vendor: InHand Networks

status: affected

ecosystem: operating-system

metric_type: Secondary

severity: critical

metric_type: Primary

severity: high

severity: medium

part: o

vendor: inhandnetworks

quality: metadata-backed

recipe_kind: composed

status: Modified

summary: A stack-based buffer overflow vulnerability exists in the console factory functionality of InHand Networks InRouter302 V3.5.4. A specially-crafted network request can lead to remote code execution. An attacker can send a sequence of malicious packets to trigger this vulnerability.


default_status: unaffected

product: Intel(R) Processors

version: See references

vendor: intel

summary: Improper input validation in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access.

title: Intel Core I5-7640X Firmware security vulnerability


summary: An OS command injection vulnerability exists in the console factory functionality of InHand Networks InRouter302 V3.5.4. A specially-crafted network request can lead to command execution. An attacker can send a sequence of requests to trigger this vulnerability.


product: LinkHub Mesh Wifi

vendor: TCL

vendor: tcl

summary: A stack-based buffer overflow vulnerability exists in the confsrv ucloud_set_node_location functionality of TCL LinkHub Mesh Wi-Fi MS1G_00_01.00_14. A specially-crafted network packet can lead to stack-based buffer overflow. An attacker can send a malicious packet to trigger this vulnerability.

title: Tcl Linkhub Mesh Wifi Ac1200 security vulnerability


product: DIAEnergie

vendor: Delta Electronics

version: unspecified

version_type: custom

ecosystem: software/application

part: a

product: diaenergie

vendor: deltaww

summary: Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability that exists in DIAE_dmdsetHandler.ashx. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database contents, and execute system commands.

title: Deltaww Diaenergie security vulnerability


product: Intel(R) DSA software for

version: before version 22.2.14

archetype: generic

summary: Improper access control in the Intel(R) DSA software for before version 22.2.14 may allow an authenticated user to potentially enable escalation of privilege via adjacent access.

title: Intel Driver & Support Assistant security vulnerability


product: pfSense CE and pfSense Plus

vendor: pfSense

product: pfsense

vendor: netgate

summary: Improper access control vulnerability in pfSense CE and pfSense Plus (pfSense CE software versions prior to 2.6.0 and pfSense Plus software versions prior to 22.01) allows a remote attacker with the privilege to change NTP GPS settings to rewrite existing files on the file system, which may result in arbitrary command execution.

title: Netgate Pfsense security vulnerability


summary: An information disclosure vulnerability exists in the router configuration export functionality of InHand Networks InRouter302 V3.5.4. A specially-crafted network request can lead to increased privileges. An attacker can send an HTTP request to trigger this vulnerability.


product: CX-Position

vendor: Omron

product: cx-position

vendor: omron

summary: Omron CX-Position (versions 2.5.3 and prior) is vulnerable to an out-of-bounds write while processing a specific project file, which may allow an attacker to execute arbitrary code.

title: Omron Cx-Position security vulnerability


summary: A leftover debug code vulnerability exists in the console verify functionality of InHand Networks InRouter302 V3.5.45. A specially-crafted series of network requests can lead to disabling security features. An attacker can send a sequence of requests to trigger this vulnerability.


version: before version 1.78.2.0.7

summary: Improper access control in the Intel(R) NUC HDMI Firmware Update Tool for NUC7i3DN, NUC7i5DN and NUC7i7DN before version 1.78.2.0.7 may allow an authenticated user to potentially enable escalation of privilege via local access.

title: Intel Nuc7I3Dnbe Firmware security vulnerability


product: OAS Platform

vendor: Open Automation Software

vendor: openautomationsoftware

summary: A denial of service vulnerability exists in the OAS Engine SecureConfigValues functionality of Open Automation Software OAS Platform V16.00.0112. A specially-crafted network request can lead to loss of communications. An attacker can send a network request to trigger this vulnerability.

title: Openautomationsoftware Oas Platform security vulnerability


product: Intel(R) VTune(TM) Profiler software

version: before version 2022.2.0

summary: Uncontrolled search path in the Intel(R) VTune(TM) Profiler software before version 2022.2.0 may allow an authenticated user to potentially enable escalation of privilege via local access.

title: Intel Vtune Profiler security vulnerability


product: Intel(R) Distribution for Python programming language for Intel(R) oneAPI Toolkits

version: before version 2022.1

ecosystem: python/pypi

summary: Uncontrolled search path element in the Intel(R) Distribution for Python programming language before version 2022.1 for Intel(R) oneAPI Toolkits may allow an authenticated user to potentially enable escalation of privilege via local access.

title: Intel Distribution For Python security vulnerability


product: CENTUM VP series with VP6E5000(AD Suite Engineering ServerFunction) installed and B/M9000 VP

vendor: Yokogawa Electric Corporation

version: CENTUM VP R6.01.10 to R6.09.00, CENTUM VP Small R6.01.10 to R6.09.00, CENTUM VP Basic R6.01.10 to R…

vendor: yokogawa

summary: Improper authentication vulnerability in the communication protocol provided by AD (Automation Design) server of CENTUM VP R6.01.10 to R6.09.00, CENTUM VP Small R6.01.10 to R6.09.00, CENTUM VP Basic R6.01.10 to R6.09.00, and B/M9000 VP R8.01.01 to R8.03.01 allows an attacker to use the functions provided by AD server. This may lead to leakage or tampering of data managed by AD server.

title: Yokogawa B/M9000 Vp security vulnerability


product: RCCMD

vendor: GENEREX SYSTEMS Computervertriebsgesellschaft mbH

version: 4.26 and earlier

product: rccmd

vendor: generex

summary: Directory traversal vulnerability in RCCMD 4.26 and earlier allows a remote authenticated attacker with an administrative privilege to read or alter an arbitrary file on the server via unspecified vectors.

title: Generex Rccmd security vulnerability


vendor: InHand Networks

summary: An OS command injection vulnerability exists in the daretools binary functionality of InHand Networks InRouter302 V3.5.4. A specially-crafted network request can lead to arbitrary command execution. An attacker can send a sequence of requests to trigger this vulnerability.


summary: An external config control vulnerability exists in the OAS Engine SecureAddSecurity functionality of Open Automation Software OAS Platform V16.00.0112. A specially-crafted series of network requests can lead to the creation of a custom Security Group. An attacker can send a sequence of requests to trigger this vulnerability.


product: Intel(R) XMM(TM) 7560 Modem software

severity: low

summary: Improper buffer restrictions in some Intel(R) XMM(TM) 7560 Modem software before version M2_7560_R_01.2146.00 may allow a privileged user to potentially enable escalation of privilege via physical access.

title: Intel Xmm 7560 Firmware security vulnerability


summary: Improper input validation for some Intel(R) PROSet/Wireless WiFi, Intel vPro(R) CSME WiFi and Killer(TM) WiFi products may allow unauthenticated user to potentially enable denial of service via local access.

title: Intel Killer Wifi Software security vulnerability


product: goomph

vendor: diffplug

summary: This affects the package com.diffplug.gradle:goomph before 3.37.2. It allows a malicious zip file to potentially break out of the expected destination directory, writing contents into arbitrary locations on the file system. Overwriting certain files/directories could allow an attacker to achieve remote code execution on a target system by exploiting this vulnerability. **Note:** This could have allowed a malicious zip file to extract itself into an arbitrary directory. The only file that Goomph extracts is the p2 bootstrapper and eclipse metadata files hosted at eclipse.org, which are not malicious, so the only way this vulnerability could have affected you is if you had set a custom bootstrap zip, and that zip was malicious.


product: Cybozu Garoon

vendor: Cybozu, Inc.

product: garoon

vendor: cybozu

summary: Operation restriction bypass vulnerability in Portal of Cybozu Garoon 4.0.0 to 5.5.1 allows a remote authenticated attacker to alter the data of Portal.

title: Cybozu Garoon security vulnerability


product: Intel(R) MPI Library for Intel(R) oneAPI HPC Toolkit

version: before version 2021.6

vendor: intel

summary: Uncontrolled search path element in the Intel(R) MPI Library before version 2021.6 for Intel(R) oneAPI HPC Toolkit may allow an authenticated user to potentially enable escalation of privilege via local access.

title: Intel Mpi Library security vulnerability


summary: Operation restriction bypass vulnerability in Link of Cybozu Garoon 4.0.0 to 5.5.1 allows a remote authenticated attacker to alter the data of Link.

title: Cybozu Garoon security vulnerability


product: Mint WorkBench

vendor: ABB

version: build

vendor: abb

summary: Vulnerabilities in the Mint WorkBench allow a low privileged attacker to create and write to a file anywhere on the file system as SYSTEM with arbitrary content as long as the file does not already exist. The Mint WorkBench installer file allows a low-privileged user to run a "repair" operation on the product

title: Abb Mint Workbench security vulnerability


product: DIAEnergie

vendor: Delta Electronics

product: diaenergie

vendor: deltaww

summary: Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability that exists in GetQueryData. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database contents, and execute system commands.


vendor: HDF5 Group

vendor: hdfgroup

summary: A heap-based buffer overflow vulnerability exists in the gif2h5 functionality of HDF5 Group libhdf5 1.10.4. A specially-crafted GIF file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability.


product: Intel(R) Trace Analyzer and Collector for Intel(R) oneAPI HPC Toolkit

summary: Uncontrolled search path element in the Intel(R) Trace Analyzer and Collector before version 2021.6 for Intel(R) oneAPI HPC Toolkit may allow an authenticated user to potentially enable escalation of privilege via local access.

title: Intel Trace Analyzer And Collector security vulnerability


summary: Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in GetLatestDemandNode. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database contents, and execute system commands.


vendor: Open Automation Software

summary: An information disclosure vulnerability exists in the OAS Engine SecureTransferFiles functionality of Open Automation Software OAS Platform V16.00.0112. A specially-crafted series of network requests can lead to arbitrary file read. An attacker can send a sequence of requests to trigger this vulnerability.


product: pistacheio/pistache

product: pistache

summary: This affects the package pistacheio/pistache before 0.0.3.20220425. It is possible to traverse directories to fetch arbitrary files from the server.


summary: Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability that exists in HandlerPage_KID.ashx. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database contents, and execute system commands.


product: Splunk Enterprise

vendor: Splunk

version: Version(s) before 8.1.0

product: splunk

vendor: splunk

summary: When handling a mismatched pre-authentication cookie, the application leaks the internal error message in the response, which contains the Splunk Enterprise local system path. The vulnerability impacts Splunk Enterprise versions before 8.1.0.

title: Splunk security vulnerability


product: BIG-IP

status: unaffected

summary: On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all versions of 12.1.x and 11.6.x, a flaw in the way reply ICMP packets are limited in the Traffic Management Microkernel (TMM) allows an attacker to quickly scan open UDP ports. This flaw allows an off-path remote attacker to effectively bypass source port UDP randomization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

title: F5 Big-Ip Access Policy Manager security vulnerability


product: Eufy Homebase 2

vendor: Anker

vendor: anker

summary: A denial of service vulnerability exists in the libxm_av.so DemuxCmdInBuffer functionality of Anker Eufy Homebase 2 2.1.8.5h. A specially-crafted set of network packets can lead to a device reboot. An attacker can send packets to trigger this vulnerability.


