deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-36404
Published: 2022-11-03
Description: Missing Authorization, Cross-Site Request Forgery (CSRF) vulnerability in David Cole Simple SEO (WordPress plugin) plugin <= 1.8.12 versions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352, CWE-862, CWE-352
References: https://patchstack.com/database/vulnerability/cds-simple-seo/wordpress-simple-seo-plugin-1-8-12-authenticated-sitemap-deletion-creation-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/cds-simple-seo/wordpress-simple-seo-plugin-1-8-12-authenticated-sitemap-deletion-creation-vulnerability?_s_id=cve
CVE: CVE-2022-36428
Published: 2022-11-03
Description: Auth. (admin+) Cross-Site Scripting (XSS) vulnerability in Stage Rock Convert plugin <= 2.11.0 on WordPress.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/rock-convert/wordpress-rock-convert-plugin-2-11-0-auth-cross-site-scripting-xss-vulnerability?_s_id=cve; https://wordpress.org/plugins/rock-convert/; https://patchstack.com/database/vulnerability/rock-convert/wordpress-rock-convert-plugin-2-11-0-auth-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2022-38710
Published: 2022-11-03
Description: IBM Robotic Process Automation 21.0.1 and 21.0.2 could disclose sensitive version to an unauthorized control sphere information that could aid in further attacks against the system.  IBM X-Force ID:  234292.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-497, CWE-312
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/234292; https://www.ibm.com/support/pages/node/6831681; https://exchange.xforce.ibmcloud.com/vulnerabilities/234292
CVE: CVE-2022-38712
Published: 2022-11-03
Description: "IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Web services could allow a man-in-the-middle attacker to conduct SOAPAction spoofing to execute unwanted or unauthorized operations. IBM X-Force ID: 234762."
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-290, CWE-290
References: https://www.ibm.com/support/pages/node/6829907; https://www.ibm.com/support/pages/node/6829907
CVE: CVE-2022-40131
Published: 2022-11-03
Description: Cross-Site Request Forgery (CSRF) vulnerability in a3rev Software Page View Count plugin <= 2.5.5 on WordPress allows an attacker to reset the plugin settings.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://patchstack.com/database/vulnerability/page-views-count/wordpress-page-view-count-plugin-2-5-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://wordpress.org/plugins/page-views-count/#developers; https://patchstack.com/database/vulnerability/page-views-count/wordpress-page-view-count-plugin-2-5-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2022-40230
Published: 2022-11-03
Description: "IBM MQ Appliance 9.2 CD, 9.2 LTS, 9.3 CD, and LTS 9.3 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 235532."
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-613, CWE-613
References: https://www.ibm.com/support/pages/node/6622051; https://www.ibm.com/support/pages/node/6622051
CVE: CVE-2022-40235
Published: 2022-11-03
Description: "IBM InfoSphere Information Server 11.7 could allow a user to cause a denial of service by removing the ability to run jobs due to improper input validation. IBM X-Force ID: 235725."
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20, CWE-20
References: https://www.ibm.com/support/pages/node/6829369; https://www.ibm.com/support/pages/node/6829369
CVE: CVE-2022-40276
Published: 2022-11-03
Description: Zettlr version 2.3.0 allows an external attacker to remotely obtain arbitrary local files on any client that attempts to view a malicious markdown file through Zettlr. This is possible because the application does not have a CSP policy (or at least not strict enough) and/or does not properly validate the contents of markdown files before rendering them.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20, CWE-20
References: https://fluidattacks.com/advisories/avicii/; https://github.com/Zettlr/Zettlr; https://fluidattacks.com/advisories/avicii/
CVE: CVE-2022-40747
Published: 2022-11-03
Description: "IBM InfoSphere Information Server 11.7 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 236584."
