deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-25606
Published: 2022-03-25
Description: Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities discovered in WP-DownloadManager WordPress plugin (versions <= 1.68.6). Vulnerable parameters &download_path, &download_path_url, &download_page_url, &download_categories.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/wp-downloadmanager/wordpress-wp-downloadmanager-plugin-1-68-5-multiple-authenticated-stored-cross-site-scripting-xss-vulnerabilities; https://wordpress.org/plugins/wp-downloadmanager/#developers; https://patchstack.com/database/vulnerability/wp-downloadmanager/wordpress-wp-downloadmanager-plugin-1-68-5-multiple-authenticated-stored-cross-site-scripting-xss-vulnerabilities
CVE: CVE-2022-25610
Published: 2022-03-25
Description: Unauthenticated Stored Cross-Site Scripting (XSS) in Simple Ajax Chat <= 20220115 allows an attacker to store the malicious code. However, the attack requires specific conditions, making it hard to exploit.
CVSS Score: 3.4 (LOW)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/simple-ajax-chat/wordpress-simple-ajax-chat-plugin-20220115-unauthenticated-stored-cross-site-scripting-xss-vulnerability; https://wordpress.org/plugins/simple-ajax-chat/#developers; https://patchstack.com/database/vulnerability/simple-ajax-chat/wordpress-simple-ajax-chat-plugin-20220115-unauthenticated-stored-cross-site-scripting-xss-vulnerability
CVE: CVE-2022-25611
Published: 2022-03-25
Description: Authenticated Stored Cross-Site Scripting (XSS) in Simple Event Planner plugin <= 1.5.4 allows attackers with contributor or higher user roles to inject the malicious script by using vulnerable parameter &custom[add_seg][].
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/simple-event-planner/wordpress-simple-event-planner-plugin-1-5-4-authenticated-stored-cross-site-scripting-xss-vulnerability; https://wordpress.org/plugins/simple-event-planner/#developers; https://patchstack.com/database/vulnerability/simple-event-planner/wordpress-simple-event-planner-plugin-1-5-4-authenticated-stored-cross-site-scripting-xss-vulnerability
CVE: CVE-2022-25612
Published: 2022-03-25
Description: Multiple Authenticated Persistent Cross-Site Scripting (XSS) vulnerabilities in Simple Event Planner WordPress plugin <= 1.5.4 allows user with author or higher user rights inject the malicious code via vulnerable parameters: &custom[event_organiser], &custom[organiser_email], &custom[organiser_contact].
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/simple-event-planner/wordpress-simple-event-planner-plugin-1-5-4-multiple-authenticated-persistent-cross-site-scripting-xss-vulnerabilities; https://wordpress.org/plugins/simple-event-planner/#developers; https://patchstack.com/database/vulnerability/simple-event-planner/wordpress-simple-event-planner-plugin-1-5-4-multiple-authenticated-persistent-cross-site-scripting-xss-vulnerabilities
CVE: CVE-2022-26573
Published: 2022-03-25
Description: Maccms v10 was discovered to contain multiple reflected cross-site scripting (XSS) vulnerabilities in /admin.php/admin/art/data.html via the select and input parameters.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/magicblack/maccms10/commit/026a2893d7de4ba4987b670b292ba569f3b8d296#diff-498970d2c74a54ff851bf844ce006053b7bb7042b19711a81966554f62aff753L41-R47; https://github.com/magicblack/maccms10/issues/840; https://github.com/magicblack/maccms10/issues/840
CVE: CVE-2022-27884
Published: 2022-03-25
Description: Maccms v10 was discovered to contain a reflected cross-site scripting (XSS) vulnerability in /admin.php/admin/plog/index.html via the wd parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/magicblack/maccms10/issues/840; https://github.com/magicblack/maccms10/issues/840
CVE: CVE-2022-27885
Published: 2022-03-25
Description: Maccms v10 was discovered to contain multiple reflected cross-site scripting (XSS) vulnerabilities in /admin.php/admin/website/data.html via the select and input parameters.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/magicblack/maccms10/issues/840; https://github.com/magicblack/maccms10/issues/840
CVE: CVE-2022-27886
Published: 2022-03-25
Description: Maccms v10 was discovered to contain a reflected cross-site scripting (XSS) vulnerability in /admin.php/admin/ulog/index.html via the wd parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/magicblack/maccms10/issues/840; https://github.com/magicblack/maccms10/issues/840