product: Intel(R) SPS

summary: Incomplete cleanup in a firmware subsystem for Intel(R) SPS before versions SPS_E3_04.08.04.330.0 and SPS_E3_04.01.04.530.0 may allow a privileged user to potentially enable denial of service via local access.

title: Intel Server Platform Services Firmware security vulnerability


vendor: inhandnetworks

summary: An OS command injection vulnerability exists in the console infactory_wlan functionality of InHand Networks InRouter302 V3.5.37. A specially-crafted series of network requests can lead to remote code execution. An attacker can send a sequence of requests to trigger this vulnerability.


summary: Uncontrolled search path element in the Intel(R) oneAPI Deep Neural Network (oneDNN) before version 2022.1 may allow an authenticated user to potentially enable escalation of privilege via local access.

title: Intel Oneapi Deep Neural Network security vulnerability


product: OAS Platform

vendor: openautomationsoftware

summary: A cleartext transmission of sensitive information vulnerability exists in the OAS Engine configuration communications functionality of Open Automation Software OAS Platform V16.00.0112. A targeted network sniffing attack can lead to a disclosure of sensitive information. An attacker can sniff network traffic to trigger this vulnerability.


product: Gallagher Controller 6000

vendor: Gallagher

vendor: gallagher

summary: Gallagher Controller 6000 is vulnerable to a Denial of Service attack via conflicting ARP packets with a duplicate IP address. This issue affects: Gallagher Gallagher Controller 6000 vCR8.60 versions prior to 220303a; vCR8.50 versions prior to 220303a; vCR8.40 versions prior to 220303a; vCR8.30 versions prior to 220303a.


product: Intel(R) XMM(TM) 7560 Modem software

summary: Improper conditions check in some Intel(R) XMM(TM) 7560 Modem software before version M2_7560_R_01.2146.00 may allow a privileged user to potentially enable escalation of privilege via local access.


product: Pulsar Plus System Controller NE843_S

product: Infinity DC Power Plant

summary: Use of Insufficiently Random Values vulnerability in ABB Pulsar Plus System Controller NE843_S, ABB Infinity DC Power Plant.This issue affects Pulsar Plus System Controller NE843_S : comcode 150042936; Infinity DC Power Plant: H5692448 G104 G842 G224L G630-4 G451C(2) G461(2) – comcode 150047415.

title: Abb H5692448 G104 Firmware security vulnerability


product: The installer of WPS Office

vendor: KINGSOFT JAPAN, INC.

version: Reported for Version 10.8.0.5745

vendor: kingsoft

summary: The installer of WPS Office Version 10.8.0.5745 insecurely load shcore.dll, allowing an attacker to execute arbitrary code with the privilege of the user invoking the installer.

title: Kingsoft Wps Office security vulnerability


summary: A file write vulnerability exists in the OAS Engine SecureTransferFiles functionality of Open Automation Software OAS Platform V16.00.0112. A specially-crafted series of network requests can lead to remote code execution. An attacker can send a sequence of requests to trigger this vulnerability.


version: before version 2021.5

vendor: intel

status: Analyzed

summary: Generation of weak initialization vector in an Intel(R) IPP Cryptography software library before version 2021.5 may allow an unauthenticated user to potentially enable information disclosure via local access.

title: Intel Integrated Performance Primitives Cryptography security vulnerability


vendor: InHand Networks

summary: An OS command injection vulnerability exists in the httpd wlscan_ASP functionality of InHand Networks InRouter302 V3.5.4. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.


version: before version 1.7.1

summary: Uncontrolled search path element in the PresentMon software maintained by Intel(R) before version 1.7.1 may allow an authenticated user to potentially enable escalation of privilege via local access.

title: Intel Gametechdev Presentmon security vulnerability


vendor: bmc

summary: An issue was discovered in BMC Remedy before 22.1. Email-based Incident Forwarding allows remote authenticated users to inject HTML (such as an SSRF payload) into the Activity Log by placing it in the To: field. This affects rendering that occurs upon a click in the "number of recipients" field. NOTE: the vendor's position is that "no real impact is demonstrated."


product: SamsungContacts

vendor: Samsung Mobile

less_than: SMR Apr-2022 Release 1

product: android

vendor: google

summary: Improper access control vulnerability in SamsungContacts prior to SMR Apr-2022 Release 1 allows that attackers can access contact information without permission.

title: Google Android security vulnerability


product: Samsung Mobile Devices

summary: Improper access control vulnerability in Knox Manage prior to SMR Apr-2022 Release 1 allows that physical attackers can bypass Knox Manage using a function key of hardware keyboard.

title: Google Android security vulnerability


summary: Improper boundary check in Quram Agif library prior to SMR Apr-2022 Release 1 allows arbitrary code execution.


summary: Null pointer dereference vulnerability in parser_irot function in libsimba library prior to SMR Apr-2022 Release 1 allows out of bounds write by remote attacker.

title: Google Android security vulnerability


summary: Null pointer dereference vulnerability in parser_auxC function in libsimba library prior to SMR Apr-2022 Release 1 allows out of bounds write by remote attacker.

title: Google Android security vulnerability


summary: Null pointer dereference vulnerability in parser_colr function in libsimba library prior to SMR Apr-2022 Release 1 allows out of bounds write by remote attacker.

title: Google Android security vulnerability


summary: Null pointer dereference vulnerability in parser_ispe function in libsimba library prior to SMR Apr-2022 Release 1 allows out of bounds write by remote attacker.

title: Google Android security vulnerability


summary: Null pointer dereference vulnerability in parser_unknown_property function in libsimba library prior to SMR Apr-2022 Release 1 allows out of bounds write by remote attacker.

title: Google Android security vulnerability


summary: Heap-based buffer overflow vulnerability in sheifd_create function of libsimba library prior to SMR Apr-2022 Release 1 allows code execution by remote attackers.

title: Google Android security vulnerability


summary: Null pointer dereference vulnerability in parser_infe function of libsimba library prior to SMR Apr-2022 Release 1 allows out of bounds read by remote attackers.

title: Google Android security vulnerability


product: SAPCAR

vendor: SAP SE

product: sapcar

vendor: sap

summary: SAPCAR - version 7.22, does not contain sufficient input validation on the SAPCAR archive. As a result, the SAPCAR process may crash, and the attacker may obtain privileged access to the system.


product: Fiori Launchpad

summary: Fiori launchpad - versions 754, 755, 756, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.

title: Sap Fiori Launchpad security vulnerability


summary: Due to missing authorization check, SAP NetWeaver Application Server for ABAP - versions 700, 701, 702, 731, allows an authenticated attacker, to access content on the start screen of any transaction that is available with in the same SAP system even if he/she isn't authorized for that transaction. A successful exploitation could expose information and in worst case manipulate data before the start screen is executed, resulting in limited impact on confidentiality and integrity of the application.

title: Sap Netweaver Application Server Abap security vulnerability


ecosystem: java/maven

summary: Under certain conditions, SAP NetWeaver (Real Time Messaging Framework) - version 7.50, allows an attacker to access information which could lead to information gathering for further exploits and attacks.

title: Sap Netweaver Application Server Java security vulnerability


product: SAP Financial Consolidation

summary: SAP Financial Consolidation - version 10.1, does not perform necessary authorization checks for updating homepage messages, resulting for an unauthorized user to alter the maintenance system message.

title: Sap Financial Consolidation security vulnerability


product: SAP NetWeaver Enterprise Portal

summary: SAP NetWeaver Enterprise Portal - versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, is susceptible to script execution attack by an unauthenticated attacker due to improper sanitization of the user inputs while interacting on the Network. On successful exploitation, an attacker can view or modify information causing a limited impact on confidentiality and integrity of the application.

title: Sap Netweaver Enterprise Portal security vulnerability


product: SAP 3D Visual Enterprise Viewer

summary: When a user opens a manipulated Computer Graphics Metafile (.cgm, CgmCore.dll) received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9.0, the application crashes and becomes temporarily unavailable to the user until restart of the application.

title: Sap 3D Visual Enterprise Viewer security vulnerability


summary: When a user opens a manipulated Jupiter Tesselation (.jt, JTReader.x3d) received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9.0, the application crashes and becomes temporarily unavailable to the user until restart of the application.


summary: When a user opens a manipulated Picture Exchange (.pcx, 2d.x3d) received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9.0, the application crashes and becomes temporarily unavailable to the user until restart of the application.


summary: When a user opens a manipulated Portable Document Format (.pdf, PDFView.x3d) received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9.0, the application crashes and becomes temporarily unavailable to the user until restart of the application.


product: htcondor

vendor: wisc

vendor: debian

summary: An issue was discovered in HTCondor 8.8.x before 8.8.16, 9.0.x before 9.0.10, and 9.1.x before 9.6.0. When a user authenticates to an HTCondor daemon via the CLAIMTOBE method, the user can then impersonate any entity when issuing additional commands to that daemon.


product: irisnext

vendor: canon

summary: The BeanShell components of IRISNext through 9.8.28 allow execution of arbitrary commands on the target server by creating a custom search (or editing an existing/predefined search) of the documents. The search components permit adding BeanShell expressions that result in Remote Code Execution in the context of the IRISNext application user, running on the web server.

title: Canon Irisnext security vulnerability


product: Apache Pinot

vendor: Apache Software Foundation

version: Apache Pinot

product: pinot

vendor: apache

summary: In 0.10.0 or older versions of Apache Pinot, Pinot query endpoint and realtime ingestion layer has a vulnerability in unprotected environments due to a groovy function support. In order to avoid this, we disabled the groovy function support by default from Pinot release 0.11.0. See https://docs.pinot.apache.org/basics/releases/0.11.0

title: Apache Pinot security vulnerability


product: Fortinet FortiClientWindows

vendor: Fortinet

version: FortiClientWindows 7.0.0 through 7.0.3, 6.4.0 through 6.4.7, 6.2.0 through 6.2.9, 6.0.0 through 6.0…

product: forticlient

vendor: fortinet

summary: An execution with unnecessary privileges vulnerability [CWE-250] in FortiClientWindows 7.0.0 through 7.0.3, 6.4.0 through 6.4.7, 6.2.0 through 6.2.9, 6.0.0 through 6.0.10 may allow a local attacker to perform an arbitrary file write on the system.

title: Fortinet Forticlient security vulnerability


product: Fortinet FortiMail

version: FortiMail before 7.2.0

product: fortimail

summary: An improper neutralization of input during web page generation vulnerability [CWE-79] in the Webmail of FortiMail before 7.2.0 may allow an unauthenticated attacker to trigger a cross-site scripting (XSS) attack via sending specially crafted mail messages.

title: Fortinet Fortimail security vulnerability


product: FortiSandbox

version_type: semver

product: fortisandbox

summary: A use of password hash with insufficient computational effort vulnerability [CWE-916] in FortiSandbox before 4.2.0 may allow an attacker with access to the password database to efficiently mount bulk guessing attacks to recover the passwords.

