deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-1361
Published: 2022-05-17
Description: The affected On-Premise cnMaestro is vulnerable to a pre-auth data exfiltration through improper neutralization of special elements used in an SQL command. This could allow an attacker to exfiltrate data about other user’s accounts and devices.
CVSS Score: 7.4 (HIGH)
CWE: CWE-89
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-132-04; https://www.cisa.gov/uscert/ics/advisories/icsa-22-132-04
CVE: CVE-2022-1362
Published: 2022-05-17
Description: The affected On-Premise cnMaestro is vulnerable inside a specific route where a user can upload a crafted package to the system. An attacker could abuse this user-controlled data to execute arbitrary commands on the server.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-78, CWE-78
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-132-04; https://www.cisa.gov/uscert/ics/advisories/icsa-22-132-04
CVE: CVE-2022-28616
Published: 2022-05-17
Description: A remote server-side request forgery (ssrf) vulnerability was discovered in HPE OneView version(s): Prior to 7.0. HPE has provided a software update to resolve this vulnerability in HPE OneView.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-918
References: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn04278en_us; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn04278en_us
CVE: CVE-2022-29162
Published: 2022-05-17
Description: runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. A bug was found in runc prior to version 1.1.2 where `runc exec --cap` created processes with non-empty inheritable Linux process capabilities, creating an atypical Linux environment and enabling programs with inheritable file capabilities to elevate those capabilities to the permitted set during execve(2). This bug did not affect the container security sandbox as the inheritable set never contained more capabilities than were included in the container's bounding set. This bug has been fixed in runc 1.1.2. This fix changes `runc exec --cap` behavior such that the additional capabilities granted to the process being executed (as specified via `--cap` arguments) do not include inheritable capabilities. In addition, `runc spec` is changed to not set any inheritable capabilities in the created example OCI spec (`config.json`) file.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-276
References: https://github.com/opencontainers/runc/commit/d04de3a9b72d7a2455c1885fc75eb36d02cd17b5; https://github.com/opencontainers/runc/releases/tag/v1.1.2; https://github.com/opencontainers/runc/security/advisories/GHSA-f3fp-gc8g-vw66
CVE: CVE-2022-29174
Published: 2022-05-17
Description: countly-server is the server-side part of Countly, a product analytics solution. Prior to versions 22.03.7 and 21.11.4, a malicious actor who knows an account email address/username and full name specified in the database is capable of guessing the password reset token. The actor may use this information to reset the password and take over the account. The problem has been patched in Countly Server version 22.03.7 for servers using the new user interface and in 21.11.4 for servers using the old user interface.
CVSS Score: 8.1 (HIGH)
CWE: CWE-640
References: https://github.com/Countly/countly-server/commit/2bfa1ee1fa46e9bb007cf8687ad197ab9c604999; https://github.com/Countly/countly-server/security/advisories/GHSA-98vh-wqw5-p23v; https://github.com/Countly/countly-server/commit/2bfa1ee1fa46e9bb007cf8687ad197ab9c604999
CVE: CVE-2019-25061
Published: 2022-05-18
Description: The random_password_generator (aka RandomPasswordGenerator) gem through 1.0.0 for Ruby uses Kernel#rand to generate passwords, which, due to its cyclic nature, can facilitate password prediction.
