stasvinokur/cve-and-cwe-dataset-1999-2025 huggingface dataset:
CVE-2022-36491 (severity: HIGH, weakness: CWE-787)
H3C Magic NX18 Plus NX18PV100R003 was discovered to contain a stack overflow via the function UpdateIpv6Params.
CVE-2022-36492 (severity: HIGH, weakness: CWE-787)
H3C Magic NX18 Plus NX18PV100R003 was discovered to contain a stack overflow via the function AddMacList.
CVE-2022-36493 (severity: HIGH, weakness: CWE-787)
H3C Magic NX18 Plus NX18PV100R003 was discovered to contain a stack overflow via the function SetAPWifiorLedInfoById.
CVE-2022-36494 (severity: HIGH, weakness: CWE-787)
H3C Magic NX18 Plus NX18PV100R003 was discovered to contain a stack overflow via the function edditactionlist.
CVE-2022-36495 (severity: HIGH, weakness: CWE-787)
H3C Magic NX18 Plus NX18PV100R003 was discovered to contain a stack overflow via the function addactionlist.
CVE-2022-36496 (severity: HIGH, weakness: CWE-787)
H3C Magic NX18 Plus NX18PV100R003 was discovered to contain a stack overflow via the function SetMobileAPInfoById.
CVE-2022-36497 (severity: HIGH, weakness: CWE-787)
H3C Magic NX18 Plus NX18PV100R003 was discovered to contain a stack overflow via the function Edit_BasicSSID_5G.
CVE-2022-36498 (severity: HIGH, weakness: CWE-787)
H3C Magic NX18 Plus NX18PV100R003 was discovered to contain a stack overflow via the function Asp_SetTimingtimeWifiAndLed.
CVE-2022-36499 (severity: HIGH, weakness: CWE-787)
H3C Magic NX18 Plus NX18PV100R003 was discovered to contain a stack overflow via the function DEleteusergroup.
CVE-2022-3650 (severity: HIGH, weakness: CWE-842)
A privilege escalation flaw was found in Ceph. Ceph-crash.service allows a local attacker to escalate privileges to root in the form of a crash dump, and dump privileged information.
CVE-2022-36500 (severity: HIGH, weakness: CWE-787)
H3C Magic NX18 Plus NX18PV100R003 was discovered to contain a stack overflow via the function EditWlanMacList.
CVE-2022-36501 (severity: HIGH, weakness: CWE-787)
H3C Magic NX18 Plus NX18PV100R003 was discovered to contain a stack overflow via the function UpdateSnat.
CVE-2022-36502 (severity: HIGH, weakness: CWE-787)
H3C Magic NX18 Plus NX18PV100R003 was discovered to contain a stack overflow via the function UpdateWanParams.
CVE-2022-36503 (severity: HIGH, weakness: CWE-787)
H3C Magic NX18 Plus NX18PV100R003 was discovered to contain a stack overflow via the function UpdateMacClone.
CVE-2022-36504 (severity: HIGH, weakness: CWE-787)
H3C Magic NX18 Plus NX18PV100R003 was discovered to contain a stack overflow via the function Edit_BasicSSID.
CVE-2022-36505 (severity: HIGH, weakness: CWE-787)
H3C Magic NX18 Plus NX18PV100R003 was discovered to contain a stack overflow via the function EDitusergroup.
CVE-2022-36506 (severity: HIGH, weakness: CWE-787)
H3C Magic NX18 Plus NX18PV100R003 was discovered to contain a stack overflow via the function SetMacAccessMode.
CVE-2022-36507 (severity: HIGH, weakness: CWE-787)
H3C Magic NX18 Plus NX18PV100R003 was discovered to contain a stack overflow via the function AddWlanMacList.
CVE-2022-36508 (severity: HIGH, weakness: CWE-787)
H3C Magic NX18 Plus NX18PV100R003 was discovered to contain a stack overflow via the function SetAPInfoById.
CVE-2022-36509 (severity: HIGH, weakness: CWE-78)
H3C GR3200 MiniGR1B0V100R014 was discovered to contain a command injection vulnerability via the param parameter at DelL2tpLNSList.
CVE-2022-36510 (severity: HIGH, weakness: CWE-78)
H3C GR2200 MiniGR1A0V100R014 was discovered to contain a command injection vulnerability via the param parameter at DelL2tpLNSList.
