rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-36401 WordPress TeraWallet – For WooCommerce Plugin <= 1.3.24 is vulnerable to Cross Site Request Forgery (CSRF)
Cross-Site Request Forgery (CSRF) vulnerability in TeraWallet – For WooCommerce plugin <= 1.3.24 versions.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: StandaloneTech
product: TeraWallet – For WooCommerce
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
version: 3.1
Credits: lang: en
value: Muhammad Daffa (Patchstack Alliance)
Published: 2023-02-02T15:45:37.182Z
CVE-2022-36402 There is an int overflow vulnerability in vmwgfx driver
An integer overflow vulnerability was found in vmwgfx driver in drivers/gpu/vmxgfx/vmxgfx_execbuf.c in GPU component of Linux kernel with device file '/dev/dri/renderD128 (or Dxxx)'. This flaw allows a local attacker with a user account on the system to gain privilege, causing a denial of service(DoS).
Problem types: cwe_id: CWE-118
description: CWE-118 Incorrect Access of Indexable Resource ('Range Error')
Affected products: vendor: Linux
product: kernel
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:H
version: 3.1
Credits: lang: en
value: Ziming Zhang(ezrakiez@gmail.com) from Ant Group Light-Year Security Lab
Published: 2022-09-16T16:08:01.414Z
CVE-2022-36403 
Untrusted search path vulnerability in the installer of Device Software Manager prior to Ver.2.20.3.0 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
Problem types: description: Untrusted search path vulnerability
Affected products: vendor: RICOH COMPANY, LTD.
product: Installer of Device Software Manager
Published: 2022-09-08T07:10:44.000Z
CVE-2022-36404 WordPress Simple SEO plugin <= 1.8.12 - Broken Access Control vulnerability
Missing Authorization, Cross-Site Request Forgery (CSRF) vulnerability in David Cole Simple SEO (WordPress plugin) plugin <= 1.8.12 versions.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: David Cole
product: Simple SEO (WordPress plugin)
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
version: 3.1
Credits: lang: en
value: Mika (Patchstack Alliance)
Published: 2022-11-03T19:27:39.403Z
CVE-2022-36405 WordPress amCharts: Charts and Maps plugin <= 1.4 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability
Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in amCharts: Charts and Maps plugin <= 1.4 at WordPress.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: amCharts
product: amCharts: Charts and Maps (WordPress plugin)
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: Vulnerability discovered by Ngo Van Thien (Patchstack Alliance)
Published: 2022-08-23T15:48:38.499Z
CVE-2022-36412 
In Zoho ManageEngine SupportCenter Plus before 11023, V3 API requests are vulnerable to authentication bypass. (An API request may, in effect, be executed with the credentials of a user who authenticated in the past.)
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-26T13:34:05.000Z
CVE-2022-36413 
Zoho ManageEngine ADSelfService Plus through 6203 is vulnerable to a brute-force attack that leads to a password reset on IDM applications.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-03-23T00:00:00.000Z
CVE-2022-36414 
There is an elevation of privilege breakout vulnerability in the Windows EXE installer in Scooter Beyond Compare 4.2.0 through 4.4.2 before 4.4.3. Affected versions allow a logged-in user to run applications with elevated privileges via the Clipboard Compare tray app after installation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-23T02:33:15.000Z
CVE-2022-36415 
A DLL hijacking vulnerability exists in the uninstaller in Scooter Beyond Compare 1.8a through 4.4.2 before 4.4.3 when installed via the EXE installer. The uninstaller attempts to load DLLs out of a Windows Temp folder. If a standard user places malicious DLLs in the C:\Windows\Temp\ folder, and then the uninstaller is run as SYSTEM, the DLLs will execute with elevated privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-23T02:32:16.000Z
CVE-2022-36416 
Protection mechanism failure in the Intel(R) Ethernet 500 Series Controller drivers for VMware before version 1.10.0.13 may allow an authenticated user to potentially enable escalation of privilege via local access.