CVE: CVE-2022-27887
Published: 2022-03-25
Description: Maccms v10 was discovered to contain a reflected cross-site scripting (XSS) vulnerability in /admin.php/admin/vod/data.html via the repeat parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/magicblack/maccms10/issues/840; https://github.com/magicblack/maccms10/issues/840
CVE: CVE-2022-27906
Published: 2022-03-25
Description: Mendelson OFTP2 before 1.1 b43 is affected by directory traversal. To access the vulnerable code path, the attacker has to know one of the configured Odette IDs of the OFTP2 server. An attacker can upload files to the server outside of the intended upload directory.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-22
References: https://insinuator.net/2022/03/a-tale-of-an-oftp2-vulnerability/; https://mendelson-e-c.com/node/3355; https://insinuator.net/2022/03/a-tale-of-an-oftp2-vulnerability/
CVE: CVE-2022-27919
Published: 2022-03-25
Description: Gradle Enterprise before 2022.1 allows remote code execution if the installation process did not specify an initial configuration file. The configuration allows certain anonymous access to administration and an API.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-276
References: https://security.gradle.com/advisory/2022-05; https://security.gradle.com/advisory/2022-05
CVE: CVE-2022-27920
Published: 2022-03-25
Description: libkiwix 10.0.0 and 10.0.1 allows XSS in the built-in webserver functionality via the search suggestions URL parameter. This is fixed in 10.1.0.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/kiwix/libkiwix/issues/728; https://github.com/kiwix/libkiwix/pull/721; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KD4KX5N2PGMIOQR2IZWEUTZCCTPWU3EJ/
CVE: CVE-2021-44905
Published: 2022-03-25
Description: Incorrect permissions in the Bluetooth Services in the Fortessa FTBTLD Smart Lock as of 12-13-2022 allows a remote attacker to disable the lock via an unauthenticated edit to the lock name.
CVSS Score: 8.2 (HIGH)
CWE: CWE-276
References: https://ashallen.net/fortessa-ftbtld-smart-lock-allows-unauthorized-users-to-change-the-device-name-hilarity-ensues; https://online.fliphtml5.com/fbwgm/fome/#p=20; https://ashallen.net/fortessa-ftbtld-smart-lock-allows-unauthorized-users-to-change-the-device-name-hilarity-ensues
CVE: CVE-2022-24643
Published: 2022-03-25
Description: A stored cross-site scripting (XSS) issue was discovered in the OpenEMR Hospital Information Management System version 6.0.0.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/openemr; https://securityforeveryone.com/blog/openemr-0-day-stored-cross-site-scripting-xss-vulnerability-cve-2022-24643; https://www.open-emr.org/
CVE: CVE-2022-25523
Published: 2022-03-25
Description: TypesetterCMS v5.1 was discovered to contain a Cross-Site Request Forgery (CSRF) which is exploited via a crafted POST request.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://typesettercms.com; https://github.com/Typesetter/Typesetter/issues/697; https://www.typesettercms.com/User
CVE: CVE-2022-26197
Published: 2022-03-25
Description: Joget DX 7 was discovered to contain a cross-site scripting (XSS) vulnerability via the Datalist table.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://joget.com; https://gist.github.com/CrimsonHamster/1aeec6db0d740de6ed4690f6a975f377; http://joget.com
CVE: CVE-2022-26659
Published: 2022-03-25
Description: Docker Desktop installer on Windows in versions before 4.6.0 allows an attacker to overwrite any administrator writable files by creating a symlink in place of where the installer writes its log file. Starting from version 4.6.0, the Docker Desktop installer, when run elevated, will write its log files to a location not writable by non-administrator users.
CVSS Score: 7.1 (HIGH)
CWE: CWE-59
References: https://docs.docker.com/desktop/windows/release-notes/; https://docs.docker.com/docker-for-windows/release-notes/; https://github.com/hmnthabit/Advisories/blob/master/CVE-2022-26659.md
CVE: CVE-2021-44683
Published: 2022-03-25
Description: The DuckDuckGo browser 7.64.4 on iOS allows Address Bar Spoofing due to mishandling of the JavaScript window.open function (used to open a secondary browser window). This could be exploited by tricking users into supplying sensitive information such as credentials, because the address bar would display a legitimate URL, but content would be hosted on the attacker's web site.