CVE-2022-36511 (severity: CRITICAL, weakness: CWE-787)
H3C GR-1200W MiniGRW1A0V100R006 was discovered to contain a stack overflow via the function EditApAdvanceInfo.
CVE-2022-36513 (severity: CRITICAL, weakness: CWE-787)
H3C GR-1200W MiniGRW1A0V100R006 was discovered to contain a stack overflow via the function edditactionlist.
CVE-2022-36514 (severity: CRITICAL, weakness: CWE-787)
H3C GR-1200W MiniGRW1A0V100R006 was discovered to contain a stack overflow via the function WanModeSetMultiWan.
CVE-2022-36515 (severity: CRITICAL, weakness: CWE-787)
H3C GR-1200W MiniGRW1A0V100R006 was discovered to contain a stack overflow via the function addactionlist.
CVE-2022-36516 (severity: CRITICAL, weakness: CWE-787)
H3C GR-1200W MiniGRW1A0V100R006 was discovered to contain a stack overflow via the function ap_version_check.
CVE-2022-36517 (severity: CRITICAL, weakness: CWE-787)
H3C GR-1200W MiniGRW1A0V100R006 was discovered to contain a stack overflow via the function debug_wlan_advance.
CVE-2022-36518 (severity: CRITICAL, weakness: CWE-787)
H3C GR-1200W MiniGRW1A0V100R006 was discovered to contain a stack overflow via the function EditWlanMacList.
CVE-2022-36519 (severity: CRITICAL, weakness: CWE-787)
H3C GR-1200W MiniGRW1A0V100R006 was discovered to contain a stack overflow via the function AddWlanMacList.
CVE-2022-3652 (severity: HIGH, weakness: CWE-843)
Type confusion in V8 in Google Chrome prior to 107.0.5304.62 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVE-2022-36520 (severity: CRITICAL, weakness: CWE-787)
H3C GR-1200W MiniGRW1A0V100R006 was discovered to contain a stack overflow via the function DEleteusergroup.
CVE-2022-36521 (severity: HIGH, weakness: CWE-306)
Insecure permissions in cskefu v7.0.1 allows unauthenticated attackers to arbitrarily add administrator accounts.
CVE-2022-36522 (severity: MEDIUM, weakness: CWE-617)
Mikrotik RouterOs through stable v6.48.3 was discovered to contain an assertion failure in the component /advanced-tools/nova/bin/netwatch. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted packet.
CVE-2022-36523 (severity: CRITICAL, weakness: CWE-77)
D-Link Go-RT-AC750 GORTAC750_revA_v101b03 & GO-RT-AC750_revB_FWv200b02 is vulnerable to command injection via /htdocs/upnpinc/gena.php.
CVE-2022-36524 (severity: HIGH, weakness: CWE-287)
D-Link GO-RT-AC750 GORTAC750_revA_v101b03 & GO-RT-AC750_revB_FWv200b02 is vulnerable to Static Default Credentials via /etc/init0.d/S80telnetd.sh.
CVE-2022-36525 (severity: CRITICAL, weakness: CWE-120)
D-Link Go-RT-AC750 GORTAC750_revA_v101b03 & GO-RT-AC750_revB_FWv200b02 is vulnerable to Buffer Overflow via authenticationcgi_main.
CVE-2022-36526 (severity: HIGH, weakness: NVD-CWE-Other)
D-Link GO-RT-AC750 GORTAC750_revA_v101b03 & GO-RT-AC750_revB_FWv200b02 is vulnerable to Authentication Bypass via function phpcgi_main in cgibin.
CVE-2022-36527 (severity: MEDIUM, weakness: CWE-79)
Jfinal CMS v5.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the post title text field under the publish blog module.
CVE-2022-36529 (severity: HIGH, weakness: CWE-89)
Kensite CMS v1.0 was discovered to contain multiple SQL injection vulnerabilities via the name and oldname parameters at /framework/mod/db/DBMapper.xml.
CVE-2022-3653 (severity: HIGH, weakness: CWE-787)
Heap buffer overflow in Vulkan in Google Chrome prior to 107.0.5304.62 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVE-2022-36530 (severity: MEDIUM, weakness: CWE-79)
An issue was discovered in rageframe2 2.6.37. There is a XSS vulnerability in the user agent related parameters of the info.php page.
CVE-2022-36532 (severity: HIGH, weakness: NVD-CWE-Other)
Bolt CMS contains a vulnerability in version 5.1.12 and below that allows an authenticated user with the ROLE_EDITOR privileges to upload and rename a malicious file to achieve remote code execution.
