deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-38333
Published: 2022-09-19
Description: Openwrt before v21.02.3 and Openwrt v22.03.0-rc6 were discovered to contain two skip loops in the function header_value(). This vulnerability allows attackers to access sensitive information via a crafted HTTP request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://git.openwrt.org/?p=project/cgi-io.git%3Ba=commit%3Bh=901b0f0463c9d16a8cf5b9ed37118d8484bc9176; https://git.openwrt.org/?p=project/cgi-io.git%3Ba=commitdiff%3Bh=901b0f0463c9d16a8cf5b9ed37118d8484bc9176; https://git.openwrt.org/?p=project/cgi-io.git%3Ba=patch%3Bh=901b0f0463c9d16a8cf5b9ed37118d8484bc9176
CVE: CVE-2022-3218
Published: 2022-09-19
Description: Due to a reliance on client-side authentication, the WiFi Mouse (Mouse Server) from Necta LLC's authentication mechanism is trivially bypassed, which can result in remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-603, CWE-287
References: http://packetstormsecurity.com/files/168509/WiFi-Mouse-1.8.3.4-Remote-Code-Execution.html; https://github.com/H4rk3nz0/PenTesting/blob/main/Exploits/wifi%20mouse/wifi-mouse-server-rce.py; https://github.com/rapid7/metasploit-framework/pull/16985
CVE: CVE-2022-40468
Published: 2022-09-19
Description: Potential leak of left-over heap data if custom error page templates containing special non-standard variables are used. Tinyproxy commit 84f203f and earlier use uninitialized buffers in process_request() function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1188
References: https://github.com/tinyproxy/tinyproxy; https://github.com/tinyproxy/tinyproxy/blob/84f203fb1c4733608c7283bbe794005a469c4b00/src/reqs.c#L346; https://github.com/tinyproxy/tinyproxy/issues/457
CVE: CVE-2022-34893
Published: 2022-09-19
Description: Trend Micro Security 2022 (consumer) has a link following vulnerability where an attacker with lower privileges could manipulate a mountpoint which could lead to escalation of privilege on an affected machine.
CVSS Score: 7.8 (HIGH)
CWE: CWE-59
References: https://helpcenter.trendmicro.com/en-us/article/tmka-11053; https://www.zerodayinitiative.com/advisories/ZDI-22-1175/; https://helpcenter.trendmicro.com/en-us/article/tmka-11053
CVE: CVE-2022-37347
Published: 2022-09-19
Description: Trend Micro Security 2021 and 2022 (Consumer) is vulnerable to an Out-Of-Bounds Read Information Disclosure Vulnerability that could allow an attacker to read sensitive information from other memory locations and cause a crash on an affected machine. This vulnerability is similar to, but not the same as CVE-2022-35234.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://helpcenter.trendmicro.com/en-us/article/tmka-11058; https://www.zerodayinitiative.com/advisories/ZDI-22-1176/; https://helpcenter.trendmicro.com/en-us/article/tmka-11058
CVE: CVE-2022-37348
Published: 2022-09-19
Description: Trend Micro Security 2021 and 2022 (Consumer) is vulnerable to an Out-Of-Bounds Read Information Disclosure Vulnerability that could allow an attacker to read sensitive information from other memory locations and cause a crash on an affected machine. This vulnerability is similar to, but not the same as CVE-2022-37347.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://helpcenter.trendmicro.com/en-us/article/tmka-11058; https://www.zerodayinitiative.com/advisories/ZDI-22-1177/; https://helpcenter.trendmicro.com/en-us/article/tmka-11058
CVE: CVE-2022-38764
Published: 2022-09-19
Description: A vulnerability on Trend Micro HouseCall version 1.62.1.1133 and below could allow a local attacker to escalate privlieges due to an overly permissive folder om the product installer.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276
References: https://helpcenter.trendmicro.com/en-us/article/tmka-11092; https://www.zerodayinitiative.com/advisories/ZDI-22-1178/; https://helpcenter.trendmicro.com/en-us/article/tmka-11092
CVE: CVE-2022-3213
Published: 2022-09-19
Description: A heap buffer overflow issue was found in ImageMagick. When an application processes a malformed TIFF file, it could lead to undefined behavior or a crash causing a denial of service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119, CWE-787
References: https://access.redhat.com/security/cve/CVE-2022-3213; https://bugzilla.redhat.com/show_bug.cgi?id=2126824; https://github.com/ImageMagick/ImageMagick/commit/30ccf9a0da1f47161b5935a95be854fe84e6c2a2
CVE: CVE-2022-40139
Published: 2022-09-19
Description: Improper validation of some components used by the rollback mechanism in Trend Micro Apex One and Trend Micro Apex One as a Service clients could allow a Apex One server administrator to instruct affected clients to download an unverified rollback package, which could lead to remote code execution. Please note: an attacker must first obtain Apex One server administration console access in order to exploit this vulnerability.
