a pipeline in the context of another user.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-863
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1460.json; https://gitlab.com/gitlab-org/gitlab/-/issues/118782; https://hackerone.com/reports/755078
CVE: CVE-2022-1510
Published: 2022-05-11
Description: An issue has been discovered in GitLab affecting all versions starting from 13.9 before 14.8.6, all versions starting from 14.9 before 14.9.4, all versions starting from 14.10 before 14.10.1. GitLab was not correctly handling malicious text in the CI Editor and CI Pipeline details page allowing the attacker to cause uncontrolled resource consumption.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-1333
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1510.json; https://gitlab.com/gitlab-org/gitlab/-/issues/343276; https://hackerone.com/reports/1353058
CVE: CVE-2022-1545
Published: 2022-05-11
Description: It was possible to disclose details of confidential notes created via the API in Gitlab CE/EE affecting all versions from 13.2 prior to 14.8.6, 14.9 prior to 14.9.4, and 14.10 prior to 14.10.1 if an unauthorised project member was tagged in the note.
CVSS Score: 4.3 (MEDIUM)
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1545.json; https://gitlab.com/gitlab-org/gitlab/-/issues/351030; https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1545.json
CVE: CVE-2022-1622
Published: 2022-05-11
Description: LibTIFF master branch has an out-of-bounds read in LZWDecode in libtiff/tif_lzw.c:619, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit b4e79bfa.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: http://seclists.org/fulldisclosure/2022/Oct/28; http://seclists.org/fulldisclosure/2022/Oct/39; http://seclists.org/fulldisclosure/2022/Oct/41
CVE: CVE-2022-1623
Published: 2022-05-11
Description: LibTIFF master branch has an out-of-bounds read in LZWDecode in libtiff/tif_lzw.c:624, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit b4e79bfa.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1623.json; https://gitlab.com/libtiff/libtiff/-/commit/b4e79bfa0c7d2d08f6f1e7ec38143fc8cb11394a; https://gitlab.com/libtiff/libtiff/-/issues/410
CVE: CVE-2022-27656
Published: 2022-05-11
Description: The Web administration UI of SAP Web Dispatcher and the Internet Communication Manager (ICM) does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://launchpad.support.sap.com/#/notes/3145046; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3145046
CVE: CVE-2022-28214
Published: 2022-05-11
Description: During an update of SAP BusinessObjects Enterprise, Central Management Server (CMS) - versions 420, 430, authentication credentials are being exposed in Sysmon event logs. This Information Disclosure could cause a high impact on systems’ Confidentiality, Integrity, and Availability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-312
References: https://launchpad.support.sap.com/#/notes/2998510; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/2998510
CVE: CVE-2022-28774
Published: 2022-05-11
Description: Under certain conditions, the SAP Host Agent logfile shows information which would otherwise be restricted.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-863, CWE-863
References: https://launchpad.support.sap.com/#/notes/3158188; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3158188
CVE: CVE-2022-29610
Published: 2022-05-11
Description: SAP NetWeaver Application Server ABAP allows an authenticated attacker to upload malicious files and delete (theme) data, which could result in Stored Cross-Site Scripting (XSS) attack.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://launchpad.support.sap.com/#/notes/3146336; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3146336
CVE: CVE-2022-29611
Published: 2022-05-11
Description: SAP NetWeaver Application Server for ABAP and ABAP Platform do not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.
