deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-41639
Published: 2022-06-24
Description: MELAG FTP Server 2.2.0.4 stores unencrpyted passwords of FTP users in a local configuration file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-312
References: https://www.securesystems.de/blog/advisory-and-exploitation-the-melag-ftp-server/; https://www.securesystems.de/blog/advisory-and-exploitation-the-melag-ftp-server/
CVE: CVE-2022-32530
Published: 2022-06-24
Description: A CWE-668 Exposure of Resource to Wrong Sphere vulnerability exists that could cause users to be misled, hiding alarms, showing the wrong server connection option or the wrong control request when a mobile device has been compromised by a malicious application. Affected Product: Geo SCADA Mobile (Build 222 and prior)
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-668
References: https://download.schneider-electric.com/files?p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2022-165-02_Geo_SCADA_Android_App_Security_Notification.pdf; https://download.schneider-electric.com/files?p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2022-165-02_Geo_SCADA_Android_App_Security_Notification.pdf
CVE: CVE-2021-40892
Published: 2022-06-24
Description: A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in validate-color v2.1.0 when handling crafted invalid rgb(a) strings.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1333
References: https://github.com/yetingli/SaveResults/blob/main/js/validate-color.js; https://github.com/yetingli/SaveResults/blob/main/js/validate-color.js
CVE: CVE-2022-32990
Published: 2022-06-24
Description: An issue in gimp_layer_invalidate_boundary of GNOME GIMP 2.10.30 allows attackers to trigger an unhandled exception via a crafted XCF file, causing a Denial of Service (DoS).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-755
References: https://gitlab.gnome.org/GNOME/gimp/-/issues/8230; https://gitlab.gnome.org/GNOME/gimp/-/issues/8230
CVE: CVE-2013-1891
Published: 2022-06-24
Description: In OpenCart 1.4.7 to 1.5.5.1, implemented anti-traversal code in filemanager.php is ineffective and can be bypassed.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22, CWE-22
References: http://www.waraxe.us/advisory-98.html; https://seclists.org/fulldisclosure/2013/Mar/176; https://www.openwall.com/lists/oss-security/2013/03/24/1
CVE: CVE-2013-1916
Published: 2022-06-24
Description: In WordPress Plugin User Photo 0.9.4, when a photo is uploaded, it is only partially validated and it is possible to upload a backdoor on the server hosting WordPress. This backdoor can be called (executed) even if the photo has not been yet approved.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434, CWE-434
References: https://plugins.trac.wordpress.org/changeset/347137; https://wordpress.org/plugins/user-photo/#developers; https://www.exploit-db.com/exploits/16181
CVE: CVE-2021-30651
Published: 2022-06-24
Description: A malicious authenticated SMG administrator user can obtain passwords for external LDAP/Active Directory servers that they might not otherwise be authorized to access.
CVSS Score: 4.9 (MEDIUM)
References: https://support.broadcom.com/external/content/SecurityAdvisories/0/20652; https://support.broadcom.com/external/content/SecurityAdvisories/0/20652
CVE: CVE-2022-1517
Published: 2022-06-24
Description: LRM utilizes elevated privileges. An unauthenticated malicious actor can upload and execute code remotely at the operating system level, which can allow an attacker to change settings, configurations, software, or access sensitive data on the affected produc. An attacker could also exploit this vulnerability to access APIs not intended for general use and interact through the network.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-250, CWE-269
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-153-02; https://www.cisa.gov/uscert/ics/advisories/icsa-22-153-02
CVE: CVE-2022-1518
Published: 2022-06-24
Description: LRM contains a directory traversal vulnerability that can allow a malicious actor to upload outside the intended directory structure.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-22
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-153-02; https://www.cisa.gov/uscert/ics/advisories/icsa-22-153-02
CVE: CVE-2022-1519
Published: 2022-06-24
Description: LRM does not restrict the types of files that can be uploaded to the affected product. A malicious actor can upload any file type, including executable code that allows for a remote code exploit.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-434
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-153-02; https://www.cisa.gov/uscert/ics/advisories/icsa-22-153-02
CVE: CVE-2022-1521
Published: 2022-06-24
Description: LRM does not implement authentication or authorization by default. A malicious actor can inject, replay, modify, and/or intercept sensitive data.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-284, CWE-306, CWE-862
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-153-02; https://www.cisa.gov/uscert/ics/advisories/icsa-22-153-02
CVE: CVE-2022-1524
Published: 2022-06-24
Description: LRM version 2.4 and lower does not implement TLS encryption. A malicious actor can MITM attack sensitive data in-transit, including credentials.