CVSS Score: 7.5 (HIGH)
CWE: CWE-335
References: https://github.com/bvsatyaram/random_password_generator/blob/2855e8d7d8803dbb580ddd6cf13846394eb4530e/lib/random_password_generator.rb#L23; https://github.com/bvsatyaram/random_password_generator/pull/1; https://ruby-doc.org/core-3.1.2/Random.html
CVE: CVE-2021-41946
Published: 2022-05-18
Description: In FiberHome VDSL2 Modem HG150-Ub_V3.0, a stored cross-site scripting (XSS) vulnerability in Parental Control --> Access Time Restriction --> Username field, a user cannot delete the rule due to the XSS.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.fiberhome.com/; https://github.com/afaq1337/CVE-2021-41946; http://www.fiberhome.com/
CVE: CVE-2022-30974
Published: 2022-05-18
Description: compile in regexp.c in Artifex MuJS through 1.2.0 results in stack consumption because of unlimited recursion, a different issue than CVE-2019-11413.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-674
References: https://github.com/ccxvii/mujs/issues/162; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MC6PLHTXHZ7GW7QQGTLBHLXL47UHTHXO/; https://www.debian.org/security/2022/dsa-5291
CVE: CVE-2022-30975
Published: 2022-05-18
Description: In Artifex MuJS through 1.2.0, jsP_dumpsyntax in jsdump.c has a NULL pointer dereference, as demonstrated by mujs-pp.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/ccxvii/mujs/issues/161; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MC6PLHTXHZ7GW7QQGTLBHLXL47UHTHXO/; https://www.debian.org/security/2022/dsa-5291
CVE: CVE-2022-30976
Published: 2022-05-18
Description: GPAC 2.0.0 misuses a certain Unicode utf8_wcslen (renamed gf_utf8_wcslen) function in utils/utf.c, resulting in a heap-based buffer over-read, as demonstrated by MP4Box.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125
References: https://github.com/gpac/gpac/blob/105d67985ff3c3f4b98a98f312e3d84ae77a4463/share/doc/man/gpac.1#L2226-L2229; https://github.com/gpac/gpac/blob/105d67985ff3c3f4b98a98f312e3d84ae77a4463/src/utils/utf.c#L35-L59; https://github.com/gpac/gpac/issues/2179
CVE: CVE-2022-28955
Published: 2022-05-18
Description: An access control issue in D-Link DIR816L_FW206b01 allows unauthenticated attackers to access folders folder_view.php and category_view.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: https://github.com/shijin0925/IOT/blob/master/DIR816/1.md; https://www.dlink.com/en/security-bulletin/; https://github.com/shijin0925/IOT/blob/master/DIR816/1.md
CVE: CVE-2022-28956
Published: 2022-05-18
Description: An issue in the getcfg.php component of D-Link DIR816L_FW206b01 allows attackers to access the device via a crafted payload.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/shijin0925/IOT/blob/master/DIR816/4.md; https://www.dlink.com/en/security-bulletin/; https://github.com/shijin0925/IOT/blob/master/DIR816/4.md
CVE: CVE-2022-28958
Published: 2022-05-18
Description: Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2022-29638
Published: 2022-05-18
Description: TOTOLINK A3100R V4.1.2cu.5050_B20200504 and V4.1.2cu.5247_B20211129 were discovered to contain a stack overflow via the comment parameter in the function setIpQosRules. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://github.com/shijin0925/IOT/blob/master/TOTOLINK%20A3100R/2.md; https://github.com/shijin0925/IOT/blob/master/TOTOLINK%20A3100R/2.md
CVE: CVE-2022-29639
Published: 2022-05-18
Description: TOTOLINK A3100R V4.1.2cu.5050_B20200504 and V4.1.2cu.5247_B20211129 were discovered to contain a command injection vulnerability via the magicid parameter in the function uci_cloudupdate_config.