CVSS Score: 8.8 (HIGH)
CWE: CWE-862
References: https://launchpad.support.sap.com/#/notes/3165801; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3165801
CVE: CVE-2022-29613
Published: 2022-05-11
Description: Due to insufficient input validation, SAP Employee Self Service allows an authenticated attacker with user privileges to alter employee number. On successful exploitation, the attacker can view personal details of other users causing a limited impact on confidentiality of the application.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: https://launchpad.support.sap.com/#/notes/3164677; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3164677
CVE: CVE-2022-29897
Published: 2022-05-11
Description: On various RAD-ISM-900-EN-* devices by PHOENIX CONTACT an admin user could use the traceroute utility integrated in the WebUI to execute arbitrary code with root privileges on the OS due to an improper input validation in all versions of the firmware.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-20
References: https://cert.vde.com/en/advisories/VDE-2022-018/; https://cert.vde.com/en/advisories/VDE-2022-018/
CVE: CVE-2022-29898
Published: 2022-05-11
Description: On various RAD-ISM-900-EN-* devices by PHOENIX CONTACT an admin user could use the configuration file uploader in the WebUI to execute arbitrary code with root privileges on the OS due to an improper validation of an integrity check value in all versions of the firmware.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-354
References: https://cert.vde.com/en/advisories/VDE-2022-018/; https://cert.vde.com/en/advisories/VDE-2022-018/
CVE: CVE-2021-38969
Published: 2022-05-11
Description: IBM Spectrum Virtualize 8.2, 8.3, and 8.4 could allow an attacker to allow unauthorized access due to the reuse of support generated credentials. IBM X-Force ID: 212609.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/212609; https://www.ibm.com/support/pages/node/6584337; https://exchange.xforce.ibmcloud.com/vulnerabilities/212609
CVE: CVE-2021-39059
Published: 2022-05-11
Description: IBM Jazz Foundation (IBM Jazz Team Server 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2) is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 214619.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/214619; https://www.ibm.com/support/pages/node/6584347; https://exchange.xforce.ibmcloud.com/vulnerabilities/214619
CVE: CVE-2021-3611
Published: 2022-05-11
Description: A stack overflow vulnerability was found in the Intel HD Audio device (intel-hda) of QEMU. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition. The highest threat from this vulnerability is to system availability. This flaw affects QEMU versions prior to 7.0.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119, CWE-787
References: https://bugzilla.redhat.com/show_bug.cgi?id=1973784; https://gitlab.com/qemu-project/qemu/-/issues/542; https://security.gentoo.org/glsa/202208-27
CVE: CVE-2021-43066
Published: 2022-05-11
Description: A external control of file name or path in Fortinet FortiClientWindows version 7.0.2 and below, version 6.4.6 and below, version 6.2.9 and below, version 6.0.10 and below allows attacker to escalate privilege via the MSI installer.
CVSS Score: 8.4 (HIGH)
CWE: CWE-668
References: https://fortiguard.com/advisory/FG-IR-21-154; https://fortiguard.com/advisory/FG-IR-21-154
CVE: CVE-2022-22320
Published: 2022-05-11
Description: IBM QRadar SIEM 7.3 and 7.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 218367.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/218367; https://www.ibm.com/support/pages/node/6584451; https://exchange.xforce.ibmcloud.com/vulnerabilities/218367
CVE: CVE-2022-22975
Published: 2022-05-11
Description: An issue was discovered in the Pinniped Supervisor with either LADPIdentityProvider or ActiveDirectoryIdentityProvider resources. An attack would involve the malicious user changing the common name (CN) of their user entry on the LDAP or AD server to include special characters, which could be used to perform LDAP query injection on the Supervisor's LDAP query which determines their Kubernetes group membership.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-74
References: https://github.com/vmware-tanzu/pinniped/security/advisories/GHSA-hvrf-5hhv-4348; https://github.com/vmware-tanzu/pinniped/security/advisories/GHSA-hvrf-5hhv-4348
CVE: CVE-2022-23137
Published: 2022-05-11
Description: ZTE's ZXCDN product has a reflective XSS vulnerability. The attacker could modify the parameters in the content clearing request url, and when a user clicks the url, an XSS attack will be triggered.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1024404; https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1024404
CVE: CVE-2022-23743
Published: 2022-05-11
Description: Check Point ZoneAlarm before version 15.8.200.19118 allows a local actor to escalate privileges during the upgrade process. In addition, weak permissions in the ProgramData\CheckPoint\ZoneAlarm\Data\Updates directory allow a local attacker the ability to execute an arbitrary file write, leading to execution of code as local system, in ZoneAlarm versions before v15.8.211.192119
CVSS Score: 7.8 (HIGH)
CWE: CWE-269, CWE-269, CWE-732
References: https://www.zonealarm.com/software/extreme-security/release-history; https://www.zonealarm.com/software/extreme-security/release-history
CVE: CVE-2022-29616
Published: 2022-05-11
Description: SAP Host Agent, SAP NetWeaver and ABAP Platform allow an attacker to leverage logical errors in memory management to cause a memory corruption.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://launchpad.support.sap.com/#/notes/3145702; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3145702
CVE: CVE-2021-26339
Published: 2022-05-11
Description: A bug in AMD CPU’s core logic may allow for an attacker, using specific code from an unprivileged VM, to trigger a CPU core hang resulting in a potential denial of service. AMD believes the specific code includes a specific x86 instruction sequence that would not be generated by compilers.
