deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-22409
Published: 2023-01-13
Description: An Unchecked Input for Loop Condition vulnerability in a NAT library of Juniper Networks Junos OS allows a local authenticated attacker with low privileges to cause a Denial of Service (DoS). When an inconsistent "deterministic NAT" configuration is present on an SRX, or MX with SPC3 and then a specific CLI command is issued the SPC will crash and restart. Repeated execution of this command will lead to a sustained DoS. Such a configuration is characterized by the total number of port blocks being greater than the total number of hosts. An example for such configuration is: [ services nat source pool TEST-POOL address x.x.x.0/32 to x.x.x.15/32 ] [ services nat source pool TEST-POOL port deterministic block-size 1008 ] [ services nat source pool TEST-POOL port deterministic host address y.y.y.0/24] [ services nat source pool TEST-POOL port deterministic include-boundary-addresses] where according to the following calculation: 65536-1024=64512 (number of usable ports per IP address, implicit) 64512/1008=64 (number of port blocks per Nat IP) x.x.x.0/32 to x.x.x.15/32 = 16 (NAT IP addresses available in NAT pool) total port blocks in NAT Pool = 64 blocks per IP * 16 IPs = 1024 Port blocks host address y.y.y.0/24 = 256 hosts (with include-boundary-addresses) If the port block size is configured to be 4032, then the total port blocks are (64512/4032) * 16 = 256 which is equivalent to the total host addresses of 256, and the issue will not be seen. This issue affects Juniper Networks Junos OS on SRX Series, and MX Series with SPC3: All versions prior to 19.4R3-S10; 20.1 version 20.1R1 and later versions; 20.2 versions prior to 20.2R3-S6; 20.3 versions prior to 20.3R3-S6; 20.4 versions prior to 20.4R3-S5; 21.1 versions prior to 21.1R3-S4; 21.2 versions prior to 21.2R3-S3; 21.3 versions prior to 21.3R3-S3; 21.4 versions prior to 21.4R3-S1; 22.1 versions prior to 22.1R2-S2, 22.1R3; 22.2 versions prior to 22.2R2.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-1284
References: https://kb.juniper.net/JSA70205; https://kb.juniper.net/JSA70205
CVE: CVE-2023-22410
Published: 2023-01-13
Description: A Missing Release of Memory after Effective Lifetime vulnerability in the Juniper Networks Junos OS on MX Series platforms with MPC10/MPC11 line cards, allows an unauthenticated adjacent attacker to cause a Denial of Service (DoS). Devices are only vulnerable when the Suspicious Control Flow Detection (scfd) feature is enabled. Upon enabling this specific feature, an attacker sending specific traffic is causing memory to be allocated dynamically and it is not freed. Memory is not freed even after deactivating this feature. Sustained processing of such traffic will eventually lead to an out of memory condition that prevents all services from continuing to function, and requires a manual restart to recover. The FPC memory usage can be monitored using the CLI command "show chassis fpc". On running the above command, the memory of AftDdosScfdFlow can be observed to detect the memory leak. This issue affects Juniper Networks Junos OS on MX Series: All versions prior to 20.2R3-S5; 20.3 version 20.3R1 and later versions.