CVSS Score: 7.4 (HIGH)
CWE: CWE-319
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-153-02; https://www.cisa.gov/uscert/ics/advisories/icsa-22-153-02
CVE: CVE-2022-1666
Published: 2022-06-24
Description: The default password for the web application’s root user (the vendor’s private account) was weak and the MD5 hash was used to crack the password using a widely available open-source tool.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-522, CWE-522
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-174-03; https://www.cisa.gov/uscert/ics/advisories/icsa-22-174-03
CVE: CVE-2022-1667
Published: 2022-06-24
Description: Client-side JavaScript controls may be bypassed by directly running a JS function to reboot the PLC (e.g., from the browser console) or by loading the corresponding, browser accessible PHP script
CVSS Score: 7.5 (HIGH)
CWE: CWE-841
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-174-03; https://www.cisa.gov/uscert/ics/advisories/icsa-22-174-03
CVE: CVE-2022-1668
Published: 2022-06-24
Description: Weak default root user credentials allow remote attackers to easily obtain OS superuser privileges over the open TCP port for SSH.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-521, CWE-521
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-174-03; https://www.cisa.gov/uscert/ics/advisories/icsa-22-174-03
CVE: CVE-2022-1739
Published: 2022-06-24
Description: The tested version of Dominion Voting Systems ImageCast X does not validate application signatures to a trusted root certificate. Use of a trusted root certificate ensures software installed on a device is traceable to, or verifiable against, a cryptographic key provided by the manufacturer to detect tampering. An attacker could leverage this vulnerability to install malicious code, which could also be spread to other vulnerable ImageCast X devices via removable media.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-347
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-154-01; https://www.cisa.gov/uscert/ics/advisories/icsa-22-154-01
CVE: CVE-2022-1740
Published: 2022-06-24
Description: The tested version of Dominion Voting Systems ImageCast X’s on-screen application hash display feature, audit log export, and application export functionality rely on self-attestation mechanisms. An attacker could leverage this vulnerability to disguise malicious applications on a device.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-1283, CWE-1283
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-154-01; https://www.cisa.gov/uscert/ics/advisories/icsa-22-154-01
CVE: CVE-2022-1741
Published: 2022-06-24
Description: The tested version of Dominion Voting Systems ImageCast X has a Terminal Emulator application which could be leveraged by an attacker to gain elevated privileges on a device and/or install malicious code.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-912
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-154-01; https://www.cisa.gov/uscert/ics/advisories/icsa-22-154-01
CVE: CVE-2022-1742
Published: 2022-06-24
Description: The tested version of Dominion Voting Systems ImageCast X allows for rebooting into Android Safe Mode, which allows an attacker to directly access the operating system. An attacker could leverage this vulnerability to escalate privileges on a device and/or install malicious code.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-424
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-154-01; https://www.cisa.gov/uscert/ics/advisories/icsa-22-154-01
CVE: CVE-2022-1743
Published: 2022-06-24
Description: The tested version of Dominion Voting System ImageCast X can be manipulated to cause arbitrary code execution by specially crafted election definition files. An attacker could leverage this vulnerability to spread malicious code to ImageCast X devices from the EMS.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-24
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-154-01; https://www.cisa.gov/uscert/ics/advisories/icsa-22-154-01
CVE: CVE-2022-1744
Published: 2022-06-24
Description: Applications on the tested version of Dominion Voting Systems ImageCast X can execute code with elevated privileges by exploiting a system level service. An attacker could leverage this vulnerability to escalate privileges on a device and/or install malicious code.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-250
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-154-01; https://www.cisa.gov/uscert/ics/advisories/icsa-22-154-01
CVE: CVE-2022-1745
Published: 2022-06-24
Description: The authentication mechanism used by technicians on the tested version of Dominion Voting Systems ImageCast X is susceptible to forgery. An attacker with physical access may use this to gain administrative privileges on a device and install malicious code or perform arbitrary administrative actions.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-290
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-154-01; https://www.cisa.gov/uscert/ics/advisories/icsa-22-154-01
CVE: CVE-2022-1746
Published: 2022-06-24
Description: The authentication mechanism used by poll workers to administer voting using the tested version of Dominion Voting Systems ImageCast X can expose cryptographic secrets used to protect election information. An attacker could leverage this vulnerability to gain access to sensitive information and perform privileged actions, potentially affecting other election equipment.
