deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-21755
Published: 2022-06-06
Description: In WLAN driver, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06545464; Issue ID: ALPS06545464.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-125
References: https://corp.mediatek.com/product-security-bulletin/June-2022; https://corp.mediatek.com/product-security-bulletin/June-2022
CVE: CVE-2022-21756
Published: 2022-06-06
Description: In WLAN driver, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06535950; Issue ID: ALPS06535950.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-125
References: https://corp.mediatek.com/product-security-bulletin/June-2022; https://corp.mediatek.com/product-security-bulletin/June-2022
CVE: CVE-2022-21757
Published: 2022-06-06
Description: In WIFI Firmware, there is a possible system crash due to a missing count check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06468894; Issue ID: ALPS06468894.
CVSS Score: 7.5 (HIGH)
CWE: CWE-354
References: https://corp.mediatek.com/product-security-bulletin/June-2022; https://corp.mediatek.com/product-security-bulletin/June-2022
CVE: CVE-2022-21758
Published: 2022-06-06
Description: In ccu, there is a possible memory corruption due to a double free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06439600; Issue ID: ALPS06439600.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-415
References: https://corp.mediatek.com/product-security-bulletin/June-2022; https://corp.mediatek.com/product-security-bulletin/June-2022
CVE: CVE-2022-21759
Published: 2022-06-06
Description: In power service, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06419106; Issue ID: ALPS06419077.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://corp.mediatek.com/product-security-bulletin/June-2022; https://corp.mediatek.com/product-security-bulletin/June-2022
CVE: CVE-2022-21760
Published: 2022-06-06
Description: In apusys driver, there is a possible system crash due to an integer overflow. This could lead to local denial of service with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06479562; Issue ID: ALPS06479562.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-190
References: https://corp.mediatek.com/product-security-bulletin/June-2022; https://corp.mediatek.com/product-security-bulletin/June-2022
CVE: CVE-2022-21761
Published: 2022-06-06
Description: In apusys driver, there is a possible system crash due to an integer overflow. This could lead to local denial of service with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06479532; Issue ID: ALPS06479532.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-190
References: https://corp.mediatek.com/product-security-bulletin/June-2022; https://corp.mediatek.com/product-security-bulletin/June-2022
CVE: CVE-2022-21762
Published: 2022-06-06
Description: In apusys driver, there is a possible system crash due to an integer overflow. This could lead to local denial of service with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06477946; Issue ID: ALPS06477946.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-190
References: https://corp.mediatek.com/product-security-bulletin/June-2022; https://corp.mediatek.com/product-security-bulletin/June-2022
CVE: CVE-2022-23712
Published: 2022-06-06
Description: A Denial of Service flaw was discovered in Elasticsearch. Using this vulnerability, an unauthenticated attacker could forcibly shut down an Elasticsearch node with a specifically formatted network request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-754
References: https://discuss.elastic.co/t/elastic-stack-7-17-4-and-8-2-1-security-update/305530; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.elastic.co/community/security/
CVE: CVE-2022-28224
Published: 2022-06-06
Description: Clusters using Calico (version 3.22.1 and below), Calico Enterprise (version 3.12.0 and below), may be vulnerable to route hijacking with the floating IP feature. Due to insufficient validation, a privileged attacker may be able to set a floating IP annotation to a pod even if the feature is not enabled. This may allow the attacker to intercept and reroute traffic to their compromised pod.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200, CWE-201, CWE-20
References: https://www.tigera.io/security-bulletins-tta-2022-001/; https://www.tigera.io/security-bulletins-tta-2022-001/
CVE: CVE-2022-1550
Published: 2022-06-06
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2022-22396
Published: 2022-06-06
Description: Credentials are printed in clear text in the IBM Spectrum Protect Plus 10.1.0.0 through 10.1.9.3 virgo log file in certain cases. Credentials could be the remote vSnap, offload targets, or VADP credentials depending on the operation performed. Credentials that are using API key or certificate are not printed. IBM X-Force ID: 222231.
CVSS Score: 7.5 (HIGH)
CWE: CWE-522
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/222231; https://www.ibm.com/support/pages/node/6591505; https://exchange.xforce.ibmcloud.com/vulnerabilities/222231
CVE: CVE-2022-30586
Published: 2022-06-06
Description: Gradle Enterprise through 2022.2.2 has Incorrect Access Control that leads to code execution.
