deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-29877
Published: 2022-05-20
Description: A vulnerability has been identified in SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00). Affected devices allow unauthenticated access to the web interface configuration area. This could allow an attacker to extract internal configuration details or to reconfigure network settings. However, the reconfigured settings cannot be activated unless the role of an authenticated administrator user.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-306, CWE-306
References: https://cert-portal.siemens.com/productcert/pdf/ssa-165073.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-165073.pdf
CVE: CVE-2022-29878
Published: 2022-05-20
Description: A vulnerability has been identified in SICAM T (All versions < V3.0). Affected devices use a limited range for challenges that are sent during the unencrypted challenge-response communication. An unauthenticated attacker could capture a valid challenge-response pair generated by a legitimate user, and request the webpage repeatedly to wait for the same challenge to reappear for which the correct response is known. This could allow the attacker to access the management interface of the device.
CVSS Score: 7.5 (HIGH)
CWE: CWE-294, CWE-294
References: https://cert-portal.siemens.com/productcert/html/ssa-165073.html; https://cert-portal.siemens.com/productcert/html/ssa-471761.html; https://cert-portal.siemens.com/productcert/pdf/ssa-165073.pdf
CVE: CVE-2022-29879
Published: 2022-05-20
Description: A vulnerability has been identified in SICAM T (All versions < V3.0). The web based management interface of affected devices does not employ special access protection for certain internal developer views. This could allow authenticated users to access critical device information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-306, CWE-306
References: https://cert-portal.siemens.com/productcert/html/ssa-165073.html; https://cert-portal.siemens.com/productcert/html/ssa-471761.html; https://cert-portal.siemens.com/productcert/pdf/ssa-165073.pdf
CVE: CVE-2022-29880
Published: 2022-05-20
Description: A vulnerability has been identified in SICAM T (All versions < V3.0). Affected devices do not properly validate input in the configuration interface. This could allow an authenticated attacker to place persistent XSS attacks to perform arbitrary actions in the name of a logged user which accesses the affected views.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://cert-portal.siemens.com/productcert/html/ssa-165073.html; https://cert-portal.siemens.com/productcert/html/ssa-471761.html; https://cert-portal.siemens.com/productcert/pdf/ssa-165073.pdf
CVE: CVE-2022-29881
Published: 2022-05-20
Description: A vulnerability has been identified in SICAM T (All versions < V3.0). The web based management interface of affected devices does not employ special access protection for certain internal developer views. This could allow unauthenticated users to extract internal configuration details.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-306, CWE-306
References: https://cert-portal.siemens.com/productcert/html/ssa-165073.html; https://cert-portal.siemens.com/productcert/html/ssa-471761.html; https://cert-portal.siemens.com/productcert/pdf/ssa-165073.pdf
CVE: CVE-2022-29882
Published: 2022-05-20
Description: A vulnerability has been identified in SICAM T (All versions < V3.0). Affected devices do not handle uploaded files correctly. An unauthenticated attacker could take advantage of this situation to store an XSS attack, which could - when a legitimate user accesses the error logs - perform arbitrary actions in the name of the user.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79, CWE-79
References: https://cert-portal.siemens.com/productcert/html/ssa-165073.html; https://cert-portal.siemens.com/productcert/html/ssa-471761.html; https://cert-portal.siemens.com/productcert/pdf/ssa-165073.pdf
CVE: CVE-2022-29883
Published: 2022-05-20
Description: A vulnerability has been identified in SICAM T (All versions < V3.0). Affected devices do not restrict unauthenticated access to certain pages of the web interface. This could allow an attacker to delete log files without authentication.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-287, CWE-306