title: Fortinet Fortisandbox security vulnerability


product: Fortinet FortiNAC

version: FortiNAC version 8.3.7 and below, 8.5.2 and below, 8.5.4, 8.6.0, 8.6.5 and below, 8.7.6 and below…

product: fortinac

summary: Multiple improper neutralization of special elements used in SQL commands ('SQL Injection') vulnerability [CWE-89] in FortiNAC version 8.3.7 and below, 8.5.2 and below, 8.5.4, 8.6.0, 8.6.5 and below, 8.7.6 and below, 8.8.11 and below, 9.1.5 and below, 9.2.2 and below may allow an authenticated attacker to execute unauthorized code or commands via specifically crafted strings parameters.

title: Fortinet Fortinac security vulnerability


summary: An empty password in configuration file vulnerability [CWE-258] in FortiNAC version 8.3.7 and below, 8.5.2 and below, 8.5.4, 8.6.0, 8.6.5 and below, 8.7.6 and below, 8.8.11 and below, 9.1.5 and below, 9.2.3 and below may allow an authenticated attacker to access the MySQL databases via the CLI.


product: Fortinet FortiManager , FortiAnalyzer

version: FortiManager 6.0.x, 6.2.x, 6.4.0 through 6.4.7, 7.0.0 through 7.0.3; FortiAnalyzer 6.0.x, 6.2.x, 6.…

product: fortianalyzer

product: fortimanager

summary: A privilege chaining vulnerability [CWE-268] in FortiManager and FortiAnalyzer 6.0.x, 6.2.x, 6.4.0 through 6.4.7, 7.0.0 through 7.0.3 may allow a local and authenticated attacker with a restricted shell to escalate their privileges to root due to incorrect permissions of some folders and executable files on the system.

title: Fortinet Fortianalyzer security vulnerability


product: Fortinet FortiSIEM

product: fortisiem

summary: A improper authentication vulnerability in Fortinet FortiSIEM before 6.5.0 allows a local attacker with CLI access to perform operations on the Glassfish server directly via a hardcoded password.

title: Fortinet Fortisiem security vulnerability


product: Fortinet FortiADC

version: FortiADC 7.0.0 through 7.0.1, 5.0.0 through 6.2.2

product: fortiadc

summary: Multiple improper neutralization of special elements used in an SQL Command ('SQL Injection') vulnerabilities [CWE-89] in FortiADC management interface 7.0.0 through 7.0.1, 5.0.0 through 6.2.2 may allow an authenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests.

title: Fortinet Fortiadc security vulnerability


summary: An exposure of resource to wrong sphere vulnerability [CWE-668] in FortiAnalyzer and FortiManager GUI 7.0.0 through 7.0.3, 6.4.0 through 6.4.8, 6.2.0 through 6.2.9, 6.0.0 through 6.0.11, 5.6.0 through 5.6.11 may allow an unauthenticated and remote attacker to access report template images via referencing the name in the URL path.

title: Fortinet Fortimanager security vulnerability


product: Fortinet AV Engine, FortiMail, FortiOS, FortiClient

version: AV Engine version 6.2.168 and below and version 6.4.274 and below.

summary: An insufficient verification of data authenticity vulnerability [CWE-345] in FortiClient, FortiMail and FortiOS AV engines version 6.2.168 and below and version 6.4.274 and below may allow an attacker to bypass the AV engine via manipulating MIME attachment with junk and pad characters in base64.

title: Fortinet Antivirus Engine security vulnerability


version: before version CHAPLCEL.0059

summary: Improper buffer restrictions in BIOS firmware for some Intel(R) NUC Boards, Intel(R) NUC 8 Boards, Intel(R) NUC 8 Rugged Boards and Intel(R) NUC 8 Rugged Kits before version CHAPLCEL.0059 may allow a privileged user to potentially enable escalation of privilege via local access.

title: Intel Nuc 8 Rugged Kit Nuc8Cchkrn Firmware security vulnerability


product: FRRouting

version: through 8.1.0

default_status: unknown

product: frrouting

vendor: frrouting

summary: Buffer overflow vulnerabilities exist in FRRouting through 8.1.0 due to wrong checks on the input packet length in isisd/isis_tlvs.c.


product: fedora

vendor: fedoraproject

summary: Buffer overflow vulnerabilities exist in FRRouting through 8.1.0 due to the use of strdup with a non-zero-terminated binary string in isis_nb_notifications.c.

title: Frrouting security vulnerability


summary: A buffer overflow vulnerability exists in FRRouting through 8.1.0 due to missing a check on the input packet length in the babel_packet_examin function in babeld/message.c.

title: Frrouting security vulnerability


summary: A buffer overflow vulnerability exists in FRRouting through 8.1.0 due to a wrong check on the input packet length in the babel_packet_examin function in babeld/message.c.

title: Frrouting security vulnerability


summary: Buffer overflow vulnerabilities exist in FRRouting through 8.1.0 due to wrong checks on the subtlv length in the functions, parse_hello_subtlv, parse_ihu_subtlv, and parse_update_subtlv in babeld/message.c.

title: Frrouting security vulnerability


product: BIG-IP

summary: On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, and 13.1.x versions prior to 13.1.5, when an Active mode-enabled FTP profile is configured on a virtual server, undisclosed traffic can cause the virtual server to stop processing active FTP data channel connections. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

title: F5 Big-Ip Access Policy Manager security vulnerability


vendor: Power Line Communications

vendor: hegemonelectronics

summary: Power Line Communications PLC4TRUCKS J2497 trailer receivers are susceptible to remote RF induced signals.


product: Bitbucket Data Center

vendor: Atlassian

less_than: unspecified

version: unspecified

vendor: atlassian

summary: SharedSecretClusterAuthenticator in Atlassian Bitbucket Data Center versions 5.14.0 and later before 7.6.14, 7.7.0 and later prior to 7.17.6, 7.18.0 and later prior to 7.18.4, 7.19.0 and later prior to 7.19.4, and 7.20.0 allow a remote, unauthenticated attacker to execute arbitrary code via Java deserialization.

title: Atlassian Bitbucket Data Center security vulnerability


product: Confluence Data Center

version: next of 1.3.0

product: Confluence Server

known_ransomware_campaign_use: Known

product: Confluence Server/Data Center

required_action: Immediately block all internet traffic to and from affected products AND apply the update per vendor instructions [https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html] OR remove the affected products by the due date on the right. Note: Once the update is successfully deployed, agencies can reassess the internet blocking rules.

vendor_project: Atlassian

vulnerability_name: Atlassian Confluence Server and Data Center Remote Code Execution Vulnerability

author: Codex

content_markdown:
CVE-2022-26134 is an unauthenticated OGNL injection in Confluence
Server and Confluence Data Center. This ID has **no GHSA**. NVD is
**Analyzed**. NVD CPE excludes **7.4.17 / 7.13.7 / 7.14.3 / 7.15.2 /
7.16.4 / 7.17.4** for Server and Data Center and exact last-affects
**7.18.0**. Atlassian’s 2022-06-02 advisory names those same excludes
plus **7.18.1**. **7.18.1 is not an NVD CPE floor.** Atlassian Cloud
(`*.atlassian.net`) is not vulnerable. CISA lists the CVE in KEV.

Do not invent a later **7.18.2** floor. Do not prove exposure by
sending OGNL or crafted requests.

## When to use it

- Inventory shows Confluence Server or Data Center below a listed
  fixed release.
- Clustered nodes may still be on mixed builds.

## Inputs

- Per-node Confluence version, cluster membership, and
  https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html.

## Affected versions

- **Vulnerable / NVD CPE:** Server and Data Center `>= 1.3` excludes
  **7.4.17**, `>= 7.13.0` excludes **7.13.7**, `>= 7.14.0` excludes
  **7.14.3**, `>= 7.15.0` excludes **7.15.2**, `>= 7.16.0` excludes
  **7.16.4**, `>= 7.17.0` excludes **7.17.4**, plus exact **7.18.0**.
- **Not affected:** Atlassian Cloud sites on `atlassian.net`.
- **Fixed / NVD CPE:** NVD excludes **7.4.17 / 7.13.7 / 7.14.3 /
  7.15.2 / 7.16.4 / 7.17.4**. There is no GHAD first_patched and
  **no 7.18.1 CPE**.
- **Fixed / vendor prose:** Atlassian names those same excludes plus
  **7.18.1**. Later LTS releases that contain the same fix are
  acceptable only when the advisory still names them.
- **Do not invent:** flatten leftover **7.18.1** onto NVD exact
  **7.18.0**, or invent **7.18.2**.
- **CISA KEV:** yes.
- **Weakness:** OGNL injection leading to unauthenticated RCE.

## Remediation strategy

- Upgrade every node to a listed fixed release, or to the current
  Long Term Support release that includes that fix, after recording
  the NVD **7.18.0** exact-CPE split.
- Cluster upgrades need downtime; Atlassian says rolling upgrades
  to the fixed versions are not available.
- Temporary JAR/class mitigations exist for some trains. Treat
  those as operator containment, not a substitute for the named
  release.
- Until patched, block internet traffic to affected products as
  CISA directs.
- Recheck the 2022-06-02 advisory and NVD before treating **7.18.1**
  as the last word.
- Do not roll back into NVD exact **7.18.0**.

## Verification

- Every node reports a listed vendor fixed release, including
  **7.18.1** on the 7.18 train, or a later advisory-named LTS.
- Operator notes cite that NVD exact last-affects **7.18.0** and
  that **7.18.1** is vendor prose.
- Tests never send OGNL or crafted Confluence requests.

## Rollback and recovery

Prefer forward recovery to another Atlassian-named fixed release.
If an operational rollback restores a build below the listed
floors or back to **7.18.0**, reapply network containment before
returning the node to its former exposure.

## Output contract

- Change request upgrading every Confluence node to a listed
  vendor fixed release after the NVD **7.18.0** split.
- `TRIAGE.md` when this repository does not own Confluence.