CVSS Score: 7.6 (HIGH)
CWE: CWE-266, CWE-863
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-154-01; https://www.cisa.gov/uscert/ics/advisories/icsa-22-154-01
CVE: CVE-2022-1747
Published: 2022-06-24
Description: The authentication mechanism used by voters to activate a voting session on the tested version of Dominion Voting Systems ImageCast X is susceptible to forgery. An attacker could leverage this vulnerability to print an arbitrary number of ballots without authorization.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-346
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-154-01; https://www.cisa.gov/uscert/ics/advisories/icsa-22-154-01
CVE: CVE-2022-21829
Published: 2022-06-24
Description: Concrete CMS Versions 9.0.0 through 9.0.2 and 8.5.7 and below can download zip files over HTTP and execute code from those zip files which could lead to an RCE. Fixed by enforcing ‘concrete_secure’ instead of ‘concrete’. Concrete now only makes requests over https even a request comes in via http. Concrete CMS security team ranked this 8 with CVSS v3.1 vector: AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H Credit goes to Anna for reporting HackerOne 1482520.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-319, CWE-319
References: https://documentation.concretecms.org/developers/introduction/version-history/858-release-notes; https://documentation.concretecms.org/developers/introduction/version-history/910-release-notes%2C; https://hackerone.com/reports/1482520%2C
CVE: CVE-2022-23170
Published: 2022-06-24
Description: SysAid - Okta SSO integration - was found vulnerable to XML External Entity Injection vulnerability. Any SysAid environment that uses the Okta SSO integration might be vulnerable. An unauthenticated attacker could exploit the XXE vulnerability by sending a malformed POST request to the identity provider endpoint. An attacker can extract the identity provider endpoint by decoding the SAMLRequest parameter's value and searching for the AssertionConsumerServiceURL parameter's value. It often allows an attacker to view files on the application server filesystem and interact with any back-end or external systems that the application can access. In some situations, an attacker can escalate an XXE attack to compromise the underlying server or other back-end infrastructure by leveraging the XXE vulnerability to perform server-side request forgery (SSRF) attacks.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-611, CWE-611
References: https://www.gov.il/en/departments/faq/cve_advisories; https://www.gov.il/en/departments/faq/cve_advisories
CVE: CVE-2022-28619
Published: 2022-06-24
Description: A potential security vulnerability has been identified in the installer of HPE Version Control Repository Manager. The vulnerability could allow local escalation of privilege. HPE has made the following software update to resolve the vulnerability in HPE Version Control Repository Manager installer 7.6.14.0.
CVSS Score: 7.8 (HIGH)
References: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn04310en_us; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn04310en_us
CVE: CVE-2022-28620
Published: 2022-06-24
Description: A remote authentication bypass vulnerability was discovered in HPE Cray Legacy Shasta System Solutions; HPE Slingshot; and HPE Cray EX supercomputers versions: Prior to node controller firmware associated with HPE Cray EX liquid cooled blades, and all versions of chassis controller firmware associated with HPE Cray EX liquid cooled cabinets prior to 1.6.27/1.5.33/1.4.27; All Slingshot versions prior to 1.7.2; All versions of node controller firmware associated with HPE Cray EX liquid cooled blades, and all versions of chassis controller firmware associated with HPE Cray EX liquid cooled cabinets prior to 1.6.27/1.5.33/1.4.27. HPE has provided a software update to resolve this vulnerability in HPE Cray Legacy Shasta System Solutions, HPE Slingshot, and HPE Cray EX Supercomputers.
CVSS Score: 9.8 (CRITICAL)
References: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbcr04284en_us; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbcr04284en_us
CVE: CVE-2022-2102
Published: 2022-06-24
Description: Controls limiting uploads to certain file extensions may be bypassed. This could allow an attacker to intercept the initial file upload page response and modify the associated code. This modified code can be forwarded and used by a script loaded later in the sequence, allowing for arbitrary file upload into a location where PHP scripts may be executed.
