deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-27133
Published: 2022-04-10
Description: zbzcms v1.0 was discovered to contain an arbitrary file deletion vulnerability via /include/up.php.
CVSS Score: 9.1 (CRITICAL)
References: https://github.com/wu610777031/My_CMSHunter/blob/main/zbzcms%20v1.0%20vulnerabilities.pdf; https://github.com/wu610777031/My_CMSHunter/blob/main/zbzcms%20v1.0%20vulnerabilities.pdf
CVE: CVE-2022-27268
Published: 2022-04-10
Description: InHand Networks InRouter 900 Industrial 4G Router before v1.0.0.r11700 was discovered to contain a remote code execution (RCE) vulnerability via the component get_cgi_from_memory. This vulnerability is triggered via a crafted packet.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://drive.google.com/drive/folders/1zJ2dGrKar-WTlYz13v1f0BIsoIm3aU0l?usp=sharing; https://github.com/wu610777031/IoT_Hunter/blob/main/Inhand%20InRouter%20900%20Industrial%204G%20Router%20%20Vulnerabilities%28RCE%29.pdf; https://drive.google.com/drive/folders/1zJ2dGrKar-WTlYz13v1f0BIsoIm3aU0l?usp=sharing
CVE: CVE-2022-27269
Published: 2022-04-10
Description: InHand Networks InRouter 900 Industrial 4G Router before v1.0.0.r11700 was discovered to contain a remote code execution (RCE) vulnerability via the component config_ovpn. This vulnerability is triggered via a crafted packet.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://drive.google.com/drive/folders/1zJ2dGrKar-WTlYz13v1f0BIsoIm3aU0l?usp=sharing; https://github.com/wu610777031/IoT_Hunter/blob/main/Inhand%20InRouter%20900%20Industrial%204G%20Router%20%20Vulnerabilities%28RCE%29.pdf; https://drive.google.com/drive/folders/1zJ2dGrKar-WTlYz13v1f0BIsoIm3aU0l?usp=sharing
CVE: CVE-2022-27270
Published: 2022-04-10
Description: InHand Networks InRouter 900 Industrial 4G Router before v1.0.0.r11700 was discovered to contain a remote code execution (RCE) vulnerability via the component ipsec_secrets. This vulnerability is triggered via a crafted packet.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://drive.google.com/drive/folders/1zJ2dGrKar-WTlYz13v1f0BIsoIm3aU0l?usp=sharing; https://github.com/wu610777031/IoT_Hunter/blob/main/Inhand%20InRouter%20900%20Industrial%204G%20Router%20%20Vulnerabilities%28RCE%29.pdf; https://drive.google.com/drive/folders/1zJ2dGrKar-WTlYz13v1f0BIsoIm3aU0l?usp=sharing
CVE: CVE-2022-27271
Published: 2022-04-10
Description: InHand Networks InRouter 900 Industrial 4G Router before v1.0.0.r11700 was discovered to contain a remote code execution (RCE) vulnerability via the component python-lib. This vulnerability is triggered via a crafted packet.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://drive.google.com/drive/folders/1zJ2dGrKar-WTlYz13v1f0BIsoIm3aU0l?usp=sharing; https://github.com/wu610777031/IoT_Hunter/blob/main/Inhand%20InRouter%20900%20Industrial%204G%20Router%20%20Vulnerabilities%28RCE%29.pdf; https://drive.google.com/drive/folders/1zJ2dGrKar-WTlYz13v1f0BIsoIm3aU0l?usp=sharing
CVE: CVE-2022-27272
Published: 2022-04-10
Description: InHand Networks InRouter 900 Industrial 4G Router before v1.0.0.r11700 was discovered to contain a remote code execution (RCE) vulnerability via the function sub_1791C. This vulnerability is triggered via a crafted packet.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://drive.google.com/drive/folders/1zJ2dGrKar-WTlYz13v1f0BIsoIm3aU0l?usp=sharing; https://github.com/wu610777031/IoT_Hunter/blob/main/Inhand%20InRouter%20900%20Industrial%204G%20Router%20%20Vulnerabilities%28RCE%29.pdf; https://drive.google.com/drive/folders/1zJ2dGrKar-WTlYz13v1f0BIsoIm3aU0l?usp=sharing
CVE: CVE-2022-27273
Published: 2022-04-10
