deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-38813
Published: 2022-11-25
Description: PHPGurukul Blood Donor Management System 1.0 does not properly restrict access to admin/dashboard.php, which allows attackers to access all data of users, delete the users, add and manage Blood Group, and Submit Report.
CVSS Score: 8.1 (HIGH)
CWE: CWE-668, CWE-668
References: https://drive.google.com/file/d/1iMswKzoUvindXUGh1cuAmi-0R84tLDaH/view?usp=sharing; https://github.com/RashidKhanPathan/CVE-2022-38813; https://ihexcoder.wixsite.com/secresearch/post/cve-2022-38813-privilege-escalations-in-blood-donor-management-system-v1-0
CVE: CVE-2022-43983
Published: 2022-11-25
Description: Browsershot version 3.57.2 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not validate that the HTML content passed to the Browsershot::html method does not contain URL's that use the file:// protocol.
CVSS Score: 8.2 (HIGH)
CWE: CWE-79, CWE-79
References: https://fluidattacks.com/advisories/khalid/; https://github.com/spatie/browsershot/; https://fluidattacks.com/advisories/khalid/
CVE: CVE-2022-43984
Published: 2022-11-25
Description: Browsershot version 3.57.3 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not validate that the JS content imported from an external source passed to the Browsershot::html method does not contain URLs that use the file:// protocol.
CVSS Score: 8.2 (HIGH)
CWE: CWE-79, CWE-79
References: https://fluidattacks.com/advisories/malone/; https://github.com/spatie/browsershot/; https://fluidattacks.com/advisories/malone/
CVE: CVE-2022-45205
Published: 2022-11-25
Description: Jeecg-boot v3.4.3 was discovered to contain a SQL injection vulnerability via the component /sys/dict/queryTableData.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-89, CWE-89
References: http://jeecg-boot.com; https://github.com/jeecgboot/jeecg-boot/issues/4128; http://jeecg-boot.com
CVE: CVE-2022-45206
Published: 2022-11-25
Description: Jeecg-boot v3.4.3 was discovered to contain a SQL injection vulnerability via the component /sys/duplicate/check.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: http://jeecg-boot.com; https://github.com/jeecgboot/jeecg-boot/issues/4129; http://jeecg-boot.com
CVE: CVE-2022-45207
Published: 2022-11-25
Description: Jeecg-boot v3.4.3 was discovered to contain a SQL injection vulnerability via the component updateNullByEmptyString.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: http://jeecg-boot.com; https://github.com/jeecgboot/jeecg-boot/issues/4127; http://jeecg-boot.com
CVE: CVE-2022-45208
Published: 2022-11-25
Description: Jeecg-boot v3.4.3 was discovered to contain a SQL injection vulnerability via the component /sys/user/putRecycleBin.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-89, CWE-89
References: http://jeecg-boot.com; https://github.com/jeecgboot/jeecg-boot/issues/4126; http://jeecg-boot.com
CVE: CVE-2022-45210
Published: 2022-11-25
Description: Jeecg-boot v3.4.3 was discovered to contain a SQL injection vulnerability via the component /sys/user/deleteRecycleBin.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-89, CWE-89
References: http://jeecg-boot.com; https://github.com/jeecgboot/jeecg-boot/issues/4125; http://jeecg-boot.com
CVE: CVE-2022-45218
Published: 2022-11-25
Description: Human Resource Management System v1.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability. This vulnerability is triggered via a crafted payload injected into an authentication error message.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/Rajeshwar40/CVE/blob/main/CVE-2022-45218; https://www.sourcecodester.com/sites/default/files/download/oretnom23/hrm.zip; https://github.com/Rajeshwar40/CVE/blob/main/CVE-2022-45218
CVE: CVE-2022-0698
Published: 2022-11-25
Description: Microweber version 1.3.1 allows an unauthenticated user to perform an account takeover via an XSS on the 'select-file' parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://fluidattacks.com/advisories/garrix/; https://github.com/microweber/microweber/; https://fluidattacks.com/advisories/garrix/
CVE: CVE-2022-41705
Published: 2022-11-25
Description: Badaso version 2.6.3 allows an unauthenticated remote attacker to execute arbitrary code remotely on the server. This is possible because the application does not properly validate the data uploaded by users.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434, CWE-434
References: https://fluidattacks.com/advisories/headhunterz/; https://github.com/uasoft-indonesia/badaso/; https://fluidattacks.com/advisories/headhunterz/
CVE: CVE-2022-41706
Published: 2022-11-25
Description: Browsershot version 3.57.2 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not validate the URL protocol passed to the Browsershot::url method.