Problem types: description: escalation of privilege
Affected products: vendor: n/a
product: Intel(R) Ethernet 500 Series Controller drivers for VMware
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 4.4
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: LOW
Published: 2023-02-16T20:00:24.397Z
CVE-2022-36417 WordPress 3D Tag Cloud plugin <= 3.8 - Multiple Stored Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF) vulnerability
Multiple Stored Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF) vulnerability in 3D Tag Cloud plugin <= 3.8 at WordPress.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Vinoj Cardoza
product: 3D Tag Cloud (WordPress plugin)
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.1
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: Vulnerability discovered by Rasi Afeef (Patchstack Alliance)
Published: 2022-09-23T15:20:49.922Z
CVE-2022-36418 WordPress HREFLANG Tags Lite Plugin <= 2.0.0 is vulnerable to Broken Authentication
Missing Authorization vulnerability in Vagary Digital HREFLANG Tags Lite.This issue affects HREFLANG Tags Lite: from n/a through 2.0.0.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: Vagary Digital
product: HREFLANG Tags Lite
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
version: 3.1
Credits: lang: en
value: Rasi Afeef (Patchstack Alliance)
Published: 2024-01-17T15:51:15.793Z
CVE-2022-36422 WP-PostRatings plugin <= 1.89 - Rating increase/decrease via race condition
Rating increase/decrease via race condition in Lester 'GaMerZ' Chan WP-PostRatings plugin <= 1.89 at WordPress.
Problem types: description: Race condition
Affected products: vendor: Lester 'GaMerZ' Chan
product: WP-PostRatings (WordPress plugin)
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: Vulnerability discovered by Nguy Minh Tuan (Patchstack Alliance)
Published: 2022-09-09T14:39:52.886Z
CVE-2022-36423 Incorrect configuration of the cJSON library lead a Stack overflow vulnerability during recursive parsing. LAN attackers can lead a DoS attack to all network devices.
OpenHarmony-v3.1.2 and prior versions have an incorrect configuration of the cJSON library, which leads a Stack overflow vulnerability during recursive parsing. LAN attackers can lead a DoS attack to all network devices.
Problem types: cwe_id: CWE-16
description: CWE-16 Configuration
Affected products: vendor: OpenHarmony
product: OpenHarmony
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 7.4
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
version: 3.1
Published: 2022-09-09T14:39:56.347Z
CVE-2022-36424 WordPress Easy Appointments Plugin <= 3.11.9 is vulnerable to Cross Site Request Forgery (CSRF)
Cross-Site Request Forgery (CSRF) vulnerability in Nikola Loncar Easy Appointments plugin <= 3.11.9 versions.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Nikola Loncar
product: Easy Appointments
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: Lana Codes (Patchstack Alliance)
Published: 2023-07-17T15:12:46.169Z
CVE-2022-36425 WordPress Beaver Builder plugin <= 2.5.4.3 - Broken Access Control vulnerability
Broken Access Control vulnerability in Beaver Builder plugin <= 2.5.4.3 at WordPress.
Problem types: cwe_id: CWE-264
description: CWE-264 Permissions, Privileges, and Access Controls
Affected products: vendor: The Beaver Builder Team
product: Beaver Builder – WordPress Page Builder (WordPress plugin)
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
version: 3.1
Credits: lang: en
value: Vulnerability discovered by Dave Jong (Patchstack)
Published: 2022-09-06T17:18:54.528Z
CVE-2022-36427 WordPress About Rentals plugin <= 1.5 - Missing Access Control vulnerability
Missing Access Control vulnerability in About Rentals. Inc. About Rentals plugin <= 1.5 at WordPress.
Problem types: cwe_id: CWE-264
description: CWE-264 Permissions, Privileges, and Access Controls
Affected products: vendor: About Rentals. Inc.
product: About Rentals (WordPress plugin)
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.3
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Vulnerability discovered by ptsfence (Patchstack Alliance)
Published: 2022-09-06T22:19:14.243Z
CVE-2022-36428 WordPress Rock Convert plugin <= 2.11.0 - Auth. Cross-Site Scripting (XSS) vulnerability
Auth. (admin+) Cross-Site Scripting (XSS) vulnerability in Stage Rock Convert plugin <= 2.11.0 on WordPress.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Stage
product: Rock Convert (WordPress plugin)
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.8
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: HIGH
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: Vulnerability discovered by Mika (Patchstack Alliance)
Published: 2022-11-03T19:22:18.187Z
CVE-2022-36429 
A command execution vulnerability exists in the ubus backend communications functionality of Netgear Orbi Satellite RBS750 4.6.8.5. A specially-crafted JSON object can lead to arbitrary command execution. An attacker can send a sequence of malicious packets to trigger this vulnerability.