Description: InHand Networks InRouter 900 Industrial 4G Router before v1.0.0.r11700 was discovered to contain a remote code execution (RCE) vulnerability via the function sub_12168. This vulnerability is triggered via a crafted packet.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://drive.google.com/drive/folders/1zJ2dGrKar-WTlYz13v1f0BIsoIm3aU0l?usp=sharing; https://github.com/wu610777031/IoT_Hunter/blob/main/Inhand%20InRouter%20900%20Industrial%204G%20Router%20%20Vulnerabilities%28RCE%29.pdf; https://drive.google.com/drive/folders/1zJ2dGrKar-WTlYz13v1f0BIsoIm3aU0l?usp=sharing
CVE: CVE-2022-27274
Published: 2022-04-10
Description: InHand Networks InRouter 900 Industrial 4G Router before v1.0.0.r11700 was discovered to contain a remote code execution (RCE) vulnerability via the function sub_12028. This vulnerability is triggered via a crafted packet.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://drive.google.com/drive/folders/1zJ2dGrKar-WTlYz13v1f0BIsoIm3aU0l?usp=sharing; https://github.com/wu610777031/IoT_Hunter/blob/main/Inhand%20InRouter%20900%20Industrial%204G%20Router%20%20Vulnerabilities%28RCE%29.pdf; https://drive.google.com/drive/folders/1zJ2dGrKar-WTlYz13v1f0BIsoIm3aU0l?usp=sharing
CVE: CVE-2022-27275
Published: 2022-04-10
Description: InHand Networks InRouter 900 Industrial 4G Router before v1.0.0.r11700 was discovered to contain a remote code execution (RCE) vulnerability via the function sub_122D0. This vulnerability is triggered via a crafted packet.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://drive.google.com/drive/folders/1zJ2dGrKar-WTlYz13v1f0BIsoIm3aU0l?usp=sharing; https://github.com/wu610777031/IoT_Hunter/blob/main/Inhand%20InRouter%20900%20Industrial%204G%20Router%20%20Vulnerabilities%28RCE%29.pdf; https://drive.google.com/drive/folders/1zJ2dGrKar-WTlYz13v1f0BIsoIm3aU0l?usp=sharing
CVE: CVE-2022-27276
Published: 2022-04-10
Description: InHand Networks InRouter 900 Industrial 4G Router before v1.0.0.r11700 was discovered to contain a remote code execution (RCE) vulnerability via the function sub_10F2C. This vulnerability is triggered via a crafted packet.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://drive.google.com/drive/folders/1zJ2dGrKar-WTlYz13v1f0BIsoIm3aU0l?usp=sharing; https://github.com/wu610777031/IoT_Hunter/blob/main/Inhand%20InRouter%20900%20Industrial%204G%20Router%20%20Vulnerabilities%28RCE%29.pdf; https://drive.google.com/drive/folders/1zJ2dGrKar-WTlYz13v1f0BIsoIm3aU0l?usp=sharing
CVE: CVE-2022-27277
Published: 2022-04-10
Description: InHand Networks InRouter 900 Industrial 4G Router before v1.0.0.r11700 was discovered to contain an arbitrary file deletion vulnerability via the function sub_17C08.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-22
References: https://drive.google.com/drive/folders/1MPtl6pGa7GMIT1-jg69YUGSQdVTfbnay?usp=sharing; https://github.com/wu610777031/IoT_Hunter/blob/main/Inhand%20InRouter%20900%20Industrial%204G%20Router%20%20Vulnerabilities%28Arbitrary%20File%20Deletion%20and%20Read%29.pdf; https://drive.google.com/drive/folders/1MPtl6pGa7GMIT1-jg69YUGSQdVTfbnay?usp=sharing
CVE: CVE-2022-27279
Published: 2022-04-10
Description: InHand Networks InRouter 900 Industrial 4G Router before v1.0.0.r11700 was discovered to contain an arbitrary file read via the function sub_177E0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://drive.google.com/drive/folders/1MPtl6pGa7GMIT1-jg69YUGSQdVTfbnay?usp=sharing; https://github.com/wu610777031/IoT_Hunter/blob/main/Inhand%20InRouter%20900%20Industrial%204G%20Router%20%20Vulnerabilities%28Arbitrary%20File%20Deletion%20and%20Read%29.pdf; https://drive.google.com/drive/folders/1MPtl6pGa7GMIT1-jg69YUGSQdVTfbnay?usp=sharing
CVE: CVE-2022-27280
Published: 2022-04-10
