deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-2936
Published: 2022-09-06
Description: The Image Hover Effects Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Video Link values that can be added to an Image Hover in versions up to, and including, 9.7.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. By default, the plugin only allows administrators access to edit Image Hovers, however, if a site admin makes the plugin's features available to lower privileged users through the 'Who Can Edit?' setting then this can be exploited by those users.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2669411%40image-hover-effects-ultimate&new=2669411%40image-hover-effects-ultimate&sfp_email=&sfph_mail=; https://www.wordfence.com/vulnerability-advisories/#CVE-2022-2936; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2669411%40image-hover-effects-ultimate&new=2669411%40image-hover-effects-ultimate&sfp_email=&sfph_mail=
CVE: CVE-2022-2939
Published: 2022-09-06
Description: The WP Cerber Security plugin for WordPress is vulnerable to security protection bypass in versions up to, and including 9.0, that makes user enumeration possible. This is due to improper validation on the value supplied through the 'author' parameter found in the ~/cerber-load.php file. In vulnerable versions, the plugin only blocks requests if the value supplied is numeric, making it possible for attackers to supply additional non-numeric characters to bypass the protection. The non-numeric characters are stripped and the user requested is displayed. This can be used by unauthenticated attackers to gather information about users that can targeted in further attacks.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200, CWE-200
References: https://plugins.trac.wordpress.org/changeset/2772930/wp-cerber/trunk/cerber-load.php; https://www.wordfence.com/vulnerability-advisories/#CVE-2022-2939; https://plugins.trac.wordpress.org/changeset/2772930/wp-cerber/trunk/cerber-load.php
CVE: CVE-2022-2941
Published: 2022-09-06
Description: The WP-UserOnline plugin for WordPress has multiple Stored Cross-Site Scripting vulnerabilities in versions up to, and including 2.88.0. This is due to the fact that all fields in the "Naming Conventions" section do not properly sanitize user input, nor escape it on output. This makes it possible for authenticated attackers, with administrative privileges, to inject JavaScript code into the setting that will execute whenever a user accesses the injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-79, CWE-79, CWE-79
References: https://github.com/lesterchan/wp-useronline/commit/59c76b20e4e27489f93dee4ef1254d6204e08b3c; https://packetstormsecurity.com/files/168479/wpuseronline2880-xss.txt; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2770235%40wp-useronline&new=2770235%40wp-useronline&sfp_email=&sfph_mail=
CVE: CVE-2022-2943
Published: 2022-09-06
Description: The WordPress Infinite Scroll – Ajax Load More plugin for Wordpress is vulnerable to arbitrary file reading in versions up to, and including, 5.5.3 due to insufficient file path validation on the alm_repeaters_export() function. This makes it possible for authenticated attackers, with administrative privileges, to download arbitrary files hosted on the server that may contain sensitive content, such as the wp-config.php file.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-22, CWE-22, CWE-22
References: https://gist.github.com/Xib3rR4dAr/f9a4b[PII_REDACTED]ec6cde7d5deb76bf9; https://plugins.svn.wordpress.org/ajax-load-more/tags/5.5.4/README.txt; https://www.wordfence.com/threat-intel/vulnerabilities/id/6d643d07-7533-430b-a1d8-8e66a2a2c5e6?source=cve
CVE: CVE-2022-2945
Published: 2022-09-06
Description: The WordPress Infinite Scroll – Ajax Load More plugin for WordPress is vulnerable to Directory Traversal in versions up to, and including, 5.5.3 via the 'type' parameter found in the alm_get_layout() function. This makes it possible for authenticated attackers, with administrative permissions, to read the contents of arbitrary files on the server, which can contain sensitive information.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://gist.github.com/Xib3rR4dAr/f9a4b[PII_REDACTED]ec6cde7d5deb76bf9; https://plugins.svn.wordpress.org/ajax-load-more/tags/5.5.4/README.txt; https://www.wordfence.com/threat-intel/vulnerabilities/id/8957413c-95e0-49c8-ba8a-02b9b5141e08?source=cve
CVE: CVE-2022-30298
Published: 2022-09-06
Description: An improper privilege management vulnerability [CWE-269] in Fortinet FortiSOAR before 7.2.1 allows a GUI user who has already found a way to modify system files (via another, unrelated and hypothetical exploit) to execute arbitrary Python commands as root.