References: https://cert-portal.siemens.com/productcert/html/ssa-165073.html; https://cert-portal.siemens.com/productcert/html/ssa-471761.html; https://cert-portal.siemens.com/productcert/pdf/ssa-165073.pdf
CVE: CVE-2022-30518
Published: 2022-05-20
Description: ChatBot Application with a Suggestion Feature 1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /simple_chat_bot/admin/responses/view_response.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://cxsecurity.com/issue/WLB[PII_REDACTED]; https://packetstormsecurity.com/files/166984/ChatBot-Application-With-A-Suggestion-Feature-1.0-SQL-Injection.html; https://cxsecurity.com/issue/WLB[PII_REDACTED]
CVE: CVE-2022-30886
Published: 2022-05-20
Description: School Dormitory Management System v1.0 was discovered to contain a SQL injection vulnerability via the month parameter at /dms/admin/reports/daily_collection_report.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://packetstormsecurity.com/files/167001/School-Dormitory-Management-System-1.0-SQL-Injection.html; https://packetstormsecurity.com/files/167001/School-Dormitory-Management-System-1.0-SQL-Injection.html
CVE: CVE-2022-30887
Published: 2022-05-20
Description: Pharmacy Management System v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the component /php_action/editProductImage.php. This vulnerability allows attackers to execute arbitrary code via a crafted image file.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://packetstormsecurity.com/files/166786/Pharmacy-Management-System-1.0-Shell-Upload.html; https://packetstormsecurity.com/files/166786/Pharmacy-Management-System-1.0-Shell-Upload.html
CVE: CVE-2022-24904
Published: 2022-05-20
Description: Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD starting with version 0.7.0 and prior to versions 2.1.15m 2.2.9, and 2.3.4 is vulnerable to a symlink following bug allowing a malicious user with repository write access to leak sensitive files from Argo CD's repo-server. A malicious Argo CD user with write access for a repository which is (or may be) used in a directory-type Application may commit a symlink which points to an out-of-bounds file. Sensitive files which could be leaked include manifest files from other Applications' source repositories (potentially decrypted files, if you are using a decryption plugin) or any JSON-formatted secrets which have been mounted as files on the repo-server. A patch for this vulnerability has been released in Argo CD versions 2.3.4, 2.2.9, and 2.1.15. Users of versions 2.3.0 or above who do not have any Jsonnet/directory-type Applications may disable the Jsonnet/directory config management tool as a workaround.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-59, CWE-61, CWE-59
References: https://github.com/argoproj/argo-cd/releases/tag/v2.1.15; https://github.com/argoproj/argo-cd/releases/tag/v2.2.9; https://github.com/argoproj/argo-cd/releases/tag/v2.3.4
CVE: CVE-2022-24905
Published: 2022-05-20
Description: Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. A vulnerability was found in Argo CD prior to versions 2.3.4, 2.2.9, and 2.1.15 that allows an attacker to spoof error messages on the login screen when single sign on (SSO) is enabled. In order to exploit this vulnerability, an attacker would have to trick the victim to visit a specially crafted URL which contains the message to be displayed. As far as the research of the Argo CD team concluded, it is not possible to specify any active content (e.g. Javascript) or other HTML fragments (e.g. clickable links) in the spoofed message. A patch for this vulnerability has been released in Argo CD versions 2.3.4, 2.2.9, and 2.1.15. There are currently no known workarounds.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: https://github.com/argoproj/argo-cd/releases/tag/v2.1.15; https://github.com/argoproj/argo-cd/releases/tag/v2.2.9; https://github.com/argoproj/argo-cd/releases/tag/v2.3.4
CVE: CVE-2021-30028
Published: 2022-05-20
Description: SOOTEWAY Wi-Fi Range Extender v1.5 was discovered to use default credentials (the admin password for the admin account) to access the TELNET service, allowing attackers to erase/read/write the firmware remotely.