CVE-2022-36533 (severity: MEDIUM, weakness: CWE-79)
Super Flexible Software GmbH & Co. KG Syncovery 9 for Linux v9.47x and below was discovered to contain a cross-site scripting (XSS) vulnerability.
CVE-2022-36534 (severity: HIGH, weakness: NVD-CWE-Other)
Super Flexible Software GmbH & Co. KG Syncovery 9 for Linux v9.47x and below was discovered to contain multiple remote code execution (RCE) vulnerabilities via the Job_ExecuteBefore and Job_ExecuteAfter parameters at post_profilesettings.php.
CVE-2022-36536 (severity: CRITICAL, weakness: CWE-330)
An issue in the component post_applogin.php of Super Flexible Software GmbH & Co. KG Syncovery 9 for Linux v9.47x and below allows attackers to escalate privileges via creating crafted session tokens.
CVE-2022-36537 (severity: HIGH, weakness: NVD-CWE-Other)
ZK Framework v9.6.1, 9.6.0.1, 9.5.1.3, 9.0.1.2 and 8.6.4.1 allows attackers to access sensitive information via a crafted POST request sent to the component AuUploader.
CVE-2022-36539 (severity: HIGH, weakness: CWE-639)
WeDayCare B.V Ouderapp before v1.1.22 allows attackers to alter the ID value within intercepted calls to gain access to data of other parents and children.
CVE-2022-3654 (severity: HIGH, weakness: CWE-416)
Use after free in Layout in Google Chrome prior to 107.0.5304.62 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVE-2022-36542 (severity: MEDIUM, weakness: NVD-CWE-Other)
An access control issue in the component /ip/admin/ of Edoc-doctor-appointment-system v1.0.1 allows attackers to arbitrarily edit, read, and delete Administrator data.
CVE-2022-36543 (severity: CRITICAL, weakness: CWE-89)
Edoc-doctor-appointment-system v1.0.1 was discovered to contain a SQL injection vulnerability via the id parameter at /patient/doctors.php.
CVE-2022-36544 (severity: CRITICAL, weakness: CWE-89)
Edoc-doctor-appointment-system v1.0.1 was discovered to contain a SQL injection vulnerability via the id parameter at /patient/booking.php.
CVE-2022-36545 (severity: CRITICAL, weakness: CWE-89)
Edoc-doctor-appointment-system v1.0.1 was discovered to contain a SQL injection vulnerability via the id parameter at /patient/settings.php.
CVE-2022-36546 (severity: HIGH, weakness: CWE-352)
Edoc-doctor-appointment-system v1.0.1 was discovered to contain a Cross-Site Request Forgery (CSRF) via /patient/settings.php.
CVE-2022-36547 (severity: MEDIUM, weakness: CWE-79)
Edoc-doctor-appointment-system v1.0.1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability at /patient/index.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Search field.
CVE-2022-36548 (severity: MEDIUM, weakness: CWE-79)
Edoc-doctor-appointment-system v1.0.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability at /patient/settings.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name text field.
CVE-2022-3655 (severity: HIGH, weakness: CWE-787)
Heap buffer overflow in Media Galleries in Google Chrome prior to 107.0.5304.62 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
CVE-2022-36551 (severity: MEDIUM, weakness: CWE-918)
A Server Side Request Forgery (SSRF) in the Data Import module in Heartex - Label Studio Community Edition versions 1.5.0 and earlier allows an authenticated user to access arbitrary files on the system. Furthermore, self-registration is enabled by default in these versions of Label Studio enabling a remote attacker to create a new account and then exploit the SSRF.
CVE-2022-36552 (severity: HIGH, weakness: CWE-552)
Tenda AC6(AC1200) v5.0 Firmware v02.03.01.114 and below contains an issue in the component /cgi-bin/DownloadFlash which allows attackers to steal all data such as source code and system files via a crafted GET request.
CVE-2022-36553 (severity: CRITICAL, weakness: CWE-77)
Hytec Inter HWL-2511-SS v1.05 and below was discovered to contain a command injection vulnerability via the component /www/cgi-bin/popen.cgi.
CVE-2022-36554 (severity: CRITICAL, weakness: CWE-77)
A command injection vulnerability in the CLI (Command Line Interface) implementation of Hytec Inter HWL-2511-SS v1.05 and below allows attackers to execute arbitrary commands with root privileges.