CVSS Score: 7.5 (HIGH)
CWE: CWE-401, CWE-401
References: https://kb.juniper.net/JSA70206; https://kb.juniper.net/JSA70206
CVE: CVE-2023-22411
Published: 2023-01-13
Description: An Out-of-Bounds Write vulnerability in Flow Processing Daemon (flowd) of Juniper Networks Junos OS allows an unauthenticated, network-based attacker to cause Denial of Service (DoS). On SRX Series devices using Unified Policies with IPv6, when a specific IPv6 packet goes through a dynamic-application filter which will generate an ICMP deny message, the flowd core is observed and the PFE is restarted. This issue affects: Juniper Networks Junos OS on SRX Series: 19.2 versions prior to 19.2R3-S6; 19.3 versions prior to 19.3R3-S6; 19.4 versions prior to 19.4R3-S9; 20.2 versions prior to 20.2R3-S5; 20.3 versions prior to 20.3R3-S4; 20.4 versions prior to 20.4R3-S3; 21.1 versions prior to 21.1R3; 21.2 versions prior to 21.2R3; 21.3 versions prior to 21.3R2; 21.4 versions prior to 21.4R2.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-787
References: https://kb.juniper.net/JSA70207; https://kb.juniper.net/JSA70207
CVE: CVE-2023-22412
Published: 2023-01-13
Description: An Improper Locking vulnerability in the SIP ALG of Juniper Networks Junos OS on MX Series with MS-MPC or MS-MIC card and SRX Series allows an unauthenticated, network-based attacker to cause a flow processing daemon (flowd) crash and thereby a Denial of Service (DoS). Continued receipt of these specific packets will cause a sustained Denial of Service condition. This issue occurs when SIP ALG is enabled and specific SIP messages are processed simultaneously. This issue affects: Juniper Networks Junos OS on MX Series and SRX Series 20.4 versions prior to 20.4R3-S4; 21.1 versions prior to 21.1R3-S3; 21.2 versions prior to 21.2R3-S2; 21.3 versions prior to 21.3R3; 21.4 versions prior to 21.4R3; 22.1 versions prior to 22.1R2. This issue does not affect Juniper Networks Junos OS versions prior to 20.4R1 on MX Series, or SRX Series.
CVSS Score: 7.5 (HIGH)
CWE: CWE-667, CWE-667
References: https://kb.juniper.net/JSA70208; https://kb.juniper.net/JSA70208
CVE: CVE-2023-22413
Published: 2023-01-13
Description: An Improper Check or Handling of Exceptional Conditions vulnerability in the IPsec library of Juniper Networks Junos OS allows a network-based, unauthenticated attacker to cause Denial of Service (DoS). On all MX platforms with MS-MPC or MS-MIC card, when specific IPv4 packets are processed by an IPsec6 tunnel, the Multiservices PIC Management Daemon (mspmand) process will core and restart. This will lead to FPC crash. Traffic flow is impacted while mspmand restarts. Continued receipt of these specific packets will cause a sustained Denial of Service (DoS) condition. This issue only occurs if an IPv4 address is not configured on the multiservice interface. This issue affects: Juniper Networks Junos OS on MX Series All versions prior to 19.4R3-S9; 20.1 version 20.1R3-S5 and later versions; 20.2 versions prior to 20.2R3-S5; 20.3 versions prior to 20.3R3-S5; 20.4 versions prior to 20.4R3-S4; 21.1 versions prior to 21.1R3-S3; 21.2 versions prior to 21.2R3-S1; 21.3 versions prior to 21.3R3; 21.4 versions prior to 21.4R2-S1, 21.4R3; 22.1 versions prior to 22.1R2.
CVSS Score: 7.5 (HIGH)
CWE: CWE-703
References: https://kb.juniper.net/JSA70209; https://kb.juniper.net/JSA70209
CVE: CVE-2023-22414
Published: 2023-01-13
Description: A Missing Release of Memory after Effective Lifetime vulnerability in Flexible PIC Concentrator (FPC) of Juniper Networks Junos OS allows an adjacent, unauthenticated attacker from the same shared physical or logical network, to cause a heap memory leak and leading to FPC crash. On all Junos PTX Series and QFX10000 Series, when specific EVPN VXLAN Multicast packets are processed, an FPC heap memory leak is observed. The FPC memory usage can be monitored using the CLI command "show heap extensive". Following is an example output. ID Base Total(b) Free(b) Used(b) % Name Peak used % -- -------- --------- --------- --------- --- ----------- ----------- 