Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ecurity-alerts/cpuapr2022.html - https://security.netapp.com/advisory/ntap-20220217-0006/ - https://www.oracle.com/security-alerts/cpujul2022.html
CVE ID: CVE-2022-23303 State: PUBLISHED Published: 2022-01-17T00:00:00.000Z Last Updated: 2025-11-03T19:26:46.732Z Vendors: n/a Products: n/a Problem Types: n/a Description: The implementations of SAE in hostapd before 2.10 and wpa_supplicant before 2.10 are vulnerable to side channel attacks as a result of cache access patterns. NOTE: this issue exists because of an incomplete fix for CVE-2019-9494. Additional Analyst Notes: - CVE Program Container: References: - https://w1.fi/security/2022-1/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YPDHU5MV464CZBPX7N2SNMUYP6DFIBZL/ - https://security.gentoo.org/glsa/202309-16
CVE ID: CVE-2022-23304 State: PUBLISHED Published: 2022-01-17T00:00:00.000Z Last Updated: 2025-11-03T19:26:48.111Z Vendors: n/a Products: n/a Problem Types: n/a Description: The implementations of EAP-pwd in hostapd before 2.10 and wpa_supplicant before 2.10 are vulnerable to side-channel attacks as a result of cache access patterns. NOTE: this issue exists because of an incomplete fix for CVE-2019-9495. Additional Analyst Notes: - CVE Program Container: References: - https://w1.fi/security/2022-1/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YPDHU5MV464CZBPX7N2SNMUYP6DFIBZL/ - https://security.gentoo.org/glsa/202309-16
CVE ID: CVE-2022-23305 State: PUBLISHED Published: 2022-01-18T15:25:22 Last Updated: 2024-08-03T03:36:20.421Z Vendors: Apache Software Foundation Products: Apache Log4j 1.x Problem Types: CWE-89 Description: By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout. The message converter, %m, is likely to always be included. This allows attackers to manipulate the SQL by entering crafted strings into input fields or headers of an application that are logged allowing unintended SQL queries to be executed. Note this issue only affects Log4j 1.x when specifically configured to use the JDBCAp
tended SQL queries to be executed. Note this issue only affects Log4j 1.x when specifically configured to use the JDBCAppender, which is not the default. Beginning in version 2.0-beta8, the JDBCAppender was re-introduced with proper support for parameterized SQL queries and further customization over the columns written to in logs. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions. Additional Analyst Notes: - CVE Program Container: References: - https://logging.apache.org/log4j/1.2/index.html - https://lists.apache.org/thread/pt6lh3pbsvxqlwlp4c5l798dv2hkc85y - http://www.openwall.com/lists/oss
4j/1.2/index.html - https://lists.apache.org/thread/pt6lh3pbsvxqlwlp4c5l798dv2hkc85y - http://www.openwall.com/lists/oss-security/2022/01/18/4 - https://www.oracle.com/security-alerts/cpuapr2022.html - https://security.netapp.com/advisory/ntap-20220217-0007/ - https://www.oracle.com/security-alerts/cpujul2022.html
CVE ID: CVE-2022-23307 State: PUBLISHED Published: 2022-01-18T15:25:23 Last Updated: 2024-08-03T03:36:20.396Z Vendors: Apache Software Foundation Products: Apache Log4j 1.x Problem Types: CWE-502 Description: CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. Prior to Chainsaw V2.0 Chainsaw was a component of Apache Log4j 1.2.x where the same issue exists. Additional Analyst Notes: - CVE Program Container: References: - https://logging.apache.org/log4j/1.2/index.html - https://lists.apache.org/thread/rg4yyc89vs3dw6kpy3r92xop9loywyhh - https://www.oracle.com/security-alerts/cpuapr2022.html - https://www.oracle.com/security-alerts/cpujul2022.html