CVSS Score: 7.2 (HIGH)
CWE: CWE-287
References: https://blog-ssh3ll.medium.com/acexy-wireless-n-wifi-repeater-vulnerabilities-8bd5d14a2990; https://www.amazon.it/SOOTEWAY-Ripetitore-Extender-Wireless-Wmplificatore/dp/B08G55T46P; https://blog-ssh3ll.medium.com/acexy-wireless-n-wifi-repeater-vulnerabilities-8bd5d14a2990
CVE: CVE-2021-43728
Published: 2022-05-20
Description: Pix-Link MiNi Router 28K.MiniRouter.20190211 was discovered to contain a stored cross-site scripting (XSS) vulnerability due to an unsanitized SSID parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.pix-link.com/page50?product_id=144; https://blog-ssh3ll.medium.com/acexy-wireless-n-wifi-repeater-vulnerabilities-8bd5d14a2990; http://www.pix-link.com/page50?product_id=144
CVE: CVE-2021-43729
Published: 2022-05-20
Description: Pix-Link MiNi Router 28K.MiniRouter.20190211 was discovered to contain a stored cross-site scripting (XSS) vulnerability due to an unsanitized Security Key parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.pix-link.com/page50?product_id=144; https://blog-ssh3ll.medium.com/acexy-wireless-n-wifi-repeater-vulnerabilities-8bd5d14a2990; http://www.pix-link.com/page50?product_id=144
CVE: CVE-2022-28660
Published: 2022-05-20
Description: The querier component in Grafana Enterprise Logs 1.1.x through 1.3.x before 1.4.0 does not require authentication when X-Scope-OrgID is used. Versions 1.2.1, 1.3.1, and 1.4.0 contain the bugfix. This affects -auth.type=enterprise in microservices mode
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://grafana.com/docs/enterprise-logs/latest/gel-releases/#v121----may-3-2022; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://grafana.com/docs/enterprise-logs/latest/gel-releases/#v121----may-3-2022
CVE: CVE-2022-29165
Published: 2022-05-20
Description: Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. A critical vulnerability has been discovered in Argo CD starting with version 1.4.0 and prior to versions 2.1.15, 2.2.9, and 2.3.4 which would allow unauthenticated users to impersonate as any Argo CD user or role, including the `admin` user, by sending a specifically crafted JSON Web Token (JWT) along with the request. In order for this vulnerability to be exploited, anonymous access to the Argo CD instance must have been enabled. In a default Argo CD installation, anonymous access is disabled. The vulnerability can be exploited to impersonate as any user or role, including the built-in `admin` account regardless of whether it is enabled or disabled. Also, the attacker does not need an account on the Argo CD instance in order to exploit this. If anonymous access to the instance is enabled, an attacker can escalate their privileges, effectively allowing them to gain the same privileges on the cluster as the Argo CD instance, which is cluster admin in a default installation. This will allow the attacker to create, manipulate and delete any resource on the cluster. They may also exfiltrate data by deploying malicious workloads with elevated privileges, thus bypassing any redaction of sensitive data otherwise enforced by the Argo CD API. A patch for this vulnerability has been released in Argo CD versions 2.3.4, 2.2.9, and 2.1.15. As a workaround, one may disable anonymous access, but upgrading to a patched version is preferable.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-200, CWE-287, CWE-290, CWE-290
References: https://github.com/argoproj/argo-cd/releases/tag/v2.1.15; https://github.com/argoproj/argo-cd/releases/tag/v2.2.9; https://github.com/argoproj/argo-cd/releases/tag/v2.3.4
CVE: CVE-2022-31245
Published: 2022-05-20
Description: mailcow before 2022-05d allows a remote authenticated user to inject OS commands and escalate privileges to domain admin via the --debug option in conjunction with the ---PIPEMESS option in Sync Jobs.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://github.com/ly1g3/Mailcow-CVE-2022-31245; https://github.com/mailcow/mailcow-dockerized/releases/tag/2022-05d; https://github.com/ly1g3/Mailcow-CVE-2022-31245
CVE: CVE-2022-24906
Published: 2022-05-20
Description: Nextcloud Deck is a Kanban-style project & personal management tool for Nextcloud, similar to Trello. The full path of the application is exposed to unauthorized users. It is recommended that the Nextcloud Deck app is upgraded to 1.2.11, 1.4.6, or 1.5.4. There is no workaround available.
CVSS Score: 3.5 (LOW)
CWE: CWE-200, CWE-209
References: https://github.com/nextcloud/deck/pull/3384; https://github.com/nextcloud/security-advisories/security/advisories/GHSA-hx9w-xfrg-2qvp; https://hackerone.com/reports/1354334
CVE: CVE-2022-29159
Published: 2022-05-20
Description: Nextcloud Deck is a Kanban-style project & personal management tool for Nextcloud. In versions prior to 1.4.8, 1.5.6, and 1.6.1, an authenticated user can move stacks with cards from their own board to a board of another user. The Nextcloud Deck app contains a patch for this issue in versions 1.4.8, 1.5.6, and 1.6.1. There are no known currently-known workarounds available.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-639, CWE-639
References: https://github.com/nextcloud/deck/pull/3541; https://github.com/nextcloud/security-advisories/security/advisories/GHSA-vqhf-673w-7r3j; https://hackerone.com/reports/1450117
CVE: CVE-2022-29160
Published: 2022-05-20
Description: Nextcloud Android is the Android client for Nextcloud, a self-hosted productivity platform. Prior to version 3.19.0, sensitive tokens, images, and user related details exist after deletion of a user account. This could result in misuse of the former account holder's information. Nextcloud Android version 3.19.0 contains a patch for this issue. There are no known workarounds available.