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-611, CWE-611
References: https://www.ibm.com/support/pages/node/6829373; https://www.ibm.com/support/pages/node/6829373
CVE: CVE-2022-41710
Published: 2022-11-03
Description: Markdownify version 1.4.1 allows an external attacker to remotely obtain arbitrary local files on any client that attempts to view a malicious markdown file through Markdownify. This is possible because the application does not have a CSP policy (or at least not strict enough) and/or does not properly validate the contents of markdown files before rendering them.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-552, CWE-552
References: https://fluidattacks.com/advisories/noisestorm/; https://github.com/amitmerchant1990/electron-markdownify; https://fluidattacks.com/advisories/noisestorm/
CVE: CVE-2022-41713
Published: 2022-11-03
Description: deep-object-diff version 1.1.0 allows an external attacker to edit or add new properties to an object. This is possible because the application does not properly validate incoming JSON keys, thus allowing the '__proto__' property to be edited.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-1321, CWE-1321
References: https://fluidattacks.com/advisories/heldens/; https://github.com/mattphillips/deep-object-diff; https://fluidattacks.com/advisories/heldens/
CVE: CVE-2022-41714
Published: 2022-11-03
Description: fastest-json-copy version 1.0.1 allows an external attacker to edit or add new properties to an object. This is possible because the application does not correctly validate the incoming JSON keys, thus allowing the '__proto__' property to be edited.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-1321, CWE-1321
References: https://fluidattacks.com/advisories/guetta/; https://github.com/streamich/fastest-json-copy; https://fluidattacks.com/advisories/guetta/
CVE: CVE-2022-42442
Published: 2022-11-03
Description: 
IBM Robotic Process Automation for Cloud Pak 21.0.1, 21.0.2, 21.0.3, 21.0.4, and 21.0.5 is vulnerable to exposure of the first tenant owner e-mail address to users with access to the container platform. IBM X-Force ID: 238214.




CVSS Score: 3.3 (LOW)
CWE: CWE-200
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/238214; https://www.ibm.com/support/pages/node/6831787; https://exchange.xforce.ibmcloud.com/vulnerabilities/238214
CVE: CVE-2022-42743
Published: 2022-11-03
Description: deep-parse-json version 1.0.2 allows an external attacker to edit or add new properties to an object. This is possible because the application does not correctly validate the incoming JSON keys, thus allowing the '__proto__' property to be edited.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-1321, CWE-1321
References: https://fluidattacks.com/advisories/buuren/; https://github.com/sibu-github/deep-parse-json; https://fluidattacks.com/advisories/buuren/
CVE: CVE-2022-42744
Published: 2022-11-03
Description: CandidATS version 3.0.0 allows an external attacker to perform CRUD operations on the application databases. This is possible because the application does not correctly validate the entriesPerPage parameter against SQLi attacks.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://candidats.net/; https://fluidattacks.com/advisories/mohawke/; https://candidats.net/
CVE: CVE-2022-42745
Published: 2022-11-03
Description: CandidATS version 3.0.0 allows an external attacker to read arbitrary files from the server. This is possible because the application is vulnerable to XXE.
CVSS Score: 7.5 (HIGH)
CWE: CWE-611
References: https://candidats.net/; https://fluidattacks.com/advisories/jcole/; https://candidats.net/
CVE: CVE-2022-42746
Published: 2022-11-03
Description: CandidATS version 3.0.0 on 'indexFile' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbitrary users. This is possible because the application application does not properly validate user input against XSS attacks.


CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://candidats.net/; https://fluidattacks.com/advisories/modestep/; https://candidats.net/
CVE: CVE-2022-42747
Published: 2022-11-03
Description: CandidATS version 3.0.0 on 'sortBy' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbitrary users. This is possible because the application application does not properly validate user input against XSS attacks.


CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://candidats.net/; https://fluidattacks.com/advisories/modestep/; https://candidats.net/
CVE: CVE-2022-42748
Published: 2022-11-03
Description: CandidATS version 3.0.0 on 'sortDirection' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbitrary users. This is possible because the application application does not properly validate user input against XSS attacks.


CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://candidats.net/; https://fluidattacks.com/advisories/modestep/; https://candidats.net/
CVE: CVE-2022-42749
Published: 2022-11-03
Description: CandidATS version 3.0.0 on 'page' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbitrary users. This is possible because the application application does not properly validate user input against XSS attacks.


CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://candidats.net/; https://fluidattacks.com/advisories/modestep/; https://candidats.net/
CVE: CVE-2022-43061
Published: 2022-11-03
Description: Online Tours & Travels Management System v1.0 was discovered to contain an arbitrary file upload vulnerability in the component /operations/travellers.php. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434, CWE-434
References: https://github.com/YorkLee53645349/Cve_report/blob/main/vendor/mayuri_k/online-tours-travels-management-system/RCE-1.md; https://github.com/YorkLee53645349/Cve_report/blob/main/vendor/mayuri_k/online-tours-travels-management-system/RCE-1.md
CVE: CVE-2022-43062
Published: 2022-11-03
Description: Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f=delete_appointment.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/YorkLee53645349/Cve_report/blob/main/vendor/oretnom23/online-diagnostic-lab-management-system/SQLi-1.md; https://github.com/YorkLee53645349/Cve_report/blob/main/vendor/oretnom23/online-diagnostic-lab-management-system/SQLi-1.md
CVE: CVE-2022-43063
Published: 2022-11-03
Description: Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Users.php?f=delete_client.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/YorkLee53645349/Cve_report/blob/main/vendor/oretnom23/online-diagnostic-lab-management-system/SQLi-2.md; https://github.com/YorkLee53645349/Cve_report/blob/main/vendor/oretnom23/online-diagnostic-lab-management-system/SQLi-2.md
CVE: CVE-2022-43449
Published: 2022-11-03
Description: OpenHarmony-v3.1.2 and prior versions had an Arbitrary file read vulnerability via download_server. Local attackers can install an malicious application on the device and reveal any file from the filesystem that is accessible to download_server service which run with UID 1000.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-20, CWE-552
References: https://gitee.com/openharmony/security/blob/master/en/security-disclosure/2022/2022-11.md; https://gitee.com/openharmony/security/blob/master/en/security-disclosure/2022/2022-11.md
CVE: CVE-2022-43451
Published: 2022-11-03
Description: OpenHarmony-v3.1.2 and prior versions had an Multiple path traversal vulnerability in appspawn and nwebspawn services. Local attackers can create arbitrary directories or escape application sandbox.If chained with other vulnerabilities it would allow an unprivileged process to gain full root privileges.
CVSS Score: 8.4 (HIGH)
CWE: CWE-287, CWE-22
References: https://gitee.com/openharmony/security/blob/master/en/security-disclosure/2022/2022-11.md; https://gitee.com/openharmony/security/blob/master/en/security-disclosure/2022/2022-11.md
CVE: CVE-2022-43495
Published: 2022-11-03
Description: OpenHarmony-v3.1.2 and prior versions had a DOS vulnerability in distributedhardware_device_manager when joining a network. Network attakcers can send an abonormal packet when joining a network, cause a nullptr reference and device reboot.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://gitee.com/openharmony/security/blob/master/en/security-disclosure/2022/2022-11.md; https://gitee.com/openharmony/security/blob/master/en/security-disclosure/2022/2022-11.md
CVE: CVE-2022-43574
Published: 2022-11-03
Description: "IBM Robotic Process Automation 21.0.1, 21.0.2, 21.0.3, 21.0.4, and 21.0.5 is vulnerable to incorrect permission assignment which could allow access to application configurations. IBM X-Force ID: 238679."
CVSS Score: 7.5 (HIGH)
CWE: CWE-276, CWE-276
References: https://www.ibm.com/support/pages/node/6831645; https://www.ibm.com/support/pages/node/6831645
CVE: CVE-2022-44627
Published: 2022-11-03
Description: Cross-Site Request Forgery (CSRF) vulnerability in David Cole Simple SEO plugin <= 1.8.12 on WordPress allows attackers to create or delete sitemaps.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://patchstack.com/database/vulnerability/cds-simple-seo/wordpress-simple-seo-plugin-1-8-12-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://wordpress.org/plugins/cds-simple-seo/#developers; https://patchstack.com/database/vulnerability/cds-simple-seo/wordpress-simple-seo-plugin-1-8-12-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2022-44628
Published: 2022-11-03
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in JumpDEMAND Inc. 4ECPS Web Forms plugin <= 0.2.17 on WordPress.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/4ecps-webforms/wordpress-4ecps-web-forms-plugin-0-2-17-auth-stored-cross-site-scripting-xss-vulnerability?_s_id=cve; https://wordpress.org/plugins/4ecps-webforms/; https://patchstack.com/database/vulnerability/4ecps-webforms/wordpress-4ecps-web-forms-plugin-0-2-17-auth-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2022-38168
Published: 2022-11-03
Description: Broken Access Control in User Authentication in Avaya Scopia Pathfinder 10 and 20 PTS version 8.3.7.0.4 allows remote unauthenticated attackers to bypass the login page, access sensitive information, and reset user passwords via URL modification.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-306, CWE-306
References: https://medium.com/%40rob_nes/avaya-scopia-pathfinder-broken-access-control-ac792e995bae; https://medium.com/%40rob_nes/avaya-scopia-pathfinder-broken-access-control-ac792e995bae
CVE: CVE-2022-43561
Published: 2022-11-03
Description: In Splunk Enterprise versions below 8.1.12, 8.2.9, and 9.0.2, a remote user that holds the “power” Splunk role can store arbitrary scripts that can lead to persistent cross-site scripting (XSS). The vulnerability affects instances with Splunk Web enabled.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://research.splunk.com/application/a974d1ee-ddca-4837-b6ad-d55a8a239c20/; https://www.splunk.com/en_us/product-security/announcements/svd-2022-1101.html; https://research.splunk.com/application/a974d1ee-ddca-4837-b6ad-d55a8a239c20/
CVE: CVE-2022-43571
Published: 2022-11-03
Description: In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can execute arbitrary code through the dashboard PDF generation component.