Problem types: cwe_id: CWE-912
description: CWE-912: Hidden Functionality
Affected products: vendor: Netgear
product: Orbi Satellite RBS750
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 7.2
baseSeverity: HIGH
Published: 2023-03-21T17:41:25.748Z
CVE-2022-36431 
An arbitrary file upload vulnerability in Rocket TRUfusion Enterprise before 7.9.6.1 allows unauthenticated attackers to execute arbitrary code via a crafted JSP file. Issue fixed in version 7.9.6.1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-01T00:00:00.000Z
CVE-2022-36432 
The Preview functionality in the Amasty Blog Pro 2.10.3 plugin for Magento 2 uses eval unsafely. This allows attackers to perform Cross-site Scripting attacks on admin panel users by manipulating the generated preview application response.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-17T00:00:00.000Z
CVE-2022-36433 
The blog-post creation functionality in the Amasty Blog Pro 2.10.3 plugin for Magento 2 allows injection of JavaScript code in the short_content and full_content fields, leading to XSS attacks against admin panel users via posts/preview or posts/save.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-29T00:00:00.000Z
CVE-2022-36436 
OSU Open Source Lab VNCAuthProxy through 1.1.1 is affected by an vncap/vnc/protocol.py VNCServerAuthenticator authentication-bypass vulnerability that could allow a malicious actor to gain unauthorized access to a VNC session or to disconnect a legitimate user from a VNC session. A remote attacker with network access to the proxy server could leverage this vulnerability to connect to VNC servers protected by the proxy server without providing any authentication credentials. Exploitation of this issue requires that the proxy server is currently accepting connections for the target VNC server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-14T03:04:34.000Z
CVE-2022-36437 
The Connection handler in Hazelcast and Hazelcast Jet allows a remote unauthenticated attacker to access and manipulate data in the cluster with the identity of another already authenticated connection. The affected Hazelcast versions are through 4.0.6, 4.1.9, 4.2.5, 5.0.3, and 5.1.2. The affected Hazelcast Jet versions are through 4.5.3.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-29T00:00:00.000Z
CVE-2022-36438 
AsusSwitch.exe on ASUS personal computers (running Windows) sets weak file permissions, leading to local privilege escalation (this also can be used to delete files within the system arbitrarily). This affects ASUS System Control Interface 3 before 3.1.5.0, and AsusSwitch.exe before 1.0.10.0.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-10-18T00:00:00.000Z
CVE-2022-36439 
AsusSoftwareManager.exe in ASUS System Control Interface on ASUS personal computers (running Windows) allows a local user to write into the Temp directory and delete another more privileged file via SYSTEM privileges. This affects ASUS System Control Interface 3 before 3.1.5.0, AsusSoftwareManger.exe before 1.0.53.0, and AsusLiveUpdate.dll before 1.0.45.0.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-10-18T00:00:00.000Z
CVE-2022-36440 
A reachable assertion was found in Frrouting frr-bgpd 8.3.0 in the peek_for_as4_capability function. Attackers can maliciously construct BGP open packets and send them to BGP peers running frr-bgpd, resulting in DoS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-03T00:00:00.000Z
CVE-2022-36441 
An issue was discovered in Zebra Enterprise Home Screen 4.1.19. The Gboard used by different applications can be used to launch and use several other applications that are restricted by the admin.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-01-10T00:00:00.000Z
CVE-2022-36442 
An issue was discovered in Zebra Enterprise Home Screen 4.1.19. By using the embedded Google Chrome application, it is possible to install an unauthorized application via a downloaded APK.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-01-10T00:00:00.000Z
CVE-2022-36443 
An issue was discovered in Zebra Enterprise Home Screen 4.1.19. The device allows the administrator to lock some communication channels (wireless and SD card) but it is still possible to use a physical connection (Ethernet cable) without restriction.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-01-10T00:00:00.000Z
CVE-2022-36444 
An issue was discovered in Atos Unify OpenScape SBC 9 and 10 before 10R2.2.1, Atos Unify OpenScape Branch 9 and 10 before version 10R2.1.1, and Atos Unify OpenScape BCF 10 before 10R9.12.1. A remote code execution vulnerability may allow an unauthenticated attacker (with network access to the admin interface) to disrupt system availability or potentially compromise the confidentiality and integrity of the system.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.6