CVSS Score: 2.8 (LOW)
CWE: CWE-284, CWE-459
References: https://github.com/nextcloud/android/pull/9644; https://github.com/nextcloud/security-advisories/security/advisories/GHSA-xcj9-3jch-qr2r; https://hackerone.com/reports/1222873
CVE: CVE-2022-29163
Published: 2022-05-20
Description: Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Prior to versions 22.2.6 and 23.0.3, a user can create a link that is not password protected even if the administrator requires links to be password protected. Versions 22.2.6 and 23.0.3 contain a patch for this issue. There are currently no known workarounds.
CVSS Score: 3.5 (LOW)
CWE: CWE-671
References: https://github.com/nextcloud/circles/pull/866; https://github.com/nextcloud/circles/pull/926; https://github.com/nextcloud/security-advisories/security/advisories/GHSA-pwjv-h37v-c4fx
CVE: CVE-2022-29170
Published: 2022-05-20
Description: Grafana is an open-source platform for monitoring and observability. In Grafana Enterprise, the Request security feature allows list allows to configure Grafana in a way so that the instance doesn’t call or only calls specific hosts. The vulnerability present starting with version 7.4.0-beta1 and prior to versions 7.5.16 and 8.5.3 allows someone to bypass these security configurations if a malicious datasource (running on an allowed host) returns an HTTP redirect to a forbidden host. The vulnerability only impacts Grafana Enterprise when the Request security allow list is used and there is a possibility to add a custom datasource to Grafana which returns HTTP redirects. In this scenario, Grafana would blindly follow the redirects and potentially give secure information to the clients. Grafana Cloud is not impacted by this vulnerability. Versions 7.5.16 and 8.5.3 contain a patch for this issue. There are currently no known workarounds.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-601
References: https://github.com/grafana/grafana/pull/49240; https://github.com/grafana/grafana/releases/tag/v7.5.16; https://github.com/grafana/grafana/releases/tag/v8.5.3
CVE: CVE-2021-39043
Published: 2022-05-20
Description: IBM Jazz Team Server 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 214032.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/214032; https://www.ibm.com/support/pages/node/6587797; https://exchange.xforce.ibmcloud.com/vulnerabilities/214032
CVE: CVE-2022-22365
Published: 2022-05-20
Description: IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0, with the Ajax Proxy Web Application (AjaxProxy.war) deployed, is vulnerable to spoofing by allowing a man-in-the-middle attacker to spoof SSL server hostnames. IBM X-Force ID: 220904.
CVSS Score: 5.9 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/220904; https://www.ibm.com/support/pages/node/6587947; https://exchange.xforce.ibmcloud.com/vulnerabilities/220904
CVE: CVE-2022-29177
Published: 2022-05-20
Description: Go Ethereum is the official Golang implementation of the Ethereum protocol. Prior to version 1.10.17, a vulnerable node, if configured to use high verbosity logging, can be made to crash when handling specially crafted p2p messages sent from an attacker node. Version 1.10.17 contains a patch that addresses the problem. As a workaround, setting loglevel to default level (`INFO`) makes the node not vulnerable to this attack.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-400
References: https://github.com/ethereum/go-ethereum/pull/24507; https://github.com/ethereum/go-ethereum/security/advisories/GHSA-wjxw-gh3m-7pm5; https://github.com/ethereum/go-ethereum/pull/24507
CVE: CVE-2022-1770
Published: 2022-05-20
Description: Improper Privilege Management in GitHub repository polonel/trudesk prior to 1.2.2.