## Related recipes

- [Search the CVE Database for CVE-2022-26134](/cve-database/?q=CVE-2022-26134#cve-catalog)

## References

- Atlassian advisory: <https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html>
- CISA KEV: <https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-26134>
- NVD: <https://nvd.nist.gov/vuln/detail/CVE-2022-26134>

description: CVE-2022-26134 is CISA KEV Confluence leftover. NVD exact last-affects 7.18.0. Vendor names 7.18.1. 7.18.1 is not an NVD CPE floor.

maturity: stable

title: CVE-2022-26134: Confluence OGNL RCE

summary: In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are from 1.3.0 before 7.4.17, from 7.13.0 before 7.13.7, from 7.14.0 before 7.14.3, from 7.15.0 before 7.15.2, from 7.16.0 before 7.16.4, from 7.17.0 before 7.17.4, and from 7.18.0 before 7.18.1.


product: Jira Core Server

product: Jira Software Server

product: Jira Software Data Center

product: Jira Service Management Server

product: Jira Service Management Data Center

summary: A vulnerability in Mobile Plugin for Jira Data Center and Server allows a remote, authenticated user (including a user who joined via the sign-up feature) to perform a full read server-side request forgery via a batch endpoint. This affects Atlassian Jira Server and Data Center from version 8.0.0 before version 8.13.22, from version 8.14.0 before 8.20.10, from version 8.21.0 before 8.22.4. This also affects Jira Management Server and Data Center versions from version 4.0.0 before 4.13.22, from version 4.14.0 before 4.20.10 and from version 4.21.0 before 4.22.4.

title: Atlassian Jira Data Center security vulnerability


product: Bamboo Server

product: Bamboo Data Center

product: Bitbucket Server

summary: A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to bypass Servlet Filters used by first and third party apps. The impact depends on which filters are used by each app, and how the filters are used. This vulnerability can result in authentication bypass and cross-site scripting. Atlassian has released updates that fix the root cause of this vulnerability, but has not exhaustively enumerated all potential consequences of this vulnerability. Atlassian Bamboo versions are affected before 8.0.9, from 8.1.0 before 8.1.8, and from 8.2.0 before 8.2.4. Atlassian Bitbucket versions are affected before 7.6.16, from 7.7.0 before 7.17.8, from 7.18.0 before 7.19.5, from 7.20.0 before 7.20.2, from 7.21.0 before 7.21.2, and versions 8.0.0 and 8.1.0. Atlassian Confluence versions are affected before 7.4.17, from 7.5.0 before 7.13.7, from 7.14.0 before 7.14.3, from 7.15.0 before 7.15.2, from 7.16.0 before 7.16.4, from 7.17.0 before 7.17.4, and version 7.21.0. Atlassian Crowd versions are affected before 4.3.8, from 4.4.0 before 4.4.2, and version 5.0.0. Atlassian Fisheye and Crucible versions before 4.8.10 are affected.

title: Atlassian Bamboo security vulnerability


summary: A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to cause additional Servlet Filters to be invoked when the application processes requests or responses. Atlassian has confirmed and fixed the only known security issue associated with this vulnerability: Cross-origin resource sharing (CORS) bypass. Sending a specially crafted HTTP request can invoke the Servlet Filter used to respond to CORS requests, resulting in a CORS bypass. An attacker that can trick a user into requesting a malicious URL can access the vulnerable application with the victim’s permissions. Atlassian Bamboo versions are affected before 8.0.9, from 8.1.0 before 8.1.8, and from 8.2.0 before 8.2.4. Atlassian Bitbucket versions are affected before 7.6.16, from 7.7.0 before 7.17.8, from 7.18.0 before 7.19.5, from 7.20.0 before 7.20.2, from 7.21.0 before 7.21.2, and versions 8.0.0 and 8.1.0. Atlassian Confluence versions are affected before 7.4.17, from 7.5.0 before 7.13.7, from 7.14.0 before 7.14.3, from 7.15.0 before 7.15.2, from 7.16.0 before 7.16.4, from 7.17.0 before 7.17.4, and version 7.21.0.

title: Atlassian Bamboo security vulnerability


product: Questions For Confluence

known_ransomware_campaign_use: Unknown

product: Confluence

required_action: Apply updates per vendor instructions.

vulnerability_name: Atlassian Questions For Confluence App Hard-coded Credentials Vulnerability

summary: The Atlassian Questions For Confluence app for Confluence Server and Data Center creates a Confluence user account in the confluence-users group with the username disabledsystemuser and a hardcoded password. A remote, unauthenticated attacker with knowledge of the hardcoded password could exploit this to log into Confluence and access all content accessible to users in the confluence-users group. This user account is created when installing versions 2.7.34, 2.7.35, and 3.0.2 of the app.


business_risk: No additional source-verified CVE-specific business impact was established.

uncertainty: The Mitel advisory page identifies product-specific security bulletins but does not expose their detailed remediation contents in the reviewed source.

uncertainty: A concrete fixed version for MiVoice Business Express was not established from an authoritative returned source.

uncertainty: The exact service exposure mechanism and port were not established from the authoritative NVD or Mitel sources reviewed.

uncertainty: The supplied record's generic ecosystem classification does not identify the deployed product or version, so applicability cannot be confirmed for a specific asset.

product: MiCollab, MiVoice Business Express

vendor_project: Mitel

vulnerability_name: MiCollab, MiVoice Business Express Access Control Vulnerability

product: micollab

vendor: mitel

summary: The TP-240 (aka tp240dvr) component in Mitel MiCollab before 9.4 SP1 FP1 and MiVoice Business Express through 8.1 allows remote attackers to obtain sensitive information and cause a denial of service (performance degradation and excessive outbound traffic). This was exploited in the wild in February and March 2022 for the TP240PhoneHome DDoS attack.


product: mantisbt

vendor: mantisbt

summary: An XSS issue was discovered in MantisBT before 2.25.3. Improper escaping of a Plugin name allows execution of arbitrary code (if CSP allows it) in manage_plugin_page.php and manage_plugin_uninstall.php when a crafted plugin is installed.


product: qtest

vendor: tricentis

summary: Tricentis qTest before 10.4 allows stored XSS by an authenticated attacker.


vendor: quectel

summary: The Quectel RG502Q-EA modem before 2022-02-23 allow OS Command Injection.


product: grafana

vendor: grafana

vendor: redhat

product: storage

summary: An issue was discovered in Grafana through 7.3.4, when integrated with Zabbix. The Zabbix password can be found in the api_jsonrpc.php HTML source code. When the user logs in and allows the user to register, one can right click to view the source code and use Ctrl-F to search for password in api_jsonrpc.php to discover the Zabbix account password and URL address.


product: revolution

vendor: modx

summary: MODX Revolution through 2.8.3-pl allows remote authenticated administrators to execute arbitrary code by uploading an executable file, because the Uploadable File Types setting can be changed by an administrator.

title: Modx Revolution security vulnerability


vendor: citrix

summary: Citrix XenMobile Server 10.12 through RP11, 10.13 through RP7, and 10.14 through RP4 allows Command Injection.


vendor: cherwell

summary: An issue was discovered in the web application in Cherwell Service Management (CSM) 10.2.3. XSS can occur via a payload in the SAMLResponse parameter of the HTTP request body.


summary: An issue was discovered in the web application in Cherwell Service Management (CSM) 10.2.3. Injection of a malicious payload within the RelayState= parameter of the HTTP request body results in the hijacking of the form action. Form-action hijacking vulnerabilities arise when an application places user-supplied input into the action URL of an HTML form. An attacker can use this vulnerability to construct a URL that, if visited by another application user, will modify the action URL of a form to point to the attacker's server.


summary: An issue was discovered in the web application in Cherwell Service Management (CSM) 10.2.3. The ASP.NET_Sessionid cookie is not protected by the Secure flag. This makes it prone to interception by an attacker if traffic is sent over unencrypted channels.


summary: An issue was discovered in the web application in Cherwell Service Management (CSM) 10.2.3. It accepts and reflects arbitrary domains supplied via a client-controlled Host header. Injection of a malicious URL in the Host: header of the HTTP Request results in a 302 redirect to an attacker-controlled page.


product: ametys

vendor: ametys

summary: The auto-completion plugin in Ametys CMS before 4.5.0 allows a remote unauthenticated attacker to read documents such as plugins/web/service/search/auto-completion/<domain>/en.xml (and similar pathnames for other languages), which contain all characters typed by all users, including the content of private pages. For example, a private page may contain usernames, e-mail addresses, and possibly passwords.

title: Ametys security vulnerability


summary: Air Cargo Management System v1.0 was discovered to contain a SQL injection vulnerability via the ref_code parameter.


summary: Simple Mobile Comparison Website v1.0 was discovered to contain a SQL injection vulnerability via the search parameter.


summary: Bank Management System v1.o was discovered to contain a SQL injection vulnerability via the email parameter.


product: jforum

vendor: jforum

summary: JForum v2.8.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via http://target_host:port/jforum-2.8.0/jforum.page, which allows attackers to arbitrarily add admin accounts.

title: Jforum security vulnerability


product: beekeeper-studio

vendor: beekeeperstudio

summary: A remote code execution (RCE) vulnerability in Beekeeper Studio v3.2.0 allows attackers to execute arbitrary code via a crafted payload injected into the display fields.

title: Beekeeperstudio Beekeeper-Studio security vulnerability


product: qdpm

vendor: qdpm

summary: qdPM 9.2 allows Cross-Site Request Forgery (CSRF) via the index.php/myAccount/update URI.


product: lepton

vendor: dropbox

summary: Dropbox Lepton v1.2.1-185-g2a08b77 was discovered to contain a heap-buffer-overflow in the function aligned_dealloc():src/lepton/bitops.cc:108.

title: Dropbox Lepton security vulnerability


ecosystem: windows/system

product: pnpm

vendor: pnpm

summary: PNPM v6.15.1 and below was discovered to contain an untrusted search path which causes the application to behave in unexpected ways when users execute PNPM commands in a directory containing malicious content. This vulnerability occurs when the application is ran on Windows OS.

title: Pnpm security vulnerability


product: poetry

vendor: python-poetry

summary: Poetry v1.1.9 and below was discovered to contain an untrusted search path which causes the application to behave in unexpected ways when users execute Poetry commands in a directory containing malicious content. This vulnerability occurs when the application is ran on Windows OS.

title: Python-Poetry Poetry security vulnerability


vendor: totolink

summary: TOTOLINK N600R V4.3.0cu.7570_B20200620 was discovered to contain a command injection vulnerability via the exportOvpn interface at cstecgi.cgi.

title: Totolink N600R Firmware security vulnerability


summary: TOTOLINK N600R V4.3.0cu.7570_B20200620 was discovered to contain a command injection vulnerability via the pingCheck function.


summary: TOTOLINK N600R V4.3.0cu.7570_B20200620 was discovered to contain a command injection vulnerability via /setting/NTPSyncWithHost.


summary: TOTOLINK N600R V4.3.0cu.7570_B20200620 was discovered to contain a command injection vulnerability via the langType parameter in the login interface.


vendor: joget

summary: Joget DX 7 was discovered to contain a cross-site scripting (XSS) vulnerability via the Datalist table.


product: notable

vendor: notable

summary: Notable v1.8.4 does not filter text editing, allowing attackers to execute arbitrary code via a crafted payload injected into the Title text field.

title: Notable security vulnerability


summary: Victor CMS v1.0 was discovered to contain a SQL injection vulnerability.


product: marky

summary: Marky commit 3686565726c65756e was discovered to contain a remote code execution (RCE) vulnerability via the Display text fields. This vulnerability allows attackers to execute arbitrary code via injection of a crafted payload.


summary: Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU V5.9c.5185_B20201128, and A810R V4.1.2cu.5182_B20201026 were discovered to contain a command injection vulnerability in the function setLanguageCfg, via the langType parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.

title: Totolink A830R Firmware security vulnerability


summary: Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU V5.9c.5185_B20201128, and A810R V4.1.2cu.5182_B20201026 were discovered to contain a command injection vulnerability in the function setDiagnosisCfg, via the ipDoamin parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.


summary: Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU V5.9c.5185_B20201128, and A810R V4.1.2cu.5182_B20201026 were discovered to contain a command injection vulnerability in the function setWebWlanIdx, via the webWlanIdx parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.