CVSS Score: 8.2 (HIGH)
CWE: CWE-1021
References: https://www.cybercitadel.com/remote-address-bar-spoofing-and-html-injection-disclosures/; https://www.cybercitadel.com/remote-address-bar-spoofing-and-html-injection-disclosures/
CVE: CVE-2022-24783
Published: 2022-03-25
Description: Deno is a runtime for JavaScript and TypeScript. The versions of Deno between release 1.18.0 and 1.20.2 (inclusive) are vulnerable to an attack where a malicious actor controlling the code executed in a Deno runtime could bypass all permission checks and execute arbitrary shell code. This vulnerability does not affect users of Deno Deploy. The vulnerability has been patched in Deno 1.20.3. There is no workaround. All users are recommended to upgrade to 1.20.3 immediately.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-269, CWE-863
References: https://github.com/denoland/deno/security/advisories/GHSA-838h-jqp6-cf2f; https://github.com/denoland/deno/security/advisories/GHSA-838h-jqp6-cf2f
CVE: CVE-2022-24784
Published: 2022-03-25
Description: Statamic is a Laravel and Git powered CMS. Before versions 3.2.39 and 3.3.2, it is possible to confirm a single character of a user's password hash using a specially crafted regular expression filter in the users endpoint of the REST API. Multiple such requests can eventually uncover the entire hash. The hash is not present in the response, however the presence or absence of a result confirms if the character is in the right position. The API has throttling enabled by default, making this a time intensive task. Both the REST API and the users endpoint need to be enabled, as they are disabled by default. The issue has been fixed in versions 3.2.39 and above, and 3.3.2 and above.
CVSS Score: 3.7 (LOW)
CWE: CWE-200, CWE-203
References: https://github.com/statamic/cms/issues/5604; https://github.com/statamic/cms/pull/5568; https://github.com/statamic/cms/security/advisories/GHSA-qcgx-7p5f-hxvr
CVE: CVE-2021-40904
Published: 2022-03-25
Description: The web management console of CheckMK Raw Edition (versions 1.5.0 to 1.6.0) allows a misconfiguration of the web-app Dokuwiki (installed by default), which allows embedded php code. As a result, remote code execution is achieved. Successful exploitation requires access to the web management interface, either with valid credentials or with a hijacked session by a user with the role of administrator.
CVSS Score: 8.8 (HIGH)
CWE: CWE-276
References: http://checkmk.com; https://github.com/Edgarloyola/CVE-2021-40904; http://checkmk.com
CVE: CVE-2021-40905
Published: 2022-03-25
Description: The web management console of CheckMK Enterprise Edition (versions 1.5.0 to 2.0.0p9) does not properly sanitise the uploading of ".mkp" files, which are Extension Packages, making remote code execution possible. Successful exploitation requires access to the web management interface, either with valid credentials or with a hijacked session of a user with administrator role. NOTE: the vendor states that this is the intended behavior: admins are supposed to be able to execute code in this manner
CVSS Score: 8.8 (HIGH)
CWE: CWE-434, CWE-434
References: http://checkmk.com; https://github.com/Edgarloyola/CVE-2021-40905; http://checkmk.com
CVE: CVE-2021-40906
Published: 2022-03-25
Description: CheckMK Raw Edition software (versions 1.5.0 to 1.6.0) does not sanitise the input of a web service parameter that is in an unauthenticated zone. This Reflected XSS allows an attacker to open a backdoor on the device with HTML content and interpreted by the browser (such as JavaScript or other client-side scripts) or to steal the session cookies of a user who has previously authenticated via a man in the middle. Successful exploitation requires access to the web service resource without authentication.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://checkmk.com; https://github.com/Edgarloyola/CVE-2021-40906; http://checkmk.com
CVE: CVE-2022-22274
Published: 2022-03-25
Description: A Stack-based buffer overflow vulnerability in the SonicOS via HTTP request allows a remote unauthenticated attacker to cause Denial of Service (DoS) or potentially results in code execution in the firewall.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-121, CWE-787
References: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0003; https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0003
CVE: CVE-2022-22995
Published: 2022-03-25
Description: The combination of primitives offered by SMB and AFP in their default configuration allows the arbitrary writing of files. By exploiting these combination of primitives, an attacker can execute arbitrary code.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-59, CWE-59
References: https://lists.debian.org/debian-lts-announce/2024/01/msg00000.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/55ROUJI22SHZX5EM23QAILZHI67EZQKW/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T5CZZLFOTUP3QYHGHSDUNENGSLPJ6KGO/
CVE: CVE-2022-1071
Published: 2022-03-26
Description: User after free in mrb_vm_exec in GitHub repository mruby/mruby prior to 3.2.