CVSS Score: 7.2 (HIGH)
References: https://success.trendmicro.com/solution/000291528; https://success.trendmicro.com/solution/000291528; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-40139
CVE: CVE-2022-40140
Published: 2022-09-19
Description: An origin validation error vulnerability in Trend Micro Apex One and Apex One as a Service could allow a local attacker to cause a denial-of-service on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-346
References: https://success.trendmicro.com/solution/000291528; https://www.zerodayinitiative.com/advisories/ZDI-22-1189/; https://success.trendmicro.com/solution/000291528
CVE: CVE-2022-40141
Published: 2022-09-19
Description: A vulnerability in Trend Micro Apex One and Apex One as a Service could allow an attacker to intercept and decode certain communication strings that may contain some identification attributes of a particular Apex One server.
CVSS Score: 7.5 (HIGH)
References: https://success.trendmicro.com/solution/000291528; https://success.trendmicro.com/solution/000291528
CVE: CVE-2022-40142
Published: 2022-09-19
Description: A security link following local privilege escalation vulnerability in Trend Micro Apex One and Trend Micro Apex One as a Service agents could allow a local attacker to create a writable folder in an arbitrary location and escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://success.trendmicro.com/solution/000291528; https://www.zerodayinitiative.com/advisories/ZDI-22-1190/; https://success.trendmicro.com/solution/000291528
CVE: CVE-2022-40143
Published: 2022-09-19
Description: A link following local privilege escalation vulnerability in Trend Micro Apex One and Trend Micro Apex One as a Service servers could allow a local attacker to abuse an insecure directory that could allow a low-privileged user to run arbitrary code with elevated privileges. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
CVSS Score: 7.3 (HIGH)
CWE: CWE-59
References: https://success.trendmicro.com/solution/000291528; https://www.zerodayinitiative.com/advisories/ZDI-22-1191/; https://success.trendmicro.com/solution/000291528
CVE: CVE-2022-40144
Published: 2022-09-19
Description: A vulnerability in Trend Micro Apex One and Trend Micro Apex One as a Service could allow an attacker to bypass the product's login authentication by falsifying request parameters on affected installations.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://appweb.trendmicro.com/SupportNews/NewsDetail.aspx?id=4553; https://jvn.jp/en/jp/JVN36454862/index.html; https://success.trendmicro.com/solution/000291528
CVE: CVE-2022-40234
Published: 2022-09-19
Description: Versions of IBM Spectrum Protect Plus prior to 10.1.12 (excluding 10.1.12) include the private key information for a certificate inside the generated .crt file when uploading a TLS certificate to IBM Spectrum Protect Plus. If this generated .crt file is shared, an attacker can obtain the private key information for the uploaded certificate. IBM X-Force ID: 235718.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-668
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/235718; https://www.ibm.com/support/pages/node/6619947; https://exchange.xforce.ibmcloud.com/vulnerabilities/235718
CVE: CVE-2022-40608
Published: 2022-09-19
Description: IBM Spectrum Protect Plus 10.1.6 through 10.1.11 Microsoft File Systems restore operation can download any file on the target machine by manipulating the URL with a directory traversal attack. This results in the restore operation gaining access to files which the operator should not have access to. IBM X-Force ID: 235873.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/235873; https://www.ibm.com/support/pages/node/6620209; https://exchange.xforce.ibmcloud.com/vulnerabilities/235873
CVE: CVE-2022-40980
Published: 2022-09-19
Description: A potential unathenticated file deletion vulnerabilty on Trend Micro Mobile Security for Enterprise 9.8 SP5 could allow an attacker with access to the Management Server to delete files. This issue was resolved in 9.8 SP5 Critical Patch 2.