CVSS Score: 8.8 (HIGH)
CWE: CWE-269, CWE-269
References: https://github.com/polonel/trudesk/commit/889876f66c9a5b28f019258e329310c31d72cbd2; https://huntr.dev/bounties/74a252a2-8bf6-4f88-a180-b90338a239fa; https://github.com/polonel/trudesk/commit/889876f66c9a5b28f019258e329310c31d72cbd2
CVE: CVE-2022-28531
Published: 2022-05-20
Description: Sourcecodester Covid-19 Directory on Vaccination System1.0 is vulnerable to SQL Injection via the admin/login.php txtusername (aka Username) field.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://packetstormsecurity.com/files/166481/Covid-19-Directory-On-Vaccination-System-1.0-SQL-Injection.html; https://www.sourcecodester.com/php/15244/design-and-implementation-covid-19-directory-vacination.html; https://packetstormsecurity.com/files/166481/Covid-19-Directory-On-Vaccination-System-1.0-SQL-Injection.html
CVE: CVE-2022-28990
Published: 2022-05-20
Description: WASM3 v0.5.0 was discovered to contain a heap overflow via the component /wabt/bin/poc.wasm.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/wasm3/wasm3/issues/323; https://github.com/wasm3/wasm3/pull/324; https://github.com/wasm3/wasm3/issues/323
CVE: CVE-2022-28995
Published: 2022-05-20
Description: Rengine v1.0.2 was discovered to contain a remote code execution (RCE) vulnerability via the yaml configuration function.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/zongdeiqianxing/rengine/issues/1; https://github.com/zongdeiqianxing/rengine/issues/1
CVE: CVE-2022-29178
Published: 2022-05-20
Description: Cilium is open source software for providing and securing network connectivity and loadbalancing between application workloads. Cilium prior to versions 1.9.16, 1.10.11, and 1.11.15 contains an incorrect default permissions vulnerability. Operating Systems with users belonging to the group ID 1000 can access the API of Cilium via Unix domain socket available on the host where Cilium is running. This could allow malicious users to compromise integrity as well as system availability on that host. The problem has been fixed and the patch is available in versions 1.9.16, 1.10.11, and 1.11.5. A potential workaround is to modify Cilium's DaemonSet to run with a certain command, which can be found in the GitHub Security Advisory for this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-276
References: https://github.com/cilium/cilium/releases/tag/v1.10.11; https://github.com/cilium/cilium/releases/tag/v1.11.5; https://github.com/cilium/cilium/releases/tag/v1.9.16
CVE: CVE-2022-29179
Published: 2022-05-20
Description: Cilium is open source software for providing and securing network connectivity and loadbalancing between application workloads. Prior to versions 1.9.16, 1.10.11, and 1.11.15, if an attacker is able to perform a container escape of a container running as root on a host where Cilium is installed, the attacker can escalate privileges to cluster admin by using Cilium's Kubernetes service account. The problem has been fixed and the patch is available in versions 1.9.16, 1.10.11, and 1.11.5. There are no known workarounds available.
CVSS Score: 7.5 (HIGH)
CWE: CWE-269
References: https://github.com/cilium/cilium/releases/tag/v1.10.11; https://github.com/cilium/cilium/releases/tag/v1.11.5; https://github.com/cilium/cilium/releases/tag/v1.9.16
CVE: CVE-2022-29181
Published: 2022-05-20
Description: Nokogiri is an open source XML and HTML library for Ruby. Nokogiri prior to version 1.13.6 does not type-check all inputs into the XML and HTML4 SAX parsers, allowing specially crafted untrusted inputs to cause illegal memory access errors (segfault) or reads from unrelated memory. Version 1.13.6 contains a patch for this issue. As a workaround, ensure the untrusted input is a `String` by calling `#to_s` or equivalent.
CVSS Score: 8.2 (HIGH)
CWE: CWE-241, CWE-843
References: https://github.com/sparklemotion/nokogiri/commit/83cc451c3f29df397caa890afc3b714eae6ab8f7; https://github.com/sparklemotion/nokogiri/commit/db05ba9a1bd4b90aa6c76742cf6102a7c7297267; https://github.com/sparklemotion/nokogiri/releases/tag/v1.13.6