CVE-2022-36555 (severity: CRITICAL, weakness: CWE-326)
Hytec Inter HWL-2511-SS v1.05 and below implements a SHA512crypt hash for the root account which can be easily cracked via a brute-force attack.
CVE-2022-36556 (severity: CRITICAL, weakness: CWE-77)
Seiko SkyBridge MB-A100/A110 v4.2.0 and below was discovered to contain a command injection vulnerability via the ipAddress parameter at 07system08execute_ping_01.
CVE-2022-36557 (severity: CRITICAL, weakness: CWE-434)
Seiko SkyBridge MB-A100/A110 v4.2.0 and below was discovered to contain an arbitrary file upload vulnerability via the restore backup function. This vulnerability allows attackers to execute arbitrary code via a crafted html file.
CVE-2022-36558 (severity: CRITICAL, weakness: CWE-798)
Seiko SkyBridge MB-A100/A110 v4.2.0 and below implements a hard-coded passcode for the root account. Attackers are able to access the passcord via the file /etc/ciel.cfg.
CVE-2022-36559 (severity: CRITICAL, weakness: CWE-77)
Seiko SkyBridge MB-A200 v01.00.04 and below was discovered to contain a command injection vulnerability via the Ping parameter at ping_exec.cgi.
CVE-2022-3656 (severity: HIGH, weakness: CWE-20)
Insufficient data validation in File System in Google Chrome prior to 107.0.5304.62 allowed a remote attacker to bypass file system restrictions via a crafted HTML page. (Chromium security severity: Medium)
CVE-2022-36560 (severity: CRITICAL, weakness: CWE-798)
Seiko SkyBridge MB-A200 v01.00.04 and below was discovered to contain multiple hard-coded passcodes for root. Attackers are able to access the passcodes at /etc/srapi/config/system.conf and /usr/sbin/ssol-sshd.sh.
CVE-2022-36561 (severity: MEDIUM, weakness: NVD-CWE-Other)
XPDF v4.0.4 was discovered to contain a segmentation violation via the component /xpdf/AcroForm.cc:538.
CVE-2022-36562 (severity: HIGH, weakness: NVD-CWE-Other)
Incorrect access control in the install directory (C:\Ruby31-x64) of Rubyinstaller2 v3.1.2 and below allows authenticated attackers to execute arbitrary code via overwriting binaries located in the directory.
CVE-2022-36563 (severity: HIGH, weakness: NVD-CWE-Other)
Incorrect access control in the install directory (C:\RailsInstaller) of Rubyinstaller2 v3.1.2 and below allows authenticated attackers to execute arbitrary code via overwriting binaries located in the directory.
CVE-2022-36564 (severity: HIGH, weakness: NVD-CWE-Other)
Incorrect access control in the install directory (C:\Strawberry) of StrawberryPerl v5.32.1.1 and below allows authenticated attackers to execute arbitrary code via overwriting binaries located in the directory.
CVE-2022-36565 (severity: HIGH, weakness: NVD-CWE-Other)
Incorrect access control in the install directory (C:\Wamp64) of Wamp v3.2.6 and below allows authenticated attackers to execute arbitrary code via overwriting binaries located in the directory.
CVE-2022-36566 (severity: CRITICAL, weakness: CWE-78)
Rengine v1.3.0 was discovered to contain a command injection vulnerability via the scan engine function.
CVE-2022-36568 (severity: HIGH, weakness: CWE-787)
Tenda AC9 V15.03.05.19 was discovered to contain a stack overflow via the list parameter at /goform/setPptpUserList.
CVE-2022-36569 (severity: HIGH, weakness: CWE-787)
Tenda AC9 V15.03.05.19 was discovered to contain a stack overflow via the deviceList parameter at /goform/setMacFilterCfg.
CVE-2022-3657 (severity: HIGH, weakness: CWE-416)
Use after free in Extensions in Google Chrome prior to 107.0.5304.62 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension. (Chromium security severity: Medium)
CVE-2022-36570 (severity: HIGH, weakness: CWE-787)
Tenda AC9 V15.03.05.19 was discovered to contain a stack overflow via the time parameter at /goform/SetLEDCfg.
CVE-2022-36571 (severity: HIGH, weakness: CWE-787)
Tenda AC9 V15.03.05.19 was discovered to contain a stack overflow via the mask parameter at /goform/WanParameterSetting.
