deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-31062
Published: 2022-06-20
Description: ### Impact A plugin public script can be used to read content of system files. ### Patches Upgrade to version 1.0.2. ### Workarounds `b/deploy/index.php` file can be deleted if deploy feature is not used.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: http://packetstormsecurity.com/files/171654/GLPI-Glpiinventory-1.0.1-Local-File-Inclusion.html; https://github.com/glpi-project/glpi-inventory-plugin/security/advisories/GHSA-q33f-jcjf-p4v9; http://packetstormsecurity.com/files/171654/GLPI-Glpiinventory-1.0.1-Local-File-Inclusion.html
CVE: CVE-2017-20067
Published: 2022-06-21
Description: A vulnerability was found in Hindu Matrimonial Script. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin/. The manipulation of the argument username/password with the input 'or''=' leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89, CWE-89
References: https://vuldb.com/?id.95407; https://www.exploit-db.com/exploits/41044/; https://vuldb.com/?id.95407
CVE: CVE-2017-20068
Published: 2022-06-21
Description: A vulnerability was found in Hindu Matrimonial Script. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/usermanagement.php. The manipulation leads to improper privilege management. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-269, CWE-269
References: https://vuldb.com/?id.95408; https://www.exploit-db.com/exploits/41044/; https://vuldb.com/?id.95408
CVE: CVE-2017-20069
Published: 2022-06-21
Description: A vulnerability classified as critical has been found in Hindu Matrimonial Script. This affects an unknown part of the file /admin/countrymanagement.php. The manipulation leads to improper privilege management. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-269, CWE-269
References: https://vuldb.com/?id.95409; https://www.exploit-db.com/exploits/41044/; https://vuldb.com/?id.95409
CVE: CVE-2017-20070
Published: 2022-06-21
Description: A vulnerability classified as critical was found in Hindu Matrimonial Script. This vulnerability affects unknown code of the file /admin/communitymanagement.php. The manipulation leads to improper privilege management. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-269, CWE-269
References: https://vuldb.com/?id.95410; https://www.exploit-db.com/exploits/41044/; https://vuldb.com/?id.95410
CVE: CVE-2017-20071
Published: 2022-06-21
Description: A vulnerability, which was classified as critical, has been found in Hindu Matrimonial Script. This issue affects some unknown processing of the file /admin/renewaldue.php. The manipulation leads to improper privilege management. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-269, CWE-269
References: https://vuldb.com/?id.95411; https://www.exploit-db.com/exploits/41044/; https://vuldb.com/?id.95411
CVE: CVE-2017-20072
Published: 2022-06-21
Description: A vulnerability, which was classified as critical, was found in Hindu Matrimonial Script. Affected is an unknown function of the file /admin/generalsettings.php. The manipulation leads to improper privilege management. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-269, CWE-269
References: https://vuldb.com/?id.95412; https://www.exploit-db.com/exploits/41044/; https://vuldb.com/?id.95412
CVE: CVE-2017-20073
Published: 2022-06-21
Description: A vulnerability has been found in Hindu Matrimonial Script and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/cms.php. The manipulation leads to improper privilege management. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-269, CWE-269
References: https://vuldb.com/?id.95413; https://www.exploit-db.com/exploits/41044/; https://vuldb.com/?id.95413
CVE: CVE-2017-20074
Published: 2022-06-21
Description: A vulnerability was found in Hindu Matrimonial Script and classified as critical. Affected by this issue is some unknown functionality of the file /admin/newsletter1.php. The manipulation leads to improper privilege management. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-269, CWE-269
References: https://vuldb.com/?id.95414; https://www.exploit-db.com/exploits/41044/; https://vuldb.com/?id.95414
CVE: CVE-2017-20075
Published: 2022-06-21
Description: A vulnerability was found in Hindu Matrimonial Script. It has been classified as critical. This affects an unknown part of the file /admin/payment.php. The manipulation leads to improper privilege management. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-269, CWE-269
References: https://vuldb.com/?id.95415; https://www.exploit-db.com/exploits/41044/; https://vuldb.com/?id.95415
CVE: CVE-2017-20076
Published: 2022-06-21
Description: A vulnerability was found in Hindu Matrimonial Script. It has been declared as critical. This vulnerability affects unknown code of the file /admin/searchview.php. The manipulation leads to improper privilege management. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-269, CWE-269