CVSS Score: 5.5 (MEDIUM)
References: https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1027; https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1028; https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1027
CVE: CVE-2021-26342
Published: 2022-05-11
Description: In SEV guest VMs, the CPU may fail to flush the Translation Lookaside Buffer (TLB) following a particular sequence of operations that includes creation of a new virtual machine control block (VMCB). The failure to flush the TLB may cause the microcode to use stale TLB translations which may allow for disclosure of SEV guest memory contents. Users of SEV-ES/SEV-SNP guest VMs are not impacted by this vulnerability.
CVSS Score: 3.3 (LOW)
References: https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1028; https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1028
CVE: CVE-2021-26347
Published: 2022-05-11
Description: Failure to validate the integer operand in ASP (AMD Secure Processor) bootloader may allow an attacker to introduce an integer overflow in the L2 directory table in SPI flash resulting in a potential denial of service.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-1284
References: https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-1031; https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-1031
CVE: CVE-2021-26348
Published: 2022-05-11
Description: Failure to flush the Translation Lookaside Buffer (TLB) of the I/O memory management unit (IOMMU) may lead an IO device to write to memory it should not be able to access, resulting in a potential loss of integrity.
CVSS Score: 5.5 (MEDIUM)
References: https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1028; https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1028
CVE: CVE-2021-26349
Published: 2022-05-11
Description: Failure to assign a new report ID to an imported guest may potentially result in an SEV-SNP guest VM being tricked into trusting a dishonest Migration Agent (MA).
CVSS Score: 5.5 (MEDIUM)
References: https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1028; https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1028
CVE: CVE-2021-26350
Published: 2022-05-11
Description: A TOCTOU race condition in SMU may allow for the caller to obtain and manipulate the address of a message port register which may result in a potential denial of service.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-367
References: https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1028; https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1028
CVE: CVE-2021-26364
Published: 2022-05-11
Description: Insufficient bounds checking in an SMU mailbox register could allow an attacker to potentially read outside of the SRAM address range which could result in an exception handling leading to a potential denial of service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119
References: https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1028; https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1028
CVE: CVE-2021-26372
Published: 2022-05-11
Description: Insufficient bound checks related to PCIE in the System Management Unit (SMU) may result in access to an invalid address space that could result in denial of service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119
References: https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1027; https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1028; https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1027
CVE: CVE-2021-26373
Published: 2022-05-11
Description: Insufficient bound checks in the System Management Unit (SMU) may result in a system voltage malfunction that could result in denial of resources and/or possibly denial of service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1027; https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1028; https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1027
CVE: CVE-2021-26375
Published: 2022-05-11
Description: Insufficient General Purpose IO (GPIO) bounds check in System Management Unit (SMU) may result in access/updates from/to invalid address space that could result in denial of service.
CVSS Score: 5.5 (MEDIUM)
References: https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1027; https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1028; https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1027
CVE: CVE-2021-26376
Published: 2022-05-11
Description: Insufficient checks in System Management Unit (SMU) FeatureConfig may result in reenabling features potentially resulting in denial of resources and/or denial of service.
CVSS Score: 5.5 (MEDIUM)
References: https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1027; https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1028; https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1027
CVE: CVE-2021-26378
Published: 2022-05-11
Description: Insufficient bound checks in the System Management Unit (SMU) may result in access to an invalid address space that could result in denial of service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119
References: https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1027; https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1028; https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1027
CVE: CVE-2021-26388
Published: 2022-05-11
Description: Improper validation of the BIOS directory may allow for searches to read beyond the directory table copy in RAM, exposing out of bounds memory contents, resulting in a potential denial of service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1027; https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1028; https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1027
CVE: CVE-2021-26400
Published: 2022-05-11
Description: AMD processors may speculatively re-order load instructions which can result in stale data being observed when multiple processors are operating on shared memory, resulting in potential data leakage.