CVE-2022-36572 (severity: CRITICAL, weakness: NVD-CWE-Other)
Sinsiu Sinsiu Enterprise Website System v1.1.1.0 was discovered to contain a remote code execution (RCE) vulnerability via the component /upload/admin.php?/deal/.
CVE-2022-36573 (severity: MEDIUM, weakness: CWE-79)
A cross-site scripting (XSS) vulnerability in Pagekit CMS v1.0.18 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Markdown text box under /blog/post/edit.
CVE-2022-36577 (severity: HIGH, weakness: CWE-352)
An issue was discovered in jizhicms v2.3.1. There is a CSRF vulnerability that can add a admin.
CVE-2022-36578 (severity: CRITICAL, weakness: CWE-89)
jizhicms v2.3.1 has SQL injection in the background.
CVE-2022-36579 (severity: HIGH, weakness: CWE-352)
Wellcms 2.2.0 is vulnerable to Cross Site Request Forgery (CSRF).
CVE-2022-3658 (severity: HIGH, weakness: CWE-416)
Use after free in Feedback service on Chrome OS in Google Chrome on Chrome OS prior to 107.0.5304.62 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via specific UI interaction. (Chromium security severity: Medium)
CVE-2022-36580 (severity: HIGH, weakness: CWE-434)
An arbitrary file upload vulnerability in the component /admin/products/controller.php?action=add of Online Ordering System v2.3.2 allows attackers to execute arbitrary code via a crafted PHP file.
CVE-2022-36581 (severity: HIGH, weakness: CWE-89)
Online Ordering System v2.3.2 was discovered to contain a SQL injection vulnerability via the user_email parameter at /admin/login.php.
CVE-2022-36582 (severity: HIGH, weakness: CWE-434)
An arbitrary file upload vulnerability in the component /php_action/createProduct.php of Garage Management System v1.0 allows attackers to execute arbitrary code via a crafted PHP file.
CVE-2022-36583 (severity: MEDIUM, weakness: CWE-79)
DedeCMS V5.7.97 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities at /dede/co_do.php via the dopost, rpok, and aid parameters.
CVE-2022-36584 (severity: CRITICAL, weakness: CWE-120)
In Tenda G3 US_G3V3.0br_V15.11.0.6(7663)_EN_TDE, the getsinglepppuser function has a buffer overflow caused by sscanf.
CVE-2022-36585 (severity: CRITICAL, weakness: CWE-120)
In Tenda G3 US_G3V3.0br_V15.11.0.6(7663)_EN_TDE, in httpd binary, the addDhcpRule function has a buffer overflow caused by sscanf.
CVE-2022-36586 (severity: CRITICAL, weakness: CWE-120)
In Tenda G3 US_G3V3.0br_V15.11.0.6(7663)_EN_TDE, there is a buffer overflow vulnerability caused by strcpy in function 0x869f4 in the httpd binary.
CVE-2022-36587 (severity: CRITICAL, weakness: CWE-120)
In Tenda G3 US_G3V3.0br_V15.11.0.6(7663)_EN_TDE, there is a buffer overflow vulnerability caused by sprintf in function in the httpd binary.
CVE-2022-36588 (severity: CRITICAL, weakness: CWE-120)
In D-Link DAP1650 v1.04 firmware, the fileaccess.cgi program in the firmware has a buffer overflow vulnerability caused by strncpy.
CVE-2022-3659 (severity: HIGH, weakness: CWE-416)
Use after free in Accessibility in Google Chrome on Chrome OS prior to 107.0.5304.62 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via specific UI interactions. (Chromium security severity: Medium)
CVE-2022-36593 (severity: MEDIUM, weakness: CWE-22)
kkFileView v4.0.0 was discovered to contain an arbitrary file deletion vulnerability via the fileName parameter at /controller/FileController.java.
CVE-2022-36594 (severity: CRITICAL, weakness: CWE-89)
Mapper v4.0.0 to v4.2.0 was discovered to contain a SQL injection vulnerability via the ids parameter at the selectByIds function.
CVE-2022-36599 (severity: CRITICAL, weakness: CWE-89)
Mingsoft MCMS 5.2.8 was discovered to contain a SQL injection vulnerability in /mdiy/model/delete URI via models Lists.