0 37dcf[PII_REDACTED][PII_REDACTED][PII_REDACTED]104 47 Kernel 47 1 17dcf[PII_REDACTED] 1048576 0 0 TOE DMA 0 2 17ecf[PII_REDACTED] 1048576 0 0 DMA 0 3 17fcf[PII_REDACTED]60 280[PII_REDACTED]05424 47 Packet DMA 47 This issue affects: Juniper Networks Junos OS PTX Series and QFX10000 Series 20.2 versions prior to 20.2R3-S6; 20.3 versions prior to 20.3R3-S6; 20.4 versions prior to 20.4R3-S4; 21.1 versions prior to 21.1R3-S3; 21.2 versions prior to 21.2R3-S1; 21.3 versions prior to 21.3R3; 21.4 versions prior to 21.4R3; 22.1 versions prior to 22.1R2; 22.2 versions prior to 22.2R2. This issue does not affect Juniper Networks Junos OS versions prior to 20.1R1 on PTX Series and QFX10000 Series.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-401, CWE-401
References: https://kb.juniper.net/JSA70210; https://kb.juniper.net/JSA70210
CVE: CVE-2023-22415
Published: 2023-01-13
Description: An Out-of-Bounds Write vulnerability in the H.323 ALG of Juniper Networks Junos OS allows an unauthenticated, network-based attacker to cause Denial of Service (DoS). On all MX Series and SRX Series platform, when H.323 ALG is enabled and specific H.323 packets are received simultaneously, a flow processing daemon (flowd) crash will occur. Continued receipt of these specific packets will cause a sustained Denial of Service (DoS) condition. This issue affects: Juniper Networks Junos OS on MX Series and SRX Series All versions prior to 19.4R3-S10; 20.2 versions prior to 20.2R3-S6; 20.3 versions prior to 20.3R3-S6; 20.4 versions prior to 20.4R3-S5; 21.1 versions prior to 21.1R3-S4; 21.2 versions prior to 21.2R3-S3; 21.3 versions prior to 21.3R3-S3; 21.4 versions prior to 21.4R3; 22.1 versions prior to 22.1R2-S1, 22.1R3; 22.2 versions prior to 22.2R1-S2, 22.2R2.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-787
References: https://kb.juniper.net/JSA70211; https://kb.juniper.net/JSA70211
CVE: CVE-2023-22416
Published: 2023-01-13
Description: A Buffer Overflow vulnerability in SIP ALG of Juniper Networks Junos OS allows a network-based, unauthenticated attacker to cause a Denial of Service (DoS). On all MX Series and SRX Series platform with SIP ALG enabled, when a malformed SIP packet is received, the flow processing daemon (flowd) will crash and restart. This issue affects: Juniper Networks Junos OS on MX Series and SRX Series 20.4 versions prior to 20.4R3-S5; 21.1 versions prior to 21.1R3-S4; 21.2 versions prior to 21.2R3-S2; 21.3 versions prior to 21.3R3-S1; 21.4 versions prior to 21.4R3; 22.1 versions prior to 22.1R1-S2, 22.1R2; 22.2 versions prior to 22.2R1-S1, 22.2R2. This issue does not affect Juniper Networks Junos OS versions prior to 20.4R1 on SRX Series.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-120
References: https://kb.juniper.net/JSA70212; https://kb.juniper.net/JSA70212
CVE: CVE-2023-22417
Published: 2023-01-13
Description: A Missing Release of Memory after Effective Lifetime vulnerability in the Flow Processing Daemon (flowd) of Juniper Networks Junos OS allows a network-based, unauthenticated attacker to cause a Denial of Service (DoS). In an IPsec VPN environment, a memory leak will be seen if a DH or ECDH group is configured. Eventually the flowd process will crash and restart. This issue affects Juniper Networks Junos OS on SRX Series: All versions prior to 19.3R3-S7; 19.4 versions prior to 19.4R2-S8, 19.4R3-S10; 20.2 versions prior to 20.2R3-S6; 20.3 versions prior to 20.3R3-S5; 20.4 versions prior to 20.4R3-S5; 21.1 versions prior to 21.1R3-S4; 21.2 versions prior to 21.2R3; 21.3 versions prior to 21.3R3; 21.4 versions prior to 21.4R2.
CVSS Score: 7.5 (HIGH)
CWE: CWE-401, CWE-401
References: https://kb.juniper.net/JSA70213; https://kb.juniper.net/JSA70213
CVE: CVE-2022-3159
Published: 2023-01-13
Description: The APDFL.dll contains a stack-based buffer overflow vulnerability that 
could be triggered while parsing specially crafted PDF files. This could
 allow an attacker to execute code in the context of the current 
process.


