deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-0835
Published: 2022-04-11
Description: AVEVA System Platform 2020 stores sensitive information in cleartext, which may allow access to an attacker or a low-privileged user.
CVSS Score: 8.1 (HIGH)
CWE: CWE-316, CWE-312
References: https://www.aveva.com/content/dam/aveva/documents/support/cyber-security-updates/SecurityBulletin_AVEVA-2021-007.pdf; https://www.cisa.gov/uscert/ics/advisories/icsa-22-067-02; https://www.aveva.com/content/dam/aveva/documents/support/cyber-security-updates/SecurityBulletin_AVEVA-2021-007.pdf
CVE: CVE-2022-0999
Published: 2022-04-11
Description: An authenticated user may be able to misuse parameters to inject arbitrary operating system commands into mySCADA myPRO versions 8.25.0 and prior.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77, CWE-78
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-083-02; https://www.cisa.gov/uscert/ics/advisories/icsa-22-083-02
CVE: CVE-2022-1067
Published: 2022-04-11
Description: Navigating to a specific URL with a patient ID number will result in the server generating a PDF of a lab report without authentication and rate limiting.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-288, CWE-287
References: https://www.cisa.gov/uscert/ics/advisories/icsma-22-095-01; https://www.cisa.gov/uscert/ics/advisories/icsma-22-095-01
CVE: CVE-2022-1157
Published: 2022-04-11
Description: Missing sanitization of logged exception messages in all versions prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 of GitLab CE/EE causes potential sensitive values in invalid URLs to be logged
CVSS Score: 2.6 (LOW)
CWE: CWE-532
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1157.json; https://gitlab.com/gitlab-org/gitlab/-/issues/37261; https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1157.json
CVE: CVE-2022-1161
Published: 2022-04-11
Description: An attacker with the ability to modify a user program may change user program code on some ControlLogix, CompactLogix, and GuardLogix Control systems. Studio 5000 Logix Designer writes user-readable program code to a separate location than the executed compiled code, allowing an attacker to change one and not the other.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-829
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-090-05; https://www.cisa.gov/uscert/ics/advisories/icsa-22-090-05
CVE: CVE-2022-1193
Published: 2022-04-11
Description: Improper access control in GitLab CE/EE versions 10.7 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allows a malicious actor to obtain details of the latest commit in a private project via Merge Requests under certain circumstances
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1193.json; https://gitlab.com/gitlab-org/gitlab/-/issues/351823; https://hackerone.com/reports/1465994
CVE: CVE-2022-1262
Published: 2022-04-11
Description: A command injection vulnerability in the protest binary allows an attacker with access to the remote command line interface to execute arbitrary commands as root.
CVSS Score: 7.8 (HIGH)
CWE: CWE-78
References: https://www.tenable.com/security/research/tra-2022-09; https://www.tenable.com/security/research/tra-2022-09
CVE: CVE-2022-1316
Published: 2022-04-11
Description: Incorrect Permission Assignment for Critical Resource in GitHub repository zerotier/zerotierone prior to 1.8.8. Local Privilege Escalation
CVSS Score: 8.8 (HIGH)
CWE: CWE-732, CWE-732
References: https://github.com/zerotier/zerotierone/commit/ffb444dbeb6bea3cb155502395e61cb6d18708c9; https://huntr.dev/bounties/e7835226-1b20-4546-b256-3f625badb022; https://github.com/zerotier/zerotierone/commit/ffb444dbeb6bea3cb155502395e61cb6d18708c9
CVE: CVE-2022-20052
Published: 2022-04-11
Description: In mdp, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS05836642; Issue ID: ALPS05836642.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-416
References: https://corp.mediatek.com/product-security-bulletin/April-2022; https://corp.mediatek.com/product-security-bulletin/April-2022
CVE: CVE-2022-20062
Published: 2022-04-11
Description: In mdp, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is no needed for exploitation. Patch ID: ALPS05836418; Issue ID: ALPS05836418.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-416
References: https://corp.mediatek.com/product-security-bulletin/April-2022; https://corp.mediatek.com/product-security-bulletin/April-2022
CVE: CVE-2022-20063
Published: 2022-04-11
Description: In atf (spm), there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS06171715; Issue ID: ALPS06171715.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787
References: https://corp.mediatek.com/product-security-bulletin/April-2022; https://corp.mediatek.com/product-security-bulletin/April-2022
CVE: CVE-2022-20064
Published: 2022-04-11
Description: In ccci, there is a possible leak of kernel pointer due to an incorrect bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06108617; Issue ID: ALPS06108617.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-125
References: https://corp.mediatek.com/product-security-bulletin/April-2022; https://corp.mediatek.com/product-security-bulletin/April-2022
CVE: CVE-2022-20065
Published: 2022-04-11
Description: In ccci, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06108658; Issue ID: ALPS06108658.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-125
References: https://corp.mediatek.com/product-security-bulletin/April-2022; https://corp.mediatek.com/product-security-bulletin/April-2022
CVE: CVE-2022-20066
Published: 2022-04-11
Description: In atf (hwfde), there is a possible leak of sensitive information due to incorrect error handling. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06171729; Issue ID: ALPS06171729.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-755