CVE ID: CVE-2022-23308 State: PUBLISHED Published: 2022-02-26T00:00:00.000Z Last Updated: 2025-05-05T16:26:56.501Z Vendors: n/a Products: n/a Problem Types: n/a Description: valid.c in libxml2 before 2.9.13 has a use-after-free of ID and IDREF attributes. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LA3MWWAYZADWJ5F6JOUBX65UZAMQB7RF/ - https://lists.debian.org/debian-lts-announce/2022/04/msg00004.html - http://seclists.org/fulldisclosure/2022/May/33 - http://seclists.org/fulldisclosure/2022/May/37 - http://seclists.org/fulldisclosure/2022/May/35 - http:
re/2022/May/33 - http://seclists.org/fulldisclosure/2022/May/37 - http://seclists.org/fulldisclosure/2022/May/35 - http://seclists.org/fulldisclosure/2022/May/38 - http://seclists.org/fulldisclosure/2022/May/36 - http://seclists.org/fulldisclosure/2022/May/34 - https://www.oracle.com/security-alerts/cpujul2022.html - https://support.apple.com/kb/HT213257 - https://support.apple.com/kb/HT213256 - https://support.apple.com/kb/HT213255 - https://gitlab.gnome.org/GNOME/libxml2/-/blob/v2.9.13/NEWS - https://github.com/GNOME/libxml2/commit/652dd12a858989b14eed4e84e453059cd3ba340e - https://security.netapp.com/advisory/ntap-20220331-0008/ - https://support.apple.com/kb/HT213253 - https://support.ap
- https://security.netapp.com/advisory/ntap-20220331-0008/ - https://support.apple.com/kb/HT213253 - https://support.apple.com/kb/HT213258 - https://support.apple.com/kb/HT213254 - https://security.gentoo.org/glsa/202210-03
CVE ID: CVE-2022-23312 State: PUBLISHED Published: 2022-02-09T15:17:30 Last Updated: 2024-08-03T03:36:20.385Z Vendors: Siemens Products: Spectrum Power 4 Problem Types: CWE-79 Description: A vulnerability has been identified in Spectrum Power 4 (All versions < V4.70 SP9 Security Patch 1). The integrated web application "Online Help" in affected product contains a Cross-Site Scripting (XSS) vulnerability that could be exploited if unsuspecting users are tricked into accessing a malicious link. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-831168.pdf
CVE ID: CVE-2022-23314 State: PUBLISHED Published: 2022-01-20T23:40:37 Last Updated: 2024-08-03T03:36:20.489Z Vendors: n/a Products: n/a Problem Types: n/a Description: MCMS v5.2.4 was discovered to contain a SQL injection vulnerability via /ms/mdiy/model/importJson.do. Additional Analyst Notes: - CVE Program Container: References: - https://gitee.com/mingSoft/MCMS/issues/I4Q4OT
CVE ID: CVE-2022-23315 State: PUBLISHED Published: 2022-01-20T23:40:37 Last Updated: 2024-08-03T03:36:20.396Z Vendors: n/a Products: n/a Problem Types: n/a Description: MCMS v5.2.4 was discovered to contain an arbitrary file upload vulnerability via the component /ms/template/writeFileContent.do. Additional Analyst Notes: - CVE Program Container: References: - https://gitee.com/mingSoft/MCMS/issues/I4Q4PX
CVE ID: CVE-2022-23316 State: PUBLISHED Published: 2022-02-04T11:24:13 Last Updated: 2024-08-03T03:36:20.365Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in taoCMS v3.0.2. There is an arbitrary file read vulnerability that can read any files via admin.php?action=file&ctrl=download&path=../../1.txt. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/taogogo/taocms/issues/15
CVE ID: CVE-2022-23317 State: PUBLISHED Published: 2022-02-15T12:53:17 Last Updated: 2024-08-03T03:36:20.372Z Vendors: n/a Products: n/a Problem Types: n/a Description: CobaltStrike <=4.5 HTTP(S) listener does not determine whether the request URL begins with "/", and attackers can obtain relevant information by specifying the URL. Additional Analyst Notes: - CVE Program Container: References: - https://donghuangt1.com/writings/Stager/
CVE ID: CVE-2022-23318 State: PUBLISHED Published: 2022-02-17T12:44:33 Last Updated: 2024-08-03T03:36:20.395Z Vendors: n/a Products: n/a Problem Types: n/a Description: A heap-buffer-overflow in pcf2bdf, versions >= 1.05 allows an attacker to trigger unsafe memory access via a specially crafted PCF font file. This out-of-bound read may lead to an application crash, information disclosure via program memory or other context-dependent impact. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ganaware/pcf2bdf - https://github.com/ganaware/pcf2bdf/issues/4