CVSS Score: 9.1 (CRITICAL)
References: https://files.trendmicro.com/documentation/readme/tmms_sp5_cp2/tmms-ee_9.8_sp5_patch2_readme_server.txt; https://files.trendmicro.com/documentation/readme/tmms_sp5_cp2/tmms-ee_9.8_sp5_patch2_readme_server.txt
CVE: CVE-2022-23766
Published: 2022-09-19
Description: An improper input validation vulnerability leading to arbitrary file execution was discovered in BigFileAgent. In order to cause arbitrary files to be executed, the attacker makes the victim access a web page d by them or inserts a script using XSS into a general website.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20, CWE-20
References: https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=66925; https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=66925
CVE: CVE-2022-23767
Published: 2022-09-19
Description: This vulnerability of SecureGate is SQL-Injection using login without password. A path traversal vulnerability is also identified during file transfer. An attacker can take advantage of these vulnerabilities to perform various attacks such as obtaining privileges and executing remote code, thereby taking over the victim’s system.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22, CWE-89, CWE-288, CWE-22, CWE-89
References: https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=66926; https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=66926
CVE: CVE-2022-23768
Published: 2022-09-19
Description: This Vulnerability in NIS-HAP11AC is caused by an exposed external port for the telnet service. Remote attackers use this vulnerability to induce all attacks such as source code hijacking, remote control of the device.
CVSS Score: 8.8 (HIGH)
CWE: CWE-284
References: https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=66928; https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=66928
CVE: CVE-2022-29835
Published: 2022-09-19
Description: WD Discovery software executable files were signed with an unsafe SHA-1 hashing algorithm. An attacker could use this weakness to create forged certificate signatures due to the use of a hashing algorithm that is not collision-free. This could thereby impact the confidentiality of user content. This issue affects: Western Digital WD Discovery WD Discovery Desktop App versions prior to 4.4.396 on Mac; WD Discovery Desktop App versions prior to 4.4.396 on Windows.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-328, CWE-326
References: https://www.westerndigital.com/support/product-security/wdc-22014-wd-discovery-desktop-app-version-4-4-396; https://www.westerndigital.com/support/product-security/wdc-22014-wd-discovery-desktop-app-version-4-4-396
CVE: CVE-2022-2995
Published: 2022-09-19
Description: Incorrect handling of the supplementary groups in the CRI-O container engine might lead to sensitive information disclosure or possible data modification if an attacker has direct access to the affected container where supplementary groups are used to set access permissions and is able to execute a binary code in that container.
CVSS Score: 7.1 (HIGH)
CWE: CWE-284, CWE-732
References: https://github.com/cri-o/cri-o/pull/6159; https://www.benthamsgaze.org/2022/08/22/vulnerability-in-linux-containers-investigation-and-mitigation/; https://github.com/cri-o/cri-o/pull/6159
CVE: CVE-2022-38576
Published: 2022-09-19
Description: Interview Management System v1.0 was discovered to contain a SQL injection vulnerability via the component /interview/delete.php?action=deletecand&id=.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/gith-boot/bug_report/blob/main/vendors/janobe/interview-management-system/SQLi-1.md; https://github.com/gith-boot/bug_report/blob/main/vendors/janobe/interview-management-system/SQLi-1.md
CVE: CVE-2022-3239
Published: 2022-09-19
Description: A flaw use after free in the Linux kernel video4linux driver was found in the way user triggers em28xx_usb_probe() for the Empia 28xx based TV cards. A local user could use this flaw to crash the system or potentially escalate their privileges on the system.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=c08eadca1bdfa099e20a32f8fa4b52b2f672236d; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=c08eadca1bdfa099e20a32f8fa4b52b2f672236d
CVE: CVE-2022-28201
Published: 2022-09-19
Description: An issue was discovered in MediaWiki before 1.35.6, 1.36.x before 1.36.4, and 1.37.x before 1.37.2. Users with the editinterface permission can trigger infinite recursion, because a bare local interwiki is mishandled for the mainpage message.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-674
References: https://blog.legoktm.com/2022/07/03/a-belated-writeup-of-cve-2022-28201-in-mediawiki.html; https://lists.debian.org/debian-lts-announce/2022/09/msg00027.html; https://phabricator.wikimedia.org/T297571
CVE: CVE-2022-28203
Published: 2022-09-19
Description: A denial-of-service issue was discovered in MediaWiki before 1.35.6, 1.36.x before 1.36.4, and 1.37.x before 1.37.2. When many files exist, requesting Special:NewFiles with actor as a condition can result in a very long running query.