Description: InHand Networks InRouter 900 Industrial 4G Router before v1.0.0.r11700 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the web_exec parameter at /apply.cgi.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/wu610777031/IoT_Hunter/blob/main/Inhand%20InRouter%20900%20Industrial%204G%20Router%20%20Vulnerabilities%28XSS%29.pdf; https://github.com/wu610777031/IoT_Hunter/blob/main/Inhand%20InRouter%20900%20Industrial%204G%20Router%20%20Vulnerabilities%28XSS%29.pdf
CVE: CVE-2022-27286
Published: 2022-04-10
Description: D-Link DIR-619 Ax v1.00 was discovered to contain a stack overflow in the function formSetWanNonLogin. This vulnerability allows attackers to cause a Denial of Service (DoS) via the curTime parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://github.com/wu610777031/IoT_Hunter/blob/main/DIR-619%20Buffer%20Overflow.pdf; https://www.dlink.com/en/security-bulletin/; https://github.com/wu610777031/IoT_Hunter/blob/main/DIR-619%20Buffer%20Overflow.pdf
CVE: CVE-2022-27287
Published: 2022-04-10
Description: D-Link DIR-619 Ax v1.00 was discovered to contain a stack overflow in the function formSetWanPPPoE. This vulnerability allows attackers to cause a Denial of Service (DoS) via the curTime parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://github.com/wu610777031/IoT_Hunter/blob/main/DIR-619%20Buffer%20Overflow.pdf; https://www.dlink.com/en/security-bulletin/; https://github.com/wu610777031/IoT_Hunter/blob/main/DIR-619%20Buffer%20Overflow.pdf
CVE: CVE-2022-27288
Published: 2022-04-10
Description: D-Link DIR-619 Ax v1.00 was discovered to contain a stack overflow in the function formSetWanPPTP. This vulnerability allows attackers to cause a Denial of Service (DoS) via the curTime parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://github.com/wu610777031/IoT_Hunter/blob/main/DIR-619%20Buffer%20Overflow.pdf; https://www.dlink.com/en/security-bulletin/; https://github.com/wu610777031/IoT_Hunter/blob/main/DIR-619%20Buffer%20Overflow.pdf
CVE: CVE-2022-27289
Published: 2022-04-10
Description: D-Link DIR-619 Ax v1.00 was discovered to contain a stack overflow in the function formSetWanL2TP. This vulnerability allows attackers to cause a Denial of Service (DoS) via the curTime parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://github.com/wu610777031/IoT_Hunter/blob/main/DIR-619%20Buffer%20Overflow.pdf; https://www.dlink.com/en/security-bulletin/; https://github.com/wu610777031/IoT_Hunter/blob/main/DIR-619%20Buffer%20Overflow.pdf
CVE: CVE-2022-27290
Published: 2022-04-10
Description: D-Link DIR-619 Ax v1.00 was discovered to contain a stack overflow in the function formSetWanDhcpplus. This vulnerability allows attackers to cause a Denial of Service (DoS) via the curTime parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://github.com/wu610777031/IoT_Hunter/blob/main/DIR-619%20Buffer%20Overflow.pdf; https://www.dlink.com/en/security-bulletin/; https://github.com/wu610777031/IoT_Hunter/blob/main/DIR-619%20Buffer%20Overflow.pdf
CVE: CVE-2022-27291
Published: 2022-04-10
Description: D-Link DIR-619 Ax v1.00 was discovered to contain a stack overflow in the function formdumpeasysetup. This vulnerability allows attackers to cause a Denial of Service (DoS) via the config.save_network_enabled parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://github.com/wu610777031/IoT_Hunter/blob/main/DIR-619%20Buffer%20Overflow.pdf; https://www.dlink.com/en/security-bulletin/; https://github.com/wu610777031/IoT_Hunter/blob/main/DIR-619%20Buffer%20Overflow.pdf
CVE: CVE-2022-27292
Published: 2022-04-10
Description: D-Link DIR-619 Ax v1.00 was discovered to contain a stack overflow in the function formLanguageChange. This vulnerability allows attackers to cause a Denial of Service (DoS) via the nextPage parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=dir-619; https://www.dlink.com/en/security-bulletin/; https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=dir-619
CVE: CVE-2022-27293
Published: 2022-04-10
