Security Vulnerabilities - CVEs Published In 2022
Claroline 13.5.7 and prior is vulnerable to Remote code execution via arbitrary file upload.
CVSS Score
9.8
EPSS Score
0.28
Published
2022-08-25
Claroline 13.5.7 and prior allows an authenticated attacker to elevate privileges via the arbitrary creation of a privileged user. By combining the XSS vulnerability present in several upload forms and a javascript request to the present API, it is possible to trigger the creation of a user with administrative rights by opening an SVG file as an administrator user.
CVSS Score
5.4
EPSS Score
0.006
Published
2022-08-25
Claroline 13.5.7 and prior is vulnerable to Cross Site Scripting (XSS) via SVG file upload.
CVSS Score
6.1
EPSS Score
0.007
Published
2022-08-25
Claroline 13.5.7 and prior is vulnerable to Cross Site Scripting (XSS). An attacker can obtain javascript code execution by adding arbitrary javascript code in the 'Location' field of a calendar event.
CVSS Score
5.4
EPSS Score
0.008
Published
2022-08-25
MDaemon Technologies SecurityGateway for Email Servers 8.5.2 is vulnerable to Cross Site Scripting (XSS) via the currentRequest parameter.
CVSS Score
5.4
EPSS Score
0.006
Published
2022-08-25
Tenda AX12 V22.03.01.21_CN is vulnerable to Buffer Overflow. This overflow is triggered in the sub_42FDE4 function, which satisfies the request of the upper-level interface function sub_430124, that is, handles the post request under /goform/SetIpMacBind.
CVSS Score
5.5
EPSS Score
0.003
Published
2022-08-25
Tenda AX1803 v1.0.0.1 was discovered to contain a stack overflow via the timezone parameter in the function fromSetSysTime.
CVSS Score
7.8
EPSS Score
0.003
Published
2022-08-25
Tenda AX1803 v1.0.0.1 was discovered to contain a stack overflow via the ddnsEn parameter in the function formSetSysToolDDNS.
CVSS Score
7.8
EPSS Score
0.003
Published
2022-08-25
Tenda AX1803 v1.0.0.1 was discovered to contain a stack overflow via the ProvinceCode parameter in the function formSetProvince.
CVSS Score
7.8
EPSS Score
0.003
Published
2022-08-25
Tenda AX1803 v1.0.0.1 was discovered to contain a stack overflow via the function fromSetRouteStatic.
CVSS Score
7.8
EPSS Score
0.003
Published
2022-08-25