rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-35110 
SWFTools commit 772e55a2 was discovered to contain a memory leak via /lib/mem.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-16T20:12:24.000Z
CVE-2022-35111 
SWFTools commit 772e55a2 was discovered to contain a stack overflow via __sanitizer::StackDepotNode::hash(__sanitizer::StackTrace const&) at /sanitizer_common/sanitizer_stackdepot.cpp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-16T20:12:25.000Z
CVE-2022-35113 
SWFTools commit 772e55a2 was discovered to contain a heap-buffer overflow via swf_DefineLosslessBitsTagToImage at /modules/swfbits.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-16T20:12:27.000Z
CVE-2022-35114 
SWFTools commit 772e55a2 was discovered to contain a segmentation violation via extractFrame at /readers/swf.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-16T20:12:28.000Z
CVE-2022-35115 
IceWarp WebClient DC2 - Update 2 Build 9 (13.0.2.9) was discovered to contain a SQL injection vulnerability via the search parameter at /webmail/server/webmail.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-23T17:36:40.000Z
CVE-2022-35117 
Clinic's Patient Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via update_medicine_details.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Packing text box under the Update Medical Details module.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-17T17:35:56.000Z
CVE-2022-35118 
PyroCMS v3.9 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-01T19:24:40.000Z
CVE-2022-35120 
IXPdata EasyInstall 6.6.14725 contains an access control issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-01T00:00:00.000Z
CVE-2022-35121 
Novel-Plus v3.6.1 was discovered to contain a SQL injection vulnerability via the keyword parameter at /service/impl/BookServiceImpl.java.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-17T19:43:42.000Z
CVE-2022-35122 
An access control issue in Ecowitt GW1100 Series Weather Stations <=GW1100B_v2.1.5 allows unauthenticated attackers to access sensitive information including device and local WiFi passwords.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-17T20:27:15.000Z
CVE-2022-35131 
Joplin v2.8.8 allows attackers to execute arbitrary commands via a crafted payload injected into the Node titles.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-25T20:30:45.000Z
CVE-2022-35132 
Usermin through 1.850 allows a remote authenticated user to execute OS commands via command injection in a filename for the GPG module.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-10-25T00:00:00.000Z
CVE-2022-35133 
A cross-site scripting (XSS) vulnerability in CherryTree v0.99.30 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name text field when creating a node.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-17T20:38:00.000Z
CVE-2022-35134 
Boodskap IoT Platform v4.4.9-02 contains a cross-site scripting (XSS) vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-10-13T00:00:00.000Z
CVE-2022-35135 
Boodskap IoT Platform v4.4.9-02 allows attackers to escalate privileges via a crafted request sent to /api/user/upsert/<uuid>.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-10-13T00:00:00.000Z
CVE-2022-35136 
Boodskap IoT Platform v4.4.9-02 allows attackers to make unauthenticated API requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-10-13T00:00:00.000Z
CVE-2022-35137 
DGIOT Lightweight industrial IoT v4.5.4 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-29T18:20:41.000Z
CVE-2022-35142 
An issue in Renato v0.17.0 allows attackers to cause a Denial of Service (DoS) via a crafted payload injected into the Search parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-04T19:37:12.000Z
CVE-2022-35143 
Renato v0.17.0 employs weak password complexity requirements, allowing attackers to crack user passwords via brute-force attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-04T19:37:10.000Z
CVE-2022-35144 
Renato v0.17.0 was discovered to contain a cross-site scripting (XSS) vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-04T19:36:56.000Z
CVE-2022-35147 
DoraCMS v2.18 and earlier allows attackers to bypass login authentication via a crafted HTTP request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-17T20:49:28.000Z
CVE-2022-35148 
maccms10 v2021.1000.1081 to v2022.1000.3031 was discovered to contain a SQL injection vulnerability via the table parameter at database/columns.html.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-17T20:56:34.000Z
CVE-2022-35150 
Baijicms v4 was discovered to contain an arbitrary file upload vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-22T15:15:50.000Z
CVE-2022-35151 
kkFileView v4.1.0 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities via the urls and currentUrl parameters at /controller/OnlinePreviewController.java.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-17T21:13:14.000Z
CVE-2022-35153 
FusionPBX 5.0.1 was discovered to contain a command injection vulnerability via /fax/fax_send.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-18T04:16:34.000Z
CVE-2022-35154 
Shopro Mall System v1.3.8 was discovered to contain a SQL injection vulnerability via the value parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-18T04:28:08.000Z
CVE-2022-35155 
Bus Pass Management System v1.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the searchdata parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-30T18:10:11.000Z
CVE-2022-35156 
Bus Pass Management System 1.0 was discovered to contain a SQL Injection vulnerability via the searchdata parameter at /buspassms/download-pass.php..