CVSS Score: 8.8 (HIGH)
CWE: CWE-94, CWE-94
References: https://research.splunk.com/application/b06b41d7-9570-4985-8137-0784f582a1b3/; https://www.splunk.com/en_us/product-security/announcements/svd-2022-1111.html; https://research.splunk.com/application/b06b41d7-9570-4985-8137-0784f582a1b3/
CVE: CVE-2022-41666
Published: 2022-11-04
Description: A CWE-347: Improper Verification of Cryptographic Signature vulnerability exists that allows adversaries with local user privileges to load a malicious DLL which could lead to execution of malicious code. Affected Products: EcoStruxure Operator Terminal Expert(V3.3 Hotfix 1 or prior), Pro-face BLUE(V3.3 Hotfix1 or prior).
CVSS Score: 7.0 (HIGH)
CWE: CWE-347
References: https://www.se.com/ww/en/download/document/SEVD-2022-284-01/; https://www.se.com/ww/en/download/document/SEVD-2022-284-01/
CVE: CVE-2022-44724
Published: 2022-11-04
Description: The Handy Tip macro in Stiltsoft Handy Macros for Confluence Server/Data Center 3.x before 3.5.5 allows remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability.
CVSS Score: 8.9 (HIGH)
CWE: CWE-79, CWE-79
References: https://stiltsoft.atlassian.net/browse/VD-3; https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2022-049.txt; https://stiltsoft.atlassian.net/browse/VD-3
CVE: CVE-2021-34686
Published: 2022-11-04
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn. Further investigation showed that it was not a vulnerability. Notes: none.
CVE: CVE-2021-41574
Published: 2022-11-04
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn. Further investigation showed that it was not a vulnerability. Notes: none.
CVE: CVE-2021-41575
Published: 2022-11-04
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn. Further investigation showed that it was not a vulnerability. Notes: none.
CVE: CVE-2021-41576
Published: 2022-11-04
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn. Further investigation showed that it was not a vulnerability. Notes: none.
CVE: CVE-2022-33684
Published: 2022-11-04
Description: The Apache Pulsar C++ Client does not verify peer TLS certificates when making HTTPS calls for the OAuth2.0 Client Credential Flow, even when tlsAllowInsecureConnection is disabled via configuration. This vulnerability allows an attacker to perform a man in the middle attack and intercept and/or modify the GET request that is sent to the ClientCredentialFlow 'issuer url'. The intercepted credentials can be used to acquire authentication data from the OAuth2.0 server to then authenticate with an Apache Pulsar cluster. An attacker can only take advantage of this vulnerability by taking control of a machine 'between' the client and the server. The attacker must then actively manipulate traffic to perform the attack. The Apache Pulsar Python Client wraps the C++ client, so it is also vulnerable in the same way. This issue affects Apache Pulsar C++ Client and Python Client versions 2.7.0 to 2.7.4; 2.8.0 to 2.8.3; 2.9.0 to 2.9.2; 2.10.0 to 2.10.1; 2.6.4 and earlier. Any users running affected versions of the C++ Client or the Python Client should rotate vulnerable OAuth2.0 credentials, including client_id and client_secret. 2.7 C++ and Python Client users should upgrade to 2.7.5 and rotate vulnerable OAuth2.0 credentials. 2.8 C++ and Python Client users should upgrade to 2.8.4 and rotate vulnerable OAuth2.0 credentials. 2.9 C++ and Python Client users should upgrade to 2.9.3 and rotate vulnerable OAuth2.0 credentials. 2.10 C++ and Python Client users should upgrade to 2.10.2 and rotate vulnerable OAuth2.0 credentials. 3.0 C++ users are unaffected and 3.0 Python Client users will be unaffected when it is released. Any users running the C++ and Python Client for 2.6 or less should upgrade to one of the above patched versions.