CVSS Score: 8.2 (HIGH)
CWE: CWE-79, CWE-79
References: https://fluidattacks.com/advisories/eminem/; https://github.com/spatie/browsershot/; https://fluidattacks.com/advisories/eminem/
CVE: CVE-2022-41712
Published: 2022-11-25
Description: Frappe version 14.10.0 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not correctly validate the information injected by the user in the import_file parameter.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://fluidattacks.com/advisories/kiniza/; https://github.com/frappe/frappe/; https://fluidattacks.com/advisories/kiniza/
CVE: CVE-2022-41958
Published: 2022-11-25
Description: super-xray is a web vulnerability scanning tool. Versions prior to 0.7 assumed trusted input for the program config which is stored in a yaml file. An attacker with local access to the file could exploit this and compromise the program. This issue has been addressed in commit `4d0d5966` and will be included in future releases. Users are advised to upgrade. There are no known workarounds for this issue.
CVSS Score: 7.3 (HIGH)
CWE: CWE-502
References: https://github.com/4ra1n/super-xray/commit/4d0d59663596db03f39d7edd2be251d48b52dcfc; https://github.com/4ra1n/super-xray/security/advisories/GHSA-39pv-4vmj-c4fr; https://github.com/4ra1n/super-xray/commit/4d0d59663596db03f39d7edd2be251d48b52dcfc
CVE: CVE-2022-44858
Published: 2022-11-25
Description: Automotive Shop Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /asms/products/view_product.php.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/thir3een/bug_report/blob/main/vendors/oretnom23/automotive-shop-management-system/SQLi-1.md; https://github.com/thir3een/bug_report/blob/main/vendors/oretnom23/automotive-shop-management-system/SQLi-1.md
CVE: CVE-2022-44859
Published: 2022-11-25
Description: Automotive Shop Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /asms/admin/products/manage_product.php.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/thir3een/bug_report/blob/main/vendors/oretnom23/automotive-shop-management-system/SQLi-2.md; https://github.com/thir3een/bug_report/blob/main/vendors/oretnom23/automotive-shop-management-system/SQLi-2.md
CVE: CVE-2022-44860
Published: 2022-11-25
Description: Automotive Shop Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/transactions/update_status.php.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/thir3een/bug_report/blob/main/vendors/oretnom23/automotive-shop-management-system/SQLi-3.md; https://github.com/thir3een/bug_report/blob/main/vendors/oretnom23/automotive-shop-management-system/SQLi-3.md
CVE: CVE-2022-45475
Published: 2022-11-25
Description: Tiny File Manager version 2.4.8 allows an unauthenticated remote attacker to access the application's internal files. This is possible because the application is vulnerable to broken access control.



CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: https://fluidattacks.com/advisories/mosey/; https://github.com/prasathmani/tinyfilemanager/; https://fluidattacks.com/advisories/mosey/
CVE: CVE-2022-45476
Published: 2022-11-25
Description: Tiny File Manager version 2.4.8 executes the code of files uploaded by users of the application, instead of just returning them for download. This is possible because the application is vulnerable to insecure file upload.



CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434, CWE-434
References: https://fluidattacks.com/advisories/mosey/; https://github.com/prasathmani/tinyfilemanager/; https://fluidattacks.com/advisories/mosey/
CVE: CVE-2022-39331
Published: 2022-11-25
Description: Nexcloud desktop is the Desktop sync client for Nextcloud. An attacker can inject arbitrary HyperText Markup Language into the Desktop Client application in the notifications. It is recommended that the Nextcloud Desktop client is upgraded to 3.6.1. There are no known workarounds for this issue.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-79
References: https://github.com/nextcloud/desktop/pull/4944; https://github.com/nextcloud/security-advisories/security/advisories/GHSA-c3xh-q694-6rc5; https://hackerone.com/reports/1668028
CVE: CVE-2022-39334
Published: 2022-11-25
Description: Nextcloud also ships a CLI utility called nextcloudcmd which is sometimes used for automated scripting and headless servers. Versions of nextcloudcmd prior to 3.6.1 would incorrectly trust invalid TLS certificates, which may enable a Man-in-the-middle attack that exposes sensitive data or credentials to a network attacker. This affects the CLI only. It does not affect the standard GUI desktop Nextcloud clients, and it does not affect the Nextcloud server.