CVSS Score: 7.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://cert-portal.siemens.com/productcert/csaf/ssa-360681.json; https://cert-portal.siemens.com/productcert/html/ssa-360681.html; https://www.cisa.gov/uscert/ics/advisories/icsa-22-349-15
CVE: CVE-2022-3160
Published: 2023-01-13
Description: 
The APDFL.dll contains an out-of-bounds write past the fixed-length 
heap-based buffer while parsing specially crafted PDF files. This could 
allow an attacker to execute code in the context of the current process.




CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: https://cert-portal.siemens.com/productcert/csaf/ssa-360681.json; https://cert-portal.siemens.com/productcert/html/ssa-360681.html; https://www.cisa.gov/uscert/ics/advisories/icsa-22-349-15
CVE: CVE-2022-3161
Published: 2023-01-13
Description: 

The APDFL.dll contains a memory corruption vulnerability while parsing 
specially crafted PDF files. This could allow an attacker to execute 
code in the context of the current process.






CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-787
References: https://cert-portal.siemens.com/productcert/csaf/ssa-360681.json; https://cert-portal.siemens.com/productcert/html/ssa-360681.html; https://www.cisa.gov/uscert/ics/advisories/icsa-22-349-15
CVE: CVE-2022-42274
Published: 2023-01-13
Description: NVIDIA BMC contains a vulnerability in IPMI handler, where an authorized attacker can cause a buffer overflow and cause a denial of service or gain code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120, CWE-120
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5435; https://nvidia.custhelp.com/app/answers/detail/a_id/5435
CVE: CVE-2022-42275
Published: 2023-01-13
Description: NVIDIA BMC IPMI handler allows an unauthenticated host to write to a host SPI flash bypassing secureboot protections. This may lead to a loss of integrity and denial of service.
CVSS Score: 7.7 (HIGH)
CWE: CWE-288, CWE-306
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5435; https://nvidia.custhelp.com/app/answers/detail/a_id/5435
CVE: CVE-2022-46471
Published: 2023-01-13
Description: Online Health Care System v1.0 was discovered to contain a SQL injection vulnerability via the consulting_id parameter at /healthcare/Admin/consulting_detail.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/dreamwonly/bug_report/blob/main/vendors/janobe/Online%20Health%20Care%20System/SQLi-1.md; https://github.com/dreamwonly/bug_report/blob/main/vendors/janobe/Online%20Health%20Care%20System/SQLi-1.md
CVE: CVE-2022-46478
Published: 2023-01-13
Description: The RPC interface in datax-web v1.0.0 and v2.0.0 to v2.1.2 contains no permission checks by default which allows attackers to execute arbitrary commands via crafted Hessian serialized data.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502, CWE-502
References: https://github.com/WeiYe-Jing/datax-web/issues/587; https://github.com/WeiYe-Jing/datax-web/issues/587
CVE: CVE-2022-48256
Published: 2023-01-13
Description: Technitium DNS Server before 10.0 allows a self-CNAME denial-of-service attack in which a CNAME loop causes an answer to contain hundreds of records.