CVSS Score: 8.1 (HIGH)
CWE: CWE-295, CWE-295, CWE-295
References: https://huntr.dev/bounties/df89b724-3201-47aa-b8cd-282e112a566f; https://lists.apache.org/thread/ky1ssskvkj00y36k7nys9b5gm5jjrzwv; https://huntr.dev/bounties/df89b724-3201-47aa-b8cd-282e112a566f
CVE: CVE-2022-38582
Published: 2022-11-04
Description: Incorrect access control in the anti-virus driver wsdkd.sys of Watchdog Antivirus v1.4.158 allows attackers to write arbitrary files.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787
References: https://gist.github.com/420SmokeBigWeedHackBadDrivers/53de9ff97d95fc3e79307345fddb0a30; https://gist.github.com/420SmokeBigWeedHackBadDrivers/53de9ff97d95fc3e79307345fddb0a30
CVE: CVE-2022-3023
Published: 2022-11-04
Description: Use of Externally-Controlled Format String in GitHub repository pingcap/tidb prior to 6.4.0, 6.1.3.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-134, CWE-134
References: https://github.com/pingcap/tidb/commit/d0376379d615cc8f263a0b17c031ce403c8dcbfb; https://huntr.dev/bounties/120f1346-e958-49d0-b66c-0f889a469540; https://github.com/pingcap/tidb/commit/d0376379d615cc8f263a0b17c031ce403c8dcbfb
CVE: CVE-2022-3340
Published: 2022-11-04
Description: XML External Entity (XXE) vulnerability in Trellix IPS Manager prior to 10.1 M8 allows a remote authenticated administrator to perform XXE attack in the administrator interface part of the interface, which allows a saved XML configuration file to be imported.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-611, CWE-611
References: https://kcm.trellix.com/corporate/index?page=content&id=SB10388; https://kcm.trellix.com/corporate/index?page=content&id=SB10388
CVE: CVE-2022-41667
Published: 2022-11-04
Description: A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that allows adversaries with local user privileges to load a malicious DLL which could lead to execution of malicious code. Affected Products: EcoStruxure Operator Terminal Expert(V3.3 Hotfix 1 or prior), Pro-face BLUE(V3.3 Hotfix1 or prior).
CVSS Score: 7.0 (HIGH)
CWE: CWE-22
References: https://www.se.com/ww/en/download/document/SEVD-2022-284-01/; https://www.se.com/ww/en/download/document/SEVD-2022-284-01/
CVE: CVE-2022-41668
Published: 2022-11-04
Description: A CWE-704: Incorrect Project Conversion vulnerability exists that allows adversaries with local user privileges to load a project file from an adversary-controlled network share which could result in execution of malicious code. Affected Products: EcoStruxure Operator Terminal Expert(V3.3 Hotfix 1 or prior), Pro-face BLUE(V3.3 Hotfix1 or prior).
CVSS Score: 7.0 (HIGH)
CWE: CWE-704
References: https://www.se.com/ww/en/download/document/SEVD-2022-284-01/; https://www.se.com/ww/en/download/document/SEVD-2022-284-01/
CVE: CVE-2022-3721
Published: 2022-11-04
Description: Code Injection in GitHub repository froxlor/froxlor prior to 0.10.39.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-94, CWE-79
References: https://github.com/froxlor/froxlor/commit/1182453c18a83309a3470b2775c148ede740806c; https://huntr.dev/bounties/a3c506f0-5f8a-4eaa-b8cc-46fb9e35cf7a; https://github.com/froxlor/froxlor/commit/1182453c18a83309a3470b2775c148ede740806c
CVE: CVE-2022-41669
Published: 2022-11-04
Description: A CWE-347: Improper Verification of Cryptographic Signature vulnerability exists in the SGIUtility component that allows adversaries with local user privileges to load a malicious DLL which could result in execution of malicious code. Affected Products: EcoStruxure Operator Terminal Expert(V3.3 Hotfix 1 or prior), Pro-face BLUE(V3.3 Hotfix1 or prior).
CVSS Score: 7.0 (HIGH)
CWE: CWE-347
References: https://www.se.com/ww/en/download/document/SEVD-2022-284-01/; https://www.se.com/ww/en/download/document/SEVD-2022-284-01/