CVSS Score: 3.9 (LOW)
CWE: CWE-295, CWE-295
References: https://github.com/nextcloud/desktop/issues/4927; https://github.com/nextcloud/desktop/pull/5022; https://github.com/nextcloud/security-advisories/security/advisories/GHSA-82xx-98xv-4jxv
CVE: CVE-2022-39338
Published: 2022-11-25
Description: user_oidc is an OpenID Connect user backend for Nextcloud. Versions prior to 1.2.1 did not properly validate discovery urls which may lead to a stored cross site scripting attack vector. The impact is limited due to the restrictive CSP that is applied on this endpoint. Additionally this vulnerability has only been shown to be exploitable in the Safari web browser. This issue has been addressed in version 1.2.1. Users are advised to upgrade. Users unable to upgrade should urge their users to avoid using the Safari web browser.
CVSS Score: 3.5 (LOW)
CWE: CWE-20, CWE-79
References: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-5fpw-795h-rg57; https://github.com/nextcloud/user_oidc/pull/496; https://hackerone.com/reports/1687410
CVE: CVE-2022-39339
Published: 2022-11-25
Description: user_oidc is an OpenID Connect user backend for Nextcloud. In versions prior to 1.2.1 sensitive information such as the OIDC client credentials and tokens are sent in plain text of HTTP without TLS. Any malicious actor with access to monitor user traffic may have been able to compromise account security. This issue has been addressed in in user_oidc v1.2.1. Users are advised to upgrade. Users unable to upgrade may use https to access Nextcloud. Set an HTTPS discovery URL in the provider settings (in Nextcloud OIDC admin settings).
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-319, CWE-319
References: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-2vff-cq8h-chhg; https://github.com/nextcloud/user_oidc/pull/495; https://hackerone.com/reports/1687005
CVE: CVE-2022-39346
Published: 2022-11-25
Description: Nextcloud server is an open source personal cloud server. Affected versions of nextcloud server did not properly limit user display names which could allow a malicious users to overload the backing database and cause a denial of service. It is recommended that the Nextcloud Server is upgraded to 22.2.10, 23.0.7 or 24.0.3. There are no known workarounds for this issue.
CVSS Score: 3.5 (LOW)
CWE: CWE-20, CWE-400
References: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-6w9f-jgjx-4vj6; https://github.com/nextcloud/server/pull/33052; https://hackerone.com/reports/1588562
CVE: CVE-2022-41156
Published: 2022-11-25
Description: Remote code execution vulnerability due to insufficient verification of URLs, etc. in OndiskPlayerAgent. A remote attacker could exploit the vulnerability to cause remote code execution by causing an arbitrary user to download and execute malicious code.
CVSS Score: 7.8 (HIGH)
CWE: CWE-345, CWE-345
References: https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=67041; https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=67041
CVE: CVE-2022-41157
Published: 2022-11-25
Description: A specific file on the sERP server if Kyungrinara(ERP solution) has a fixed password with the SYSTEM authority. This vulnerability could allow attackers to leak or steal sensitive information or execute malicious commands.
CVSS Score: 8.1 (HIGH)
CWE: CWE-798, CWE-798
References: https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=67042; https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=67042
CVE: CVE-2022-41158
Published: 2022-11-25
Description: Remote code execution vulnerability can be achieved by using cookie values as paths to a file by this builder program. A remote attacker could exploit the vulnerability to execute or inject malicious code.
CVSS Score: 7.2 (HIGH)
CWE: CWE-22, CWE-94, CWE-22
References: https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=67043; https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=67043
CVE: CVE-2022-41926
Published: 2022-11-25
Description: Nextcould talk android is the android OS implementation of the nextcloud talk chat system. In affected versions the receiver is not protected by broadcastPermission allowing malicious apps to monitor communication. It is recommended that the Nextcloud Talk Android is upgraded to 14.1.0. There are no known workarounds for this issue.