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-30T18:10:01.000Z
CVE-2022-35158 
A vulnerability in the lua parser of TscanCode tsclua v2.15.01 allows attackers to cause a Denial of Service (DoS) via a crafted lua script.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-03T20:33:42.000Z
CVE-2022-35161 
GVRET Stable Release as of Aug 15, 2015 was discovered to contain a buffer overflow via the handleConfigCmd function at SerialConsole.cpp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-03T20:33:43.000Z
CVE-2022-35162 
Complete Online Job Search System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the CATEGORY parameter at /category/controller.php?action=edit.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-05T20:13:41.000Z
CVE-2022-35163 
Complete Online Job Search System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the U_NAME parameter at /category/controller.php?action=edit.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-05T20:13:50.000Z
CVE-2022-35164 
LibreDWG v0.12.4.4608 & commit f2dea29 was discovered to contain a heap use-after-free via bit_copy_chain.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-18T04:49:05.000Z
CVE-2022-35165 
An issue in AP4_SgpdAtom::AP4_SgpdAtom() of Bento4-1.6.0-639 allows attackers to cause a Denial of Service (DoS) via a crafted mp4 input.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-18T04:49:05.000Z
CVE-2022-35166 
libjpeg commit 842c7ba was discovered to contain an infinite loop via the component JPEG::ReadInternal.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-18T04:49:06.000Z
CVE-2022-35167 
Printix Cloud Print Management v1.3.1149.0 for Windows was discovered to contain insecure permissions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-19T01:03:05.000Z
CVE-2022-35168 
Due to improper input sanitization of XML input in SAP Business One - version 10.0, an attacker can perform a denial-of-service attack rendering the system temporarily inoperative.
Problem types: cwe_id: CWE-611
description: CWE-611
Affected products: vendor: SAP SE
product: SAP Business one
Published: 2022-07-12T20:27:54.000Z
CVE-2022-35169 
SAP BusinessObjects Business Intelligence Platform (LCM) - versions 420, 430, allows an attacker with an admin privilege to read and decrypt LCMBIAR file's password under certain conditions, enabling the attacker to modify the password or import the file into another system causing high impact on confidentiality but a limited impact on the availability and integrity of the application.
Problem types: cwe_id: CWE-200
description: CWE-200
Affected products: vendor: SAP SE
product: SAP BusinessObjects Business Intelligence Platform (LCM)
Published: 2022-07-12T20:28:08.000Z
CVE-2022-35170 
SAP NetWeaver Enterprise Portal does - versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, not sufficiently encode user-controlled inputs over the network, resulting in reflected Cross-Site Scripting (XSS) vulnerability, therefore changing the scope of the attack. This leads to limited impact on confidentiality and integrity of data.
Problem types: cwe_id: CWE-79
description: CWE-79
Affected products: vendor: SAP SE
product: SAP NetWeaver Enterprise Portal
Published: 2022-07-12T20:28:02.000Z
CVE-2022-35171 
When a user opens manipulated JPEG 2000 (.jp2, jp2k.x3d) files received from untrusted sources in SAP 3D Visual Enterprise Viewer, the application crashes and becomes temporarily unavailable to the user until restart of the application. The file format details along with their CVE relevant information can be found below
Problem types: cwe_id: CWE-20
description: CWE-20
Affected products: vendor: SAP SE
product: SAP 3D Visual Enterprise Viewer
Published: 2022-07-12T20:28:13.000Z
CVE-2022-35172 
SAP NetWeaver Enterprise Portal - versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs, resulting in reflected Cross-Site Scripting (XSS) vulnerability.