CVSS Score: 8.1 (HIGH)
References: https://github.com/shijin0925/IOT/blob/master/TOTOLINK%20A3100R/1.md; https://github.com/shijin0925/IOT/blob/master/TOTOLINK%20A3100R/1.md
CVE: CVE-2022-29640
Published: 2022-05-18
Description: TOTOLINK A3100R V4.1.2cu.5050_B20200504 and V4.1.2cu.5247_B20211129 were discovered to contain a stack overflow via the comment parameter in the function setPortForwardRules. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://github.com/shijin0925/IOT/blob/master/TOTOLINK%20A3100R/3.md; https://github.com/shijin0925/IOT/blob/master/TOTOLINK%20A3100R/3.md
CVE: CVE-2022-29641
Published: 2022-05-18
Description: TOTOLINK A3100R V4.1.2cu.5050_B20200504 and V4.1.2cu.5247_B20211129 were discovered to contain a stack overflow via the startTime and endTime parameters in the function setParentalRules. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: http://totolink.com; https://github.com/shijin0925/IOT/blob/master/TOTOLINK%20A3100R/4.md; http://totolink.com
CVE: CVE-2022-29642
Published: 2022-05-18
Description: TOTOLINK A3100R V4.1.2cu.5050_B20200504 and V4.1.2cu.5247_B20211129 were discovered to contain a stack overflow via the url parameter in the function setUrlFilterRules. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://github.com/shijin0925/IOT/blob/master/TOTOLINK%20A3100R/5.md; https://github.com/shijin0925/IOT/blob/master/TOTOLINK%20A3100R/5.md
CVE: CVE-2022-29643
Published: 2022-05-18
Description: TOTOLINK A3100R V4.1.2cu.5050_B20200504 and V4.1.2cu.5247_B20211129 were discovered to contain a stack overflow via the macAddress parameter in the function setMacQos. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://github.com/shijin0925/IOT/blob/master/TOTOLINK%20A3100R/6.md; https://github.com/shijin0925/IOT/blob/master/TOTOLINK%20A3100R/6.md
CVE: CVE-2022-29644
Published: 2022-05-18
Description: TOTOLINK A3100R V4.1.2cu.5050_B20200504 and V4.1.2cu.5247_B20211129 were discovered to contain a hard coded password for the telnet service stored in the component /web_cste/cgi-bin/product.ini.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://github.com/shijin0925/IOT/blob/master/TOTOLINK%20A3100R/7.md; https://github.com/shijin0925/IOT/blob/master/TOTOLINK%20A3100R/7.md
CVE: CVE-2022-29645
Published: 2022-05-18
Description: TOTOLINK A3100R V4.1.2cu.5050_B20200504 and V4.1.2cu.5247_B20211129 were discovered to contain a hard coded password for root stored in the component /etc/shadow.sample.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://github.com/shijin0925/IOT/blob/master/TOTOLINK%20A3100R/8.md; https://github.com/shijin0925/IOT/blob/master/TOTOLINK%20A3100R/8.md
CVE: CVE-2022-29646
Published: 2022-05-18
Description: An access control issue in TOTOLINK A3100R V4.1.2cu.5050_B20200504 and V4.1.2cu.5247_B20211129 allows attackers to obtain sensitive information via a crafted web request.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-668
References: https://github.com/shijin0925/IOT/blob/master/TOTOLINK%20A3100R/9.md; https://github.com/shijin0925/IOT/blob/master/TOTOLINK%20A3100R/9.md
CVE: CVE-2022-1430
Published: 2022-05-18
Description: Cross-site Scripting (XSS) - DOM in GitHub repository octoprint/octoprint prior to 1.8.0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-79, CWE-79
References: https://github.com/octoprint/octoprint/commit/8087528e4a7ddd15c7d95ff662deb5ef7de90045; https://huntr.dev/bounties/0cd30d71-1e32-4a0b-b4c3-faaa1907b541; https://github.com/octoprint/octoprint/commit/8087528e4a7ddd15c7d95ff662deb5ef7de90045
CVE: CVE-2022-1432
Published: 2022-05-18
Description: Cross-site Scripting (XSS) - Generic in GitHub repository octoprint/octoprint prior to 1.8.0.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/octoprint/octoprint/commit/6d259d7e6f5b0de9a1c762831537a386e53978d3; https://huntr.dev/bounties/cb545c63-a3c1-4d57-8f06-e4593ab389bf; https://github.com/octoprint/octoprint/commit/6d259d7e6f5b0de9a1c762831537a386e53978d3
CVE: CVE-2022-1727
Published: 2022-05-18
Description: Improper Input Validation in GitHub repository jgraph/drawio prior to 18.0.6.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20, CWE-20
References: https://github.com/jgraph/drawio/commit/4deecee18191f67e242422abf3ca304e19e49687; https://huntr.dev/bounties/b242e806-fc8c-41c0-aad7-e0c9c37ecdee; https://github.com/jgraph/drawio/commit/4deecee18191f67e242422abf3ca304e19e49687
CVE: CVE-2022-23067
Published: 2022-05-18
Description: ToolJet versions v0.5.0 to v1.2.2 are vulnerable to token leakage via Referer header that leads to account takeover . If the user opens the invite link/signup link and then clicks on any external links within the page, it leaks the password set token/signup token in the referer header. Using these tokens the attacker can access the user’s account.