summary: Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU V5.9c.5185_B20201128, and A810R V4.1.2cu.5182_B20201026 were discovered to contain a command injection vulnerability in the function setUploadSetting, via the FileName parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.


summary: Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU V5.9c.5185_B20201128, and A810R V4.1.2cu.5182_B20201026 were discovered to contain a command injection vulnerability in the function setUpgradeFW, via the FileName parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.


summary: Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU V5.9c.5185_B20201128, and A810R V4.1.2cu.5182_B20201026 were discovered to contain a command injection vulnerability in the function CloudACMunualUpdate, via the deviceMac and deviceName parameters. This vulnerability allows attackers to execute arbitrary commands via a crafted request.


summary: Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU V5.9c.5185_B20201128, and A810R V4.1.2cu.5182_B20201026 were discovered to contain a command injection vulnerability in the function setDeviceName, via the deviceMac and deviceName parameters. This vulnerability allows attackers to execute arbitrary commands via a crafted request.


summary: Totolink X5000R_Firmware v9.1.0u.6118_B20201102 was discovered to contain a command injection vulnerability in the function setNtpCfg, via the tz parameters. This vulnerability allows attackers to execute arbitrary commands via a crafted request.

title: Totolink X5000R Firmware security vulnerability


summary: Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU V5.9c.5185_B20201128, and A810R V4.1.2cu.5182_B20201026 were discovered to contain a command injection vulnerability in the function NTPSyncWithHost. This vulnerability allows attackers to execute arbitrary commands via the host_time parameter.


vendor: barco

summary: Barco Control Room Management through Suite 2.9 Build 0275 was discovered to be vulnerable to directory traversal, allowing attackers to access sensitive information and components. Requests must begin with the "GET /..\.." substring.

title: Barco Control Room Management Suite security vulnerability


vendor: beckmancoulter

summary: A vulnerability was discovered in the Remisol Advance v2.0.12.1 and below for the Normand Message Server. On installation, the permissions set by Remisol Advance allow non-privileged users to overwrite and/or manipulate executables and libraries that run as the elevated SYSTEM user on Windows.


summary: The default privileges for the running service Normand Remisol Advance Launcher in Beckman Coulter Remisol Advance v2.0.12.1 and prior allows non-privileged users to overwrite and manipulate executables and libraries. This allows attackers to access sensitive data.

title: Beckmancoulter Remisol Advance security vulnerability


summary: The default privileges for the running service Normand Viewer Service in Beckman Coulter Remisol Advance v2.0.12.1 and prior allows non-privileged users to overwrite and manipulate executables and libraries. This allows attackers to access sensitive data.


summary: The default privileges for the running service Normand Service Manager in Beckman Coulter Remisol Advance v2.0.12.1 and prior allows non-privileged users to overwrite and manipulate executables and libraries. This allows attackers to access sensitive data.


summary: The default privileges for the running service Normand License Manager in Beckman Coulter Remisol Advance v2.0.12.1 and prior allows unprivileged users to overwrite and manipulate executables and libraries. This allows attackers to access sensitive data.


summary: The default privileges for the running service Normand Message Buffer in Beckman Coulter Remisol Advance v2.0.12.1 and prior allows non-privileged users to overwrite and manipulate executables and libraries. This allows attackers to access sensitive data.


vendor: tendacn

summary: Tenda AC10-1200 v15.03.06.23_EN was discovered to contain a buffer overflow in the setSmartPowerManagement function.


summary: A stored cross-site scripting (XSS) vulnerability in Hospital Patient Record Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the "special" field.

title: Hospital'S Patient Records Management System Project Hospital'S Patient… security vulnerability


product: falcon-plus

vendor: open-falcon

summary: Falcon-plus v0.3 was discovered to contain a SQL injection vulnerability via the parameter grpName in /config/service/host.go.


product: tms

summary: TMS v2.28.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /TMS/admin/setting/mail/createorupdate.


summary: TMS v2.28.0 contains an insecure permissions vulnerability via the component /TMS/admin/user/Update2. This vulnerability allows attackers to modify the administrator account and password.


product: surveyking

summary: Survey King v0.3.0 does not filter data properly when exporting excel files, allowing attackers to execute arbitrary code or access sensitive information via a CSV injection attack.

title: Surveyking Project Surveyking security vulnerability


product: synaman

vendor: synametrics

summary: Synaman v5.1 and below was discovered to contain weak file permissions which allows authenticated attackers to escalate privileges.


summary: The HTTP interface of Synaman v5.1 and below was discovered to allow authenticated attackers to execute arbitrary code and escalate privileges.

title: Synametrics Synaman security vulnerability


product: aapanel

vendor: aapanel

summary: aaPanel v6.8.21 was discovered to be vulnerable to directory traversal. This vulnerability allows attackers to obtain the root user private SSH key(id_rsa).


product: wowonder

vendor: wowonder

summary: WoWonder The Ultimate PHP Social Network Platform v4.0.0 was discovered to contain an access control issue which allows unauthenticated attackers to arbitrarily change group ID names.

title: Wowonder security vulnerability


product: clash

summary: Clash for Windows v0.19.8 was discovered to allow arbitrary code execution via a crafted payload injected into the Proxies name column.


required_action: The impacted product is end-of-life and should be disconnected if still in use.

vendor_project: D-Link

vulnerability_name: D-Link DIR-820L Remote Code Execution Vulnerability

description: CVE-2022-26258 is remote command execution via the Device Name parameter on D-Link DIR-820L 1.05B03. GHSA last-names 1.05B03. Do not invent 1.05B04.

maturity: development

model: GPT 5.5 Extra High reasoning

title: CVE-2022-26258: D-Link DIR-820L RCE, 1.05B03

vendor: dlink

recipe_kind: markdown-draft

summary: D-Link DIR-820L 1.05B03 was discovered to contain remote command execution (RCE) vulnerability via HTTP POST to get set ccp.


vendor: xiongmaitech

summary: A buffer over flow in Xiongmai DVR devices NBD80X16S-KL, NBD80X09S-KL, NBD80X08S-KL, NBD80X09RA-KL, AHB80X04R-MH, AHB80X04R-MH-V2, AHB80X04-R-MH-V3, AHB80N16T-GS, AHB80N32F4-LME, and NBD90S0VT-QW allows attackers to cause a Denial of Service (DoS) via a crafted RSTP request.

title: Xiongmaitech Nbd80X16S-Kl Firmware security vulnerability


product: simple-plist

summary: Simple-Plist v1.3.0 was discovered to contain a prototype pollution vulnerability via .parse().


vendor: yonyou

summary: Yonyou u8 v13.0 was discovered to contain a DOM-based cross-site scripting (XSS) vulnerability via the component /u8sl/WebHelp.


product: contao

vendor: contao

summary: Contao Managed Edition v1.5.0 was discovered to contain a remote command execution (RCE) vulnerability via the component php_cli parameter.


product: piwigo

vendor: piwigo

summary: Piwigo v12.2.0 was discovered to contain a SQL injection vulnerability via pwg.users.php.


summary: Piwigo v12.2.0 was discovered to contain an information leak via the action parameter in /admin/maintenance_actions.php.


product: xiaohuanxiong

summary: Xiaohuanxiong v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /app/controller/Books.php.


vendor: globalsuzuki

summary: Suzuki Connect v1.0.15 allows attackers to tamper with displayed messages via spoofed CAN messages.


summary: 74cmsSE v3.4.1 was discovered to contain an arbitrary file read vulnerability via the $url parameter at \index\controller\Download.php.


product: ionize

vendor: ionizecms

summary: A remote code execution (RCE) vulnerability in Ionize v1.0.8.1 allows attackers to execute arbitrary code via a crafted string written to the file application/config/config.php.

title: Ionizecms Ionize security vulnerability


product: eyoucms

vendor: eyoucms

summary: EyouCMS v1.5.4 was discovered to lack parameter filtering in \user\controller\shop.php, leading to payment logic vulnerabilities.


product: onenav

vendor: onenav

summary: An issue in index.php of OneNav v0.9.14 allows attackers to perform directory traversal.


vendor: tenda

summary: Tenda AC9 v15.03.2.21_cn was discovered to contain a stack overflow via the time parameter in the PowerSaveSet function.


summary: EyouCMS v1.5.5 was discovered to have no access control in the component /data/sqldata.


product: libarchive

vendor: libarchive

product: fedora

vendor: fedoraproject

summary: Libarchive v3.6.0 was discovered to contain an out-of-bounds read via the component zipx_lzma_alone_init.


vendor: bigantsoft

summary: BigAnt Server v5.6.06 was discovered to contain an incorrect access control issue.


summary: Simple Subscription Website v1.0 was discovered to contain a SQL injection vulnerability via the id parameter in the view_plan endpoint. This vulnerability allows attackers to dump the application's database via crafted HTTP requests.


summary: Simple Client Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter in the manage_client endpoint. This vulnerability allows attackers to dump the application's database via crafted HTTP requests.

title: Simple Client Management System Project Simple Client Management System security vulnerability


summary: Simple Subscription Website v1.0 was discovered to contain a SQL injection vulnerability via the id parameter in the apply endpoint. This vulnerability allows attackers to dump the application's database via crafted HTTP requests.


summary: Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /goform/exeCommand.


summary: Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /goform/WriteFacMac.


vendor: debian

summary: lrzip v0.641 was discovered to contain a multiple concurrency use-after-free between the functions zpaq_decompress_buf() and clear_rulist(). This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted Irz file.


summary: Online Project Time Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter in the function save_employee at /ptms/classes/Users.php.

title: Online Project Time Management System Project Online Project Time Manag… security vulnerability


summary: A stored cross-site scripting (XSS) vulnerability in /ptms/?page=user of Online Project Time Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the user name field.


product: risvc-boom

vendor: boom-core

summary: BOOM: The Berkeley Out-of-Order RISC-V Processor commit d77c2c3 was discovered to allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis.

title: Boom-Core Risvc-Boom security vulnerability


product: eos

summary: EOS v2.1.0 was discovered to contain a heap-buffer-overflow via the function txn_test_gen_plugin.


product: tuzicms

vendor: yejiao

summary: TuziCMS v2.0.6 was discovered to contain a SQL injection vulnerability via the component App\Manage\Controller\ZhuantiController.class.php.


product: V-SFT

vendor: FUJI ELECTRIC CO., LTD. / Hakko Electronics Co., Ltd.

version: versions prior to v6.1.6.0

product: v-sft

vendor: fujielectric

summary: Heap-based buffer overflow exists in the simulator module contained in the graphic editor 'V-SFT' versions prior to v6.1.6.0, which may allow an attacker to obtain information and/or execute arbitrary code by having a user to open a specially crafted image file.

title: Fujielectric V-Sft security vulnerability


product: OAS Platform

vendor: Open Automation Software

vendor: openautomationsoftware

summary: An external config control vulnerability exists in the OAS Engine SecureAddUser functionality of Open Automation Software OAS Platform V16.00.0112. A specially-crafted series of network requests can lead to the creation of an OAS user account. An attacker can send a sequence of requests to trigger this vulnerability.