CVSS Score: 7.5 (HIGH)
CWE: CWE-835, CWE-835
References: https://github.com/TechnitiumSoftware/DnsServer/blob/master/CHANGELOG.md#version-100; https://github.com/TechnitiumSoftware/DnsServer/blob/master/CHANGELOG.md#version-100
CVE: CVE-2022-48257
Published: 2023-01-13
Description: In Eternal Terminal 6.2.1, etserver and etclient have predictable logfile names in /tmp.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-732, CWE-732
References: http://www.openwall.com/lists/oss-security/2023/02/16/1; https://github.com/MisterTea/EternalTerminal/issues/555; https://github.com/MisterTea/EternalTerminal/pull/556
CVE: CVE-2022-48258
Published: 2023-01-13
Description: In Eternal Terminal 6.2.1, etserver and etclient have world-readable logfiles.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://www.openwall.com/lists/oss-security/2023/02/16/1; https://github.com/MisterTea/EternalTerminal/issues/555; https://github.com/MisterTea/EternalTerminal/pull/556
CVE: CVE-2023-23559
Published: 2023-01-13
Description: In rndis_query_oid in drivers/net/wireless/rndis_wlan.c in the Linux kernel through 6.1.5, there is an integer overflow in an addition.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190, CWE-190
References: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=b870e73a56c4cccbec33224233eaf295839f228c; https://lists.debian.org/debian-lts-announce/2023/05/msg00005.html; https://lists.debian.org/debian-lts-announce/2023/05/msg00006.html
CVE: CVE-2022-42276
Published: 2023-01-13
Description: NVIDIA DGX A100 contains a vulnerability in SBIOS in the SmiFlash, where a local user with elevated privileges can read, write and erase flash, which may lead to code execution, escalation of privileges, denial of service, and information disclosure. The scope of impact can extend to other components.
CVSS Score: 7.5 (HIGH)
CWE: CWE-288, CWE-306
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5435; https://nvidia.custhelp.com/app/answers/detail/a_id/5435
CVE: CVE-2022-42277
Published: 2023-01-13
Description: NVIDIA DGX Station contains a vulnerability in SBIOS in the SmiFlash, where a local user with elevated privileges can read, write and erase flash, which may lead to code execution, escalation of privileges, denial of service, and information disclosure. The scope of impact can extend to other components.
CVSS Score: 7.5 (HIGH)
CWE: CWE-288, CWE-306
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5435; https://nvidia.custhelp.com/app/answers/detail/a_id/5435
CVE: CVE-2022-42278
Published: 2023-01-13
Description: NVIDIA BMC contains a vulnerability in SPX REST API, where an authorized attacker can read and write to arbitrary locations within the memory context of the IPMI server process, which may lead to code execution, denial of service, information disclosure and data tampering.
CVSS Score: 7.2 (HIGH)
CWE: CWE-119
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5435; https://nvidia.custhelp.com/app/answers/detail/a_id/5435
CVE: CVE-2022-42279
Published: 2023-01-13
Description: NVIDIA BMC contains a vulnerability in SPX REST API, where an authorized attacker can inject arbitrary shell commands, which may lead to code execution, denial of service, information disclosure and data tampering.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78, CWE-78
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5435; https://nvidia.custhelp.com/app/answers/detail/a_id/5435
CVE: CVE-2022-42280
Published: 2023-01-13
Description: NVIDIA BMC contains a vulnerability in SPX REST auth handler, where an un-authorized attacker can exploit a path traversal, which may lead to authentication bypass.
CVSS Score: 7.1 (HIGH)
CWE: CWE-22, CWE-22
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5435; https://nvidia.custhelp.com/app/answers/detail/a_id/5435
CVE: CVE-2022-42281
Published: 2023-01-13
Description: NVIDIA DGX A100 contains a vulnerability in SBIOS in the FsRecovery, which may allow a highly privileged local attacker to cause an out-of-bounds write, which may lead to code execution, denial of service, compromised integrity, and information disclosure.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5435; https://nvidia.custhelp.com/app/answers/detail/a_id/5435
CVE: CVE-2022-42282
Published: 2023-01-13
Description: NVIDIA BMC contains a vulnerability in SPX REST API, where an authorized attacker can access arbitrary files, which may lead to information disclosure.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5435; https://nvidia.custhelp.com/app/answers/detail/a_id/5435
CVE: CVE-2022-42283
Published: 2023-01-13
Description: NVIDIA BMC contains a vulnerability in IPMI handler, where an authorized attacker can cause a buffer overflow and cause a denial of service or gain code execution.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-120, CWE-120
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5435; https://nvidia.custhelp.com/app/answers/detail/a_id/5435