CVSS Score: 7.0 (HIGH)
CWE: CWE-269
References: https://fortiguard.com/psirt/FG-IR-22-152; https://fortiguard.com/psirt/FG-IR-22-152
CVE: CVE-2022-31790
Published: 2022-09-06
Description: WatchGuard Firebox and XTM appliances allow an unauthenticated remote attacker to retrieve sensitive authentication server settings by sending a malicious request to exposed authentication endpoints. This is fixed in Fireware OS 12.8.1, 12.5.10, and 12.1.4.
CVSS Score: 7.5 (HIGH)
References: https://www.ambionics.io/blog/hacking-watchguard-firewalls; https://www.openwall.com/lists/oss-security/2022/08/30/2; https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2022-00017
CVE: CVE-2022-31860
Published: 2022-09-06
Description: An issue was discovered in OpenRemote through 1.0.4 allows attackers to execute arbitrary code via a crafted Groovy rule.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://github.com/openremote/openremote/; https://securityblog101.blogspot.com/2022/09/cve-2022-31860.html; https://stackoverflow.com/questions/159148/groovy-executing-shell-commands
CVE: CVE-2022-32264
Published: 2022-09-06
Description: sys/netinet/tcp_timer.h in FreeBSD before 7.0 contains a denial-of-service (DoS) vulnerability due to improper handling of TSopt on TCP connections. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
CVSS Score: 7.5 (HIGH)
CWE: CWE-755, CWE-755
References: http://jvn.jp/en/jp/JVN20930118/; https://cgit.freebsd.org/src/commit/?id=4dc630cdd2f7a790604d2724ecb19c6aa95130a7; http://jvn.jp/en/jp/JVN20930118/
CVE: CVE-2022-33177
Published: 2022-09-06
Description: Cross-Site Request Forgery (CSRF) vulnerability in WPdevelop/Oplugins Booking Calendar plugin <= 9.2.1 at WordPress leading to Translations Update.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/booking/wordpress-booking-calendar-plugin-9-2-1-cross-site-request-forgery-csrf-leading-to-translations-update/_s_id=cve; https://wordpress.org/plugins/booking/#developers; https://patchstack.com/database/vulnerability/booking/wordpress-booking-calendar-plugin-9-2-1-cross-site-request-forgery-csrf-leading-to-translations-update/_s_id=cve
CVE: CVE-2022-34656
Published: 2022-09-06
Description: Authenticated (admin+) Cross-Site Scripting (XSS) vulnerability in wpdevart Poll, Survey, Questionnaire and Voting system plugin <= 1.7.4 at WordPress.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/polls-widget/wordpress-poll-survey-questionnaire-and-voting-system-plugin-1-7-4-authenticated-cross-site-scripting-xss-vulnerability/_s_id=cve; https://wordpress.org/plugins/polls-widget/; https://patchstack.com/database/vulnerability/polls-widget/wordpress-poll-survey-questionnaire-and-voting-system-plugin-1-7-4-authenticated-cross-site-scripting-xss-vulnerability/_s_id=cve
CVE: CVE-2022-34867
Published: 2022-09-06
Description: Unauthenticated Sensitive Information Disclosure vulnerability in WP Libre Form 2 plugin <= 2.0.8 at WordPress allows attackers to list and delete submissions. Affects only versions from 2.0.0 to 2.0.8.
CVSS Score: 7.3 (HIGH)
CWE: CWE-200, CWE-668
References: https://github.com/libreform/libreform/pull/54/files; https://patchstack.com/database/vulnerability/libreform/wordpress-wp-libre-form-2-plugin-2-0-8-unauthenticated-sensitive-information-disclosure-vulnerability; https://github.com/libreform/libreform/pull/54/files
CVE: CVE-2022-35847
Published: 2022-09-06
Description: An improper neutralization of special elements used in a template engine vulnerability [CWE-1336] in FortiSOAR management interface 7.2.0, 7.0.0 through 7.0.3, 6.4.0 through 6.4.4 may allow a remote and authenticated attacker to execute arbitrary code via a crafted payload.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-94
References: https://fortiguard.com/psirt/FG-IR-22-306; https://fortiguard.com/psirt/FG-IR-22-306
CVE: CVE-2022-35931
Published: 2022-09-06
Description: Nextcloud Password Policy is an app that enables a Nextcloud server admin to define certain rules for passwords. Prior to versions 22.2.10, 23.0.7, and 24.0.3 the random password generator may, in very rare cases, generate common passwords that the validator itself would block. Upgrade Nextcloud Server to 22.2.10, 23.0.7 or 24.0.3 to receive a patch for the issue in Password Policy. There are no known workarounds available.