title: Openautomationsoftware Oas Platform security vulnerability


product: LibreOffice

vendor: The Document Foundation

product: libreoffice

vendor: libreoffice

summary: An Improper Certificate Validation vulnerability in LibreOffice existed where determining if a macro was signed by a trusted author was done by only matching the serial number and issuer string of the used certificate with that of a trusted certificate. This is not sufficient to verify that the macro was actually signed with the certificate. An adversary could therefore create an arbitrary certificate with a serial number and an issuer string identical to a trusted certificate which LibreOffice would present as belonging to the trusted author, potentially leading to the user to execute arbitrary code contained in macros improperly trusted. This issue affects: The Document Foundation LibreOffice 7.2 versions prior to 7.2.7; 7.3 versions prior to 7.3.1.

title: Libreoffice security vulnerability


summary: LibreOffice supports the storage of passwords for web connections in the user’s configuration database. The stored passwords are encrypted with a single master key provided by the user. A flaw in LibreOffice existed where the required initialization vector for encryption was always the same which weakens the security of the encryption making them vulnerable if an attacker has access to the user's configuration data. This issue affects: The Document Foundation LibreOffice 7.2 versions prior to 7.2.7; 7.3 versions prior to 7.3.1.


summary: LibreOffice supports the storage of passwords for web connections in the user’s configuration database. The stored passwords are encrypted with a single master key provided by the user. A flaw in LibreOffice existed where master key was poorly encoded resulting in weakening its entropy from 128 to 43 bits making the stored passwords vulerable to a brute force attack if an attacker has access to the users stored config. This issue affects: The Document Foundation LibreOffice 7.2 versions prior to 7.2.7; 7.3 versions prior to 7.3.3.


product: Pandora FMS

vendor: Artica PFMS

vendor: pandorafms

summary: Pandora FMS v7.0NG.760 and below allows an improper access control in Configuration (Credential store) where a user with the role of Operator (Write) could create, delete, view existing keys which are outside the intended role.

title: Pandorafms Pandora Fms security vulnerability


summary: Pandora FMS v7.0NG.759 allows Cross-Site Request Forgery in Bulk operation (User operation) resulting in elevation of privilege to Administrator group.


summary: Pandora FMS v7.0NG.760 and below allows an improper authorization in User Management where any authenticated user with access to the User Management module could create, modify or delete any user with full admin privilege. The impact could lead to a vertical privilege escalation to access the privileges of a higher-level user or typically an admin user.


vendor: couchbase

summary: Couchbase Operator 2.2.x before 2.2.3 exposes Sensitive Information to an Unauthorized Actor. Secrets are not redacted in logs collected from Kubernetes environments.


product: Mendix Forgot Password Appstore module

vendor: Siemens

version: All versions >= V3.3.0 < V3.5.1

vendor: mendix

summary: A vulnerability has been identified in Mendix Forgot Password Appstore module (All versions >= V3.3.0 < V3.5.1). In certain configurations of the affected product, a threat actor could use the sign up flow to hijack arbitrary user accounts.


version: All versions < V3.2.2

summary: A vulnerability has been identified in Mendix Forgot Password Appstore module (All versions >= V3.3.0 < V3.5.1), Mendix Forgot Password Appstore module (Mendix 7 compatible) (All versions < V3.2.2). Initial passwords are generated in an insecure manner. This could allow an unauthenticated remote attacker to efficiently brute force passwords in specific situations.

title: Mendix Forgot Password security vulnerability


product: qrcp

summary: qrcp through 0.8.4, in receive mode, allows ../ Directory Traversal via the file name specified by the uploader.


product: Mendix Applications using Mendix 7

version: All versions < V7.23.29

product: mendix

summary: A vulnerability has been identified in Mendix Applications using Mendix 7 (All versions < V7.23.29). When returning the result of a completed Microflow execution call the affected framework does not correctly verify, if the request was initially made by the user requesting the result. Together with predictable identifiers for Microflow execution calls, this could allow a malicious attacker to retrieve information about arbitrary Microflow execution calls made by users within the affected system.


business_risk: Critical remote code execution risk affecting WatchGuard Firebox and XTM appliances. The issue is exploitable without authentication when management access is exposed, and CISA lists the CVE in its Known Exploited Vulnerabilities Catalog.

claim: The vulnerability affects WatchGuard Firebox and XTM appliances running affected Fireware OS releases.

claim: WatchGuard states that the vulnerability affects Fireware OS 12.0 through and including 12.7.2_Update1, with branch-specific applicability described in the advisory.

claim: WatchGuard describes an unauthenticated remote attacker exploiting exposed management access and recommends restricting management access to trusted networks.

kind: exposure

claim: WatchGuard lists resolved releases including 12.7.2_Update2, 12.5.9_Update2, 12.3.1_Update2, 12.1.3_Update8, and Fireware OS 12.8 for the applicable branches.

claim: CISA's required action for this known-exploited vulnerability is to apply updates according to vendor instructions.

kind: remediation

claim: Firmware-version verification against the vendor's listed resolved versions is supported by WatchGuard's affected and resolution tables; no exploit-based verification is required.

kind: verification

exposure_conditions: A vulnerable Fireware OS release is installed on a Firebox or XTM appliance.

exposure_conditions: Management access is exposed to an attacker-controlled network; WatchGuard describes exploitation by an unauthenticated remote attacker through exposed management access.

exposure_conditions: The affected appliance is reachable over the network. No evidence supports a narrower required service, port, or configuration condition.

remediation_steps: Upgrade Fireware OS to a WatchGuard-resolved release appropriate for the appliance branch: 12.7.2_Update2 or later for 12.7.x; 12.5.9_Update2 or later for affected 12.5.x T15/T35 models; 12.3.1_Update2 or later for the 12.3.1 FIPS-certified release; 12.1.3_Update8 or later for affected 12.1.x XTM models; or Fireware OS 12.8 or later for the general 12.x branch.

remediation_steps: Until firmware updates are applied, restrict Firebox management access to trusted networks as recommended by WatchGuard. This is risk reduction only and is not a substitute for updating.

remediation_steps: Prioritize remediation because CISA records active exploitation status for this CVE and specifies applying vendor updates.

status: complete

uncertainty: CISA associates CVE-2022-26318 with CWE-122, while NVD currently reports NVD-CWE-Other. The supplied command_code_injection archetype is not independently established by the authoritative sources reviewed; WatchGuard describes the underlying issue as a null pointer dereference leading to potential arbitrary code execution.

uncertainty: The WatchGuard advisory identifies affected product branches and model-specific applicability for some releases. Appliance model and installed Fireware OS version were not provided, so the exact applicable fixed release cannot be selected.

uncertainty: No source reviewed provides a safe, product-specific vulnerability test beyond checking the installed firmware release and management-access exposure.

verification_steps: Using the vendor-supported, read-only device-management or inventory interface, confirm the running Fireware OS release and update level.

verification_steps: Compare the installed release with the applicable WatchGuard resolved release for the appliance branch; treat a release below the applicable resolved version as unremediated.

verification_steps: Confirm that management access is restricted to trusted networks according to the organization’s approved network policy; do not perform exploitation or unauthorized remote probing.

product: Firebox and XTM Appliances

vendor_project: WatchGuard

vulnerability_name: WatchGuard Firebox and XTM Appliances Arbitrary Code Execution

product: fireware

vendor: watchguard

summary: On WatchGuard Firebox and XTM appliances, an unauthenticated user can execute arbitrary code, aka FBX-22786. This vulnerability impacts Fireware OS before 12.7.2_U2, 12.x before 12.1.3_U8, and 12.2.x through 12.5.x before 12.5.9_U2.


product: Trend Micro Portable Security

vendor: Trend Micro

vendor: trendmicro

summary: An installer search patch element vulnerability in Trend Micro Portable Security 3.0 Pro, 3.0 and 2.0 could allow a local attacker to place an arbitrarily generated DLL file in an installer folder to elevate local privileges. Please note: an attacker must first obtain the ability to execute high-privileged code on the target system in order to exploit this vulnerability.

title: Trendmicro Portable Security security vulnerability


vendor: rambus

vendor: fujifilm

summary: The Rambus SafeZone Basic Crypto Module before 10.4.0, as used in certain Fujifilm (formerly Fuji Xerox) devices before 2022-03-01, Canon imagePROGRAF and imageRUNNER devices through 2022-03-14, and potentially many other devices, generates RSA keys that can be broken with Fermat's factorization method. This allows efficient calculation of private RSA keys from the public key of a TLS certificate.

title: Rambus Safezone Basic Crypto Module security vulnerability


default_status: affected

platforms:
Windows
Linux
64 bit

product: Identity Manager REST Driver 1.1.2.0200

vendor: OpenText

version_type: rpm, exe

vendor: netiq

summary: Possible Insertion of Sensitive Information into Log File Vulnerability in Identity Manager has been discovered in OpenText™ Identity Manager REST Driver. This impact version before 1.1.2.0200.

title: Netiq Identity Manager Rest Driver security vulnerability


product: Operations Bridge Manager

vendor: OpenText™

product: Operations Bridge Suite (Containerized)

product: UCMDB ( Classic and Containerized)

status: Deferred

summary: Incorrect Use of Privileged APIs vulnerability in OpenText™ Operations Bridge Manager, OpenText™ Operations Bridge Suite (Containerized), OpenText™ UCMDB ( Classic and Containerized) allows Privilege Escalation. The vulnerability could allow authenticated attackers to elevate user privileges. This issue affects Operations Bridge Manager: through 2021.05; Operations Bridge Suite (Containerized): through 2021.05; UCMDB ( Classic and Containerized): through 2021.05.

title: Opentext™ Operations Bridge Manager security vulnerability


product: iManager

product: imanager

vendor: microfocus

summary: Possible XSS in iManager URL for access Component has been discovered in OpenText™ iManager 3.2.6.0000.


product: NetIQ Access Manager

vendor: Micro Focus

version: NetIQ Access Manager

summary: Reflected Cross Site Scripting (XSS) vulnerability in NetIQ Access Manager prior to 5.0.2


summary: Potential open redirection vulnerability when URL is crafted in specific format in NetIQ Access Manager prior to 5.0.2


product: Performance Center

summary: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in OpenText Performance Center on Windows allows Retrieve Embedded Sensitive Data.This issue affects Performance Center: 12.63.

title: Opentext Performance Center security vulnerability


product: NetIQ Identity Manager

version: NetIQ Identity Manager

summary: File existence disclosure vulnerability in NetIQ Identity Manager plugin prior to version 4.8.5 allows attacker to determine whether a file exists on the filesystem. This issue affects: Micro Focus NetIQ Identity Manager NetIQ Identity Manager versions prior to 4.8.5 on ALL.

title: Netiq Identity Manager security vulnerability


product: Micro Focus ArcSight Logger

summary: Potential vulnerabilities have been identified in Micro Focus ArcSight Logger. The vulnerabilities could be remotely exploited resulting in Information Disclosure, or Self Cross-Site Scripting (XSS). This issue affects: Micro Focus ArcSight Logger versions prior to v7.2.2 version and prior versions.