CVSS Score: 8.2 (HIGH)
CWE: CWE-416, CWE-416
References: https://github.com/mruby/mruby/commit/aaa28a508903041dd7399d4159a8ace9766b022f; https://huntr.dev/bounties/6597ece9-07af-415b-809b-919ce0a17cf3; https://github.com/mruby/mruby/commit/aaa28a508903041dd7399d4159a8ace9766b022f
CVE: CVE-2022-27938
Published: 2022-03-26
Description: stb_image.h (aka the stb image loader) 2.19, as used in libsixel and other products, has a reachable assertion in stbi__create_png_image_raw.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-617
References: https://github.com/saitoha/libsixel/issues/163; https://github.com/saitoha/libsixel/issues/163
CVE: CVE-2022-27939
Published: 2022-03-26
Description: tcprewrite in Tcpreplay 4.4.1 has a reachable assertion in get_layer4_v6 in common/get.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-617
References: https://github.com/appneta/tcpreplay/issues/717; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5B75AFRJUGOYHCFG2ZV2JKSUPA6MSCT5/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ECRCFJ6X3IVB7BT4KS6AHQMSL532YXYD/
CVE: CVE-2022-27940
Published: 2022-03-26
Description: tcprewrite in Tcpreplay 4.4.1 has a heap-based buffer over-read in get_ipv6_next in common/get.c.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://github.com/appneta/tcpreplay/issues/718; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5B75AFRJUGOYHCFG2ZV2JKSUPA6MSCT5/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ECRCFJ6X3IVB7BT4KS6AHQMSL532YXYD/
CVE: CVE-2022-27941
Published: 2022-03-26
Description: tcprewrite in Tcpreplay 4.4.1 has a heap-based buffer over-read in get_l2len_protocol in common/get.c.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://github.com/appneta/tcpreplay/issues/716; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5B75AFRJUGOYHCFG2ZV2JKSUPA6MSCT5/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ECRCFJ6X3IVB7BT4KS6AHQMSL532YXYD/
CVE: CVE-2022-27942
Published: 2022-03-26
Description: tcpprep in Tcpreplay 4.4.1 has a heap-based buffer over-read in parse_mpls in common/get.c.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://github.com/appneta/tcpreplay/issues/719; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5B75AFRJUGOYHCFG2ZV2JKSUPA6MSCT5/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ECRCFJ6X3IVB7BT4KS6AHQMSL532YXYD/
CVE: CVE-2022-27943
Published: 2022-03-26
Description: libiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-674
References: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105039; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H424YXGW7OKXS2NCAP35OP6Y4P4AW6VG/; https://sourceware.org/bugzilla/show_bug.cgi?id=28995
CVE: CVE-2022-27945
Published: 2022-03-26
Description: NETGEAR R8500 1.0.2.158 devices allow remote authenticated users to execute arbitrary commands (such as telnetd) via shell metacharacters in the sysNewPasswd and sysConfirmPasswd parameters to password.cgi.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://github.com/donothingme/VUL/blob/main/vul2/2.md; https://github.com/donothingme/VUL/blob/main/vul2/2.md
CVE: CVE-2022-27946
Published: 2022-03-26
Description: NETGEAR R8500 1.0.2.158 devices allow remote authenticated users to execute arbitrary commands (such as telnetd) via shell metacharacters in the sysNewPasswd and sysConfirmPasswd parameters to admin_account.cgi.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://github.com/donothingme/VUL/blob/main/vul3/3.md; https://github.com/donothingme/VUL/blob/main/vul3/3.md
CVE: CVE-2022-27947
Published: 2022-03-26
Description: NETGEAR R8500 1.0.2.158 devices allow remote authenticated users to execute arbitrary commands (such as telnetd) via shell metacharacters in the ipv6_fix.cgi ipv6_wan_ipaddr, ipv6_lan_ipaddr, ipv6_wan_length, or ipv6_lan_length parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://github.com/donothingme/VUL/blob/main/vul1/1.md; https://github.com/donothingme/VUL/blob/main/vul1/1.md
CVE: CVE-2022-26198
Published: 2022-03-27
Description: Notable v1.8.4 does not filter text editing, allowing attackers to execute arbitrary code via a crafted payload injected into the Title text field.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/notable/notable/issues/1595; https://github.com/notable/notable/issues/1595
CVE: CVE-2022-26200
Published: 2022-03-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2022-26620
Published: 2022-03-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2022-26205
Published: 2022-03-27
Description: Marky commit[PII_REDACTED]c65756e was discovered to contain a remote code execution (RCE) vulnerability via the Display text fields. This vulnerability allows attackers to execute arbitrary code via injection of a crafted payload.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-74