CVSS Score: 2.7 (LOW)
CWE: CWE-261, CWE-326
References: https://github.com/nextcloud/password_policy/pull/363; https://github.com/nextcloud/security-advisories/security/advisories/GHSA-c7mw-9q4r-8qwr; https://github.com/nextcloud/password_policy/pull/363
CVE: CVE-2022-36425
Published: 2022-09-06
Description: Broken Access Control vulnerability in Beaver Builder plugin <= 2.5.4.3 at WordPress.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-264
References: https://patchstack.com/database/vulnerability/beaver-builder-lite-version/wordpress-beaver-builder-plugin-2-5-4-3-broken-access-control-vulnerability/_s_id=cve; https://wordpress.org/plugins/beaver-builder-lite-version/#developers; https://patchstack.com/database/vulnerability/beaver-builder-lite-version/wordpress-beaver-builder-plugin-2-5-4-3-broken-access-control-vulnerability/_s_id=cve
CVE: CVE-2022-38131
Published: 2022-09-06
Description: RStudio Connect prior to 2023.01.0 is affected by an Open Redirect issue. The vulnerability could allow an attacker to redirect users to malicious websites.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://support.posit.co/hc/en-us/articles/[PII_REDACTED]023; https://tenable.com/security/research/tra-2022-30; https://support.posit.co/hc/en-us/articles/[PII_REDACTED]023
CVE: CVE-2022-38289
Published: 2022-09-06
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2022-3026
Published: 2022-09-06
Description: The WP Users Exporter plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 1.4.2 via the 'Export Users' functionality. This makes it possible for authenticated attackers, such as a subscriber, to add untrusted input into profile information like First Names that will embed into the exported CSV file triggered by an administrator and can result in code execution when these files are downloaded and opened on a local system with a vulnerable configuration.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-1236, CWE-1236
References: https://plugins.trac.wordpress.org/browser/wp-users-exporter/trunk/A_UserExporter.class.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/7da1d7cf-e8b5-4b7c-bdc1-13ef8c11b663?source=cve; https://www.wordfence.com/vulnerability-advisories/#CVE-2022-3026
CVE: CVE-2020-21516
Published: 2022-09-06
Description: There is an arbitrary file upload vulnerability in FeehiCMS 2.0.8 at the head image upload, that allows attackers to execute relevant PHP code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://github.com/liufee/cms/issues/46; https://github.com/liufee/cms/issues/46
CVE: CVE-2022-31789
Published: 2022-09-06
Description: An integer overflow in WatchGuard Firebox and XTM appliances allows an unauthenticated remote attacker to trigger a buffer overflow and potentially execute arbitrary code by sending a malicious request to exposed management ports. This is fixed in Fireware OS 12.8.1, 12.5.10, and 12.1.4.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190
References: https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2022-00015; https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2022-00015
CVE: CVE-2022-31791
Published: 2022-09-06
Description: WatchGuard Firebox and XTM appliances allow a local attacker (that has already obtained shell access) to elevate their privileges and execute code with root permissions. This is fixed in Fireware OS 12.8.1, 12.5.10, and 12.1.4.
CVSS Score: 7.8 (HIGH)
References: https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2022-00018; https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2022-00018
CVE: CVE-2022-31792
Published: 2022-09-06
Description: A stored cross-site scripting (XSS) vulnerability exists in the management web interface of WatchGuard Firebox and XTM appliances. A remote attacker can potentially execute arbitrary JavaScript code in the management web interface by sending crafted requests to exposed management ports. This is fixed in Fireware OS 12.8.1, 12.5.10, and 12.1.4.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2022-00014; https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2022-00014
CVE: CVE-2022-36032
Published: 2022-09-06
Description: ReactPHP HTTP is a streaming HTTP client and server implementation for ReactPHP. In ReactPHP's HTTP server component versions starting with 0.7.0 and prior to 1.7.0, when ReactPHP is processing incoming HTTP cookie values, the cookie names are url-decoded. This may lead to cookies with prefixes like `__Host-` and `__Secure-` confused with cookies that decode to such prefix, thus leading to an attacker being able to forge cookie which is supposed to be secure. This issue is fixed in ReactPHP HTTP version 1.7.0. As a workaround, Infrastructure or DevOps can place a reverse proxy in front of the ReactPHP HTTP server to filter out any unexpected `Cookie` request headers.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20, CWE-565
References: https://github.com/reactphp/http/commit/663c9a3b77b71463fa7fcb76a6676ffd16979dd6; https://github.com/reactphp/http/pull/175; https://github.com/reactphp/http/releases/tag/v1.7.0
CVE: CVE-2022-36038
Published: 2022-09-06
Description: CircuitVerse is an open-source platform which allows users to construct digital logic circuits online. A remote code execution (RCE) vulnerability in CircuitVerse allows authenticated attackers to execute arbitrary code via specially crafted JSON payloads. This issue may lead to Remote Code Execution (RCE). A patch is available in commit number 7b3023a99499a7675f10f2c1d9effdf10c35fb6e. There are currently no known workarounds.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502