CVSS Score: 7.2 (HIGH)
CWE: CWE-200
References: https://security.gradle.com; https://security.gradle.com/advisory/2022-09; https://security.gradle.com
CVE: CVE-2022-31493
Published: 2022-06-06
Description: LibreHealth EHR Base 2.0.0 allows gacl/admin/acl_admin.php acl_id XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/LibreHealthIO/lh-ehr/tags; https://gitlab.com/librehealth/ehr/lh-ehr/-/tags; https://nitroteam.kz/index.php?action=researches&slug=librehealth2_r
CVE: CVE-2022-31768
Published: 2022-06-06
Description: IBM InfoSphere Information Server 11.7 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/227986; https://www.ibm.com/support/pages/node/6592573; https://exchange.xforce.ibmcloud.com/vulnerabilities/227986
CVE: CVE-2022-32275
Published: 2022-06-06
Description: Grafana 8.4.3 allows reading files via (for example) a /dashboard/snapshot/%7B%7Bconstructor.constructor'/.. /.. /.. /.. /.. /.. /.. /.. /etc/passwd URI. NOTE: the vendor's position is that there is no vulnerability; this request yields a benign error page, not /etc/passwd content
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/BrotherOfJhonny/grafana; https://github.com/BrotherOfJhonny/grafana/blob/main/README.md; https://github.com/grafana/grafana/issues/50336
CVE: CVE-2020-6220
Published: 2022-06-06
Description: BI Launchpad and CMC in SAP Business Objects Business Intelligence Platform, versions 4.1, 4.2, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. Exploit is possible only when the bttoken in victim’s session is active.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-79
References: https://launchpad.support.sap.com/#/notes/2878507; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=544214202; https://launchpad.support.sap.com/#/notes/2878507
CVE: CVE-2022-29617
Published: 2022-06-06
Description: Due to improper error handling an authenticated user can crash CLA assistant instance. This could impact the availability of the application.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-755, CWE-755
References: https://github.com/cla-assistant/cla-assistant/security/advisories/GHSA-jjjv-grgr-v8h3; https://github.com/cla-assistant/cla-assistant/security/advisories/GHSA-jjjv-grgr-v8h3
CVE: CVE-2022-30587
Published: 2022-06-06
Description: Gradle Enterprise through 2022.2.2 has Incorrect Access Control that leads to information disclosure.
CVSS Score: 7.5 (HIGH)
CWE: CWE-522
References: https://security.gradle.com; https://security.gradle.com/advisory/2022-10; https://security.gradle.com
CVE: CVE-2022-31492
Published: 2022-06-06
Description: Cross Site scripting (XSS) vulnerability inLibreHealth EHR Base 2.0.0 via interface/usergroup/usergroup_admin_add.php Username.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/LibreHealthIO/lh-ehr/tags; https://gitlab.com/librehealth/ehr/lh-ehr/-/tags; https://nitroteam.kz/index.php?action=researches&slug=librehealth2_r
CVE: CVE-2022-29631
Published: 2022-06-06
Description: Jodd HTTP v6.0.9 was discovered to contain multiple CLRF injection vulnerabilities via the components jodd.http.HttpRequest#set and `jodd.http.HttpRequest#send. These vulnerabilities allow attackers to execute Server-Side Request Forgery (SSRF) via a crafted TCP payload.