References: https://github.com/V1ntLyn/marky_[PII_REDACTED]c65756e; https://github.com/V1ntLyn/marky_[PII_REDACTED]c65756e
CVE: CVE-2022-27948
Published: 2022-03-27
Description: Certain Tesla vehicles through 2022-03-26 allow attackers to open the charging port via a 315 MHz RF signal containing a fixed sequence of approximately one hundred symbols. NOTE: the vendor's perspective is that the behavior is as intended
CVSS Score: 7.2 (HIGH)
CWE: CWE-862
References: https://github.com/pompel123/Tesla-Charging-Port-Opener; https://twitter.com/IfNotPike/status/[PII_REDACTED]68858631; https://twitter.com/IfNotPike/status/[PII_REDACTED]99661827
CVE: CVE-2022-1106
Published: 2022-03-27
Description: use after free in mrb_vm_exec in GitHub repository mruby/mruby prior to 3.2.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-416, CWE-416
References: https://github.com/mruby/mruby/commit/7f5a490d09f4d56801ac3a3e4e39e03e1471b44c; https://huntr.dev/bounties/16b9d0ea-71ed-41bc-8a88-2deb4c20be8f; https://github.com/mruby/mruby/commit/7f5a490d09f4d56801ac3a3e4e39e03e1471b44c
CVE: CVE-2022-26245
Published: 2022-03-27
Description: Falcon-plus v0.3 was discovered to contain a SQL injection vulnerability via the parameter grpName in /config/service/host.go.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/open-falcon/falcon-plus/issues/951; https://github.com/open-falcon/falcon-plus/issues/951
CVE: CVE-2022-26252
Published: 2022-03-27
Description: aaPanel v6.8.21 was discovered to be vulnerable to directory traversal. This vulnerability allows attackers to obtain the root user private SSH key(id_rsa).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://www.exploit-db.com/exploits/50780; https://www.exploit-db.com/exploits/50780
CVE: CVE-2022-26254
Published: 2022-03-27
Description: WoWonder The Ultimate PHP Social Network Platform v4.0.0 was discovered to contain an access control issue which allows unauthenticated attackers to arbitrarily change group ID names.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-639
References: https://youtu.be/b665r1ZfCg4; https://youtu.be/b665r1ZfCg4
CVE: CVE-2021-44127
Published: 2022-03-27
Description: In DLink DAP-1360 F1 firmware version <=v6.10 in the "webupg" binary, an attacker can use the "file" parameter to execute arbitrary system commands when the parameter is "name=deleteFile" after being authorized.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/tgp-top/DAP-1360/blob/main/README.md; https://www.dlink.com/en/security-bulletin/; https://github.com/tgp-top/DAP-1360/blob/main/README.md
CVE: CVE-2022-26255
Published: 2022-03-28
Description: Clash for Windows v0.19.8 was discovered to allow arbitrary code execution via a crafted payload injected into the Proxies name column.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-79
References: https://github.com/Fndroid/clash_for_windows_pkg/issues/2710; https://github.com/Fndroid/clash_for_windows_pkg/issues/2710
CVE: CVE-2022-26258
Published: 2022-03-28
Description: D-Link DIR-820L 1.05B03 was discovered to contain remote command execution (RCE) vulnerability via HTTP POST to get set ccp.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: http://dir-820l.com; http://dlink.com; https://github.com/skyedai910/Vuln/tree/master/DIR-820L/command_execution_0
CVE: CVE-2021-26598
Published: 2022-03-28
Description: ImpressCMS before 1.4.3 has Incorrect Access Control because include/findusers.php allows access by unauthenticated attackers (who are, by design, able to have a security token).
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-287
References: http://karmainsecurity.com/KIS-2022-03; http://seclists.org/fulldisclosure/2022/Mar/45; https://hackerone.com/reports/1081137
CVE: CVE-2021-26599
Published: 2022-03-28
Description: ImpressCMS before 1.4.3 allows include/findusers.php groups SQL Injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://karmainsecurity.com/KIS-2022-04; http://packetstormsecurity.com/files/166404/ImpressCMS-1.4.2-SQL-Injection.html; http://seclists.org/fulldisclosure/2022/Mar/46
CVE: CVE-2021-26600
Published: 2022-03-28
Description: ImpressCMS before 1.4.3 has plugins/preloads/autologin.php type confusion with resultant Authentication Bypass (!= instead of !==).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-843
References: http://karmainsecurity.com/KIS-2022-01; http://packetstormsecurity.com/files/166393/ImpressCMS-1.4.2-Authentication-Bypass.html; http://seclists.org/fulldisclosure/2022/Mar/43