CVSS Score: 7.5 (HIGH)
CWE: CWE-763
References: https://lists.debian.org/debian-lts-announce/2022/09/msg00027.html; https://phabricator.wikimedia.org/T297731; https://www.debian.org/security/2022/dsa-5246
CVE: CVE-2022-28204
Published: 2022-09-19
Description: A denial-of-service issue was discovered in MediaWiki 1.37.x before 1.37.2. Rendering of w/index.php?title=Special%3AWhatLinksHere&target=Property%3AP31&namespace=1&invert=1 can take more than thirty seconds. There is a DDoS risk.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://phabricator.wikimedia.org/T297754; https://phabricator.wikimedia.org/T297754
CVE: CVE-2022-38351
Published: 2022-09-19
Description: A vulnerability in Suprema BioStar (aka Bio Star) 2 v2.8.16 allows attackers to escalate privileges to System Administrator via a crafted PUT request to the update profile page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-269, CWE-269
References: https://nobugescapes.com/blog/privilege-escalation-from-user-operator-to-system-administrator/; https://nobugescapes.com/wp-content/uploads/2022/08/Part1.docx; https://nobugescapes.com/blog/privilege-escalation-from-user-operator-to-system-administrator/
CVE: CVE-2022-0143
Published: 2022-09-19
Description: When the LDAP connector is started with StartTLS configured, unauthenticated access is granted. This issue affects: all versions of the LDAP connector prior to 1.5.20.9. The LDAP connector is bundled with Identity Management (IDM) and Remote Connector Server (RCS)
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-284, CWE-863
References: https://backstage.forgerock.com/downloads/browse/idm/featured/connectors; https://backstage.forgerock.com/knowledge/kb/article/a11380515; https://backstage.forgerock.com/downloads/browse/idm/featured/connectors
CVE: CVE-2022-28321
Published: 2022-09-19
Description: The Linux-PAM package before 1.5.2-6.1 for openSUSE Tumbleweed allows authentication bypass for SSH logins. The pam_access.so module doesn't correctly restrict login if a user tries to connect from an IP address that is not resolvable via DNS. In such conditions, a user with denied access to a machine can still get access. NOTE: the relevance of this issue is largely limited to openSUSE Tumbleweed and openSUSE Factory; it does not affect Linux-PAM upstream.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287, CWE-287
References: http://download.opensuse.org/source/distribution/openSUSE-current/repo/oss/src/; https://bugzilla.suse.com/show_bug.cgi?id=1197654; https://www.suse.com/security/cve/CVE-2022-28321.html
CVE: CVE-2022-35060
Published: 2022-09-19
Description: OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6c0a32.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://drive.google.com/file/d/1VYQgASJR85XpuaakJJxRh_HmAoa61Nce/view?usp=sharing; https://github.com/Cvjark/Poc/blob/main/otfcc/CVE-2022-35060.md; https://drive.google.com/file/d/1VYQgASJR85XpuaakJJxRh_HmAoa61Nce/view?usp=sharing
CVE: CVE-2022-35061
Published: 2022-09-19
Description: OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6e412a.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://drive.google.com/file/d/1q7LJap9D_gyo-L64b3Nhfc4zEC-_mcH3/view?usp=sharing; https://github.com/Cvjark/Poc/blob/main/otfcc/CVE-2022-35061.md; https://drive.google.com/file/d/1q7LJap9D_gyo-L64b3Nhfc4zEC-_mcH3/view?usp=sharing
CVE: CVE-2022-35062
Published: 2022-09-19
Description: OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6c0bc3.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://drive.google.com/file/d/10KZeJTraCRuFED4y6Dv0XyPA-QJydKSa/view?usp=sharing; https://github.com/Cvjark/Poc/blob/main/otfcc/CVE-2022-35062.md; https://drive.google.com/file/d/10KZeJTraCRuFED4y6Dv0XyPA-QJydKSa/view?usp=sharing
CVE: CVE-2022-35063
Published: 2022-09-19
Description: OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6e41a8.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://drive.google.com/file/d/1VW_6SXTGWABHMqW6m-hpfpbedaJFFG5b/view?usp=sharing; https://github.com/Cvjark/Poc/blob/main/otfcc/CVE-2022-35063.md; https://drive.google.com/file/d/1VW_6SXTGWABHMqW6m-hpfpbedaJFFG5b/view?usp=sharing
CVE: CVE-2022-35064
Published: 2022-09-19
Description: OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x4adcdb in __asan_memset.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://drive.google.com/file/d/1btOL19V9nmB4BCUBSQ2fViABe3tMZ8mp/view?usp=sharing; https://github.com/Cvjark/Poc/blob/main/otfcc/CVE-2022-35064.md; https://drive.google.com/file/d/1btOL19V9nmB4BCUBSQ2fViABe3tMZ8mp/view?usp=sharing