CVSS Score: 3.3 (LOW)
CWE: CWE-200, CWE-732
References: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-564v-3rfc-352m; https://github.com/nextcloud/talk-android/pull/2148; https://hackerone.com/reports/1596459
CVE: CVE-2022-41954
Published: 2022-11-25
Description: MPXJ is an open source library to read and write project plans from a variety of file formats and databases. On Unix-like operating systems (not Windows or macos), MPXJ's use of `File.createTempFile(..)` results in temporary files being created with the permissions `-rw-r--r--`. This means that any other user on the system can read the contents of this file. When MPXJ is reading a schedule file which requires the creation of a temporary file or directory, a knowledgeable local user could locate these transient files while they are in use and would then be able to read the schedule being processed by MPXJ. The problem has been patched, MPXJ version 10.14.1 and later includes the necessary changes. Users unable to upgrade may set `java.io.tmpdir` to a directory to which only the user running the application has access will prevent other users from accessing these temporary files.
CVSS Score: 3.3 (LOW)
CWE: CWE-200, CWE-377, CWE-668
References: https://github.com/joniles/mpxj/commit/ae0af24345d79ad45705265d9927fe55e94a5721; https://github.com/joniles/mpxj/security/advisories/GHSA-jf2p-4gqj-849g; https://github.com/joniles/mpxj/commit/ae0af24345d79ad45705265d9927fe55e94a5721
CVE: CVE-2022-45152
Published: 2022-11-25
Description: A blind Server-Side Request Forgery (SSRF) vulnerability was found in Moodle. This flaw exists due to insufficient validation of user-supplied input in LTI provider library. The library does not utilise Moodle's inbuilt cURL helper, which resulted in a blind SSRF risk. An attacker can send a specially crafted HTTP request and trick the application to initiate requests to arbitrary systems. This vulnerability allows a remote attacker to perform SSRF attacks.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-918, CWE-918, CWE-918
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-71920; https://bugzilla.redhat.com/show_bug.cgi?id=2142775; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2DHYIIAUXUBHMBEDYU7TYNZXEN2W2SA2/
CVE: CVE-2022-39325
Published: 2022-11-25
Description: BaserCMS is a content management system with a japanese language focus. In affected versions there is a cross-site scripting vulnerability on the management system of baserCMS. This is a vulnerability that needs to be addressed when the management system is used by an unspecified number of users. Users of baserCMS are advised to upgrade as soon as possible. There are no known workarounds for this vulnerability.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-79
References: https://basercms.net/security/JVN_53682526; https://github.com/baserproject/basercms/commit/b6f8a54e90dee51317eddf517b776fe8b4cd3ef6; https://github.com/baserproject/basercms/security/advisories/GHSA-395x-wv32-44v5
CVE: CVE-2022-39332
Published: 2022-11-25
Description: Nexcloud desktop is the Desktop sync client for Nextcloud. An attacker can inject arbitrary HyperText Markup Language into the Desktop Client application via user status and information. It is recommended that the Nextcloud Desktop client is upgraded to 3.6.1. There are no known workarounds for this issue.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-79
References: https://github.com/nextcloud/desktop/pull/4972; https://github.com/nextcloud/security-advisories/security/advisories/GHSA-q9f6-4r6r-h74p; https://hackerone.com/reports/1707977
CVE: CVE-2022-39333
Published: 2022-11-25
Description: Nexcloud desktop is the Desktop sync client for Nextcloud. An attacker can inject arbitrary HyperText Markup Language into the Desktop Client application. It is recommended that the Nextcloud Desktop client is upgraded to 3.6.1. There are no known workarounds for this issue.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-79
References: https://github.com/nextcloud/desktop/pull/4972; https://github.com/nextcloud/security-advisories/security/advisories/GHSA-92p9-x79h-2mj8; https://hackerone.com/reports/1711847
CVE: CVE-2022-44843
Published: 2022-11-25
Description: TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the port parameter in the setting/setOpenVpnClientCfg function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://github.com/EPhaha/IOT_vuln/tree/main/TOTOLink/A7100RU/1; https://github.com/EPhaha/IOT_vuln/tree/main/TOTOLink/A7100RU/1
CVE: CVE-2022-44844
Published: 2022-11-25
