deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-26360
Published: 2022-04-05
Description: IOMMU: RMRR (VT-d) and unity map (AMD-Vi) handling issues T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Certain PCI devices in a system might be assigned Reserved Memory Regions (specified via Reserved Memory Region Reporting, "RMRR") for Intel VT-d or Unity Mapping ranges for AMD-Vi. These are typically used for platform tasks such as legacy USB emulation. Since the precise purpose of these regions is unknown, once a device associated with such a region is active, the mappings of these regions need to remain continuouly accessible by the device. This requirement has been violated. Subsequent DMA or interrupts from the device may have unpredictable behaviour, ranging from IOMMU faults to memory corruption.
CVSS Score: 7.8 (HIGH)
References: http://www.openwall.com/lists/oss-security/2022/04/05/3; http://xenbits.xen.org/xsa/advisory-400.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6ETPM2OVZZ6KOS2L7QO7SIW6XWT5OW3F/
CVE: CVE-2022-26361
Published: 2022-04-05
Description: IOMMU: RMRR (VT-d) and unity map (AMD-Vi) handling issues T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Certain PCI devices in a system might be assigned Reserved Memory Regions (specified via Reserved Memory Region Reporting, "RMRR") for Intel VT-d or Unity Mapping ranges for AMD-Vi. These are typically used for platform tasks such as legacy USB emulation. Since the precise purpose of these regions is unknown, once a device associated with such a region is active, the mappings of these regions need to remain continuouly accessible by the device. This requirement has been violated. Subsequent DMA or interrupts from the device may have unpredictable behaviour, ranging from IOMMU faults to memory corruption.
CVSS Score: 7.8 (HIGH)
References: http://www.openwall.com/lists/oss-security/2022/04/05/3; http://xenbits.xen.org/xsa/advisory-400.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6ETPM2OVZZ6KOS2L7QO7SIW6XWT5OW3F/
CVE: CVE-2021-41245
Published: 2022-04-05
Description: Combodo iTop is a web based IT Service Management tool. In versions prior to 2.7.6 and 3.0.0, CSRF tokens generated by `privUITransactionFile` aren't properly checked. Versions 2.7.6 and 3.0.0 contain a patch for this issue. As a workaround, use the session implementation by adding in the iTop config file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://github.com/Combodo/iTop/commit/7757f1f2d2330d49a3ebb40194f5ec4c8eaf8186; https://github.com/Combodo/iTop/security/advisories/GHSA-33pr-5776-9jqf; https://huntr.dev/bounties/0a39630d-f4b9-4468-86d8-aea3b02f91ae
CVE: CVE-2022-1243
Published: 2022-04-05
Description: CRHTLF can lead to invalid protocol extraction potentially leading to XSS in GitHub repository medialize/uri.js prior to 1.19.11.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-20
References: https://github.com/medialize/uri.js/commit/b0c9796aa1a95a85f40924fb18b1e5da3dc8ffae; https://huntr.dev/bounties/8c5afc47-1553-4eba-a98e-024e4cc3dfb7; https://github.com/medialize/uri.js/commit/b0c9796aa1a95a85f40924fb18b1e5da3dc8ffae
CVE: CVE-2022-26982
Published: 2022-04-05
Description: SimpleMachinesForum 2.1.1 and earlier allows remote authenticated administrators to execute arbitrary code by inserting a vulnerable php code because the themes can be modified by an administrator. NOTE: the vendor's position is that administrators are intended to have the ability to modify themes, and can thus choose any PHP code that they wish to have executed on the server.