References: https://corp.mediatek.com/product-security-bulletin/May-2022; https://corp.mediatek.com/product-security-bulletin/May-2022
CVE: CVE-2022-20067
Published: 2022-04-11
Description: In mdp, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is no needed for exploitation. Patch ID: ALPS05836585; Issue ID: ALPS05836585.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://corp.mediatek.com/product-security-bulletin/April-2022; https://corp.mediatek.com/product-security-bulletin/April-2022
CVE: CVE-2022-20068
Published: 2022-04-11
Description: In mobile_log_d, there is a possible symbolic link following due to an improper link resolution. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06308907; Issue ID: ALPS06308907.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-59
References: https://corp.mediatek.com/product-security-bulletin/April-2022; https://corp.mediatek.com/product-security-bulletin/April-2022
CVE: CVE-2022-20069
Published: 2022-04-11
Description: In preloader (usb), there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege, for an attacker who has physical access to the device, with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS06160425; Issue ID: ALPS06160425.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-190
References: https://corp.mediatek.com/product-security-bulletin/April-2022; https://corp.mediatek.com/product-security-bulletin/April-2022
CVE: CVE-2022-20070
Published: 2022-04-11
Description: In ssmr, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is no needed for exploitation. Patch ID: ALPS06362920; Issue ID: ALPS06362920.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://corp.mediatek.com/product-security-bulletin/April-2022; https://corp.mediatek.com/product-security-bulletin/April-2022
CVE: CVE-2022-20071
Published: 2022-04-11
Description: In ccu, there is a possible escalation of privilege due to a missing certificate validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is no needed for exploitation. Patch ID: ALPS06183315; Issue ID: ALPS06183315.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-295
References: https://corp.mediatek.com/product-security-bulletin/April-2022; https://corp.mediatek.com/product-security-bulletin/April-2022
CVE: CVE-2022-20072
Published: 2022-04-11
Description: In search engine service, there is a possible way to change the default search engine due to an incorrect comparison. This could lead to local escalation of privilege with System execution privileges needed. User interaction is no needed for exploitation. Patch ID: ALPS06219118; Issue ID: ALPS06219118.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-697
References: https://corp.mediatek.com/product-security-bulletin/April-2022; https://corp.mediatek.com/product-security-bulletin/April-2022
CVE: CVE-2022-20073
Published: 2022-04-11
Description: In preloader (usb), there is a possible out of bounds write due to a integer underflow. This could lead to local escalation of privilege, for an attacker who has physical access to the device, with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS06160841; Issue ID: ALPS06160841.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-191
References: https://corp.mediatek.com/product-security-bulletin/April-2022; https://corp.mediatek.com/product-security-bulletin/April-2022
CVE: CVE-2022-20074
Published: 2022-04-11
Description: In preloader (partition), there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege, for an attacker who has physical access to the device, with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS06183301; Issue ID: ALPS06183301.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-125, CWE-787
References: https://corp.mediatek.com/product-security-bulletin/April-2022; https://corp.mediatek.com/product-security-bulletin/April-2022
CVE: CVE-2022-20075
Published: 2022-04-11
Description: In ged, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05838808; Issue ID: ALPS05838808.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-190
References: https://corp.mediatek.com/product-security-bulletin/April-2022; https://corp.mediatek.com/product-security-bulletin/April-2022
CVE: CVE-2022-20076
Published: 2022-04-11
Description: In ged, there is a possible memory corruption due to an incorrect error handling. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05838808; Issue ID: ALPS05839556.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-755
References: https://corp.mediatek.com/product-security-bulletin/April-2022; https://corp.mediatek.com/product-security-bulletin/April-2022
CVE: CVE-2022-20077
Published: 2022-04-11
Description: In vow, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is no needed for exploitation. Patch ID: ALPS05837742; Issue ID: ALPS05852812.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-362
References: https://corp.mediatek.com/product-security-bulletin/April-2022; https://corp.mediatek.com/product-security-bulletin/April-2022
CVE: CVE-2022-20078
Published: 2022-04-11
Description: In vow, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is no needed for exploitation. Patch ID: ALPS05852819; Issue ID: ALPS05852819.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-362
References: https://corp.mediatek.com/product-security-bulletin/April-2022; https://corp.mediatek.com/product-security-bulletin/April-2022
CVE: CVE-2022-20079
Published: 2022-04-11
Description: In vow, there is a possible read of uninitialized data due to a improper input validation. This could lead to local information disclosure with System execution privileges needed. User interaction is no needed for exploitation. Patch ID: ALPS05837742; Issue ID: ALPS05857289.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-908