title: Potential vulnerabilities have been identified in Micro Focus ArcSight Logger


product: cipi

vendor: cipi

summary: Cipi 3.1.15 allows Add Server stored XSS via the /api/servers name field.


product: SCALANCE X302-7 EEC (230V)

version: All versions < V4.1.4

product: SCALANCE X302-7 EEC (230V, coated)

product: SCALANCE X302-7 EEC (24V)

product: SCALANCE X302-7 EEC (24V, coated)

product: SCALANCE X302-7 EEC (2x 230V)

product: SCALANCE X302-7 EEC (2x 230V, coated)

product: SCALANCE X302-7 EEC (2x 24V)

product: SCALANCE X302-7 EEC (2x 24V, coated)

product: SCALANCE X304-2FE

product: SCALANCE X306-1LD FE

product: SCALANCE X307-2 EEC (230V)

product: SCALANCE X307-2 EEC (230V, coated)

vendor: siemens

summary: A vulnerability has been identified in SCALANCE X302-7 EEC (230V), SCALANCE X302-7 EEC (230V, coated), SCALANCE X302-7 EEC (24V), SCALANCE X302-7 EEC (24V, coated), SCALANCE X302-7 EEC (2x 230V), SCALANCE X302-7 EEC (2x 230V, coated), SCALANCE X302-7 EEC (2x 24V), SCALANCE X302-7 EEC (2x 24V, coated), SCALANCE X304-2FE, SCALANCE X306-1LD FE, SCALANCE X307-2 EEC (230V), SCALANCE X307-2 EEC (230V, coated), SCALANCE X307-2 EEC (24V), SCALANCE X307-2 EEC (24V, coated), SCALANCE X307-2 EEC (2x 230V), SCALANCE X307-2 EEC (2x 230V, coated), SCALANCE X307-2 EEC (2x 24V), SCALANCE X307-2 EEC (2x 24V, coated), SCALANCE X307-3, SCALANCE X307-3, SCALANCE X307-3LD, SCALANCE X307-3LD, SCALANCE X308-2, SCALANCE X308-2, SCALANCE X308-2LD, SCALANCE X308-2LD, SCALANCE X308-2LH, SCALANCE X308-2LH, SCALANCE X308-2LH+, SCALANCE X308-2LH+, SCALANCE X308-2M, SCALANCE X308-2M, SCALANCE X308-2M PoE, SCALANCE X308-2M PoE, SCALANCE X308-2M TS, SCALANCE X308-2M TS, SCALANCE X310, SCALANCE X310, SCALANCE X310FE, SCALANCE X310FE, SCALANCE X320-1 FE, SCALANCE X320-1-2LD FE, SCALANCE X408-2, SCALANCE XR324-12M (230V, ports on front), SCALANCE XR324-12M (230V, ports on front), SCALANCE XR324-12M (230V, ports on r…

title: Siemens Scalance X302-7Eec Firmware security vulnerability


product: poi-scratchpad

vendor: Apache Software Foundation

product: poi

vendor: apache

vendor: netapp

summary: A shortcoming in the HMEF package of poi-scratchpad (Apache POI) allows an attacker to cause an Out of Memory exception. This package is used to read TNEF files (Microsoft Outlook and Microsoft Exchange Server). If an application uses poi-scratchpad to parse TNEF files and the application allows untrusted users to supply them, then a carefully crafted file can cause an Out of Memory exception. This issue affects poi-scratchpad version 5.2.0 and prior versions. Users are recommended to upgrade to poi-scratchpad 5.2.1.


product: Trend Micro Password Manager

summary: Trend Micro Password Manager (Consumer) installer version 5.0.0.1262 and below is vulnerable to an Uncontrolled Search Path Element vulnerability that could allow an attacker to use a specially crafted file to exploit the vulnerability and escalate local privileges on the affected machine.

title: Trendmicro Password Manager security vulnerability


product: DIAEnergie

vendor: Delta Electronics

product: diaenergie

vendor: deltaww

summary: Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in HandlerPageP_KID.ashx. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database contents, and execute system commands.


product: BIG-IP

product: BIG-IQ Centralized Management

summary: On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all versions of 12.1.x and 11.6.x, and F5 BIG-IQ Centralized Management all versions of 8.x and 7.x, an authenticated, high-privileged attacker with no bash access may be able to access Certificate and Key files using Secure Copy (SCP) protocol from a remote system. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

title: F5 Big-Ip Access Policy Manager security vulnerability


product: Intel(R) AMT SDK, Intel(R) EMA and Intel(R) MC

version: See references

vendor: intel

summary: Insufficiently protected credentials in software in Intel(R) AMT SDK before version 16.0.4.1, Intel(R) EMA before version 1.7.1 and Intel(R) MC before version 2.3.2 may allow an authenticated user to potentially enable escalation of privilege via network access.

title: Intel Active Management Technology Software Development Kit security vulnerability


product: LinkHub Mesh Wifi

vendor: TCL

vendor: tcl

summary: A buffer overflow vulnerability exists in the confsrv ucloud_set_node_location functionality of TCL LinkHub Mesh Wi-Fi MS1G_00_01.00_14. A specially-crafted network packet can lead to a buffer overflow. An attacker can send a malicious packet to trigger this vulnerability.


product: Intel(R) Processors

summary: Improper access control in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access.

title: Intel Xeon Bronze 3104 Firmware security vulnerability


product: version

summary: Incorrect default permissions in the installation binaries for Intel(R) SEAPI all versions may allow an authenticated user to potentially enable escalation of privilege via local access.

title: Intel Single Event Api security vulnerability


product: Intel(R) oneAPI Toolkit OpenMP

version: before version 2022.1

product: openmp

summary: Uncontrolled search path element in the Intel(R) oneAPI Toolkit OpenMP before version 2022.1 may allow an authenticated user to potentially enable escalation of privilege via local access.

title: Intel Openmp security vulnerability


summary: A denial of service vulnerability exists in the ucloud_del_node functionality of TCL LinkHub Mesh Wi-Fi MS1G_00_01.00_14. A specially-crafted network packet can lead to denial of service. An attacker can send packets to trigger this vulnerability.


product: Command Centre

vendor: Gallagher

vendor: gallagher

summary: Command Centre Server is vulnerable to SQL Injection via Windows Registry settings for date fields on the server. The Windows Registry setting allows an attacker using the Visitor Management Kiosk, an application designed for public use, to invoke an arbitrary SQL query that has been preloaded into the registry of the Windows Server to obtain sensitive information. This issue affects: Gallagher Command Centre 8.60 versions prior to 8.60.1652; 8.50 versions prior to 8.50.2245; 8.40 versions prior to 8.40.2216; 8.30 versions prior to 8.30.1470; version 8.20 and prior versions.


summary: Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability that exists in DIAE_eccoefficientHandler.ashx. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database contents, and execute system commands.

title: Deltaww Diaenergie security vulnerability


product: dotCMS

vendor_project: dotCMS

vulnerability_name: dotCMS Unrestricted Upload of File Vulnerability

product: dotcms

vendor: dotcms

summary: An issue was discovered in the ContentResource API in dotCMS 3.0 through 22.02. Attackers can craft a multipart form request to post a file whose filename is not initially sanitized. This allows directory traversal, in which the file is saved outside of the intended storage location. If anonymous content creation is enabled, this allows an unauthenticated attacker to upload an executable file, such as a .jsp file, that can lead to remote code execution.


product: qemu-kvm

version: Affected QEMU version: 6.2.0

product: qemu

vendor: qemu

vendor: debian

summary: A flaw was found in the virtio-net device of QEMU. This flaw was inadvertently introduced with the fix for CVE-2021-3748, which forgot to unmap the cached virtqueue elements on error, leading to memory leakage and other unexpected results. Affected QEMU version: 6.2.0.


product: Federated Authentication Service (FAS)

vendor: Citrix

vendor: citrix

summary: Citrix Federated Authentication Service (FAS) 7.17 - 10.6 causes deployments that have been configured to store a registration authority certificate's private key in a Trusted Platform Module (TPM) to incorrectly store that key in the Microsoft Software Key Storage Provider (MSKSP). This issue only occurs if PowerShell was used when configuring FAS to store the registration authority certificate’s private key in the TPM. It does not occur if the TPM was not selected for use or if the FAS administration console was used for configuration.

title: Citrix Federated Authentication Service security vulnerability


product: xen

vendor: xen

product: fedora

vendor: fedoraproject

summary: Racy interactions between dirty vram tracking and paging log dirty hypercalls Activation of log dirty mode done by XEN_DMOP_track_dirty_vram (was named HVMOP_track_dirty_vram before Xen 4.9) is racy with ongoing log dirty hypercalls. A suitably timed call to XEN_DMOP_track_dirty_vram can enable log dirty while another CPU is still in the process of tearing down the structures related to a previously enabled log dirty mode (XEN_DOMCTL_SHADOW_OP_OFF). This is due to lack of mutually exclusive locking between both operations and can lead to entries being added in already freed slots, resulting in a memory leak.

title: Xen security vulnerability


summary: race in VT-d domain ID cleanup Xen domain IDs are up to 15 bits wide. VT-d hardware may allow for only less than 15 bits to hold a domain ID associating a physical device with a particular domain. Therefore internally Xen domain IDs are mapped to the smaller value range. The cleaning up of the housekeeping structures has a race, allowing for VT-d domain IDs to be leaked and flushes to be bypassed.


summary: IOMMU: RMRR (VT-d) and unity map (AMD-Vi) handling issues T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Certain PCI devices in a system might be assigned Reserved Memory Regions (specified via Reserved Memory Region Reporting, "RMRR") for Intel VT-d or Unity Mapping ranges for AMD-Vi. These are typically used for platform tasks such as legacy USB emulation. Since the precise purpose of these regions is unknown, once a device associated with such a region is active, the mappings of these regions need to remain continuouly accessible by the device. This requirement has been violated. Subsequent DMA or interrupts from the device may have unpredictable behaviour, ranging from IOMMU faults to memory corruption.

title: Xen security vulnerability


summary: x86 pv: Race condition in typeref acquisition Xen maintains a type reference count for pages, in addition to a regular reference count. This scheme is used to maintain invariants required for Xen's safety, e.g. PV guests may not have direct writeable access to pagetables; updates need auditing by Xen. Unfortunately, the logic for acquiring a type reference has a race condition, whereby a safely TLB flush is issued too early and creates a window where the guest can re-establish the read/write mapping before writeability is prohibited.


summary: x86 pv: Insufficient care with non-coherent mappings T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Xen maintains a type reference count for pages, in addition to a regular reference count. This scheme is used to maintain invariants required for Xen's safety, e.g. PV guests may not have direct writeable access to pagetables; updates need auditing by Xen. Unfortunately, Xen's safety logic doesn't account for CPU-induced cache non-coherency; cases where the CPU can cause the content of the cache to be different to the content in main memory. In such cases, Xen's safety logic can incorrectly conclude that the contents of a page is safe.