References: https://vuldb.com/?id.95416; https://www.exploit-db.com/exploits/41044/; https://vuldb.com/?id.95416
CVE: CVE-2017-20077
Published: 2022-06-21
Description: A vulnerability was found in Hindu Matrimonial Script. It has been rated as critical. This issue affects some unknown processing of the file /admin/success_story.php. The manipulation leads to improper privilege management. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-269, CWE-269
References: https://vuldb.com/?id.95417; https://www.exploit-db.com/exploits/41044/; https://vuldb.com/?id.95417
CVE: CVE-2017-20078
Published: 2022-06-21
Description: A vulnerability classified as critical has been found in Hindu Matrimonial Script. Affected is an unknown function of the file /admin/featured.php. The manipulation leads to improper privilege management. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-269, CWE-269
References: https://vuldb.com/?id.95418; https://www.exploit-db.com/exploits/41044/; https://vuldb.com/?id.95418
CVE: CVE-2017-20079
Published: 2022-06-21
Description: A vulnerability classified as critical was found in Hindu Matrimonial Script. Affected by this vulnerability is an unknown functionality of the file /admin/photo.php. The manipulation leads to improper privilege management. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-269, CWE-269
References: https://vuldb.com/?id.95419; https://www.exploit-db.com/exploits/41044/; https://vuldb.com/?id.95419
CVE: CVE-2017-20080
Published: 2022-06-21
Description: A vulnerability, which was classified as critical, has been found in Hindu Matrimonial Script. Affected by this issue is some unknown functionality of the file /admin/googleads.php. The manipulation leads to improper privilege management. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-269, CWE-269
References: https://vuldb.com/?id.95420; https://www.exploit-db.com/exploits/41044/; https://vuldb.com/?id.95420
CVE: CVE-2017-20081
Published: 2022-06-21
Description: A vulnerability, which was classified as critical, was found in Hindu Matrimonial Script. This affects an unknown part of the file /admin/reports.php. The manipulation leads to improper privilege management. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-269, CWE-269
References: https://vuldb.com/?id.95421; https://www.exploit-db.com/exploits/41044/; https://vuldb.com/?id.95421
CVE: CVE-2022-23072
Published: 2022-06-21
Description: In Recipes, versions 1.0.5 through 1.2.5 are vulnerable to Stored Cross-Site Scripting (XSS), in “Add to Cart” functionality. When a victim accesses the food list page, then adds a new Food with a malicious javascript payload in the ‘Name’ parameter and clicks on the Add to Shopping Cart icon, an XSS payload will trigger. A low privileged attacker will have the victim's API key and can lead to admin's account takeover.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/TandoorRecipes/recipes/commit/7b2117c0190d4f541ba4cc7ee4122f04738c4ac6; https://www.mend.io/vulnerability-database/CVE-2022-23072; https://github.com/TandoorRecipes/recipes/commit/7b2117c0190d4f541ba4cc7ee4122f04738c4ac6
CVE: CVE-2022-31800
Published: 2022-06-21
Description: An unauthenticated, remote attacker could upload malicious logic to devices based on ProConOS/ProConOS eCLR in order to gain full control over the device.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-345
References: https://cert.vde.com/en/advisories/VDE-2022-025/; https://cert.vde.com/en/advisories/VDE-2022-025/
CVE: CVE-2022-31801
Published: 2022-06-21
Description: An unauthenticated, remote attacker could upload malicious logic to the devices based on ProConOS/ProConOS eCLR in order to gain full control over the device.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-345
References: https://cert.vde.com/en/advisories/VDE-2022-026/; https://cert.vde.com/en/advisories/VDE-2022-026/
CVE: CVE-2022-23073
Published: 2022-06-21
Description: In Recipes, versions 1.0.5 through 1.2.5 are vulnerable to Stored Cross-Site Scripting (XSS), in copy to clipboard functionality. When a victim accesses the food list page, then adds a new Food with a malicious javascript payload in the ‘Name’ parameter and clicks on the clipboard icon, an XSS payload will trigger. A low privileged attacker will have the victim's API key and can lead to admin's account takeover.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-79
References: https://github.com/TandoorRecipes/recipes/commit/7b2117c0190d4f541ba4cc7ee4122f04738c4ac6; https://www.mend.io/vulnerability-database/CVE-2022-23073; https://github.com/TandoorRecipes/recipes/commit/7b2117c0190d4f541ba4cc7ee4122f04738c4ac6
CVE: CVE-2022-23074
Published: 2022-06-21