References: https://corp.mediatek.com/product-security-bulletin/April-2022; https://corp.mediatek.com/product-security-bulletin/April-2022
CVE: CVE-2022-20080
Published: 2022-04-11
Description: In SUB2AF, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is no needed for exploitation. Patch ID: ALPS05881290; Issue ID: ALPS05881290.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-362
References: https://corp.mediatek.com/product-security-bulletin/April-2022; https://corp.mediatek.com/product-security-bulletin/April-2022
CVE: CVE-2022-20081
Published: 2022-04-11
Description: In A-GPS, there is a possible man in the middle attack due to improper certificate validation. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06461919; Issue ID: ALPS06461919.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-295
References: https://corp.mediatek.com/product-security-bulletin/April-2022; https://corp.mediatek.com/product-security-bulletin/April-2022
CVE: CVE-2022-22253
Published: 2022-04-11
Description: The DFX module has a vulnerability of improper validation of integrity check values.Successful exploitation of this vulnerability may affect system stability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-354
References: https://consumer.huawei.com/en/support/bulletin/2022/4/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202204-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2022/4/
CVE: CVE-2022-22254
Published: 2022-04-11
Description: A permission bypass vulnerability exists when the NFC CAs access the TEE.Successful exploitation of this vulnerability may affect data confidentiality.
CVSS Score: 7.5 (HIGH)
References: https://consumer.huawei.com/en/support/bulletin/2022/4/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202204-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2022/4/
CVE: CVE-2022-22255
Published: 2022-04-11
Description: The application framework has a common DoS vulnerability.Successful exploitation of this vulnerability may affect the availability.
CVSS Score: 7.5 (HIGH)
References: https://consumer.huawei.com/en/support/bulletin/2022/4/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202204-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2022/4/
CVE: CVE-2022-22256
Published: 2022-04-11
Description: The DFX module has an access control vulnerability.Successful exploitation of this vulnerability may affect data confidentiality.
CVSS Score: 7.5 (HIGH)
References: https://consumer.huawei.com/en/support/bulletin/2022/4/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202204-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2022/4/
CVE: CVE-2022-22257
Published: 2022-04-11
Description: The customization framework has a vulnerability of improper permission control.Successful exploitation of this vulnerability may affect data integrity.
CVSS Score: 7.5 (HIGH)
CWE: CWE-269
References: https://consumer.huawei.com/en/support/bulletin/2022/4/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202204-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2022/4/
CVE: CVE-2022-22258
Published: 2022-04-11
Description: The Wi-Fi module has an event notification vulnerability.Successful exploitation of this vulnerability may allow third-party applications to intercept event notifications and add information and result in elevation-of-privilege.
CVSS Score: 9.8 (CRITICAL)
References: https://consumer.huawei.com/en/support/bulletin/2022/4/; https://consumer.huawei.com/en/support/bulletin/2022/5/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202204-[PII_REDACTED]
CVE: CVE-2022-22571
Published: 2022-04-11
Description: An authenticated high privileged user can perform a stored XSS attack due to incorrect output encoding in Incapptic connect and affects all current versions.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://excellium-services.com/cert-xlm-advisory/cve-2022-22571/; https://forums.ivanti.com/s/article/Security-Advisory-for-incapptic-Connect-SA-2022-03-11?language=en_US; https://excellium-services.com/cert-xlm-advisory/cve-2022-22571/
CVE: CVE-2022-22572
Published: 2022-04-11
Description: A non-admin user with user management permission can escalate his privilege to admin user via password reset functionality. The vulnerability affects Incapptic Connect version < 1.40.1.
CVSS Score: 8.8 (HIGH)
References: https://excellium-services.com/cert-xlm-advisory/cve-2022-22572/; https://forums.ivanti.com/s/article/Security-Advisory-for-incapptic-Connect-SA-2022-03-10?language=en_US; https://excellium-services.com/cert-xlm-advisory/cve-2022-22572/
CVE: CVE-2022-22954
Published: 2022-04-11
Description: VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side template injection. A malicious actor with network access can trigger a server-side template injection that may result in remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94, CWE-94
References: http://packetstormsecurity.com/files/166935/VMware-Workspace-ONE-Access-Template-Injection-Command-Execution.html; https://www.vmware.com/security/advisories/VMSA-2022-0011.html; http://packetstormsecurity.com/files/166935/VMware-Workspace-ONE-Access-Template-Injection-Command-Execution.html
CVE: CVE-2022-22962
Published: 2022-04-11
Description: VMware Horizon Agent for Linux (prior to 22.x) contains a local privilege escalation as a user is able to change the default shared folder location due to a vulnerable symbolic link. Successful exploitation can result in linking to a root owned file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-59
References: https://www.vmware.com/security/advisories/VMSA-2022-0012.html; https://www.vmware.com/security/advisories/VMSA-2022-0012.html
CVE: CVE-2022-22964
Published: 2022-04-11
Description: VMware Horizon Agent for Linux (prior to 22.x) contains a local privilege escalation that allows a user to escalate to root due to a vulnerable configuration file.