CVE ID: CVE-2022-23319 State: PUBLISHED Published: 2022-02-17T13:44:29 Last Updated: 2024-08-03T03:36:20.395Z Vendors: n/a Products: n/a Problem Types: n/a Description: A segmentation fault during PCF file parsing in pcf2bdf versions >=1.05 allows an attacker to trigger a program crash via a specially crafted PCF font file. This crash affects the availability of the software and dependent downstream components. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ganaware/pcf2bdf - https://github.com/ganaware/pcf2bdf/issues/5
CVE ID: CVE-2022-23320 State: PUBLISHED Published: 2022-02-07T10:47:33 Last Updated: 2024-08-03T03:36:20.416Z Vendors: n/a Products: n/a Problem Types: n/a Description: XMPie uStore 12.3.7244.0 allows for administrators to generate reports based on raw SQL queries. Since the application ships with default administrative credentials, an attacker may authenticate into the application and exfiltrate sensitive information from the database. Additional Analyst Notes: - CVE Program Container: References: - http://xmpie.com - https://www.triaxiomsecurity.com/xmpie-ustore-vulnerabilities-discovered/ - https://www.xmpie.com/ustore-release-notes/ - https://www.linkedin.com/feed/update/urn:li:activity:
lities-discovered/ - https://www.xmpie.com/ustore-release-notes/ - https://www.linkedin.com/feed/update/urn:li:activity:6894666176450887681?commentUrn=urn%3Ali%3Acomment%3A%28activity%3A6894666176450887681%2C6895051709354192896%29
CVE ID: CVE-2022-23321 State: PUBLISHED Published: 2022-02-10T18:11:16 Last Updated: 2024-08-03T03:36:20.341Z Vendors: n/a Products: n/a Problem Types: n/a Description: A persistent cross-site scripting (XSS) vulnerability exists on two input fields within the administrative panel when editing users in the XMPie UStore application on version 12.3.7244.0. Additional Analyst Notes: - CVE Program Container: References: - http://xmpie.com - https://www.triaxiomsecurity.com/xmpie-ustore-vulnerabilities-discovered/ - https://www.xmpie.com/ustore-release-notes/
CVE ID: CVE-2022-23327 State: PUBLISHED Published: 2022-03-04T11:24:13 Last Updated: 2024-08-03T03:36:20.397Z Vendors: n/a Products: n/a Problem Types: n/a Description: A design flaw in Go-Ethereum 1.10.12 and older versions allows an attacker node to send 5120 future transactions with a high gas price in one message, which can purge all of pending transactions in a victim node's memory pool, causing a denial of service (DoS). Additional Analyst Notes: - CVE Program Container: References: - http://ethereum.com - http://go-ethereum.com - https://tristartom.github.io/docs/ccs21.pdf - https://dl.acm.org/doi/pdf/10.1145/3460120.3485369
CVE ID: CVE-2022-23328 State: PUBLISHED Published: 2022-03-04T11:24:22 Last Updated: 2024-08-03T03:36:20.422Z Vendors: n/a Products: n/a Problem Types: n/a Description: A design flaw in all versions of Go-Ethereum allows an attacker node to send 5120 pending transactions of a high gas price from one account that all fully spend the full balance of the account to a victim Geth node, which can purge all of pending transactions in a victim node's memory pool and then occupy the memory pool to prevent new transactions from entering the pool, resulting in a denial of service (DoS). Additional Analyst Notes: - CVE Program Container: References: - http://ethereum.com - http://go-ethereum.com - http
S). Additional Analyst Notes: - CVE Program Container: References: - http://ethereum.com - http://go-ethereum.com - https://tristartom.github.io/docs/ccs21.pdf - https://dl.acm.org/doi/pdf/10.1145/3460120.3485369