CVSS Score: 9.4 (CRITICAL)
CWE: CWE-841, CWE-434
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-174-03; https://www.cisa.gov/uscert/ics/advisories/icsa-22-174-03
CVE: CVE-2022-2103
Published: 2022-06-24
Description: An attacker with weak credentials could access the TCP port via an open FTP port, allowing an attacker to read sensitive files and write to remotely executable directories.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284, CWE-522
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-174-03; https://www.cisa.gov/uscert/ics/advisories/icsa-22-174-03
CVE: CVE-2022-2104
Published: 2022-06-24
Description: The www-data (Apache web server) account is configured to run sudo with no password for many commands (including /bin/sh and /bin/bash).
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-269
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-174-03; https://www.cisa.gov/uscert/ics/advisories/icsa-22-174-03
CVE: CVE-2022-2105
Published: 2022-06-24
Description: Client-side JavaScript controls may be bypassed to change user credentials and permissions without authentication, including a “root” user level meant only for the vendor. Web server root level access allows for changing of safety critical parameters.
CVSS Score: 9.4 (CRITICAL)
CWE: CWE-841
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-174-03; https://www.cisa.gov/uscert/ics/advisories/icsa-22-174-03
CVE: CVE-2022-2119
Published: 2022-06-24
Description: OFFIS DCMTK's (All versions prior to 3.6.7) service class provider (SCP) is vulnerable to path traversal, allowing an attacker to write DICOM files into arbitrary directories under controlled names. This could allow remote code execution.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://www.cisa.gov/uscert/ics/advisories/icsma-22-174-01; https://lists.debian.org/debian-lts-announce/2025/06/msg00025.html; https://www.cisa.gov/uscert/ics/advisories/icsma-22-174-01
CVE: CVE-2022-2120
Published: 2022-06-24
Description: OFFIS DCMTK's (All versions prior to 3.6.7) service class user (SCU) is vulnerable to relative path traversal, allowing an attacker to write DICOM files into arbitrary directories under controlled names. This could allow remote code execution.
CVSS Score: 7.5 (HIGH)
CWE: CWE-23, CWE-22
References: https://www.cisa.gov/uscert/ics/advisories/icsma-22-174-01; https://lists.debian.org/debian-lts-announce/2025/06/msg00025.html; https://www.cisa.gov/uscert/ics/advisories/icsma-22-174-01
CVE: CVE-2022-2121
Published: 2022-06-24
Description: OFFIS DCMTK's (All versions prior to 3.6.7) has a NULL pointer dereference vulnerability while processing DICOM files, which may result in a denial-of-service condition.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://lists.debian.org/debian-lts-announce/2024/06/msg00022.html; https://www.cisa.gov/uscert/ics/advisories/icsma-22-174-01; https://lists.debian.org/debian-lts-announce/2024/06/msg00022.html
CVE: CVE-2022-30117
Published: 2022-06-24
Description: Concrete 8.5.7 and below as well as Concrete 9.0 through 9.0.2 allow traversal in /index.php/ccm/system/file/upload which could result in an Arbitrary File Delete exploit. This was remediated by sanitizing /index.php/ccm/system/file/upload to ensure Concrete doesn’t allow traversal and by changing isFullChunkFilePresent to have an early false return when input doesn't match expectations.Concrete CMS Security team ranked this 5.8 with CVSS v3.1 vector AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H. Credit to Siebene for reporting.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-22, CWE-22
References: https://documentation.concretecms.org/developers/introduction/version-history/858-release-notes; https://documentation.concretecms.org/developers/introduction/version-history/910-release-notes; https://hackerone.com/reports/1482280
CVE: CVE-2022-30118
Published: 2022-06-24
Description: Title for CVE: XSS in /dashboard/system/express/entities/forms/save_control/[GUID]: old browsers only.Description: When using Internet Explorer with the XSS protection disabled, editing a form control in an express entities form for Concrete 8.5.7 and below as well as Concrete 9.0 through 9.0.2 can allow XSS. This cannot be exploited in modern-day web browsers due to an automatic input escape mechanism. Concrete CMS Security team ranked this vulnerability 2 with CVSS v3.1 Vector AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N. Thanks zeroinside for reporting.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://documentation.concretecms.org/developers/introduction/version-history/858-release-notes; https://documentation.concretecms.org/developers/introduction/version-history/910-release-notes; https://hackerone.com/reports/1370054