CVSS Score: 7.8 (HIGH)
References: https://www.vmware.com/security/advisories/VMSA-2022-0012.html; https://www.vmware.com/security/advisories/VMSA-2022-0012.html
CVE: CVE-2022-24804
Published: 2022-04-11
Description: Discourse is an open source platform for community discussion. In stable versions prior to 2.8.3 and beta versions prior 2.9.0.beta4 erroneously expose groups. When a group with restricted visibility has been used to set the permissions of a category, the name of the group is leaked to any user that is able to see the category. To workaround the problem, a site administrator can remove groups with restricted visibility from any category's permissions setting.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200, CWE-276
References: https://github.com/discourse/discourse/commit/0f7b9878ff3207ce20970f[PII_REDACTED]920bb3d2; https://github.com/discourse/discourse/security/advisories/GHSA-v4c9-6m9g-37ff; https://github.com/discourse/discourse/commit/0f7b9878ff3207ce20970f[PII_REDACTED]920bb3d2
CVE: CVE-2022-24815
Published: 2022-04-11
Description: JHipster is a development platform to quickly generate, develop, & deploy modern web applications & microservice architectures. SQL Injection vulnerability in entities for applications generated with the option "reactive with Spring WebFlux" enabled and an SQL database using r2dbc. Applications created without "reactive with Spring WebFlux" and applications with NoSQL databases are not affected. Users who have generated a microservice Gateway using the affected version may be impacted as Gateways are reactive by default. Currently, SQL injection is possible in the findAllBy(Pageable pageable, Criteria criteria) method of an entity repository class generated in these applications as the where clause using Criteria for queries are not sanitized and user input is passed on as it is by the criteria. This issue has been patched in v7.8.1. Users unable to upgrade should be careful when combining criterias and conditions as the root of the issue lies in the `EntityManager.java` class when creating the where clause via `Conditions.just(criteria.toString())`. `just` accepts the literal string provided. Criteria's `toString` method returns a plain string and this combination is vulnerable to sql injection as the string is not sanitized and will contain whatever used passed as input using any plain SQL.
CVSS Score: 8.1 (HIGH)
CWE: CWE-89
References: https://github.com/jhipster/generator-jhipster/commit/c220a210fd7742c53eea72bd5fadbb96220faa98; https://github.com/jhipster/generator-jhipster/issues/18269; https://github.com/jhipster/generator-jhipster/security/advisories/GHSA-qjmq-8hjr-qcv6
CVE: CVE-2022-24829
Published: 2022-04-11
Description: Garden is an automation platform for Kubernetes development and testing. In versions prior to 0.12.39 multiple endpoints did not require authentication. In some operating modes this allows for an attacker to gain access to the application erroneously. The configuration is leaked through the /api endpoint on the local server that is responsible for serving the Garden dashboard. At the moment, this server is accessible to 0.0.0.0 which makes it accessible to anyone on the same network (or anyone on the internet if they are on a public, static IP). This may lead to the ability to compromise credentials, secrets or environment variables. Users are advised to upgrade to version 0.12.39 as soon as possible. Users unable to upgrade should use a firewall blocking access to port 9777 from all untrusted network machines.
CVSS Score: 8.1 (HIGH)
CWE: CWE-306
References: https://github.com/garden-io/garden/commit/56051a5b50409227bc420910da88ed156a6e432b; https://github.com/garden-io/garden/security/advisories/GHSA-f5f3-qrqw-2vqf; https://github.com/garden-io/garden/commit/56051a5b50409227bc420910da88ed156a6e432b
CVE: CVE-2022-25614
Published: 2022-04-11
Description: Cross-Site Request Forgery (CSRF) in StylemixThemes eRoom – Zoom Meetings & Webinar (WordPress plugin) <= 1.3.7 allows an attacker to Sync with Zoom Meetings.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://patchstack.com/database/vulnerability/eroom-zoom-meetings-webinar/wordpress-eroom-plugin-1-3-7-cross-site-request-forgery-csrf-leading-to-sync-with-zoom-meetings-vulnerability; https://wordpress.org/plugins/eroom-zoom-meetings-webinar/#developers; https://patchstack.com/database/vulnerability/eroom-zoom-meetings-webinar/wordpress-eroom-plugin-1-3-7-cross-site-request-forgery-csrf-leading-to-sync-with-zoom-meetings-vulnerability