CVSS Score: 8.8 (HIGH)
CWE: CWE-200
References: https://github.com/ToolJet/ToolJet/commit/eacbfc4c9da089ff9cda9edf8a1156390ae8a101; https://www.whitesourcesoftware.com/vulnerability-database/CVE-2022-23067; https://github.com/ToolJet/ToolJet/commit/eacbfc4c9da089ff9cda9edf8a1156390ae8a101
CVE: CVE-2022-23068
Published: 2022-05-18
Description: ToolJet versions v0.6.0 to v1.10.2 are vulnerable to HTML injection where an attacker can inject malicious code inside the first name and last name field while inviting a new user which will be reflected in the invitational e-mail.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-74, CWE-79
References: https://github.com/ToolJet/ToolJet/commit/431dc961cdfe4d26343d1c1c951ced778fbddb58; https://www.whitesourcesoftware.com/vulnerability-database/CVE-2022-23068; https://github.com/ToolJet/ToolJet/commit/431dc961cdfe4d26343d1c1c951ced778fbddb58
CVE: CVE-2021-27548
Published: 2022-05-18
Description: There is a Null Pointer Dereference vulnerability in the XFAScanner::scanNode() function in XFAScanner.cc in xpdf 4.03.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://forum.xpdfreader.com/viewtopic.php?f=3&t=42115; https://forum.xpdfreader.com/viewtopic.php?f=3&t=42115
CVE: CVE-2022-1782
Published: 2022-05-18
Description: Cross-site Scripting (XSS) - Generic in GitHub repository erudika/para prior to v1.45.11.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/erudika/para/commit/9d844f31333475a0394dd14b901ea50674b281f8; https://huntr.dev/bounties/7555693f-94e4-4183-98cb-3497da6df028; https://github.com/erudika/para/commit/9d844f31333475a0394dd14b901ea50674b281f8
CVE: CVE-2022-1795
Published: 2022-05-18
Description: Use After Free in GitHub repository gpac/gpac prior to v2.1.0-DEV.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416, CWE-416
References: https://github.com/gpac/gpac/commit/c535bad50d5812d27ee5b22b54371bddec411514; https://huntr.dev/bounties/9c312763-41a6-4fc7-827b-269eb86efcbc; https://www.debian.org/security/2023/dsa-5411
CVE: CVE-2022-27632
Published: 2022-05-18
Description: Cross-site request forgery (CSRF) vulnerability in Rebooter(WATCH BOOT nino RPC-M2C [End of Sale] all firmware versions, WATCH BOOT light RPC-M5C [End of Sale] all firmware versions, WATCH BOOT L-zero RPC-M4L [End of Sale] all firmware versions, WATCH BOOT mini RPC-M4H [End of Sale] all firmware versions, WATCH BOOT nino RPC-M2CS firmware version 1.00A to 1.00D, WATCH BOOT light RPC-M5CS firmware version 1.00A to 1.00D, WATCH BOOT L-zero RPC-M4LS firmware version 1.00A to 1.20A, and Signage Rebooter RPC-M4HSi firmware version 1.00A), PoE Rebooter(PoE BOOT nino PoE8M2 firmware version 1.00A to 1.20A), Scheduler(TIME BOOT mini RSC-MT4H [End of Sale] all firmware versions, TIME BOOT RSC-MT8F [End of Sale] all firmware versions, TIME BOOT RSC-MT8FP [End of Sale] all firmware versions, TIME BOOT mini RSC-MT4HS firmware version 1.00A to 1.10A, and TIME BOOT RSC-MT8FS firmware version 1.00A to 1.00E), and Contact Converter(POSE SE10-8A7B1 firmware version 1.00A to 1.20A) allows a remote attacker to hijack the authentication of an administrator and conduct arbitrary operations by having a user to view a specially crafted page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://jvn.jp/en/jp/JVN58266015/index.html; https://www.meikyo.co.jp/vln/; https://jvn.jp/en/jp/JVN58266015/index.html
CVE: CVE-2022-28717
Published: 2022-05-18