CVSS Score: 7.5 (HIGH)
CWE: CWE-74
References: https://github.com/oblac/jodd-http/issues/9; https://github.com/oblac/jodd/issues/787; https://github.com/oblac/jodd-http/issues/9
CVE: CVE-2022-30469
Published: 2022-06-06
Description: In Afian Filerun 20220202, lack of sanitization of the POST parameter "metadata[]" in `/?module=fileman&section=get&page=grid` leads to SQL injection.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://filerun.com/changelog; https://github.com/blockomat2100/PoCs/blob/main/filerun/CVE-2022-30469.md; https://filerun.com/changelog
CVE: CVE-2022-31498
Published: 2022-06-06
Description: LibreHealth EHR Base 2.0.0 allows interface/orders/patient_match_dialog.php key XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/LibreHealthIO/lh-ehr/tags; https://gitlab.com/librehealth/ehr/lh-ehr/-/tags; https://nitroteam.kz/index.php?action=researches&slug=librehealth2_r
CVE: CVE-2022-32511
Published: 2022-06-06
Description: jmespath.rb (aka JMESPath for Ruby) before 1.6.1 uses JSON.load in a situation where JSON.parse is preferable.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/jmespath/jmespath.rb/compare/v1.6.0...v1.6.1; https://github.com/jmespath/jmespath.rb/pull/55; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/376NUPIPTYBWWGS33GO4UOLQRI4D3BTP/
CVE: CVE-2022-27438
Published: 2022-06-06
Description: Caphyon Ltd Advanced Installer 19.3 and earlier and many products that use the updater from Advanced Installer (Advanced Updater) are affected by a remote code execution vulnerability via the CustomDetection parameter in the update check function. To exploit this vulnerability, a user must start an affected installation to trigger the update check.
CVSS Score: 8.1 (HIGH)
CWE: CWE-494
References: http://advanced.com; http://caphyon.com; https://gerr.re/posts/cve-2022-27438/
CVE: CVE-2022-28051
Published: 2022-06-06
Description: The "Add category" functionality inside the "Global Keywords" menu in "SeedDMS" version 6.0.18 and 5.1.25, is prone to stored XSS which allows an attacker to inject malicious javascript code.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/looCiprian/Responsible-Vulnerability-Disclosure/blob/main/CVE-2022-28051/README.md; https://github.com/looCiprian/Responsible-Vulnerability-Disclosure/tree/main/CVE-2022-28051; https://sourceforge.net/p/seeddms/code/ci/6fc17be5d95e8f00fbe5c124c4acd377fa2ce69d/
CVE: CVE-2022-28478
Published: 2022-06-06
Description: SeedDMS 6.0.17 and 5.1.24 are vulnerable to Directory Traversal. The "Remove file" functionality inside the "Log files management" menu does not sanitize user input allowing attackers with admin privileges to delete arbitrary files on the remote system.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://github.com/looCiprian/Responsible-Vulnerability-Disclosure/tree/main/CVE-2022-28478; https://sourceforge.net/p/seeddms/code/ci/d68c922152e8a8060dd7fc3ebdd7af685e270e36/; https://github.com/looCiprian/Responsible-Vulnerability-Disclosure/tree/main/CVE-2022-28478
CVE: CVE-2022-28479
Published: 2022-06-06
Description: SeedDMS versions 6.0.18 and 5.1.25 and below are vulnerable to stored XSS. An attacker with admin privileges can inject the payload inside the "Role management" menu and then trigger the payload by loading the "Users management" menu
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/looCiprian/Responsible-Vulnerability-Disclosure/tree/main/CVE-2022-28479; https://sourceforge.net/p/seeddms/code/ci/9e92524fdbd1e7c3e6771d669f140c62389ec375/; https://github.com/looCiprian/Responsible-Vulnerability-Disclosure/tree/main/CVE-2022-28479
CVE: CVE-2022-29296
Published: 2022-06-06
Description: A reflected cross-site scripting (XSS) vulnerability in the login portal of Avantune Genialcloud ProJ - 10 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/167341/Avantune-Genialcloud-ProJ-10-Cross-Site-Scripting.html; https://dl.packetstormsecurity.net/2206-exploits/avantunegenialcloudproj10-xss.txt; http://packetstormsecurity.com/files/167341/Avantune-Genialcloud-ProJ-10-Cross-Site-Scripting.html
CVE: CVE-2022-30927
Published: 2022-06-06
Description: A SQL injection vulnerability exists in Simple Task Scheduling System 1.0 when MySQL is being used as the application database. An attacker can issue SQL commands to the MySQL database through the vulnerable "id" parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/ykosan1/Simple-Task-Scheduling-System-id-SQL-Injection-Unauthenticated; https://www.sourcecodester.com/php/15328/simple-task-scheduler-system-phpoop-free-source-code.html; https://www.sourcecodester.com/sites/default/files/download/oretnom23/tss.zip
CVE: CVE-2022-31494
Published: 2022-06-06