References: https://github.com/CircuitVerse/CircuitVerse/commit/7b3023a99499a7675f10f2c1d9effdf10c35fb6e; https://github.com/CircuitVerse/CircuitVerse/security/advisories/GHSA-8c8q-4h7g-4rp3; https://github.com/CircuitVerse/CircuitVerse/commit/7b3023a99499a7675f10f2c1d9effdf10c35fb6e
CVE: CVE-2022-36039
Published: 2022-09-06
Description: Rizin is a UNIX-like reverse engineering framework and command-line toolset. Versions 0.4.0 and prior are vulnerable to out-of-bounds write when parsing DEX files. A user opening a malicious DEX file could be affected by this vulnerability, allowing an attacker to execute code on the user's machine. A patch is available on the `dev` branch of the repository.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/rizinorg/rizin/commit/1524f85211445e41506f98180f8f69f7bf115406; https://github.com/rizinorg/rizin/issues/2969; https://github.com/rizinorg/rizin/security/advisories/GHSA-pr85-hv85-45pg
CVE: CVE-2022-36042
Published: 2022-09-06
Description: Rizin is a UNIX-like reverse engineering framework and command-line toolset. Versions 0.4.0 and prior are vulnerable to an out-of-bounds write when getting data from dyld cache files. A user opening a malicious dyld cache file could be affected by this vulnerability, allowing an attacker to execute code on the user's machine. Commit number 556ca2f9eef01ec0f4a76d1fbacfcf3a87a44810 contains a patch.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/rizinorg/rizin/commit/556ca2f9eef01ec0f4a76d1fbacfcf3a87a44810; https://github.com/rizinorg/rizin/security/advisories/GHSA-pf72-jg54-8gvp; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WQZLMHEI5D7EJASA5UW6XN4ODHLRHK6N/
CVE: CVE-2022-36670
Published: 2022-09-06
Description: PCProtect Endpoint prior to v5.17.470 for Microsoft Windows lacks tamper protection, allowing authenticated attackers with Administrator privileges to modify processes within the application and escalate privileges to SYSTEM via a crafted executable.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-732
References: https://mrvar0x.com/2022/07/21/pcprotect-endpoint-tampering-exploit/; https://mrvar0x.com/2022/07/21/pcprotect-endpoint-tampering-exploit/
CVE: CVE-2022-37771
Published: 2022-09-06
Description: IObit Malware Fighter v9.2 for Microsoft Windows lacks tamper protection, allowing authenticated attackers with Administrator privileges to modify processes within the application and escalate privileges to SYSTEM via a crafted executable.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-732
References: https://mrvar0x.com/2022/08/02/multiple-endpoints-security-tampering-exploit/; https://packetstormsecurity.com/files/167913/IObit-Malware-Fighter-9.2-Tampering-Privilege-Escalation.html; https://mrvar0x.com/2022/08/02/multiple-endpoints-security-tampering-exploit/
CVE: CVE-2022-32277
Published: 2022-09-06
Description: Squiz Matrix CMS 6.20 is vulnerable to an Insecure Direct Object Reference caused by failure to correctly validate authorization when submitting a request to change a user's contact details. NOTE: this is disputed by both the vendor and the original discoverer because it is a site-specific finding, not a finding about the Squiz Matrix CMS product.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-639
References: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/; https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/squiz-matrix-cms-authenticated-privilege-escalation-through-idor/; https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/
CVE: CVE-2022-36040
Published: 2022-09-06
Description: Rizin is a UNIX-like reverse engineering framework and command-line toolset. Versions 0.4.0 and prior are vulnerable to an out-of-bounds write when getting data from PYC(python) files. A user opening a malicious PYC file could be affected by this vulnerability, allowing an attacker to execute code on the user's machine. Commit number[PII_REDACTED]3a12786704e54227b8b2f918c2fd27 contains a patch.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/rizinorg/rizin/commit/[PII_REDACTED]3a12786704e54227b8b2f918c2fd27; https://github.com/rizinorg/rizin/issues/2963; https://github.com/rizinorg/rizin/security/advisories/GHSA-h897-rhm9-rpmw
CVE: CVE-2022-36041
Published: 2022-09-06
Description: Rizin is a UNIX-like reverse engineering framework and command-line toolset. Versions 0.4.0 and prior are vulnerable to an out-of-bounds write when parsing Mach-O files. A user opening a malicious Mach-O file could be affected by this vulnerability, allowing an attacker to execute code on the user's machine. Commit number 7323e64d68ecccfb0ed3ee480f704384c38676b2 contains a patch.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://github.com/rizinorg/rizin/commit/7323e64d68ecccfb0ed3ee480f704384c38676b2; https://github.com/rizinorg/rizin/issues/2956; https://github.com/rizinorg/rizin/security/advisories/GHSA-2c7m-2f37-mr5m
CVE: CVE-2022-36043
Published: 2022-09-06
Description: Rizin is a UNIX-like reverse engineering framework and command-line toolset. Versions 0.4.0 and prior are vulnerable to a double free in bobj.c:rz_bin_reloc_storage_free() when freeing relocations generated from qnx binary plugin. A user opening a malicious qnx binary could be affected by this vulnerability, allowing an attacker to execute code on the user's machine. Commit number a3d50c1ea185f3f642f2d8180715f82d98840784 contains a patch for this issue.