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AC:L/AV:N/A:H/C:L/I:L/PR:N/S:U/UI:N
version: 3.1
Published: 2022-07-25T05:38:54.000Z
CVE-2022-36446 
software/apt-lib.pl in Webmin before 1.997 lacks HTML escaping for a UI command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-25T05:56:47.000Z
CVE-2022-36447 
An inflation issue was discovered in Chia Network CAT1 Standard 1.0.0. Previously minted tokens minted on the Chia blockchain using the CAT1 standard can be inflated to an arbitrary extent by any holder of any amount of the token. The total amount of the token can be increased as high as the malicious actor pleases. This is true for every CAT1 on the Chia blockchain regardless of issuance rules. This attack is auditable on chain, so maliciously altered coins can potentially be marked by off-chain observers as malicious.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-29T20:32:20.000Z
CVE-2022-36448 
An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. There is an SMM memory corruption vulnerability in the Software SMI handler in the PnpSmm driver.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-28T15:50:09.000Z
CVE-2022-36449 
An issue was discovered in the Arm Mali GPU Kernel Driver. A non-privileged user can make improper GPU processing operations to gain access to already freed memory, write a limited amount outside of buffer bounds, or to disclose details of memory mappings. This affects Midgard r4p0 through r32p0, Bifrost r0p0 through r38p0 and r39p0 before r38p1, and Valhall r19p0 through r38p0 and r39p0 before r38p1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-01T02:50:37.000Z
CVE-2022-36450 
Obsidian 0.14.x and 0.15.x before 0.15.5 allows obsidian://hook-get-address remote code execution because window.open is used without checking the URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:L/S:U/UI:R
version: 3.1
Published: 2022-07-25T06:15:49.000Z
CVE-2022-36451 
A vulnerability in the MiCollab Client server component of Mitel MiCollab through 9.5.0.101 could allow an authenticated attacker to conduct a Server-Side Request Forgery (SSRF) attack due to insufficient restriction of URL parameters. A successful exploit could allow an attacker to leverage connections and permissions available to the host server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-10-25T00:00:00.000Z
CVE-2022-36452 
A vulnerability in the web conferencing component of Mitel MiCollab through 9.5.0.101 could allow an unauthenticated attacker to upload malicious files. A successful exploit could allow an attacker to execute arbitrary code within the context of the application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-10-25T00:00:00.000Z
CVE-2022-36453 
A vulnerability in the MiCollab Client API of Mitel MiCollab 9.1.3 through 9.5.0.101 could allow an authenticated attacker to modify their profile parameters due to improper authorization controls. A successful exploit could allow the authenticated attacker to control another extension number.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-10-25T00:00:00.000Z
CVE-2022-36454 
A vulnerability in the MiCollab Client API of Mitel MiCollab through 9.5.0.101 could allow an authenticated attacker to modify their profile parameters due to improper authorization controls. A successful exploit could allow the authenticated attacker to impersonate another user's name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-10-25T00:00:00.000Z
CVE-2022-36455 
TOTOLink A3600R V4.1.2cu.5182_B20201102 was discovered to contain a command injection vulnerability via the username parameter in /cstecgi.cgi.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-25T14:06:06.000Z
CVE-2022-36456 
TOTOLink A720R V4.1.5cu.532_B20210610 was discovered to contain a command injection vulnerability via the username parameter in /cstecgi.cgi.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-25T13:53:25.000Z
CVE-2022-36458 
TOTOLINK A3700R V9.1.2u.6134_B20201202 was discovered to contain a command injection vulnerability via the command parameter in the function setTracerouteCfg.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-25T13:53:26.000Z
CVE-2022-36459 
TOTOLINK A3700R V9.1.2u.6134_B20201202 was discovered to contain a command injection vulnerability via the host_time parameter in the function NTPSyncWithHost.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-25T13:53:27.000Z
CVE-2022-36460 
TOTOLINK A3700R V9.1.2u.6134_B20201202 was discovered to contain a command injection vulnerability via the FileName parameter in the function UploadFirmwareFile.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-25T13:53:27.000Z