CVE ID: CVE-2022-23329 State: PUBLISHED Published: 2022-02-04T21:03:52 Last Updated: 2024-08-03T03:36:20.457Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability in ${"freemarker.template.utility.Execute"?new() of UJCMS Jspxcms v10.2.0 allows attackers to execute arbitrary commands via uploading malicious files. Additional Analyst Notes: - CVE Program Container: References: - https://gitee.com/jspxcms/Jspxcms/issues/I4QAZN
CVE ID: CVE-2022-23330 State: PUBLISHED Published: 2022-02-04T21:03:55 Last Updated: 2024-08-03T03:36:20.378Z Vendors: n/a Products: n/a Problem Types: n/a Description: A remote code execution (RCE) vulnerability in HelloWorldAddonController.java of jpress v4.2.0 allows attackers to execute arbitrary code via a crafted JAR package. Additional Analyst Notes: - CVE Program Container: References: - https://gitee.com/JPressProjects/jpress/issues/I4QZZ8
CVE ID: CVE-2022-23331 State: PUBLISHED Published: 2022-02-08T12:29:28 Last Updated: 2024-08-03T03:36:20.404Z Vendors: n/a Products: n/a Problem Types: n/a Description: In DataEase v1.6.1, an authenticated user can gain unauthorized access to all user information and can change the administrator password. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/dataease/dataease/issues/1618
CVE ID: CVE-2022-23332 State: PUBLISHED Published: 2022-05-09T13:37:24 Last Updated: 2024-08-03T03:36:20.403Z Vendors: n/a Products: n/a Problem Types: n/a Description: Command injection vulnerability in Manual Ping Form (Web UI) in Shenzhen Ejoin Information Technology Co., Ltd. ACOM508/ACOM516/ACOM532 609-915-041-100-020 allows a remote attacker to inject arbitrary code via the field. Additional Analyst Notes: - CVE Program Container: References: - http://en.ejointech.com/ - https://drive.google.com/drive/folders/1QRs6wos3mL9289TTUm98n5OmgBVrbYTx - https://github.com/kyl3song/CVE/tree/main/CVE-2022-23332
CVE ID: CVE-2022-23334 State: PUBLISHED Published: 2023-01-30T00:00:00.000Z Last Updated: 2025-03-28T15:42:09.078Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Robot application in Ip-label Newtest before v8.5R0 was discovered to use weak signature checks on executed binaries, allowing attackers to have write access and escalate privileges via replacing NEWTESTREMOTEMANAGER.EXE. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://ip-label.com - http://newtest.com - https://www.on-x.com/wp-content/uploads/2023/01/ON-X-Security-Advisory-Ip-label-Ekara-Newtest-CVE-2022-23334.pdf
CVE ID: CVE-2022-23335 State: PUBLISHED Published: 2022-02-14T20:18:11 Last Updated: 2024-08-03T03:36:20.448Z Vendors: n/a Products: n/a Problem Types: n/a Description: Metinfo v7.5.0 was discovered to contain a SQL injection vulnerability in language_general.class.php via doModifyParameter. Additional Analyst Notes: - CVE Program Container: References: - http://note.youdao.com/noteshare?id=3009926ba5c401a766901ded26c1df63
CVE ID: CVE-2022-23336 State: PUBLISHED Published: 2022-02-14T20:18:13 Last Updated: 2024-08-03T03:36:20.380Z Vendors: n/a Products: n/a Problem Types: n/a Description: S-CMS v5.0 was discovered to contain a SQL injection vulnerability in member_pay.php via the O_id parameter. Additional Analyst Notes: - CVE Program Container: References: - http://note.youdao.com/noteshare?id=30c7cdeac5c7611fdf64379eb4569269
CVE ID: CVE-2022-23337 State: PUBLISHED Published: 2022-02-14T20:18:14 Last Updated: 2024-08-03T03:36:20.401Z Vendors: n/a Products: n/a Problem Types: n/a Description: DedeCMS v5.7.87 was discovered to contain a SQL injection vulnerability in article_coonepage_rule.php via the ids parameter. Additional Analyst Notes: - CVE Program Container: References: - http://note.youdao.com/noteshare?id=608f19009c8bd1ace5f1a59c1ddd657b
CVE ID: CVE-2022-23340 State: PUBLISHED Published: 2022-02-08T13:20:31 Last Updated: 2024-08-03T03:36:20.418Z Vendors: n/a Products: n/a Problem Types: n/a Description: Joplin 2.6.10 allows remote attackers to execute system commands through malicious code in user search results. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/laurent22/joplin/issues/6004