CVSS Score: 7.8 (HIGH)
CWE: CWE-415, CWE-415
References: https://github.com/rizinorg/rizin/commit/a3d50c1ea185f3f642f2d8180715f82d98840784; https://github.com/rizinorg/rizin/issues/2964; https://github.com/rizinorg/rizin/security/advisories/GHSA-rjhv-mj4g-j4p5
CVE: CVE-2022-36044
Published: 2022-09-06
Description: Rizin is a UNIX-like reverse engineering framework and command-line toolset. Versions 0.4.0 and prior are vulnerable to an out-of-bounds write when getting data from Luac files. A user opening a malicious Luac file could be affected by this vulnerability, allowing an attacker to execute code on the user's machine. Commits 07b43bc8aa1ffebd9b68d60624c9610cf7e460c7 and 05bbd147caccc60162d6fba9baaaf24befa281cd contain fixes for the issue.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/rizinorg/rizin/commit/05bbd147caccc60162d6fba9baaaf24befa281cd; https://github.com/rizinorg/rizin/commit/07b43bc8aa1ffebd9b68d60624c9610cf7e460c7; https://github.com/rizinorg/rizin/security/advisories/GHSA-mqcj-82c6-gh5q
CVE: CVE-2022-36057
Published: 2022-09-06
Description: Discourse-Chat is an asynchronous messaging plugin for the Discourse open-source discussion platform. Users of Discourse Chat can be affected by admin users inserting HTML into chat titles and descriptions, causing a Cross-Site Scripting (XSS) attack. Version 0.9 contains a patch for this issue.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-80
References: https://github.com/discourse/discourse-chat/pull/1205; https://github.com/discourse/discourse-chat/security/advisories/GHSA-3vf2-wrjx-p6xj; https://github.com/discourse/discourse-chat/pull/1205
CVE: CVE-2022-36058
Published: 2022-09-06
Description: Elrond go is the go implementation for the Elrond Network protocol. In versions prior to 1.3.34, anyone who uses elrond-go to process blocks (historical or actual) could encounter a `MultiESDTNFTTransfer` transaction like this: `MultiESDTNFTTransfer` with a missing function name. Basic functionality like p2p messaging, storage, API requests and such are unaffected. Version 1.3.34 contains a fix for this issue. There are no known workarounds.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://github.com/ElrondNetwork/elrond-go/blob/8e402fa6d7e91e779980122d3798b2bf50892945/integrationTests/vm/txsFee/asyncESDT_test.go#L402; https://github.com/ElrondNetwork/elrond-go/commit/cb487fd7be2a2077638eb34ae771a73630c870c7; https://github.com/ElrondNetwork/elrond-go/security/advisories/GHSA-qf7j-25g9-r63f
CVE: CVE-2022-36757
Published: 2022-09-06
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2022-37185
Published: 2022-09-06
Description: SQL injection vulnerability exists in the school information query interface (repschoolproj.php) of the EMS 6.2 system of the Office of the Thai Basic Education Commission, which can lead to data leakage.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://eme1.obec.go.th; http://eme1.obec.go.th/~eme62/repschoolproj.php?claster=school&idarea=648; https://github.com/00xdF/emes/blob/main/readme.md