deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-9420
Published: 2022-12-14
Description: The login password of the web administrative dashboard in Arcadyan Wifi routers VRV9506JAC23 is sent in cleartext, allowing an attacker to sniff and intercept traffic to learn the administrative credentials to the router.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-319, CWE-319
References: https://gist.github.com/AsherDLL/03d0762b5a535e300f1121caebe333ce; https://gist.github.com/AsherDLL/03d0762b5a535e300f1121caebe333ce
CVE: CVE-2022-24377
Published: 2022-12-14
Description: The package cycle-import-check before 1.3.2 are vulnerable to Command Injection via the writeFileToTmpDirAndOpenIt function due to improper user-input sanitization.
CVSS Score: 7.4 (HIGH)
CWE: CWE-78, CWE-78
References: https://github.com/Soontao/cycle-import-check/commit/1ca97b59df7e9c704471fcb4cf042ce76d7c9890; https://security.snyk.io/vuln/SNYK-JS-CYCLEIMPORTCHECK-3157955; https://github.com/Soontao/cycle-import-check/commit/1ca97b59df7e9c704471fcb4cf042ce76d7c9890
CVE: CVE-2022-4436
Published: 2022-12-14
Description: Use after free in Blink Media in Google Chrome prior to 108.0.5359.124 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2022/12/stable-channel-update-for-desktop_13.html; https://crbug.com/1383991; https://security.gentoo.org/glsa/202305-10
CVE: CVE-2022-4437
Published: 2022-12-14
Description: Use after free in Mojo IPC in Google Chrome prior to 108.0.5359.124 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2022/12/stable-channel-update-for-desktop_13.html; https://crbug.com/1394692; https://security.gentoo.org/glsa/202305-10
CVE: CVE-2022-4438
Published: 2022-12-14
Description: Use after free in Blink Frames in Google Chrome prior to 108.0.5359.124 allowed a remote attacker who convinced the user to engage in specific UI interactions to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2022/12/stable-channel-update-for-desktop_13.html; https://crbug.com/1381871; https://security.gentoo.org/glsa/202305-10
CVE: CVE-2022-4439
Published: 2022-12-14
Description: Use after free in Aura in Google Chrome on Windows prior to 108.0.5359.124 allowed a remote attacker who convinced the user to engage in specific UI interactions to potentially exploit heap corruption via specific UI interactions. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2022/12/stable-channel-update-for-desktop_13.html; https://crbug.com/1392661; https://security.gentoo.org/glsa/202305-10
CVE: CVE-2022-4440
Published: 2022-12-14
Description: Use after free in Profiles in Google Chrome prior to 108.0.5359.124 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2022/12/stable-channel-update-for-desktop_13.html; https://crbug.com/1382761; https://security.gentoo.org/glsa/202305-10
CVE: CVE-2022-23500
Published: 2022-12-14
Description: TYPO3 is an open source PHP based web content management system. In versions prior to 9.5.38, 10.4.33, 11.5.20, and 12.1.1, requesting invalid or non-existing resources via HTTP triggers the page error handler, which again could retrieve content to be shown as an error message from another page. This leads to a scenario in which the application is calling itself recursively - amplifying the impact of the initial attack until the limits of the web server are exceeded. This vulnerability is very similar, but not identical, to the one described in CVE-2021-21359. This issue is patched in versions 9.5.38 ELTS, 10.4.33, 11.5.20 or 12.1.1.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-674
References: https://github.com/TYPO3/typo3/security/advisories/GHSA-8c28-5mp7-v24h; https://github.com/TYPO3/typo3/security/advisories/GHSA-8c28-5mp7-v24h
CVE: CVE-2022-23501
Published: 2022-12-14
Description: TYPO3 is an open source PHP based web content management system. In versions prior to 8.7.49, 9.5.38, 10.4.33, 11.5.20, and 12.1.1 TYPO3 is vulnerable to Improper Authentication. Restricting frontend login to specific users, organized in different storage folders (partitions), can be bypassed. A potential attacker might use this ambiguity in usernames to get access to a different account - however, credentials must be known to the adversary.  This issue is patched in versions 8.7.49 ELTS, 9.5.38 ELTS, 10.4.33, 11.5.20, 12.1.1.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-287
References: https://github.com/TYPO3/typo3/security/advisories/GHSA-jfp7-79g7-89rf; https://github.com/TYPO3/typo3/security/advisories/GHSA-jfp7-79g7-89rf
CVE: CVE-2022-23502
Published: 2022-12-14
Description: TYPO3 is an open source PHP based web content management system. In versions prior to 10.4.33, 11.5.20, and 12.1.1, When users reset their password using the corresponding password recovery functionality, existing sessions for that particular user account were not revoked. This applied to both frontend user sessions and backend user sessions. This issue is patched in versions 10.4.33, 11.5.20, 12.1.1.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-613
References: https://github.com/TYPO3/typo3/security/advisories/GHSA-mgj2-q8wp-29rr; https://github.com/TYPO3/typo3/security/advisories/GHSA-mgj2-q8wp-29rr
CVE: CVE-2022-23503
Published: 2022-12-14