CVSS Score: 7.2 (HIGH)
CWE: CWE-94
References: http://packetstormsecurity.com/files/171486/SimpleMachinesForum-2.1.1-Remote-Code-Execution.html; https://github.com/sartlabs/0days/blob/main/SimpleMachinesForum/Exploit.txt; http://packetstormsecurity.com/files/171486/SimpleMachinesForum-2.1.1-Remote-Code-Execution.html
CVE: CVE-2022-26986
Published: 2022-04-05
Description: SQL Injection in ImpressCMS 1.4.3 and earlier allows remote attackers to inject into the code in unintended way, this allows an attacker to read and modify the sensitive information from the database used by the application. If misconfigured, an attacker can even upload a malicious web shell to compromise the entire system.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.com/files/171485/ImpressCMS-1.4.3-SQL-Injection.html; https://github.com/sartlabs/0days/blob/main/ImpressCMS1.4.3/Exploit.txt; http://packetstormsecurity.com/files/171485/ImpressCMS-1.4.3-SQL-Injection.html
CVE: CVE-2020-19229
Published: 2022-04-05
Description: Jeesite 1.2.7 uses the apache shiro version 1.2.3 affected by CVE-2016-4437. Because of this version of the java deserialization vulnerability, an attacker could exploit the vulnerability to execute arbitrary commands via the rememberMe parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://github.com/thinkgem/jeesite/issues/490; https://github.com/thinkgem/jeesite/issues/490
CVE: CVE-2020-23349
Published: 2022-04-05
Description: An intent redirection issue was doscovered in Sina Weibo Android SDK 4.2.7 (com.sina.weibo.sdk.share.WbShareTransActivity), any unexported Activities could be started by the com.sina.weibo.sdk.share.WbShareTransActivity.
CVSS Score: 7.5 (HIGH)
References: https://github.com/sinaweibosdk/weibo_android_sdk/issues/406; https://github.com/sinaweibosdk/weibo_android_sdk/issues/406
CVE: CVE-2020-28847
Published: 2022-04-05
Description: Cross Site Scripting (XSS) vulnerability in xCss Valine v1.4.14 via the nick parameter to /classes/Comment.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/xCss/Valine/issues/348; https://github.com/xCss/Valine/issues/348
CVE: CVE-2021-27116
Published: 2022-04-05
Description: An issue was discovered in file profile.go in function MemProf in beego through 2.0.2, allows attackers to launch symlink attacks locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-59
References: https://github.com/beego/beego/issues/4484; https://github.com/beego/beego/issues/4484
CVE: CVE-2021-27117
Published: 2022-04-05
Description: An issue was discovered in file profile.go in function GetCPUProfile in beego through 2.0.2, allows attackers to launch symlink attacks locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-59
References: https://github.com/beego/beego/issues/4484; https://github.com/beego/beego/issues/4484
CVE: CVE-2021-28428
Published: 2022-04-05
Description: File upload vulnerability in HorizontCMS before 1.0.0-beta.3 via uploading a .htaccess and *.hello files using the Media Files upload functionality. The original file upload vulnerability (CVE-2020-27387) was remediated by restricting the PHP extensions; however, we confirmed that the filter was bypassed via uploading an arbitrary .htaccess and *.hello files in order to execute PHP code to gain RCE.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://github.com/ttimot24/HorizontCMS; https://github.com/ttimot24/HorizontCMS/commit/9c4d6827cbe96decec6834d53660e14ab2bf8838; https://github.com/ttimot24/HorizontCMS
CVE: CVE-2021-30080
Published: 2022-04-05
Description: An issue was discovered in the route lookup process in beego before 1.12.11 that allows attackers to bypass access control.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/beego/beego/commit/d5df5e470d0a8ed291930ae802fd7e6b95226519; https://github.com/beego/beego/releases/tag/v1.12.11; https://github.com/beego/beego/commit/d5df5e470d0a8ed291930ae802fd7e6b95226519
CVE: CVE-2021-41751
Published: 2022-04-05
Description: Buffer overflow vulnerability in file ecma-builtin-array-prototype.c:909 in function ecma_builtin_array_prototype_object_slice in Jerryscript before commit e1ce7dd7271288be8c0c8136eea9107df73a8ce2 on Oct 20, 2021.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://github.com/jerryscript-project/jerryscript/pull/4797; https://github.com/jerryscript-project/jerryscript/pull/4797
CVE: CVE-2021-41752
Published: 2022-04-05
Description: Stack overflow vulnerability in Jerryscript before commit e1ce7dd7271288be8c0c8136eea9107df73a8ce2 on Oct 20, 2021 due to an unbounded recursive call to the new opt() function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-674
References: https://github.com/jerryscript-project/jerryscript/issues/4779; https://github.com/jerryscript-project/jerryscript/issues/4779
CVE: CVE-2022-0602
Published: 2022-04-05