CVE ID: CVE-2022-23342 State: PUBLISHED Published: 2022-06-21T13:29:21 Last Updated: 2024-08-03T03:36:20.420Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Hyland Onbase Application Server releases prior to 20.3.58.1000 and OnBase releases 21.1.1.1000 through 21.1.15.1000 are vulnerable to a username enumeration vulnerability. An attacker can obtain valid users based on the response returned for invalid and valid users by sending a POST login request to the /mobilebroker/ServiceToBroker.svc/Json/Connect endpoint. This can lead to user enumeration against the underlying Active Directory integrated systems. Additional Analyst Notes: - CVE Program Container: References: - https
e underlying Active Directory integrated systems. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/InitRoot/CVE-2022-23342 - https://community.hyland.com/login?returnUrl=/connect/hyland-research-and-development/security-advisories/username-enumeration-in-onbase
CVE ID: CVE-2022-23345 State: PUBLISHED Published: 2022-03-21T19:42:29 Last Updated: 2024-08-03T03:36:20.449Z Vendors: n/a Products: n/a Problem Types: n/a Description: BigAnt Software BigAnt Server v5.6.06 was discovered to contain incorrect access control. Additional Analyst Notes: - CVE Program Container: References: - http://bigant.com - https://github.com/bzyo/cve-pocs/tree/master/CVE-2022-23345 - https://www.bigantsoft.com/
CVE ID: CVE-2022-23346 State: PUBLISHED Published: 2022-03-21T19:39:32 Last Updated: 2024-08-03T03:36:20.384Z Vendors: n/a Products: n/a Problem Types: n/a Description: BigAnt Software BigAnt Server v5.6.06 was discovered to contain incorrect access control issues. Additional Analyst Notes: - CVE Program Container: References: - http://bigant.com - https://github.com/bzyo/cve-pocs/tree/master/CVE-2022-23346 - https://www.bigantsoft.com/
CVE ID: CVE-2022-23347 State: PUBLISHED Published: 2022-03-21T19:23:37 Last Updated: 2024-08-03T03:36:20.364Z Vendors: n/a Products: n/a Problem Types: n/a Description: BigAnt Software BigAnt Server v5.6.06 was discovered to be vulnerable to directory traversal attacks. Additional Analyst Notes: - CVE Program Container: References: - http://bigant.com - https://github.com/bzyo/cve-pocs/tree/master/CVE-2022-23347 - https://www.bigantsoft.com/
CVE ID: CVE-2022-23348 State: PUBLISHED Published: 2022-03-21T19:33:00 Last Updated: 2024-08-03T03:36:20.392Z Vendors: n/a Products: n/a Problem Types: n/a Description: BigAnt Software BigAnt Server v5.6.06 was discovered to utilize weak password hashes. Additional Analyst Notes: - CVE Program Container: References: - http://bigant.com - https://github.com/bzyo/cve-pocs/tree/master/CVE-2022-23348 - https://www.bigantsoft.com/
CVE ID: CVE-2022-23349 State: PUBLISHED Published: 2022-03-21T19:26:28 Last Updated: 2024-08-03T03:36:20.411Z Vendors: n/a Products: n/a Problem Types: n/a Description: BigAnt Software BigAnt Server v5.6.06 was discovered to contain a Cross-Site Request Forgery (CSRF). Additional Analyst Notes: - CVE Program Container: References: - http://bigant.com - https://github.com/bzyo/cve-pocs/tree/master/CVE-2022-23349 - https://www.bigantsoft.com/
CVE ID: CVE-2022-23350 State: PUBLISHED Published: 2022-03-21T19:29:34 Last Updated: 2024-08-03T03:36:20.398Z Vendors: n/a Products: n/a Problem Types: n/a Description: BigAnt Software BigAnt Server v5.6.06 was discovered to contain a cross-site scripting (XSS) vulnerability. Additional Analyst Notes: - CVE Program Container: References: - http://bigant.com - https://github.com/bzyo/cve-pocs/tree/master/CVE-2022-23350 - https://www.bigantsoft.com/