Description: TYPO3 is an open source PHP based web content management system. Versions prior to 8.7.49, 9.5.38, 10.4.33, 11.5.20, and 12.1.1 are vulnerable to Code Injection. Due to the lack of separating user-submitted data from the internal configuration in the Form Designer backend module, it is possible to inject code instructions to be processed and executed via TypoScript as PHP code. The existence of individual TypoScript instructions for a particular form item and a valid backend user account with access to the form module are needed to exploit this vulnerability. This issue is patched in versions 8.7.49 ELTS, 9.5.38 ELTS, 10.4.33, 11.5.20, 12.1.1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: https://github.com/TYPO3/typo3/security/advisories/GHSA-c5wx-6c2c-f7rm; https://github.com/TYPO3/typo3/security/advisories/GHSA-c5wx-6c2c-f7rm
CVE: CVE-2022-23504
Published: 2022-12-14
Description: TYPO3 is an open source PHP based web content management system. Versions prior to 9.5.38, 10.4.33, 11.5.20, and 12.1.1 are subject to Sensitive Information Disclosure. Due to the lack of handling user-submitted YAML placeholder expressions in the site configuration backend module, attackers could expose sensitive internal information, such as system configuration or HTTP request messages of other website visitors. A valid backend user account having administrator privileges is needed to exploit this vulnerability. This issue has been patched in versions 9.5.38 ELTS, 10.4.33, 11.5.20, 12.1.1.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-200, CWE-917, CWE-917
References: https://github.com/TYPO3/typo3/security/advisories/GHSA-8w3p-qh3x-6gjr; https://github.com/TYPO3/typo3/security/advisories/GHSA-8w3p-qh3x-6gjr
CVE: CVE-2022-34271
Published: 2022-12-14
Description: A vulnerability in import module of Apache Atlas allows an authenticated user to write to web server filesystem.  This issue affects Apache Atlas versions from 0.8.4 to 2.2.0.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22, CWE-22
References: https://lists.apache.org/thread/0rqvcxo6brmos9w3lzfsdn2lsmlblpw3; https://lists.apache.org/thread/0rqvcxo6brmos9w3lzfsdn2lsmlblpw3
CVE: CVE-2022-3073
Published: 2022-12-14
Description: Quanos "SCHEMA ST4" example web templates in version Bootstrap 2019 v2/2021 v1/2022 v1/2022 SP1 v1 or below are prone to JavaScript injection allowing a remote attacker to hijack existing sessions to e.g. other web services in the same environment or execute scripts in the users browser environment. The affected script is '*-schema.js'.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://cert.vde.com/de/advisories/VDE-2022-056/; https://cert.vde.com/de/advisories/VDE-2022-056/
CVE: CVE-2022-3590
Published: 2022-12-14
Description: WordPress is affected by an unauthenticated blind SSRF in the pingback feature. Because of a TOCTOU race condition between the validation checks and the HTTP request, attackers can reach internal hosts that are explicitly forbidden.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-367
References: https://blog.sonarsource.com/wordpress-core-unauthenticated-blind-ssrf/; https://wpscan.com/vulnerability/c8814e6e-78b3-4f63-a1d3-6906a84c1f11; https://blog.sonarsource.com/wordpress-core-unauthenticated-blind-ssrf/
CVE: CVE-2022-4493
Published: 2022-12-14
Description: A vulnerability classified as critical was found in scifio. Affected by this vulnerability is the function downloadAndUnpackResource of the file src/test/java/io/scif/util/DefaultSampleFilesService.java of the component ZIP File Handler. The manipulation leads to path traversal. The attack can be launched remotely. The name of the patch is fcb0dbca0ec72b22fe0c9ddc8abc9cb188a0ff31. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-215803.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-22
References: https://github.com/scifio/scifio/commit/fcb0dbca0ec72b22fe0c9ddc8abc9cb188a0ff31; https://vuldb.com/?id.215803; https://github.com/scifio/scifio/commit/fcb0dbca0ec72b22fe0c9ddc8abc9cb188a0ff31
CVE: CVE-2022-4494
Published: 2022-12-14
Description: A vulnerability, which was classified as critical, has been found in bspkrs MCPMappingViewer. Affected by this issue is the function extractZip of the file src/main/java/bspkrs/mmv/RemoteZipHandler.java of the component ZIP File Handler. The manipulation leads to path traversal. The attack may be launched remotely. The name of the patch is 6e602746c96b4756c271d080dae7d22ad804a1bd. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-215804.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-22
References: https://github.com/bspkrs/MCPMappingViewer/commit/6e602746c96b4756c271d080dae7d22ad804a1bd; https://vuldb.com/?id.215804; https://github.com/bspkrs/MCPMappingViewer/commit/6e602746c96b4756c271d080dae7d22ad804a1bd
CVE: CVE-2022-23512
Published: 2022-12-14
Description: MeterSphere is a one-stop open source continuous testing platform. Versions prior to 2.4.1 are vulnerable to Path Injection in ApiTestCaseService::deleteBodyFiles which takes a user-controlled string id and passes it to ApiTestCaseService, which uses the user-provided value (testId) in new File(BODY_FILE_DIR + "/" + testId), being deleted later by file.delete(). By adding some camouflage parameters to the url, an attacker can target files on the server. The vulnerability has been fixed in v2.4.1.