Description: In Recipes, versions 0.17.0 through 1.2.5 are vulnerable to Stored Cross-Site Scripting (XSS), in the ‘Name’ field of Keyword, Food and Unit components. When a victim accesses the Keyword/Food/Unit endpoints, the XSS payload will trigger. A low privileged attacker will have the victim's API key and can lead to admin's account takeover.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/TandoorRecipes/recipes/commit/7b2117c0190d4f541ba4cc7ee4122f04738c4ac6; https://www.mend.io/vulnerability-database/CVE-2022-23074; https://github.com/TandoorRecipes/recipes/commit/7b2117c0190d4f541ba4cc7ee4122f04738c4ac6
CVE: CVE-2022-31302
Published: 2022-06-21
Description: maccms8 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Server Group text field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/maccmspro/maccms8/issues/1; https://github.com/maccmspro/maccms8/issues/1
CVE: CVE-2022-31303
Published: 2022-06-21
Description: maccms10 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Server Group text field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/maccmspro/maccms10/issues/20; https://github.com/maccmspro/maccms10/issues/20
CVE: CVE-2022-31306
Published: 2022-06-21
Description: Nginx NJS v0.7.2 was discovered to contain a segmentation violation in the function njs_array_convert_to_slow_array at src/njs_array.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416
References: https://github.com/nginx/njs/commit/81af26364c21c196dd21fb5e14c7fa9ce7debd17; https://github.com/nginx/njs/issues/481; https://github.com/nginx/njs/commit/81af26364c21c196dd21fb5e14c7fa9ce7debd17
CVE: CVE-2022-31307
Published: 2022-06-21
Description: Nginx NJS v0.7.2 was discovered to contain a segmentation violation in the function njs_string_offset at src/njs_string.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416
References: https://github.com/nginx/njs/commit/eafe4c7a326b163612f[PII_REDACTED]b5da5b1792; https://github.com/nginx/njs/issues/482; https://github.com/nginx/njs/commit/eafe4c7a326b163612f[PII_REDACTED]b5da5b1792
CVE: CVE-2022-31373
Published: 2022-06-21
Description: SolarView Compact v6.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component Solar_AiConf.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/badboycxcc/SolarView_Compact_6.0_xss; https://github.com/badboycxcc/SolarView_Compact_6.0_xss
CVE: CVE-2022-31374
Published: 2022-06-21
Description: An arbitrary file upload vulnerability /images/background/1.php in of SolarView Compact 6.0 allows attackers to execute arbitrary code via a crafted php file.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://github.com/badboycxcc/SolarView_Compact_6.0_upload; https://github.com/badboycxcc/SolarView_Compact_6.0_upload
CVE: CVE-2022-32414
Published: 2022-06-21
Description: Nginx NJS v0.7.2 was discovered to contain a segmentation violation in the function njs_vmcode_interpreter at src/njs_vmcode.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416
References: https://github.com/nginx/njs/commit/31ed93a5623f24ca94e6d47e895ba735d9d97d46; https://github.com/nginx/njs/issues/483; https://github.com/nginx/njs/commit/31ed93a5623f24ca94e6d47e895ba735d9d97d46
CVE: CVE-2022-33119
Published: 2022-06-21
Description: NUUO Network Video Recorder NVRsolo v03.06.02 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via login.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/badboycxcc/nuuo-xss/blob/main/README.md; https://github.com/badboycxcc/nuuo-xss/blob/main/README.md
CVE: CVE-2022-33139
Published: 2022-06-21
Description: A vulnerability has been identified in Cerberus DMS (All versions), Desigo CC (All versions), Desigo CC Compact (All versions), SIMATIC WinCC OA V3.16 (All versions in default configuration), SIMATIC WinCC OA V3.17 (All versions in non-default configuration), SIMATIC WinCC OA V3.18 (All versions in non-default configuration). Affected applications use client-side only authentication, when neither server-side authentication (SSA) nor Kerberos authentication is enabled. In this configuration, attackers could impersonate other users or exploit the client-server protocol without being authenticated.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-603, CWE-287
References: https://cert-portal.siemens.com/productcert/pdf/ssa-111512.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-836027.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-111512.pdf
CVE: CVE-2022-23342
Published: 2022-06-21
Description: The Hyland Onbase Application Server releases prior to 20.3.58.1000 and OnBase releases 21.1.1.1000 through 21.1.15.1000 are vulnerable to a username enumeration vulnerability. An attacker can obtain valid users based on the response returned for invalid and valid users by sending a POST login request to the /mobilebroker/ServiceToBroker.svc/Json/Connect endpoint. This can lead to user enumeration against the underlying Active Directory integrated systems.