Description: D-Link DIR-619 Ax v1.00 was discovered to contain a stack overflow in the function formWlanSetup. This vulnerability allows attackers to cause a Denial of Service (DoS) via the webpage parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://github.com/wu610777031/IoT_Hunter/blob/main/DIR-619%20Buffer%20Overflow.pdf; https://www.dlink.com/en/security-bulletin/; https://github.com/wu610777031/IoT_Hunter/blob/main/DIR-619%20Buffer%20Overflow.pdf
CVE: CVE-2022-27294
Published: 2022-04-10
Description: D-Link DIR-619 Ax v1.00 was discovered to contain a stack overflow in the function formWlanWizardSetup. This vulnerability allows attackers to cause a Denial of Service (DoS) via the webpage parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://github.com/wu610777031/IoT_Hunter/blob/main/DIR-619%20Buffer%20Overflow.pdf; https://www.dlink.com/en/security-bulletin/; https://github.com/wu610777031/IoT_Hunter/blob/main/DIR-619%20Buffer%20Overflow.pdf
CVE: CVE-2022-27295
Published: 2022-04-10
Description: D-Link DIR-619 Ax v1.00 was discovered to contain a stack overflow in the function formAdvanceSetup. This vulnerability allows attackers to cause a Denial of Service (DoS) via the webpage parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://github.com/wu610777031/IoT_Hunter/blob/main/DIR-619%20Buffer%20Overflow.pdf; https://www.dlink.com/en/security-bulletin/; https://github.com/wu610777031/IoT_Hunter/blob/main/DIR-619%20Buffer%20Overflow.pdf
CVE: CVE-2022-27476
Published: 2022-04-10
Description: A cross-site scripting (XSS) vulnerability at /admin/goods/update in Newbee-Mall v1.0.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the goodsName parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/newbee-ltd/newbee-mall/issues/64; https://github.com/newbee-ltd/newbee-mall/issues/64
CVE: CVE-2022-27477
Published: 2022-04-10
Description: Newbee-Mall v1.0.0 was discovered to contain an arbitrary file upload via the Upload function at /admin/goods/edit.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://github.com/newbee-ltd/newbee-mall/issues/63; https://github.com/newbee-ltd/newbee-mall/issues/63
CVE: CVE-2022-27958
Published: 2022-04-10
Description: Insecure permissions configured in the userid parameter at /user/getuserprofile of FEBS-Security v1.0 allows attackers to access and arbitrarily modify users' personal information.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-276
References: https://github.com/afeng2016-s/CVE-Request/blob/main/febs-security/febs.md; https://github.com/afeng2016-s/CVE-Request/blob/main/febs-security/febs.md
CVE: CVE-2022-27960
Published: 2022-04-10
Description: Insecure permissions configured in the user_id parameter at SysUserController.java of OFCMS v1.1.4 allows attackers to access and arbitrarily modify users' personal information.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-276
References: https://gitee.com/oufu/ofcms/issues/I4Z8SS; https://gitee.com/oufu/ofcms/issues/I4Z8SS
CVE: CVE-2022-27961
Published: 2022-04-10
Description: A cross-site scripting (XSS) vulnerability at /ofcms/company-c-47 in OFCMS v1.1.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Comment text box.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://gitee.com/oufu/ofcms/issues/I4Z8QU; https://gitee.com/oufu/ofcms/issues/I4Z8QU
CVE: CVE-2022-28893
Published: 2022-04-11
Description: The SUNRPC subsystem in the Linux kernel through 5.17.2 can call xs_xprt_free before ensuring that sockets are in the intended state.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: http://www.openwall.com/lists/oss-security/2022/04/11/3; http://www.openwall.com/lists/oss-security/2022/04/11/4; http://www.openwall.com/lists/oss-security/2022/04/11/5
CVE: CVE-2021-32156
Published: 2022-04-11