CVSS Score: 7.7 (HIGH)
CWE: CWE-22
References: https://github.com/metersphere/metersphere/security/advisories/GHSA-5mwp-xw7p-5j27; https://github.com/metersphere/metersphere/security/advisories/GHSA-5mwp-xw7p-5j27
CVE: CVE-2022-23514
Published: 2022-12-14
Description: Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Loofah < 2.19.1 contains an inefficient regular expression that is susceptible to excessive backtracking when attempting to sanitize certain SVG attributes. This may lead to a denial of service through CPU resource consumption. This issue is patched in version 2.19.1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1333
References: https://github.com/flavorjones/loofah/security/advisories/GHSA-486f-hjj9-9vhh; https://hackerone.com/reports/1684163; https://lists.debian.org/debian-lts-announce/2023/09/msg00011.html
CVE: CVE-2022-23515
Published: 2022-12-14
Description: Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Loofah >= 2.1.0, < 2.19.1 is vulnerable to cross-site scripting via the image/svg+xml media type in data URIs. This issue is patched in version 2.19.1.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/flavorjones/loofah/issues/101; https://github.com/flavorjones/loofah/security/advisories/GHSA-228g-948r-83gx; https://hackerone.com/reports/1694173
CVE: CVE-2022-23516
Published: 2022-12-14
Description: Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Loofah >= 2.2.0, < 2.19.1 uses recursion for sanitizing CDATA sections, making it susceptible to stack exhaustion and raising a SystemStackError exception.  This may lead to a denial of service through CPU resource consumption. This issue is patched in version 2.19.1. Users who are unable to upgrade may be able to mitigate this vulnerability by limiting the length of the strings that are sanitized.
CVSS Score: 7.5 (HIGH)
CWE: CWE-674
References: https://github.com/flavorjones/loofah/security/advisories/GHSA-3x8r-x6xp-q4vm; https://lists.debian.org/debian-lts-announce/2023/09/msg00011.html; https://github.com/flavorjones/loofah/security/advisories/GHSA-3x8r-x6xp-q4vm
CVE: CVE-2022-31358
Published: 2022-12-14
Description: A reflected cross-site scripting (XSS) vulnerability in Proxmox Virtual Environment prior to v7.2-3 allows remote attackers to execute arbitrary web scripts or HTML via non-existent endpoints under path /api2/html/.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-79, CWE-79
References: http://proxmox.com; https://git.proxmox.com/?p=pve-http-server.git%3Ba=commitdiff%3Bh=00661f1223b7c0afffa64e1d91f5e018b985f762; https://starlabs.sg/blog/2022/12-multiple-vulnerabilites-in-proxmox-ve--proxmox-mail-gateway/
CVE: CVE-2022-44832
Published: 2022-12-14
Description: D-Link DIR-3040 device with firmware 120B03 was discovered to contain a command injection vulnerability via the SetTriggerLEDBlink function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-77
References: https://github.com/flamingo1616/iot_vuln/blob/main/D-Link/DIR-3040/6.md; https://www.dlink.com/en/security-bulletin/; https://github.com/flamingo1616/iot_vuln/blob/main/D-Link/DIR-3040/6.md
CVE: CVE-2022-44898
Published: 2022-12-14
Description: The MsIo64.sys component in Asus Aura Sync through v1.07.79 does not properly validate input to IOCTL 0x80102040, 0x80102044, 0x80102050, and 0x80102054, allowing attackers to trigger a memory corruption and cause a Denial of Service (DoS) or escalate privileges via crafted IOCTL requests.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: http://packetstormsecurity.com/files/174447/MsIo64-LOLDriver-Memory-Corruption.html; https://heegong.github.io/posts/ASUS-AuraSync-Kernel-Stack-Based-Buffer-Overflow-Local-Privilege-Escalation/; https://www.asus.com/campaign/aura/us/download.php
CVE: CVE-2022-46609
Published: 2022-12-14