CVE: CVE-2022-35065
Published: 2022-09-19
Description: OTFCC commit 617837b was discovered to contain a segmentation violation via /release-x64/otfccdump+0x65f724.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787
References: https://drive.google.com/file/d/1emVd7wtL-kIhpSrl0ynkuci2KsSnaoO9/view?usp=sharing; https://github.com/Cvjark/Poc/blob/main/otfcc/CVE-2022-35065.md; https://drive.google.com/file/d/1emVd7wtL-kIhpSrl0ynkuci2KsSnaoO9/view?usp=sharing
CVE: CVE-2022-35066
Published: 2022-09-19
Description: OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6e41b8.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://drive.google.com/file/d/1zUk2e65kK-htzApaQZguAQgT6nqq4S7J/view?usp=sharing; https://github.com/Cvjark/Poc/blob/main/otfcc/CVE-2022-35066.md; https://drive.google.com/file/d/1zUk2e65kK-htzApaQZguAQgT6nqq4S7J/view?usp=sharing
CVE: CVE-2022-35067
Published: 2022-09-19
Description: OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6e41b0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://drive.google.com/file/d/12PsreXrpGGy0Rx2URDd4XmlPPh5wVLmF/view?usp=sharing; https://github.com/Cvjark/Poc/blob/main/otfcc/CVE-2022-35067.md; https://drive.google.com/file/d/12PsreXrpGGy0Rx2URDd4XmlPPh5wVLmF/view?usp=sharing
CVE: CVE-2022-35068
Published: 2022-09-19
Description: OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6e420d.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://drive.google.com/file/d/193D7sPydmZiciaRD3r1UK_V3VT17GJFA/view?usp=sharing; https://github.com/Cvjark/Poc/blob/main/otfcc/CVE-2022-35068.md; https://drive.google.com/file/d/193D7sPydmZiciaRD3r1UK_V3VT17GJFA/view?usp=sharing
CVE: CVE-2022-35069
Published: 2022-09-19
Description: OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6b544e.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787
References: https://drive.google.com/file/d/1MRrjkDzgaSXPuA994xggZcEAH-QfAvXK/view?usp=sharing; https://github.com/Cvjark/Poc/blob/main/otfcc/CVE-2022-35069.md; https://drive.google.com/file/d/1MRrjkDzgaSXPuA994xggZcEAH-QfAvXK/view?usp=sharing
CVE: CVE-2022-35070
Published: 2022-09-19
Description: OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x65fc97.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787
References: https://drive.google.com/file/d/13_Iq4Uj3B4iz07N8qWYhx_bZd618F6YN/view?usp=sharing; https://github.com/Cvjark/Poc/blob/main/otfcc/CVE-2022-35070.md; https://drive.google.com/file/d/13_Iq4Uj3B4iz07N8qWYhx_bZd618F6YN/view?usp=sharing
CVE: CVE-2022-37032
Published: 2022-09-19
Description: An out-of-bounds read in the BGP daemon of FRRouting FRR before 8.4 may lead to a segmentation fault and denial of service. This occurs in bgp_capability_msg_parse in bgpd/bgp_packet.c.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-125
References: https://bugzilla.suse.com/show_bug.cgi?id=1202023; https://github.com/FRRouting/frr/commit/6d58272b4cf96f0daa846210dd[PII_REDACTED]f921; https://github.com/FRRouting/frr/commit/ff6db1027f8f36df657ff2e5ea[PII_REDACTED]7ed
CVE: CVE-2022-38339
Published: 2022-09-19
Description: Safe Software FME Server v2021.2.5, v2022.0.0.2 and below contains a cross-site scripting (XSS) vulnerability which allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the login page.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-79
References: https://community.safe.com/s/article/FME-Server-Stored-Cross-Site-Scripting-XSS-Vulnerabilities; https://www.cycura.com/blog/safe-software-inc-fme-server-vulnerability-disclosure/; https://community.safe.com/s/article/FME-Server-Stored-Cross-Site-Scripting-XSS-Vulnerabilities
CVE: CVE-2022-38509
Published: 2022-09-19
Description: Wedding Planner v1.0 was discovered to contain a SQL injection vulnerability via the booking_id parameter at /admin/budget.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/ptanly/bug_report/blob/main/vendors/pushpam02/wedding-planner/SQLi-1.md; https://github.com/ptanly/bug_report/blob/main/vendors/pushpam02/wedding-planner/SQLi-1.md
CVE: CVE-2022-38527
Published: 2022-09-19
Description: UCMS v1.6.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Import function under the Site Management page.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/Zoe0427/UCMS-v1.6/blob/gh-pages/UCMS_v1.6.0%20XSS.md; https://github.com/Zoe0427/UCMS-v1.6/blob/gh-pages/UCMS_v1.6.0%20XSS.md