CVSS Score: 4.0 (MEDIUM)
References: https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1035; https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1035
CVE: CVE-2021-30361
Published: 2022-05-11
Description: The Check Point Gaia Portal's GUI Clients allowed authenticated administrators with permission for the GUI Clients settings to inject a command that would run on the Gaia OS.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-78, CWE-78
References: https://supportcontent.checkpoint.com/solutions?id=sk179128; https://supportcontent.checkpoint.com/solutions?id=sk179128
CVE: CVE-2021-46744
Published: 2022-05-11
Description: An attacker with access to a malicious hypervisor may be able to infer data values used in a SEV guest on AMD CPUs by monitoring ciphertext values over time.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-203
References: http://www.openwall.com/lists/oss-security/2022/08/08/6; https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1033; http://www.openwall.com/lists/oss-security/2022/08/08/6
CVE: CVE-2022-0024
Published: 2022-05-11
Description: A vulnerability exists in Palo Alto Networks PAN-OS software that enables an authenticated network-based PAN-OS administrator to upload a specifically created configuration that disrupts system processes and potentially execute arbitrary code with root privileges when the configuration is committed on both hardware and virtual firewalls. This issue does not impact Panorama appliances or Prisma Access customers. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.23; PAN-OS 9.0 versions earlier than PAN-OS 9.0.16; PAN-OS 9.1 versions earlier than PAN-OS 9.1.13; PAN-OS 10.0 versions earlier than PAN-OS 10.0.10; PAN-OS 10.1 versions earlier than PAN-OS 10.1.5.
CVSS Score: 7.2 (HIGH)
CWE: CWE-138
References: https://security.paloaltonetworks.com/CVE-2022-0024; https://security.paloaltonetworks.com/CVE-2022-0024
CVE: CVE-2022-0025
Published: 2022-05-11
Description: A local privilege escalation (PE) vulnerability exists in Palo Alto Networks Cortex XDR agent software on Windows that enables an authenticated local user with file creation privilege in the Windows root directory (such as C:\) to execute a program with elevated privileges. This issue impacts: All versions of the Cortex XDR agent when upgrading to Cortex XDR agent 7.7.0 on Windows; Cortex XDR agent 7.7.0 without content update 500 or a later version on Windows. This issue does not impact other platforms or other versions of the Cortex XDR agent.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-427, CWE-427
References: https://security.paloaltonetworks.com/CVE-2022-0025; https://security.paloaltonetworks.com/CVE-2022-0025
CVE: CVE-2022-0026
Published: 2022-05-11
Description: A local privilege escalation (PE) vulnerability exists in Palo Alto Networks Cortex XDR agent software on Windows that enables an authenticated local user with file creation privilege in the Windows root directory (such as C:\) to execute a program with elevated privileges. This issue impacts all versions of Cortex XDR agent without content update 330 or a later content update version.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-282
References: https://security.paloaltonetworks.com/CVE-2022-0026; https://security.paloaltonetworks.com/CVE-2022-0026
CVE: CVE-2022-0027
Published: 2022-05-11
Description: An improper authorization vulnerability in Palo Alto Network Cortex XSOAR software enables authenticated users in non-Read-Only groups to generate an email report that contains summary information about all incidents in the Cortex XSOAR instance, including incidents to which the user does not have access. This issue impacts: All versions of Cortex XSOAR 6.1; All versions of Cortex XSOAR 6.2; All versions of Cortex XSOAR 6.5; Cortex XSOAR 6.6 versions earlier than Cortex XSOAR 6.6.0 build 6.6.0.2585049.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-285
References: https://security.paloaltonetworks.com/CVE-2022-0027; https://security.paloaltonetworks.com/CVE-2022-0027
CVE: CVE-2021-28290
Published: 2022-05-11
Description: A cross-site scripting (XSS) vulnerability in Skoruba IdentityServer4.Admin before 2.0.0 via unencoded value passed to the data-secret-value parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/skoruba/IdentityServer4.Admin/issues/813; https://github.com/skoruba/IdentityServer4.Admin/issues/813
CVE: CVE-2021-31330
Published: 2022-05-11
Description: A Cross-Site Scripting (XSS) vulnerability exists within Review Board versions 3.0.20 and 4.0 RC1 and earlier. An authenticated attacker may inject malicious Javascript code when using Markdown editing within the application which remains persistent.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://mattschmidt.net/2021/04/14/review-board-xss-discovered/; https://www.reviewboard.org/docs/releasenotes/reviewboard/3.0.21/; https://www.reviewboard.org/docs/releasenotes/reviewboard/4.0-rc-2/
CVE: CVE-2021-33315
Published: 2022-05-11
Description: The TRENDnet TI-PG1284i switch(hw v2.0R) prior to version 2.0.2.S0 suffers from an integer underflow vulnerability. This vulnerability exists in its lldp related component. Due to lack of proper validation on length field of PortID TLV, by sending a crafted lldp packet to the device, integer underflow would occur and the negative number will be passed to memcpy() later, which may cause buffer overflow or invalid memory access.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: https://www.trendnet.com/support/view.asp?cat=4&id=81; https://www.trendnet.com/support/view.asp?cat=4&id=81