CVE-2022-3660 (severity: MEDIUM, weakness: NVD-CWE-Other)
Inappropriate implementation in Full screen mode in Google Chrome on Android prior to 107.0.5304.62 allowed a remote attacker to hide the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: Medium)
CVE-2022-36600 (severity: MEDIUM, weakness: CWE-79)
BlogEngine v3.3.8.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /blogengine/api/posts. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Description field.
CVE-2022-36601 (severity: CRITICAL, weakness: NVD-CWE-Other)
The Eclipse TCF debug interface in JasMiner-X4-Server-20220621-090907 and below is open on port 1534. This issue allows unauthenticated attackers to gain root privileges on the affected device and access sensitive data or execute arbitrary commands.
CVE-2022-36602 (severity: HIGH, weakness: NVD-CWE-Other)
InnoSilicon A10 a10_20200924_120556 was discovered to contain a remote code execution (RCE) vulnerability in the setPlatformAPI function.
CVE-2022-36603 (severity: HIGH, weakness: NVD-CWE-Other)
InnoSilicon T3T+ t2t+_soc_20190911_151433.swu was discovered to contain a remote code execution (RCE) vulnerability in the checkUrl function.
CVE-2022-36604 (severity: HIGH, weakness: CWE-306)
An access control issue in Canaan Avalon ASIC Miner 2020.3.30 and below allows unauthenticated attackers to arbitrarily change user passwords via a crafted POST request.
CVE-2022-36605 (severity: CRITICAL, weakness: CWE-89)
Yimioa v6.1 was discovered to contain a SQL injection vulnerability via the orderbyGET parameter.
CVE-2022-36606 (severity: CRITICAL, weakness: CWE-89)
Ywoa before v6.1 was discovered to contain a SQL injection vulnerability via /oa/setup/checkPool?database.
CVE-2022-36609 (severity: CRITICAL, weakness: CWE-89)
Clinic's Patient Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /pms/update_patient.php.
CVE-2022-3661 (severity: MEDIUM, weakness: CWE-20)
Insufficient data validation in Extensions in Google Chrome prior to 107.0.5304.62 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted Chrome extension. (Chromium security severity: Low)
CVE-2022-36610 (severity: HIGH, weakness: CWE-798)
TOTOLINK A720R V4.1.5cu.532_B20210610 was discovered to contain a hardcoded password for root at /etc/shadow.sample.
CVE-2022-36611 (severity: HIGH, weakness: CWE-798)
TOTOLINK A800R V4.1.2cu.5137_B20200730 was discovered to contain a hardcoded password for root at /etc/shadow.sample.
CVE-2022-36612 (severity: HIGH, weakness: CWE-798)
TOTOLINK A950RG V4.1.2cu.5204_B20210112 was discovered to contain a hardcoded password for root at /etc/shadow.sample.
CVE-2022-36613 (severity: HIGH, weakness: CWE-798)
TOTOLINK N600R V4.3.0cu.7647_B20210106 was discovered to contain a hardcoded password for root at /etc/shadow.sample.
CVE-2022-36614 (severity: HIGH, weakness: CWE-798)
TOTOLINK A860R V4.1.2cu.5182_B20201027 was discovered to contain a hardcoded password for root at /etc/shadow.sample.
CVE-2022-36615 (severity: HIGH, weakness: CWE-798)
TOTOLINK A3000RU V4.1.2cu.5185_B20201128 was discovered to contain a hardcoded password for root at /etc/shadow.sample.
CVE-2022-36616 (severity: HIGH, weakness: CWE-798)
TOTOLINK A810R V4.1.2cu.5182_B20201026 and V5.9c.4050_B20190424 was discovered to contain a hardcoded password for root at /etc/shadow.sample.
CVE-2022-36617 (severity: MEDIUM, weakness: CWE-522)
Arq Backup 7.19.5.0 and below stores backup encryption passwords using reversible encryption. This issue allows attackers with administrative privileges to recover cleartext passwords.
CVE-2022-36619 (severity: HIGH, weakness: CWE-306)
In D-link DIR-816 A2_v1.10CNB04.img,the network can be reset without authentication via /goform/setMAC.
CVE-2022-3662 (severity: HIGH, weakness: CWE-119)
A vulnerability was found in Axiomatic Bento4. It has been declared as critical. This vulnerability affects the function GetOffset of the file Ap4Sample.h of the component mp42hls. The manipulation leads to use after free. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-212002 is the identifier assigned to this vulnerability.