Description: Python3-RESTfulAPI commit d9907f14e9e25dcdb54f5b22252b0e9452e3970e and e772e0beee284c50946e94c54a1d43071ca78b74 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well as escalate privileges.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/herry-zhang/Python3-RESTfulAPI/; https://github.com/herry-zhang/Python3-RESTfulAPI/blob/1c2081dca357685b3180b9baeb7e761e9a10ca99/SECURITY.md; https://github.com/herry-zhang/Python3-RESTfulAPI/commit/1c2081dca357685b3180b9baeb7e761e9a10ca99
CVE: CVE-2022-46996
Published: 2022-12-14
Description: vSphere_selfuse commit 2a9fe074a64f6a0dd8ac02f21e2f10d66cac5749 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well as escalate privileges.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-912
References: https://github.com/SHenry07/vSphere_selfuse/; https://github.com/SHenry07/vSphere_selfuse/issues/39; https://mirrors.neusoft.edu.cn/pypi/web/simple/request/
CVE: CVE-2022-46997
Published: 2022-12-14
Description: Passhunt commit 54eb987d30ead2b8ebbf1f0b880aa[PII_REDACTED] was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well as escalate privileges.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-912
References: https://github.com/Viralmaniar/Passhunt/; https://github.com/Viralmaniar/Passhunt/issues/14; https://mirrors.neusoft.edu.cn/pypi/web/simple/request/
CVE: CVE-2022-4495
Published: 2022-12-14
Description: A vulnerability, which was classified as problematic, has been found in collective.dms.basecontent up to 1.6. This issue affects the function renderCell of the file src/collective/dms/basecontent/browser/column.py. The manipulation leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 1.7 is able to address this issue. The name of the patch is 6c4d616fcc771822a14ebae5e23f3f6d96d134bd. It is recommended to upgrade the affected component. The identifier VDB-215813 was assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-79
References: https://github.com/collective/collective.dms.basecontent/commit/6c4d616fcc771822a14ebae5e23f3f6d96d134bd; https://github.com/collective/collective.dms.basecontent/releases/tag/1.7; https://vuldb.com/?id.215813
CVE: CVE-2022-23517
Published: 2022-12-14
Description: rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Certain configurations of rails-html-sanitizer < 1.4.4 use an inefficient regular expression that is susceptible to excessive backtracking when attempting to sanitize certain SVG attributes. This may lead to a denial of service through CPU resource consumption. This issue has been patched in version 1.4.4.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1333
References: https://github.com/rails/rails-html-sanitizer/commit/56c61c0cebd1e493e8ad7bca2a0191609a4a6979; https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-5x79-w82f-gw8w; https://hackerone.com/reports/1684163
CVE: CVE-2022-23518
Published: 2022-12-14
Description: rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Versions >= 1.0.3, < 1.4.4 are vulnerable to cross-site scripting via data URIs when used in combination with Loofah >= 2.1.0. This issue is patched in version 1.4.4.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/rails/rails-html-sanitizer/issues/135; https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-mcvf-2q2m-x72m; https://hackerone.com/reports/1694173
CVE: CVE-2022-23519
Published: 2022-12-14
Description: rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Prior to version 1.4.4, a possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer may allow an attacker to inject content if the application developer has overridden the sanitizer's allowed tags in either of the following ways: allow both "math" and "style" elements,  or allow both "svg" and "style" elements. Code is only impacted if allowed tags are being overridden. . This issue is fixed in version 1.4.4. All users overriding the allowed tags to include "math" or "svg" and "style" should either upgrade or use the following workaround immediately: Remove "style" from the overridden allowed tags, or remove "math" and "svg" from the overridden allowed tags.