Description: A cross-site request forgery (CSRF) vulnerability exists in Webmin 1.973 via the Scheduled Cron Jobs feature.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/Mesh3l911/CVE-2021-32156; https://github.com/Mesh3l911/CVE-2021-32156
CVE: CVE-2021-32157
Published: 2022-04-11
Description: A Cross-Site Scripting (XSS) vulnerability exists in Webmin 1.973 via the Scheduled Cron Jobs feature.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-79
References: https://github.com/Mesh3l911/CVE-2021-32157; https://github.com/Mesh3l911/CVE-2021-32157
CVE: CVE-2021-32158
Published: 2022-04-11
Description: A Cross-Site Scripting (XSS) vulnerability exists in Webmin 1.973 via the Upload and Download feature.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/Mesh3l911/CVE-2021-32158; https://github.com/Mesh3l911/CVE-2021-32158
CVE: CVE-2021-32159
Published: 2022-04-11
Description: A Cross-site request forgery (CSRF) vulnerability exists in Webmin 1.973 via the Upload and Download feature.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/Mesh3l911/CVE-2021-32159; https://github.com/Mesh3l911/CVE-2021-32159
CVE: CVE-2021-32160
Published: 2022-04-11
Description: A Cross-Site Scripting (XSS) vulnerability exists in Webmin 1.973 through the Add Users feature.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/Mesh3l911/CVE-2021-32160; https://github.com/Mesh3l911/CVE-2021-32160
CVE: CVE-2021-32161
Published: 2022-04-11
Description: A Cross-Site Scripting (XSS) vulnerability exists in Webmin 1.973 through the File Manager feature.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/Mesh3l911/CVE-2021-32161; https://github.com/Mesh3l911/CVE-2021-32161
CVE: CVE-2021-32162
Published: 2022-04-11
Description: A Cross-site request forgery (CSRF) vulnerability exists in Webmin 1.973 through the File Manager feature.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/Mesh3l911/CVE-2021-32162; https://github.com/Mesh3l911/CVE-2021-32162
CVE: CVE-2022-0936
Published: 2022-04-11
Description: Cross-site Scripting (XSS) - Stored in GitHub repository autolab/autolab prior to 2.8.0.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/autolab/autolab/commit/02d76ab3737689bba95ffe9a1c69ca5166d71c6b; https://huntr.dev/bounties/90701766-bfed-409e-b3dd-6ff884373968; https://github.com/autolab/autolab/commit/02d76ab3737689bba95ffe9a1c69ca5166d71c6b
CVE: CVE-2022-1045
Published: 2022-04-11
Description: Stored XSS viva .svg file upload in GitHub repository polonel/trudesk prior to v1.2.0.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-434
References: https://github.com/polonel/trudesk/commit/c4b262c2613d4a8865de0b[PII_REDACTED]bd81997a; https://huntr.dev/bounties/b0c4f992-4ac8-4479-82f4-367ed1a2a826; https://github.com/polonel/trudesk/commit/c4b262c2613d4a8865de0b[PII_REDACTED]bd81997a
CVE: CVE-2022-1252
Published: 2022-04-11
Description: Use of a Broken or Risky Cryptographic Algorithm in GitHub repository gnuboard/gnuboard5 prior to and including 5.5.5. A vulnerability in gnuboard v5.5.5 and below uses weak encryption algorithms leading to sensitive information exposure. This allows an attacker to derive the email address of any user, including when the 'Let others see my information.' box is ticked off. Or to send emails to any email address, with full control of its contents
CVSS Score: 8.2 (HIGH)
CWE: CWE-327, CWE-327
References: https://0g.vc/posts/insecure-cipher-gnuboard5/; https://huntr.dev/bounties/c8c2c3e1-67d0-4a11-a4d4-11af567a9ebb; https://0g.vc/posts/insecure-cipher-gnuboard5/
CVE: CVE-2022-0556
Published: 2022-04-11
Description: A local privilege escalation vulnerability caused by incorrect permission assignment in some directories of the Zyxel AP Configurator (ZAC) version 1.1.4, which could allow an attacker to execute arbitrary code as a local administrator.