CVE: CVE-2022-42284
Published: 2023-01-13
Description: NVIDIA BMC stores user passwords in an obfuscated form in a database accessible by the host. This may lead to a credentials exposure.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-312, CWE-312
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5435; https://nvidia.custhelp.com/app/answers/detail/a_id/5435
CVE: CVE-2022-42285
Published: 2023-01-13
Description: DGX A100 SBIOS contains a vulnerability in the Pre-EFI Initialization (PEI)phase, where a privileged user can disable SPI flash protection, which may lead to denial of service, escalation of privileges, or data tampering.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-1231
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5435; https://nvidia.custhelp.com/app/answers/detail/a_id/5435
CVE: CVE-2022-46502
Published: 2023-01-13
Description: Online Student Enrollment System v1.0 was discovered to contain a SQL injection vulnerability via the username parameter at /student_enrollment/admin/login.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/snowingllll/bug_report/blob/main/vendors/donbermoy/Online%20Student%20Enrollment%20System/SQLi-1.md; https://github.com/snowingllll/bug_report/blob/main/vendors/donbermoy/Online%20Student%20Enrollment%20System/SQLi-1.md
CVE: CVE-2022-42286
Published: 2023-01-13
Description: DGX A100 SBIOS contains a vulnerability in Bds, which may lead to code execution, denial of service, or escalation of privileges.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-119
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5435; https://nvidia.custhelp.com/app/answers/detail/a_id/5435
CVE: CVE-2022-42287
Published: 2023-01-13
Description: NVIDIA BMC contains a vulnerability in IPMI handler, where an authorized attacker can upload and download arbitrary files under certain circumstances, which may lead to denial of service, escalation of privileges, information disclosure and data tampering.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-22, CWE-434
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5435; https://nvidia.custhelp.com/app/answers/detail/a_id/5435
CVE: CVE-2022-42288
Published: 2023-01-13
Description: NVIDIA BMC contains a vulnerability in IPMI handler, where an unauthorized attacker can use certain oracles to guess a valid BMC username, which may lead to an information disclosure.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-208, CWE-203
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5435; https://nvidia.custhelp.com/app/answers/detail/a_id/5435
CVE: CVE-2022-42289
Published: 2023-01-13
Description: NVIDIA BMC contains a vulnerability in SPX REST API, where an authorized attacker can inject arbitrary shell commands, which may lead to code execution, denial of service, information disclosure and data tampering.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78, CWE-78
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5435; https://nvidia.custhelp.com/app/answers/detail/a_id/5435
CVE: CVE-2022-42290
Published: 2023-01-13
Description: NVIDIA BMC contains a vulnerability in SPX REST API, where an authorized attacker can inject arbitrary shell commands, which may lead to code execution, denial of service, information disclosure and data tampering.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78, CWE-78
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5435; https://nvidia.custhelp.com/app/answers/detail/a_id/5435
CVE: CVE-2023-23566
Published: 2023-01-13
Description: A 2-Step Verification problem in Axigen 10.3.3.52 allows an attacker to access a mailbox by bypassing 2-Step Verification when they try to add an account to any third-party webmail service (or add an account to Outlook or Gmail, etc.) with IMAP or POP3 without any verification code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-276
References: https://github.com/umz-cert/vulnerabilities/issues/1; https://github.com/umz-cert/vulnerabilitys/blob/patch-1/Axigen%20Mail%20Server%2010.3.3.52%202-Step%20verification; https://www.axigen.com/documentation/2-step-verification-two-factor-authentication-for-webmail-p69140479
CVE: CVE-2022-21191
Published: 2023-01-13
Description: Versions of the package global-modules-path before 3.0.0 are vulnerable to Command Injection due to missing input sanitization or other checks and sandboxes being employed to the getPath  function.
CVSS Score: 7.4 (HIGH)
CWE: CWE-78, CWE-77
References: https://github.com/lorenzomigliorero/npm-node-utils/blob/b55dd81c597db657c9751332bb2242403fd3e26b/index.js%23L186; https://github.com/rosen-vladimirov/global-modules-path/commit/edbdaff077ea0cf295b1469923c06bbccad3c180; https://github.com/rosen-vladimirov/global-modules-path/releases/tag/v3.0.0
CVE: CVE-2023-0235
Published: 2023-01-13
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none.