Description: LibreHealth EHR Base 2.0.0 allows gacl/admin/acl_admin.php action XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/LibreHealthIO/lh-ehr/tags; https://gitlab.com/librehealth/ehr/lh-ehr/-/tags; https://nitroteam.kz/index.php?action=researches&slug=librehealth2_r
CVE: CVE-2022-1991
Published: 2022-06-07
Description: A vulnerability classified as problematic has been found in Fast Food Ordering System 1.0. Affected is the file Master.php of the Master List. The manipulation of the argument Description with the input foo "><img src="" onerror="alert(document.cookie)"> leads to cross site scripting. It is possible to launch the attack remotely but it requires authentication. Exploit details have been disclosed to the public.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-79
References: https://cyberthoth.medium.com/fast-food-ordering-system-1-0-cross-site-scripting-7927f4b1edd6; https://vuldb.com/?id.201276; https://cyberthoth.medium.com/fast-food-ordering-system-1-0-cross-site-scripting-7927f4b1edd6
CVE: CVE-2021-37589
Published: 2022-06-07
Description: Virtua Cobranca before 12R allows SQL Injection on the login page.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.com/files/167480/Virtua-Software-Cobranca-12S-SQL-Injection.html; https://github.com/luca-regne/my-cves/tree/main/CVE-2021-37589; https://www.virtuasoftware.com.br/conteudo.php?content=downloads&lang=pt-br
CVE: CVE-2022-25361
Published: 2022-06-07
Description: WatchGuard Firebox and XTM appliances allow an unauthenticated remote attacker to delete arbitrary files from a limited set of directories on the system. This vulnerability impacts Fireware OS before 12.7.2_U2, 12.x before 12.1.3_U8, and 12.2.x through 12.5.x before 12.5.9_U2.
CVSS Score: 9.1 (CRITICAL)
References: https://watchguard.com; https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2022-00004; https://watchguard.com
CVE: CVE-2022-29564
Published: 2022-06-07
Description: Jamf Private Access before 2022-05-16 has Incorrect Access Control, in which an unauthorized user can reach a system in the internal infrastructure, aka WND-44801.
CVSS Score: 7.5 (HIGH)
References: https://github.com/wandera/public-disclosures/blob/master/CVE-2022-29564.md; https://jamf.com; https://github.com/wandera/public-disclosures/blob/master/CVE-2022-29564.md
CVE: CVE-2022-31025
Published: 2022-06-07
Description: Discourse is an open source platform for community discussion. Prior to version 2.8.4 on the `stable` branch and 2.9.0beta5 on the `beta` and `tests-passed` branches, inviting users on sites that use single sign-on could bypass the `must_approve_users` check and invites by staff are always approved automatically. The issue is patched in Discourse version 2.8.4 on the `stable` branch and version `2.9.0.beta5` on the `beta` and `tests-passed` branches. As a workaround, disable invites or increase `min_trust_level_to_allow_invite` to reduce the attack surface to more trusted users.
CVSS Score: 2.6 (LOW)
CWE: CWE-285
References: https://github.com/discourse/discourse/commit/0fa0094531efc82d9371f90a02aa804b176d59cf; https://github.com/discourse/discourse/commit/7c4e2d33fa4b922354c177ffc880a2f2701a91f9; https://github.com/discourse/discourse/pull/16974
CVE: CVE-2022-31495
Published: 2022-06-07
Description: LibreHealth EHR Base 2.0.0 allows gacl/admin/acl_admin.php return_page XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/LibreHealthIO/lh-ehr/tags; https://gitlab.com/librehealth/ehr/lh-ehr/-/tags; https://nitroteam.kz/index.php?action=researches&slug=librehealth2_r
CVE: CVE-2022-31028
Published: 2022-06-07
Description: MinIO is a multi-cloud object storage solution. Starting with version RELEASE.2019-09-25T18-25-51Z and ending with version RELEASE.2022-06-02T02-11-04Z, MinIO is vulnerable to an unending go-routine buildup while keeping connections established due to HTTP clients not closing the connections. Public-facing MinIO deployments are most affected. Users should upgrade to RELEASE.2022-06-02T02-11-04Z to receive a patch. One possible workaround is to use a reverse proxy to limit the number of connections being attempted in front of MinIO, and actively rejecting connections from such malicious clients.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-400
References: https://gist.github.com/harshavardhana/2d00e6f909054d2d2524c71485ad02e1; https://github.com/minio/minio/pull/14995; https://github.com/minio/minio/releases/tag/RELEASE.2022-06-03T01-40-53Z
CVE: CVE-2022-31279
Published: 2022-06-07
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2019-9971
Published: 2022-06-07
Description: PhoneSystem Terminal in 3CX Phone System (Debian based installation) 16.0.0.1570 allows an attacker to gain root privileges by using sudo with the tcpdump command, without a password. This occurs because the -z (aka postrotate-command) option to tcpdump can be unsafe when used in conjunction with sudo.