CVE ID: CVE-2022-23352 State: PUBLISHED Published: 2022-03-21T19:35:48 Last Updated: 2024-08-03T03:36:20.407Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in BigAnt Software BigAnt Server v5.6.06 can lead to a Denial of Service (DoS). Additional Analyst Notes: - CVE Program Container: References: - http://bigant.com - https://github.com/bzyo/cve-pocs/tree/master/CVE-2022-23352 - https://www.bigantsoft.com/
CVE ID: CVE-2022-23357 State: PUBLISHED Published: 2022-02-03T02:38:41 Last Updated: 2024-08-03T03:36:20.449Z Vendors: n/a Products: n/a Problem Types: n/a Description: mozilo2.0 was discovered to be vulnerable to directory traversal attacks via the parameter curent_dir. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/truonghuuphuc/CVE - https://github.com/truonghuuphuc/CVE/blob/main/CVE-2022-23357.pdf
CVE ID: CVE-2022-23358 State: PUBLISHED Published: 2022-02-16T12:01:24 Last Updated: 2024-08-03T03:36:20.397Z Vendors: n/a Products: n/a Problem Types: n/a Description: EasyCMS v1.6 allows for SQL injection via ArticlemAction.class.php. In the background, search terms provided by the user were not sanitized and were used directly to construct a SQL statement. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jojosec/EasyCMS-s-SQL-injection-new-/blob/main/README.md
CVE ID: CVE-2022-23363 State: PUBLISHED Published: 2022-01-21T22:08:43 Last Updated: 2024-08-03T03:36:20.389Z Vendors: n/a Products: n/a Problem Types: n/a Description: Online Banking System v1.0 was discovered to contain a SQL injection vulnerability via index.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/g33kyrash/Online-Banking-system/issues/15
CVE ID: CVE-2022-23364 State: PUBLISHED Published: 2022-01-21T22:08:44 Last Updated: 2024-08-03T03:36:20.404Z Vendors: n/a Products: n/a Problem Types: n/a Description: HMS v1.0 was discovered to contain a SQL injection vulnerability via adminlogin.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/kabirkhyrul/HMS/discussions/4
CVE ID: CVE-2022-23365 State: PUBLISHED Published: 2022-01-21T22:08:46 Last Updated: 2024-08-03T03:36:20.355Z Vendors: n/a Products: n/a Problem Types: n/a Description: HMS v1.0 was discovered to contain a SQL injection vulnerability via doctorlogin.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/kabirkhyrul/HMS/discussions/4
CVE ID: CVE-2022-23366 State: PUBLISHED Published: 2022-01-21T22:08:47 Last Updated: 2024-08-03T03:36:20.523Z Vendors: n/a Products: n/a Problem Types: n/a Description: HMS v1.0 was discovered to contain a SQL injection vulnerability via patientlogin.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/kabirkhyrul/HMS/discussions/4 - http://packetstormsecurity.com/files/165948/Hospital-Management-Startup-1.0-SQL-Injection.html - https://github.com/nu11secur1ty/CVE-mitre/tree/main/2022/CVE-2022-23366 - https://www.nu11secur1ty.com/2022/02/cve-2022-23366.html
CVE ID: CVE-2022-23367 State: PUBLISHED Published: 2022-02-14T17:45:45 Last Updated: 2024-08-03T03:36:20.426Z Vendors: n/a Products: n/a Problem Types: n/a Description: Fulusso v1.1 was discovered to contain a DOM-based cross-site scripting (XSS) vulnerability in /BindAccount/SuccessTips.js. This vulnerability allows attackers to inject malicious code into a victim user's device via open redirection. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/bincat99/311aff295c270371dc8ee89599b016f1
CVE ID: CVE-2022-23375 State: PUBLISHED Published: 2022-02-19T15:43:09 Last Updated: 2024-08-03T03:36:20.404Z Vendors: n/a Products: n/a Problem Types: n/a Description: WikiDocs version 0.1.18 has an authenticated remote code execution vulnerability. An attacker can upload a malicious file using the image upload form through index.php. Additional Analyst Notes: - CVE Program Container: References: - https://wikidocs.it/ - https://demo.wikidocs.it/ - https://github.com/Zavy86/WikiDocs - https://github.com/Zavy86/WikiDocs/issues/28