Description: TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the pass parameter in the setting/setOpenVpnCfg function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://github.com/EPhaha/IOT_vuln/tree/main/TOTOLink/A7100RU/2; https://github.com/EPhaha/IOT_vuln/tree/main/TOTOLink/A7100RU/2
CVE: CVE-2022-45225
Published: 2022-11-25
Description: Book Store Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability in /bsms_ci/index.php/book. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the book_title parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://medium.com/%40just0rg/book-store-management-system-1-0-unrestricted-input-leads-to-xss-74506d42492e; https://medium.com/%40just0rg/book-store-management-system-1-0-unrestricted-input-leads-to-xss-74506d42492e; https://medium.com/%40just0rg/book-store-management-system-1-0-unrestricted-input-leads-to-xss-74506d42492e
CVE: CVE-2022-45907
Published: 2022-11-26
Description: In PyTorch before trunk/89695, torch.jit.annotations.parse_type_line can cause arbitrary code execution because eval is used unsafely.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94, CWE-94
References: https://github.com/pytorch/pytorch/commit/767f6aa49fe20a2766b9843d01e3b7f7793df6a3; https://github.com/pytorch/pytorch/issues/88868; https://github.com/pytorch/pytorch/commit/767f6aa49fe20a2766b9843d01e3b7f7793df6a3
CVE: CVE-2022-45908
Published: 2022-11-26
Description: In PaddlePaddle before 2.4, paddle.audio.functional.get_window is vulnerable to code injection because it calls eval on a user-supplied winstr. This may lead to arbitrary code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94, CWE-94
References: https://github.com/PaddlePaddle/Paddle/blob/develop/security/advisory/pdsa-2022-002.md; https://github.com/PaddlePaddle/Paddle/commit/26c419ca386aeae3c461faf2b828d00b48e908eb; https://github.com/PaddlePaddle/Paddle/blob/develop/security/advisory/pdsa-2022-002.md
CVE: CVE-2022-45909
Published: 2022-11-26
Description: drachtio-server before 0.8.19 has a heap-based buffer over-read via a long Request-URI in an INVITE request.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-125, CWE-125
References: https://github.com/drachtio/drachtio-server/commit/a63d01854987d9fd846cdc9265af38ee9eb72490; https://github.com/drachtio/drachtio-server/compare/v0.8.18...v0.8.19; https://github.com/drachtio/drachtio-server/pull/238
CVE: CVE-2022-24999
Published: 2022-11-26
Description: qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used. In many typical Express use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application, such as a[__proto__]=b&a[__proto__]&a[length]=100000000. The fix was backported to qs 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, and 6.2.4 (and therefore Express 4.17.3, which has "deps: qs@6.9.7" in its release description, is not vulnerable).
CVSS Score: 7.5 (HIGH)
CWE: CWE-1321, CWE-1321
References: https://github.com/expressjs/express/releases/tag/4.17.3; https://github.com/ljharb/qs/pull/428; https://github.com/n8tz/CVE-2022-24999
CVE: CVE-2022-45914
Published: 2022-11-27
Description: The ESL (Electronic Shelf Label) protocol, as implemented by (for example) the OV80e934802 RF transceiver on the ETAG-2130-V4.3 20190629 board, does not use authentication, which allows attackers to change label values via 433 MHz RF signals, as demonstrated by disrupting the organization of a hospital storage unit, or changing retail pricing.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-294, CWE-294
References: http://packetstormsecurity.com/files/170177/Zhuhai-Suny-Technology-ESL-Tag-Forgery-Replay-Attacks.html; http://seclists.org/fulldisclosure/2022/Dec/6; https://www.youtube.com/watch?v=FQRMNjZVlHg
CVE: CVE-2022-45919
Published: 2022-11-27
Description: An issue was discovered in the Linux kernel through 6.0.10. In drivers/media/dvb-core/dvb_ca_en50221.c, a use-after-free can occur is there is a disconnect after an open, because of the lack of a wait_event.
CVSS Score: 7.0 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=280a8ab81733da8bc442253c700a52c4c0886ffd; https://lore.kernel.org/linux-media/[PII_REDACTED]3308.GA33821%40ubuntu/T/#u; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2022-45930
Published: 2022-11-27
Description: A SQL injection issue was discovered in AAA in OpenDaylight (ODL) before 0.16.5. The aaa-idm-store-h2/src/main/java/org/opendaylight/aaa/datastore/h2/DomainStore.java deleteDomain function is affected for the /auth/v1/domains/ API interface.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89, CWE-89
References: https://git.opendaylight.org/gerrit/c/aaa/+/103242; https://jira.opendaylight.org/browse/AAA-240; https://git.opendaylight.org/gerrit/c/aaa/+/103242