title: Xen security vulnerability


ecosystem: linux/kernel

vendor: linux

summary: Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Linux Block and Network PV device frontends don't zero memory regions before sharing them with the backend (CVE-2022-26365, CVE-2022-33740). Additionally the granularity of the grant table doesn't allow sharing less than a 4K page, leading to unrelated data residing in the same 4K page as data shared with a backend being accessible by such backend (CVE-2022-33741, CVE-2022-33742).

title: Linux Linux Kernel security vulnerability


product: AdRotate Banner Manager (WordPress plugin)

vendor: Arnan de Gans

ecosystem: php/wordpress

summary: Cross-Site Request Forgery (CSRF) in AdRotate Banner Manager Plugin <= 5.9 on WordPress.


product: Intel(R) XMM(TM) 7560 Modem software

summary: Improper buffer restrictions in some Intel(R) XMM(TM) 7560 Modem software before version M2_7560_R_01.2146.00 may allow a privileged user to potentially enable escalation of privilege via local access.

title: Intel Xmm 7560 Firmware security vulnerability


product: Cybozu Garoon

vendor: Cybozu, Inc.

product: garoon

vendor: cybozu

summary: Browse restriction bypass and operation restriction bypass vulnerability in Cabinet of Cybozu Garoon 4.0.0 to 5.5.1 allows a remote authenticated attacker to alter and/or obtain the data of Cabinet.

title: Cybozu Garoon security vulnerability


summary: Out-of-bounds read in some Intel(R) XMM(TM) 7560 Modem software before version M2_7560_R_01.2146.00 may allow a privileged user to potentially enable escalation of privilege via adjacent access.


product: BIG-IP

summary: On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5, and 14.1.x versions prior to 14.1.4.6, when a Session Initiation Protocol (SIP) message routing framework (MRF) application layer gateway (ALG) profile is configured on a Message Routing virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated


summary: On F5 BIG-IP 15.1.x versions prior to 15.1.0.2, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all versions of 12.1.x and 11.6.x, when a DNS listener is configured on a virtual server with DNS queueing (default), undisclosed requests can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.


product: Intel(R) Processors

summary: Non-transparent sharing of return predictor targets between contexts in some Intel(R) Processors may allow an authorized user to potentially enable information disclosure via local access.

title: Intel Xeon Platinum 8253 Firmware security vulnerability


product: version

summary: Uncontrolled search path in the installation binaries for Intel(R) SEAPI all versions may allow an authenticated user to potentially enable escalation of privilege via local access.


product: AB Press Optimizer (WordPress plugin)

vendor: Mammothology

vendor: abpressoptimizer

summary: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Mammothology AB Press Optimizer plugin <= 1.1.1 on WordPress.

title: Abpressoptimizer Ab Press Optimizer security vulnerability


product: Asuswrt-Merlin New Gen

vendor: Asuswrt-Merlin

version: prior to 386.7

product: asuswrt

vendor: asus

vendor: asuswrt-merlin

summary: A memory corruption vulnerability exists in the httpd unescape functionality of Asuswrt prior to 3.0.0.4.386_48706 and Asuswrt-Merlin New Gen prior to 386.7.. A specially-crafted HTTP request can lead to memory corruption. An attacker can send a network request to trigger this vulnerability.

title: Asus Asuswrt security vulnerability


product: Apache HTTP Server

vendor: Apache Software Foundation

version: Apache HTTP Server 2.4

vendor: apache

vendor: netapp

summary: Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server allows an attacker to smuggle requests to the AJP server it forwards requests to. This issue affects Apache HTTP Server Apache HTTP Server 2.4 version 2.4.53 and prior versions.

title: Apache Http Server security vulnerability


product: SCALANCE X302-7 EEC (230V)

vendor: Siemens

product: SCALANCE X302-7 EEC (230V, coated)

product: SCALANCE X302-7 EEC (24V)

product: SCALANCE X302-7 EEC (24V, coated)

product: SCALANCE X302-7 EEC (2x 230V)

product: SCALANCE X302-7 EEC (2x 230V, coated)

product: SCALANCE X302-7 EEC (2x 24V)

product: SCALANCE X302-7 EEC (2x 24V, coated)

product: SCALANCE X304-2FE

product: SCALANCE X306-1LD FE

product: SCALANCE X307-2 EEC (230V)

product: SCALANCE X307-2 EEC (230V, coated)

vendor: siemens

summary: A vulnerability has been identified in SCALANCE X302-7 EEC (230V), SCALANCE X302-7 EEC (230V, coated), SCALANCE X302-7 EEC (24V), SCALANCE X302-7 EEC (24V, coated), SCALANCE X302-7 EEC (2x 230V), SCALANCE X302-7 EEC (2x 230V, coated), SCALANCE X302-7 EEC (2x 24V), SCALANCE X302-7 EEC (2x 24V, coated), SCALANCE X304-2FE, SCALANCE X306-1LD FE, SCALANCE X307-2 EEC (230V), SCALANCE X307-2 EEC (230V, coated), SCALANCE X307-2 EEC (24V), SCALANCE X307-2 EEC (24V, coated), SCALANCE X307-2 EEC (2x 230V), SCALANCE X307-2 EEC (2x 230V, coated), SCALANCE X307-2 EEC (2x 24V), SCALANCE X307-2 EEC (2x 24V, coated), SCALANCE X307-3, SCALANCE X307-3, SCALANCE X307-3LD, SCALANCE X307-3LD, SCALANCE X308-2, SCALANCE X308-2, SCALANCE X308-2LD, SCALANCE X308-2LD, SCALANCE X308-2LH, SCALANCE X308-2LH, SCALANCE X308-2LH+, SCALANCE X308-2LH+, SCALANCE X308-2M, SCALANCE X308-2M, SCALANCE X308-2M PoE, SCALANCE X308-2M PoE, SCALANCE X308-2M TS, SCALANCE X308-2M TS, SCALANCE X310, SCALANCE X310, SCALANCE X310FE, SCALANCE X310FE, SCALANCE X320-1 FE, SCALANCE X320-1-2LD FE, SCALANCE X408-2, SCALANCE XR324-12M (230V, ports on front), SCALANCE XR324-12M (230V, ports on front), SCALANCE XR324-12M (230V, ports on r…


product: Firefox

vendor: Mozilla

product: Firefox ESR

product: Thunderbird

ecosystem: browser

product: firefox

vendor: mozilla

product: thunderbird

summary: An attacker could have caused a use-after-free by forcing a text reflow in an SVG object leading to a potentially exploitable crash. This vulnerability affects Firefox < 98, Firefox ESR < 91.7, and Thunderbird < 91.7.


summary: While the text displayed in Autofill tooltips cannot be directly read by JavaScript, the text was rendered using page fonts. Side-channel attacks on the text by using specially crafted fonts could have lead to this text being inferred by the webpage. This vulnerability affects Firefox < 98.


summary: When resizing a popup after requesting fullscreen access, the popup would not display the fullscreen notification. This vulnerability affects Firefox < 98, Firefox ESR < 91.7, and Thunderbird < 91.7.


summary: If an attacker could control the contents of an iframe sandboxed with allow-popups but not allow-scripts, they were able to craft a link that, when clicked, would lead to JavaScript execution in violation of the sandbox. This vulnerability affects Firefox < 98, Firefox ESR < 91.7, and Thunderbird < 91.7.

title: Mozilla Firefox security vulnerability


summary: In unusual circumstances, an individual thread may outlive the thread's manager during shutdown. This could have led to a use-after-free causing a potentially exploitable crash. This vulnerability affects Firefox < 98.


summary:
Previously Firefox for macOS and Linux would download temporary files to a user-specific directory in /tmp, but this behavior was changed to download them to /tmp where they could be affected by other local users. This behavior was reverted to the original, user-specific directory.
*This bug only affects Firefox for macOS and Linux. Other operating systems are unaffected.*. This vulnerability affects Firefox ESR < 91.7 and Thunderbird < 91.7.

title: Mozilla Firefox Esr security vulnerability


summary: When installing an add-on, Firefox verified the signature before prompting the user; but while the user was confirming the prompt, the underlying add-on file could have been modified and Firefox would not have noticed. This vulnerability affects Firefox < 98, Firefox ESR < 91.7, and Thunderbird < 91.7.

title: Mozilla Firefox security vulnerability


product: ELI 380 Resting Electrocardiograph

vendor: Welch Allyn

summary: A use of hard-coded password vulnerability may allow authentication abuse.This issue affects ELI 380 Resting Electrocardiograph: Versions 2.6.0 and prior; ELI 280/BUR280/MLBUR 280 Resting Electrocardiograph: Versions 2.3.1 and prior; ELI 250c/BUR 250c Resting Electrocardiograph: Versions 2.1.2 and prior; ELI 150c/BUR 150c/MLBUR 150c Resting Electrocardiograph: Versions 2.2.0 and prior.

title: Welch Allyn Eli 380 Resting Electrocardiograph security vulnerability


vendor: Baxter/ Hillrom

summary: An improper access control vulnerability may allow privilege escalation.This issue affects: * ELI 380 Resting Electrocardiograph: Versions 2.6.0 and prior; * ELI 280/BUR280/MLBUR 280 Resting Electrocardiograph: Versions 2.3.1 and prior; * ELI 250c/BUR 250c Resting Electrocardiograph: Versions 2.1.2 and prior; * ELI 150c/BUR 150c/MLBUR 150c Resting Electrocardiograph: Versions 2.2.0 and prior.

title: Baxter/ Hillrom Eli 380 Resting Electrocardiograph security vulnerability


vendor: Baxter

vendor: baxter

summary: The Baxter Spectrum Wireless Battery Module (WBM) stores network credentials and PHI (only applicable to Spectrum IQ pumps using auto programming) in unencrypted form. An attacker with physical access to a device that hasn't had all data and settings erased may be able to extract sensitive information.

title: Baxter Spectrum Wireless Battery Module Firmware security vulnerability


product: Baxter Spectrum Wireless Battery Module (WBM)

summary: The Baxter Spectrum WBM (v16, v16D38) and Baxter Spectrum WBM (v17, v17D19, v20D29 to v20D32) when in superuser mode is susceptible to format string attacks via application messaging. An attacker could use this to read memory in the WBM to access sensitive information.


summary: The Baxter Spectrum WBM is susceptible to format string attacks via application messaging. An attacker could use this to read memory in the WBM to access sensitive information or cause a Denial of Service (DoS) on the WBM.


summary: The Baxter Spectrum WBM does not perform mutual authentication with the gateway server host. This may allow an attacker to perform a man in the middle attack that modifies parameters making the network connection fail.


product: VMG3312-T20A firmware

vendor: Zyxel

vendor: zyxel

summary: A command injection vulnerability in the CGI program of Zyxel VMG3312-T20A firmware version 5.30(ABFX.5)C0 could allow a local authenticated attacker to execute arbitrary OS commands on a vulnerable device via a LAN interface.

title: Zyxel Vmg3312-T20A Firmware security vulnerability


summary: A potential buffer overflow vulnerability was identified in some internal functions of Zyxel VMG3312-T20A firmware version 5.30(ABFX.5)C0, which could be exploited by a local authenticated attacker to cause a denial of service.