Problem types: cwe_id: CWE-79
description: CWE-79
Affected products: vendor: SAP SE
product: SAP NetWeaver Enterprise Portal
Published: 2022-07-12T20:28:18.000Z
CVE-2022-35173 
An issue was discovered in Nginx NJS v0.7.5. The JUMP offset for a break instruction was not set to a correct offset during code generation, leading to a segmentation violation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-18T05:08:54.000Z
CVE-2022-35174 
A stored cross-site scripting (XSS) vulnerability in Kirby's Starterkit v3.7.0.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Tags field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-18T17:27:17.000Z
CVE-2022-35175 
Barangay Management System v1.0 was discovered to contain a SQL injection vulnerability via the hidden_id parameter at /blotter/blotter.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-18T17:34:58.000Z
CVE-2022-35191 
D-Link Wireless AC1200 Dual Band VDSL ADSL Modem Router DSL-3782 Firmware v1.01 allows unauthenticated attackers to cause a Denial of Service (DoS) via a crafted HTTP connection request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-22T23:35:26.000Z
CVE-2022-35192 
D-Link Wireless AC1200 Dual Band VDSL ADSL Modem Router DSL-3782 Firmware v1.01 allows unauthenticated attackers to cause a Denial of Service (DoS) via the User parameter or Pwd parameter to Login.asp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-25T23:22:28.000Z
CVE-2022-35193 
TestLink v1.9.20 was discovered to contain a SQL injection vulnerability via /lib/execute/execNavigator.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-16T15:59:19.000Z
CVE-2022-35194 
TestLink v1.9.20 was discovered to contain a stored cross-site scripting (XSS) vulnerability via /lib/inventory/inventoryView.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-16T20:30:27.000Z
CVE-2022-35195 
TestLink 1.9.20 Raijin was discovered to contain a broken access control vulnerability at /lib/attachments/attachmentdownload.php
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-16T15:36:53.000Z
CVE-2022-35196 
TestLink v1.9.20 was discovered to contain a Cross-Site Request Forgery (CSRF) via /lib/plan/planView.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-20T15:52:42.000Z
CVE-2022-35198 
Contract Management System v2.0 contains a weak default password which gives attackers to access database connection information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-18T05:35:40.000Z
CVE-2022-35201 
Tenda-AC18 V15.03.05.05 was discovered to contain a remote command execution (RCE) vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-19T14:25:08.000Z
CVE-2022-35202 
A security issue in Sitevision version 10.3.1 and older allows a remote attacker, in certain (non-default) scenarios, to gain access to the private keys used for signing SAML Authn requests. The underlying issue is a Java keystore that may become accessible and downloadable via WebDAV. This keystore is protected with a low-complexity, auto-generated password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-11T00:00:00.000Z
CVE-2022-35203 
An access control issue in TrendNet TV-IP572PI v1.0 allows unauthenticated attackers to access sensitive system information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-23T12:34:01.000Z
CVE-2022-35204 
Vitejs Vite before v2.9.13 was discovered to allow attackers to perform a directory traversal via a crafted URL to the victim's service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-18T18:15:21.000Z
CVE-2022-35205 
An issue was discovered in Binutils readelf 2.38.50, reachable assertion failure in function display_debug_names allows attackers to cause a denial of service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-22T00:00:00.000Z
CVE-2022-35206 
Null pointer dereference vulnerability in Binutils readelf 2.38.50 via function read_and_display_attr_value in file dwarf.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-22T00:00:00.000Z
CVE-2022-35212 
osCommerce2 before v2.3.4.1 was discovered to contain a cross-site scripting (XSS) vulnerability via the function tep_db_error().
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-18T19:30:23.000Z
CVE-2022-35213 
Ecommerce-CodeIgniter-Bootstrap before commit 56465f was discovered to contain a cross-site scripting (XSS) vulnerability via the function base_url() at /blog/blogpublish.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-18T19:30:24.000Z
CVE-2022-35216 ITPison OMICARD EDM - Use of Hard-coded Credentials
OMICARD EDM’s mail image relay function has a path traversal vulnerability. An unauthenticated remote attacker can exploit this vulnerability to by-pass authentication and access arbitrary system files.
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: ITPison
product: OMICARD EDM
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2022-08-04T09:15:30.441Z
CVE-2022-35217 NHI card’s web service component - Stack-based Buffer Overflow-1
The NHI card’s web service component has a stack-based buffer overflow vulnerability due to insufficient validation for network packet header length. A local area network attacker with general user privilege can exploit this vulnerability to execute arbitrary code, manipulate system command or disrupt service.