CVSS Score: 7.2 (HIGH)
CWE: CWE-79, CWE-79
References: https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-9h9g-93gc-623h; https://hackerone.com/reports/1656627; https://lists.debian.org/debian-lts-announce/2023/09/msg00012.html
CVE: CVE-2022-46073
Published: 2022-12-14
Description: Helmet Store Showroom 1.0 is vulnerable to Cross Site Scripting (XSS).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.youtube.com/watch?v=jT09Uiwl0Jo&ab_channel=IkariShinji; https://yuyudhn.github.io/CVE-2022-46073/; https://www.youtube.com/watch?v=jT09Uiwl0Jo&ab_channel=IkariShinji
CVE: CVE-2022-46074
Published: 2022-12-14
Description: Helmet Store Showroom 1.0 is vulnerable to Cross Site Request Forgery (CSRF). An unauthenticated user can add an admin account due to missing CSRF protection.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://www.youtube.com/watch?v=5Q3vyTo02bc&ab_channel=IkariShinji; https://yuyudhn.github.io/CVE-2022-46074/; https://www.youtube.com/watch?v=5Q3vyTo02bc&ab_channel=IkariShinji
CVE: CVE-2022-46117
Published: 2022-12-14
Description: Helmet Store Showroom Site v1.0 is vulnerable to SQL Injection via /hss/?page=view_product&id=.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/HMHYHM/bug_report/blob/main/vendors/oretnom23/helmet-store-showroom-site/SQLi-1.md; https://github.com/HMHYHM/bug_report/blob/main/vendors/oretnom23/helmet-store-showroom-site/SQLi-1.md
CVE: CVE-2022-46118
Published: 2022-12-14
Description: Helmet Store Showroom Site v1.0 is vulnerable to SQL Injection via /hss/?page=product_per_brand&bid=.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/HMHYHM/bug_report/blob/main/vendors/oretnom23/helmet-store-showroom-site/SQLi-2.md; https://github.com/HMHYHM/bug_report/blob/main/vendors/oretnom23/helmet-store-showroom-site/SQLi-2.md
CVE: CVE-2022-46119
Published: 2022-12-14
Description: Helmet Store Showroom Site v1.0 is vulnerable to SQL Injection via /hss/?page=categories&c=.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/HMHYHM/bug_report/blob/main/vendors/oretnom23/helmet-store-showroom-site/SQLi-3.md; https://github.com/HMHYHM/bug_report/blob/main/vendors/oretnom23/helmet-store-showroom-site/SQLi-3.md
CVE: CVE-2022-46120
Published: 2022-12-14
Description: Helmet Store Showroom Site v1.0 is vulnerable to SQL Injection via /hss/admin/?page=products/view_product&id=.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/HMHYHM/bug_report/blob/main/vendors/oretnom23/helmet-store-showroom-site/SQLi-4.md; https://github.com/HMHYHM/bug_report/blob/main/vendors/oretnom23/helmet-store-showroom-site/SQLi-4.md
CVE: CVE-2022-46121
Published: 2022-12-14
Description: Helmet Store Showroom Site v1.0 is vulnerable to SQL Injection via /hss/admin/?page=products/manage_product&id=.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/HMHYHM/bug_report/blob/main/vendors/oretnom23/helmet-store-showroom-site/SQLi-5.md; https://github.com/HMHYHM/bug_report/blob/main/vendors/oretnom23/helmet-store-showroom-site/SQLi-5.md
CVE: CVE-2022-46122
Published: 2022-12-14
Description: Helmet Store Showroom Site v1.0 is vulnerable to SQL Injection via /hss/admin/categories/view_category.php?id=.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/HMHYHM/bug_report/blob/main/vendors/oretnom23/helmet-store-showroom-site/SQLi-6.md; https://github.com/HMHYHM/bug_report/blob/main/vendors/oretnom23/helmet-store-showroom-site/SQLi-6.md
CVE: CVE-2022-46123
Published: 2022-12-14
Description: Helmet Store Showroom Site v1.0 is vulnerable to SQL Injection via /hss/admin/categories/manage_category.php?id=.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/HMHYHM/bug_report/blob/main/vendors/oretnom23/helmet-store-showroom-site/SQLi-7.md; https://github.com/HMHYHM/bug_report/blob/main/vendors/oretnom23/helmet-store-showroom-site/SQLi-7.md
CVE: CVE-2022-46124
Published: 2022-12-14
Description: Helmet Store Showroom Site v1.0 is vulnerable to SQL Injection via /hss/admin/?page=user/manage_user&id=.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/HMHYHM/bug_report/blob/main/vendors/oretnom23/helmet-store-showroom-site/SQLi-9.md; https://github.com/HMHYHM/bug_report/blob/main/vendors/oretnom23/helmet-store-showroom-site/SQLi-9.md