CVSS Score: 7.3 (HIGH)
CWE: CWE-269, CWE-732
References: https://www.zyxel.com/support/Zyxel-security-advisory-for-local-privilege-escalation-vulnerability-of-AP-Configurator.shtml; https://www.zyxel.com/support/Zyxel-security-advisory-for-local-privilege-escalation-vulnerability-of-AP-Configurator.shtml
CVE: CVE-2022-1295
Published: 2022-04-11
Description: Prototype Pollution in GitHub repository alvarotrigo/fullpage.js prior to 4.0.2.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1321
References: https://github.com/alvarotrigo/fullpage.js/commit/bf62492a22e5d296e63c3ed918a42fc5645a0d48; https://huntr.dev/bounties/3b9d450c-24ac-4037-b04d-4d4dafbf593a; https://github.com/alvarotrigo/fullpage.js/commit/bf62492a22e5d296e63c3ed918a42fc5645a0d48
CVE: CVE-2022-1296
Published: 2022-04-11
Description: Out-of-bounds read in `r_bin_ne_get_relocs` function in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability may allow attackers to read sensitive information or cause a crash.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-125
References: https://github.com/radareorg/radare2/commit/153bcdc29f11cd8c90e7d639a7405450f644ddb6; https://huntr.dev/bounties/52b57274-0e1a-4d61-ab29-1373b555fea0; https://github.com/radareorg/radare2/commit/153bcdc29f11cd8c90e7d639a7405450f644ddb6
CVE: CVE-2022-1297
Published: 2022-04-11
Description: Out-of-bounds Read in r_bin_ne_get_entrypoints function in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability may allow attackers to read sensitive information or cause a crash.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-125
References: https://github.com/radareorg/radare2/commit/0a557045476a2969c7079aec9eeb29d02f2809c6; https://huntr.dev/bounties/ec538fa4-06c6-4050-a141-f60153ddeaac; https://github.com/radareorg/radare2/commit/0a557045476a2969c7079aec9eeb29d02f2809c6
CVE: CVE-2022-26413
Published: 2022-04-11
Description: A command injection vulnerability in the CGI program of Zyxel VMG3312-T20A firmware version 5.30(ABFX.5)C0 could allow a local authenticated attacker to execute arbitrary OS commands on a vulnerable device via a LAN interface.
CVSS Score: 8.0 (HIGH)
CWE: CWE-78, CWE-78
References: https://www.zyxel.com/support/OS-command-injection-and-buffer-overflow-vulnerabilities-of-CPE-and-ONTs.shtml; https://www.zyxel.com/support/OS-command-injection-and-buffer-overflow-vulnerabilities-of-CPE-and-ONTs.shtml
CVE: CVE-2022-26414
Published: 2022-04-11
Description: A potential buffer overflow vulnerability was identified in some internal functions of Zyxel VMG3312-T20A firmware version 5.30(ABFX.5)C0, which could be exploited by a local authenticated attacker to cause a denial of service.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-120, CWE-120
References: https://www.zyxel.com/support/OS-command-injection-and-buffer-overflow-vulnerabilities-of-CPE-and-ONTs.shtml; https://www.zyxel.com/support/OS-command-injection-and-buffer-overflow-vulnerabilities-of-CPE-and-ONTs.shtml
CVE: CVE-2022-27041
Published: 2022-04-11
Description: Due to lack of protection, parameter student_id in OpenSIS Classic 8.0 /modules/eligibility/Student.php can be used to inject SQL queries to extract information from databases.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://github.com/OS4ED/openSIS-Classic/issues/248; https://github.com/OS4ED/openSIS-Classic/issues/248
CVE: CVE-2022-27088
Published: 2022-04-11
Description: Ivanti DSM Remote <= 6.3.1.1862 is vulnerable to an unquoted service path allowing local users to launch processes with elevated privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-428
References: https://hansesecure.de/2022/03/schwachstelle-in-dsm-remote/; https://hansesecure.de/2022/03/schwachstelle-in-dsm-remote/
CVE: CVE-2022-27089
Published: 2022-04-11
Description: In Fujitsu PlugFree Network <= 7.3.0.3, an Unquoted service path in PFNService.exe software allows a local attacker to potentially escalate privileges to system level.
CVSS Score: 7.8 (HIGH)
CWE: CWE-428
References: https://hansesecure.de/2022/03/schwachstelle-in-fujitsu-plugfree-network/; https://hansesecure.de/2022/03/schwachstelle-in-fujitsu-plugfree-network/
CVE: CVE-2021-24986
Published: 2022-04-11
Description: The Post Grid WordPress plugin before 2.1.16 does not escape the keyword parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting in pages containing a Post Grid with a search form
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/51e57f25-b8b2-44ca-9162-d7328eac64eb; https://wpscan.com/vulnerability/51e57f25-b8b2-44ca-9162-d7328eac64eb