Description: Cross-site scripting vulnerability in Rebooter(WATCH BOOT nino RPC-M2C [End of Sale] all firmware versions, WATCH BOOT light RPC-M5C [End of Sale] all firmware versions, WATCH BOOT L-zero RPC-M4L [End of Sale] all firmware versions, WATCH BOOT mini RPC-M4H [End of Sale] all firmware versions, WATCH BOOT nino RPC-M2CS firmware version 1.00A to 1.00D, WATCH BOOT light RPC-M5CS firmware version 1.00A to 1.00D, WATCH BOOT L-zero RPC-M4LS firmware version 1.00A to 1.20A, and Signage Rebooter RPC-M4HSi firmware version 1.00A), PoE Rebooter(PoE BOOT nino PoE8M2 firmware version 1.00A to 1.20A), Scheduler(TIME BOOT mini RSC-MT4H [End of Sale] all firmware versions, TIME BOOT RSC-MT8F [End of Sale] all firmware versions, TIME BOOT RSC-MT8FP [End of Sale] all firmware versions, TIME BOOT mini RSC-MT4HS firmware version 1.00A to 1.10A, and TIME BOOT RSC-MT8FS firmware version 1.00A to 1.00E), and Contact Converter(POSE SE10-8A7B1 firmware version 1.00A to 1.20A) allows a remote attacker with the administrative privilege to inject an arbitrary script via unspecified vectors.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://jvn.jp/en/jp/JVN58266015/index.html; https://www.meikyo.co.jp/vln/; https://jvn.jp/en/jp/JVN58266015/index.html
CVE: CVE-2022-29516
Published: 2022-05-18
Description: The web console of FUJITSU Network IPCOM series (IPCOM EX2 IN(3200, 3500), IPCOM EX2 LB(1100, 3200, 3500), IPCOM EX2 SC(1100, 3200, 3500), IPCOM EX2 NW(1100, 3200, 3500), IPCOM EX2 DC, IPCOM EX2 DC, IPCOM EX IN(2300, 2500, 2700), IPCOM EX LB(1100, 1300, 2300, 2500, 2700), IPCOM EX SC(1100, 1300, 2300, 2500, 2700), and IPCOM EX NW(1100, 1300, 2300, 2500, 2700)) allows a remote attacker to execute an arbitrary OS command via unspecified vectors.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://jvn.jp/en/jp/JVN96561229/index.html; https://www.fujitsu.com/jp/products/network/support/2022/ipcom-01/; https://jvn.jp/en/jp/JVN96561229/index.html
CVE: CVE-2022-29518
Published: 2022-05-18
Description: Screen Creator Advance2, HMI GC-A2 series, and Real time remote monitoring and control tool Screen Creator Advance2 versions prior to Ver.0.1.1.3 Build01, HMI GC-A2 series(GC-A22W-CW, GC-A24W-C(W), GC-A26W-C(W), GC-A24, GC-A24-M, GC-A25, GC-A26, and GC-A26-J2), and Real time remote monitoring and control tool(Remote GC) allows a local attacker to bypass authentication due to the improper check for the Remote control setting's account names. This may allow attacker who can access the HMI from Real time remote monitoring and control tool may perform arbitrary operations on the HMI. As a result, the information stored in the HMI may be disclosed, deleted or altered, and/or the equipment may be illegally operated via the HMI.
CVSS Score: 7.0 (HIGH)
References: https://jvn.jp/en/jp/JVN50337155/index.html; https://www.koyoele.co.jp/en/topics/[PII_REDACTED]16/; https://jvn.jp/en/jp/JVN50337155/index.html
CVE: CVE-2022-30065
Published: 2022-05-18
Description: A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://bugs.busybox.net/show_bug.cgi?id=14781; https://cert-portal.siemens.com/productcert/pdf/ssa-333517.pdf; https://bugs.busybox.net/show_bug.cgi?id=14781
CVE: CVE-2021-3922
Published: 2022-05-18
Description: A race condition vulnerability was reported in IMController, a software component of Lenovo System Interface Foundation, prior to version 1.1.20.3 that could allow a local attacker to connect and interact with the IMController child process' named pipe.