CVSS Score: 8.8 (HIGH)
CWE: CWE-269
References: https://www.gosecure.net/blog; https://www.gosecure.net/blog/2022/05/31/security-advisory-multiple-vulnerabilities-impact-3cx-phone-system/; https://www.securusglobal.com/community/2014/03/17/how-i-got-root-with-sudo/
CVE: CVE-2019-9972
Published: 2022-06-07
Description: PhoneSystem Terminal in 3CX Phone System (Debian based installation) 16.0.0.1570 allows an authenticated attacker to run arbitrary commands with the phonesystem user privileges because of "<space><space> followed by <shift><enter>" mishandling.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: https://www.gosecure.net/blog; https://www.gosecure.net/blog/2022/05/31/security-advisory-multiple-vulnerabilities-impact-3cx-phone-system/; https://www.gosecure.net/blog
CVE: CVE-2020-36523
Published: 2022-06-07
Description: A vulnerability was found in PlantUML 6.43. It has been declared as problematic. Affected by this vulnerability is the component Database Information Macro. The manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-79
References: https://seclists.org/fulldisclosure/2020/Oct/15; https://vuldb.com/?id.164509; https://seclists.org/fulldisclosure/2020/Oct/15
CVE: CVE-2020-36524
Published: 2022-06-07
Description: A vulnerability was found in Refined Toolkit. It has been rated as problematic. Affected by this issue is some unknown functionality of the component UI-Image/UI-Button. The manipulation leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-79
References: https://seclists.org/fulldisclosure/2020/Oct/15; https://vuldb.com/?id.164510; https://seclists.org/fulldisclosure/2020/Oct/15
CVE: CVE-2020-36525
Published: 2022-06-07
Description: A vulnerability classified as problematic has been found in Linking. This affects an unknown part of the component New Windows Macro. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-79
References: https://seclists.org/fulldisclosure/2020/Oct/15; https://vuldb.com/?id.164511; https://seclists.org/fulldisclosure/2020/Oct/15
CVE: CVE-2020-36526
Published: 2022-06-07
Description: A vulnerability classified as problematic was found in Countdown Timer. This vulnerability affects unknown code of the component Macro Handler. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-79
References: https://seclists.org/fulldisclosure/2020/Oct/15; https://vuldb.com/?id.164512; https://seclists.org/fulldisclosure/2020/Oct/15
CVE: CVE-2020-36527
Published: 2022-06-07
Description: A vulnerability, which was classified as problematic, has been found in Server Status. This issue affects some unknown processing of the component HTTP Status/SMTP Status. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-79
References: https://seclists.org/fulldisclosure/2020/Oct/15; https://vuldb.com/?id.164513; https://seclists.org/fulldisclosure/2020/Oct/15
CVE: CVE-2020-36528
Published: 2022-06-07
Description: A vulnerability, which was classified as critical, was found in Platinum Mobile 1.0.4.850. Affected is /MobileHandler.ashx which leads to broken access control. The attack requires authentication. Upgrading to version 1.0.4.851 is able to address this issue. It is recommended to upgrade the affected component.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-264, CWE-287
References: http://seclists.org/fulldisclosure/2020/Oct/4; https://vuldb.com/?id.162264; http://seclists.org/fulldisclosure/2020/Oct/4
CVE: CVE-2020-36529
Published: 2022-06-07
Description: A vulnerability classified as critical has been found in SevOne Network Management System up to 5.7.2.22. This affects the file traceroute.php of the Traceroute Handler. The manipulation leads to privilege escalation with a command injection. It is possible to initiate the attack remotely.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77, CWE-77
References: http://seclists.org/fulldisclosure/2020/Oct/5; https://vuldb.com/?id.162261; http://seclists.org/fulldisclosure/2020/Oct/5