CVSS Score: 5.3 (MEDIUM)
References: https://community.hyland.com/login?returnUrl=/connect/hyland-research-and-development/security-advisories/username-enumeration-in-onbase; https://github.com/InitRoot/CVE-2022-23342; https://community.hyland.com/login?returnUrl=/connect/hyland-research-and-development/security-advisories/username-enumeration-in-onbase
CVE: CVE-2022-25585
Published: 2022-06-21
Description: Unioncms v1.0.13 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Default settings.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://unioncms.com; https://github.com/union-home/unioncms/issues/5; http://unioncms.com
CVE: CVE-2022-29774
Published: 2022-06-21
Description: iSpy v7.2.2.0 is vulnerable to remote command execution via path traversal.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://gist.github.com/securylight/79f673aa3a453c80c0e78f356a8f650b; https://github.com/securylight/CVES_write_ups; https://github.com/securylight/CVES_write_ups/blob/main/iSpy_connect.pdf
CVE: CVE-2022-29775
Published: 2022-06-21
Description: iSpyConnect iSpy v7.2.2.0 allows attackers to bypass authentication via a crafted URL.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://gist.github.com/securylight/79f673aa3a453c80c0e78f356a8f650b; https://github.com/securylight/CVES_write_ups; https://gist.github.com/securylight/79f673aa3a453c80c0e78f356a8f650b
CVE: CVE-2022-31478
Published: 2022-06-21
Description: The UserTakeOver plugin before 4.0.1 for ILIAS allows an attacker to list all users via the search function.
CVSS Score: 4.3 (MEDIUM)
References: https://github.com/srsolutionsag/UserTakeOver; https://medium.com/%40bcksec/ilias-lms-usertakeover-4-0-1-vulnerability-b[PII_REDACTED]; https://github.com/srsolutionsag/UserTakeOver
CVE: CVE-2022-33048
Published: 2022-06-21
Description: Online Railway Reservation System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /orrs/admin/reservations/view_details.php.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/online-railway-reservation-system/SQLi-1.md; https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/online-railway-reservation-system/SQLi-1.md
CVE: CVE-2022-33049
Published: 2022-06-21
Description: Online Railway Reservation System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /orrs/admin/?page=user/manage_user.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/online-railway-reservation-system/SQLi-2.md; https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/online-railway-reservation-system/SQLi-2.md
CVE: CVE-2022-33055
Published: 2022-06-21
Description: Online Railway Reservation System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /orrs/admin/trains/manage_train.php.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/online-railway-reservation-system/SQLi-3.md; https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/online-railway-reservation-system/SQLi-3.md
CVE: CVE-2022-33056
Published: 2022-06-21
Description: Online Railway Reservation System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /orrs/admin/schedules/manage_schedule.php.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/online-railway-reservation-system/SQLi-4.md; https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/online-railway-reservation-system/SQLi-4.md
CVE: CVE-2021-41924
Published: 2022-06-21
Description: Webkul krayin crm before 1.2.2 is vulnerable to Cross Site Scripting (XSS).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/krayin/laravel-crm/pull/195/commits/882dc2e7e7e9149b96cf1ccacf34900960b92fb7; https://github.com/krayin/laravel-crm/pull/195/commits/882dc2e7e7e9149b96cf1ccacf34900960b92fb7
CVE: CVE-2022-1596
Published: 2022-06-21
Description: Incorrect Permission Assignment for Critical Resource vulnerability in ABB REX640 PCL1, REX640 PCL2, REX640 PCL3 allows an authenticated attacker to launch an attack against the user database file and try to take control of an affected system node.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-732, CWE-732
References: https://search.abb.com/library/Download.aspx?DocumentID=2NGA001421; https://search.abb.com/library/Download.aspx?DocumentID=2NGA001421
CVE: CVE-2022-1665
Published: 2022-06-21
Description: A set of pre-production kernel packages of Red Hat Enterprise Linux for IBM Power architecture can be booted by the grub in Secure Boot mode even though it shouldn't. These kernel builds don't have the secure boot lockdown patches applied to it and can bypass the secure boot validations, allowing the attacker to load another non-trusted code.