CVE: CVE-2022-30119
Published: 2022-06-24
Description: XSS in /dashboard/reports/logs/view - old browsers only. When using Internet Explorer with the XSS protection disabled, insufficient sanitation where built urls are outputted can be exploited for Concrete 8.5.7 and below as well as Concrete 9.0 through 9.0.2. This cannot be exploited in modern-day web browsers due to an automatic input escape mechanism. Concrete CMS Security team ranked this vulnerability 2 with CVSS v3.1 Vector AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N. Thanks zeroinside for reporting.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://documentation.concretecms.org/developers/introduction/version-history/858-release-notes; https://documentation.concretecms.org/developers/introduction/version-history/910-release-notes; https://hackerone.com/reports/1370054
CVE: CVE-2022-30120
Published: 2022-06-24
Description: XSS in /dashboard/blocks/stacks/view_details/ - old browsers only. When using an older browser with built-in XSS protection disabled, insufficient sanitation where built urls are outputted can be exploited for Concrete 8.5.7 and below as well as Concrete 9.0 through 9.0.2 to allow XSS. This cannot be exploited in modern-day web browsers due to an automatic input escape mechanism. Concrete CMS Security team ranked this vulnerability 3.1with CVSS v3.1 Vector AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N. Sanitation has been added where built urls are output. Credit to Credit to Bogdan Tiron from FORTBRIDGE (https://www.fortbridge.co.uk/ ) for reporting
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://documentation.concretecms.org/developers/introduction/version-history/858-release-notes; https://documentation.concretecms.org/developers/introduction/version-history/910-release-notes; https://hackerone.com/reports/1363598
CVE: CVE-2022-32209
Published: 2022-06-24
Description: # Possible XSS Vulnerability in Rails::Html::SanitizerThere is a possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer.This vulnerability has been assigned the CVE identifier CVE-2022-32209.Versions Affected: ALLNot affected: NONEFixed Versions: v1.4.3## ImpactA possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer may allow an attacker to inject content if the application developer has overridden the sanitizer's allowed tags to allow both `select` and `style` elements.Code is only impacted if allowed tags are being overridden. This may be done via application configuration:```ruby# In config/application.rbconfig.action_view.sanitized_allowed_tags = ["select", "style"]```see https://guides.rubyonrails.org/configuring.html#configuring-action-viewOr it may be done with a `:tags` option to the Action View helper `sanitize`:```<%= sanitize @comment.body, tags: ["select", "style"] %>```see https://api.rubyonrails.org/classes/ActionView/Helpers/SanitizeHelper.html#method-i-sanitizeOr it may be done with Rails::Html::SafeListSanitizer directly:```ruby# class-level optionRails::Html::SafeListSanitizer.allowed_tags = ["select", "style"]```or```ruby# instance-level optionRails::Html::SafeListSanitizer.new.sanitize(@article.body, tags: ["select", "style"])```All users overriding the allowed tags by any of the above mechanisms to include both "select" and "style" should either upgrade or use one of the workarounds immediately.## ReleasesThe FIXED releases are available at the normal locations.## WorkaroundsRemove either `select` or `style` from the overridden allowed tags.## CreditsThis vulnerability was responsibly reported by [windshock](https://hackerone.com/windshock?type=user).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://hackerone.com/reports/1530898; https://lists.debian.org/debian-lts-announce/2022/12/msg00012.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AGRLWBEB3S5AU3D4TTROIS7O6QPHDTRH/
CVE: CVE-2020-21046
Published: 2022-06-24
Description: A local privilege escalation vulnerability was identified within the "luminati_net_updater_win_eagleget_com" service in EagleGet Downloader version 2.1.5.20 Stable. This issue allows authenticated non-administrative user to escalate their privilege and conduct code execution as a SYSTEM privilege.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: http://eagleget.com; https://medium.com/%40n1pwn/local-privilege-escalation-in-eagleget-1fde79fe47c0; http://eagleget.com