CVSS Score: 7.8 (HIGH)
CWE: CWE-367, CWE-362
References: https://support.lenovo.com/us/en/product_security/LEN-75210; https://support.lenovo.com/us/en/product_security/LEN-75210
CVE: CVE-2021-3956
Published: 2022-05-18
Description: A read-only authentication bypass vulnerability was reported in the Third Quarter 2021 release of Lenovo XClarity Controller (XCC) firmware affecting XCC devices configured in LDAP Authentication Only Mode and using an LDAP server that supports “unauthenticated bind”, such as Microsoft Active Directory. An unauthenticated user can gain read-only access to XCC in such a configuration, thereby allowing the XCC device configuration to be viewed but not changed. XCC devices configured to use local authentication, LDAP Authentication + Authorization Mode, or LDAP servers that support only “authenticated bind” and/or “anonymous bind” are not affected.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863, CWE-863
References: https://support.lenovo.com/us/en/product_security/LEN-72074; https://support.lenovo.com/us/en/product_security/LEN-72074
CVE: CVE-2021-3969
Published: 2022-05-18
Description: A Time of Check Time of Use (TOCTOU) vulnerability was reported in IMController, a software component of Lenovo System Interface Foundation, prior to version 1.1.20.3that could allow a local attacker to elevate privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-367, CWE-367
References: https://support.lenovo.com/us/en/product_security/LEN-75210; https://support.lenovo.com/us/en/product_security/LEN-75210
CVE: CVE-2021-42848
Published: 2022-05-18
Description: An information disclosure vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow an unauthenticated user to retrieve device and networking details.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://iknow.lenovo.com.cn/detail/dc_200017.html; https://iknow.lenovo.com.cn/detail/dc_200017.html
CVE: CVE-2021-42849
Published: 2022-05-18
Description: A weak default password for the serial port was reported in some Lenovo Personal Cloud Storage devices that could allow unauthorized device access to an attacker with physical access.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-798, CWE-287
References: https://iknow.lenovo.com.cn/detail/dc_200017.html; https://iknow.lenovo.com.cn/detail/dc_200017.html
CVE: CVE-2021-42850
Published: 2022-05-18
Description: A weak default administrator password for the web interface and serial port was reported in some Lenovo Personal Cloud Storage devices that could allow unauthorized device access to an attacker with physical or local network access.
CVSS Score: 8.8 (HIGH)
CWE: CWE-798, CWE-798
References: https://iknow.lenovo.com.cn/detail/dc_200017.html; https://iknow.lenovo.com.cn/detail/dc_200017.html
CVE: CVE-2021-42851
Published: 2022-05-18
Description: A vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow an unauthenticated user to create a standard user account.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-862
References: https://iknow.lenovo.com.cn/detail/dc_200017.html; https://iknow.lenovo.com.cn/detail/dc_200017.html
CVE: CVE-2021-42852
Published: 2022-05-18
Description: A command injection vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow an authenticated user to execute operating system commands by sending a crafted packet to the device.
CVSS Score: 8.0 (HIGH)
CWE: CWE-78, CWE-78
References: https://iknow.lenovo.com.cn/detail/dc_200017.html; https://iknow.lenovo.com.cn/detail/dc_200017.html
CVE: CVE-2022-1110
Published: 2022-05-18
Description: A buffer overflow vulnerability in Lenovo Smart Standby Driver prior to version 4.1.50.0 could allow a local attacker to cause denial of service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-120, CWE-120
References: https://support.lenovo.com/us/en/product_security/LEN-79452; https://support.lenovo.com/us/en/product_security/LEN-79452
CVE: CVE-2022-1767
Published: 2022-05-18
Description: Server-Side Request Forgery (SSRF) in GitHub repository jgraph/drawio prior to 18.0.7.
CVSS Score: 7.5 (HIGH)
CWE: CWE-918, CWE-918
References: https://github.com/jgraph/drawio/commit/c63f3a04450f30798df47f9badbc74eb8a69fbdf; https://huntr.dev/bounties/b1ce040c-9ed1-4d36-9b48-82df42310868; https://github.com/jgraph/drawio/commit/c63f3a04450f30798df47f9badbc74eb8a69fbdf