Problem types: cwe_id: CWE-787
description: CWE-787 Out-of-bounds Write
Affected products: vendor: NHI
product: card’s web service component
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2022-08-02T02:55:28.143Z
CVE-2022-35218 NHI card’s web service component - Heap-based Buffer Overflow
The NHI card’s web service component has a heap-based buffer overflow vulnerability due to insufficient validation for packet origin parameter length. A LAN attacker with general user privilege can exploit this vulnerability to disrupt service.
Problem types: cwe_id: CWE-787
description: CWE-787 Out-of-bounds Write
Affected products: vendor: NHI
product: card’s web service component
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 5.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2022-08-02T15:20:04.675Z
CVE-2022-35219 NHI card’s web service component - Stack-based Buffer Overflow-2
The NHI card’s web service component has a stack-based buffer overflow vulnerability due to insufficient validation for network packet key parameter. A LAN attacker with general user privilege can exploit this vulnerability to disrupt service.
Problem types: cwe_id: CWE-787
description: CWE-787 Out-of-bounds Write
Affected products: vendor: NHI
product: card’s web service component
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 5.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2022-08-02T15:20:19.164Z
CVE-2022-35220 TEAMPLUS TECHNOLOGY INC. Teamplus Pro - Allocation of Resources Without Limits or Throttling-1
Teamplus Pro community discussion function has an ‘allocation of resource without limits or throttling’ vulnerability. A remote attacker with general user privilege posting a thread with large content can cause the receiving client device to allocate too much memory, leading to abnormal termination of this client’s Teamplus Pro application.
Problem types: cwe_id: CWE-770
description: CWE-770 Allocation of Resources Without Limits or Throttling
Affected products: vendor: TEAMPLUS TECHNOLOGY INC.
product: Teamplus Pro
vendor: TEAMPLUS TECHNOLOGY INC.
product: Teamplus Pro
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.7
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
version: 3.1
Published: 2022-08-02T15:20:32.031Z
CVE-2022-35221 TEAMPLUS TECHNOLOGY INC. Teamplus Pro - Allocation of Resources Without Limits or Throttling-2
Teamplus Pro community discussion has an ‘allocation of resource without limits or throttling’ vulnerability on thread subject field. A remote attacker with general user privilege posting a thread subject with large content can cause the server to allocate too much memory, leading to missing partial post content and disrupt partial service.
Problem types: cwe_id: CWE-770
description: CWE-770 Allocation of Resources Without Limits or Throttling
Affected products: vendor: TEAMPLUS TECHNOLOGY INC.
product: Teamplus Pro
vendor: TEAMPLUS TECHNOLOGY INC.
product: Teamplus Pro
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
version: 3.1
Published: 2022-08-02T15:20:44.721Z
CVE-2022-35222 HiCOS Citizen verification component - Stack Buffer Overflow
HiCOS Citizen verification component has a stack-based buffer overflow vulnerability due to insufficient parameter length validation. An unauthenticated physical attacker can exploit this vulnerability to execute arbitrary code, manipulate system command or disrupt service.
Problem types: cwe_id: CWE-787
description: CWE-787 Out-of-bounds Write
Affected products: vendor: HINET
product: HiCOS Citizen verification component - Stack Buffer Overflow
vendor: HINET
product: HiCOS Citizen verification component - Stack Buffer Overflow
vendor: HINET
product: HiCOS Citizen verification component - Stack Buffer Overflow
CVSS v3.1: attackComplexity: LOW
attackVector: PHYSICAL
availabilityImpact: HIGH
baseScore: 6.8
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2022-08-02T15:21:00.177Z
CVE-2022-35223 EasyUse MailHunter Ultimate - Deserialization of Untrusted Data
EasyUse MailHunter Ultimate’s cookie deserialization function has an inadequate validation vulnerability. Deserializing a cookie containing malicious payload will trigger this insecure deserialization vulnerability, allowing an unauthenticated remote attacker to execute arbitrary code, manipulate system command or interrupt service.
Problem types: cwe_id: CWE-502
description: CWE-502 Deserialization of Untrusted Data
Affected products: vendor: EasyUse
product: MailHunter Ultimate
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2022-08-02T15:21:11.229Z