CVSS Score: 8.2 (HIGH)
CWE: CWE-1291
References: https://bugzilla.redhat.com/show_bug.cgi?id=2089529; https://bugzilla.redhat.com/show_bug.cgi?id=2089529
CVE: CVE-2022-1833
Published: 2022-06-21
Description: A flaw was found in AMQ Broker Operator 7.9.4 installed via UI using OperatorHub where a low-privilege user that has access to the namespace where the AMQ Operator is deployed has access to clusterwide edit rights by checking the secrets. The service account used for building the Operator gives more permission than expected and an attacker could benefit from it. This requires at least an already compromised low-privilege account or insider attack.
CVSS Score: 8.8 (HIGH)
CWE: CWE-276, CWE-276
References: https://bugzilla.redhat.com/show_bug.cgi?id=2089406#c4; https://bugzilla.redhat.com/show_bug.cgi?id=2089406#c4
CVE: CVE-2022-22979
Published: 2022-06-21
Description: In Spring Cloud Function versions prior to 3.2.6, it is possible for a user who directly interacts with framework provided lookup functionality to cause a denial-of-service condition due to the caching issue in the Function Catalog component of the framework.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://tanzu.vmware.com/security/cve-2022-22979; https://tanzu.vmware.com/security/cve-2022-22979
CVE: CVE-2022-23171
Published: 2022-06-21
Description: AtlasVPN - Privilege Escalation Lack of proper security controls on named pipe messages can allow an attacker with low privileges to send a malicious payload and gain SYSTEM permissions on a windows computer where the AtlasVPN client is installed.
CVSS Score: 5.9 (MEDIUM)
References: https://www.gov.il/en/departments/faq/cve_advisories; https://www.gov.il/en/departments/faq/cve_advisories
CVE: CVE-2022-26147
Published: 2022-06-21
Description: The Quectel RG502Q-EA modem before 2022-02-23 allow OS Command Injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://nns.ee/blog/2022/06/21/modem-rce2.html; https://nns.ee/blog/2022/06/21/modem-rce2.html
CVE: CVE-2022-27867
Published: 2022-06-21
Description: A maliciously crafted JT file in Autodesk AutoCAD 2022, 2021, 2020, 2019 can be used to trigger use-after-free vulnerability. Exploitation of this vulnerability may lead to code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0002; https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0002
CVE: CVE-2022-27868
Published: 2022-06-21
Description: A maliciously crafted CAT file in Autodesk AutoCAD 2023 can be used to trigger use-after-free vulnerability. Exploitation of this vulnerability may lead to code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0005; https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0005
CVE: CVE-2022-27869
Published: 2022-06-21
Description: A maliciously crafted TIFF file in Autodesk AutoCAD 2023 can be forced to read and write beyond allocated boundaries when parsing the TIFF file. This vulnerability can be exploited to execute arbitrary code.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125, CWE-787
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0004; https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0004