Description: Cross-site Scripting (XSS) - DOM in GitHub repository tastyigniter/tastyigniter prior to 3.3.0.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/tastyigniter/tastyigniter/commit/992d4ce6444805c3132e3635a01b6fd222063554; https://huntr.dev/bounties/615f1788-d474-4580-b0ef-5edd50274010; https://github.com/tastyigniter/tastyigniter/commit/992d4ce6444805c3132e3635a01b6fd222063554
CVE: CVE-2022-24795
Published: 2022-04-05
Description: yajl-ruby is a C binding to the YAJL JSON parsing and generation library. The 1.x branch and the 2.x branch of `yajl` contain an integer overflow which leads to subsequent heap memory corruption when dealing with large (~2GB) inputs. The reallocation logic at `yajl_buf.c#L64` may result in the `need` 32bit integer wrapping to 0 when `need` approaches a value of 0x80000000 (i.e. ~2GB of data), which results in a reallocation of buf->alloc into a small heap chunk. These integers are declared as `size_t` in the 2.x branch of `yajl`, which practically prevents the issue from triggering on 64bit platforms, however this does not preclude this issue triggering on 32bit builds on which `size_t` is a 32bit integer. Subsequent population of this under-allocated heap chunk is based on the original buffer size, leading to heap memory corruption. This vulnerability mostly impacts process availability. Maintainers believe exploitation for arbitrary code execution is unlikely. A patch is available and anticipated to be part of yajl-ruby version 1.4.2. As a workaround, avoid passing large inputs to YAJL.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-122, CWE-190
References: https://github.com/brianmario/yajl-ruby/blob/7168bd79b888900aa[PII_REDACTED]6f968a93eb3a6/ext/yajl/yajl_buf.c#L64; https://github.com/brianmario/yajl-ruby/commit/7168bd79b888900aa[PII_REDACTED]6f968a93eb3a6; https://github.com/brianmario/yajl-ruby/security/advisories/GHSA-jj47-x69x-mxrm
CVE: CVE-2022-27462
Published: 2022-04-05
Description: Cross Site Scripting (XSS) vulnerability in objects/function.php in function getDeviceID in WWBN AVideo through 11.6, via the yptDevice parameter to view/include/head.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://avideo.tube/; https://github.com/WWBN/AVideo/commit/3722335f808484e6bfb5e71028fedddd942add4a; https://avideo.tube/
CVE: CVE-2022-27463
Published: 2022-04-05
Description: Open redirect vulnerability in objects/login.json.php in WWBN AVideo through 11.6, allows attackers to arbitrarily redirect users from a crafted url to the login page.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://avideo.tube/; https://github.com/WWBN/AVideo/commit/77e9aa6411ff4b97571eb82e587139ec05ff894c; https://avideo.tube/
CVE: CVE-2022-22355
Published: 2022-04-05
Description: IBM MQ Appliance 9.2 CD and 9.2 LTS are vulnerable to a denial of service in the Login component of the application which could allow an attacker to cause a drop in performance.
CVSS Score: 5.3 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/220486; https://www.ibm.com/support/pages/node/6564711; https://exchange.xforce.ibmcloud.com/vulnerabilities/220486
CVE: CVE-2022-22356
Published: 2022-04-05
Description: IBM MQ Appliance 9.2 CD and 9.2 LTS could allow an attacker to enumerate account credentials due to an observable discrepancy in valid and invalid login attempts. IBM X-Force ID: 220487.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-203
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/220487; https://www.ibm.com/support/pages/node/6564711; https://exchange.xforce.ibmcloud.com/vulnerabilities/220487
CVE: CVE-2022-26635
Published: 2022-04-05
Description: PHP-Memcached v2.2.0 and below contains an improper NULL termination which allows attackers to execute CLRF injection. Note: Third parties have disputed this as not affecting PHP-Memcached directly.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/php-memcached-dev/php-memcached/issues/519; https://xhzeem.me/posts/Php5-memcached-Injection-Bypass/read/; https://github.com/php-memcached-dev/php-memcached/issues/519
CVE: CVE-2022-26630
Published: 2022-04-05
Description: Jellycms v3.8.1 and below was discovered to contain an arbitrary file upload vulnerability via \app.\admin\Controllers\db.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://github.com/guodongtech/jellycms/issues/1; https://github.com/guodongtech/jellycms/issues/1
CVE: CVE-2022-28648
Published: 2022-04-05
Description: In JetBrains YouTrack before 2022.1.43563 HTML code from the issue description was being rendered
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-80, CWE-79
References: https://www.jetbrains.com/privacy-security/issues-fixed/; https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2022-28649
Published: 2022-04-05
Description: In JetBrains YouTrack before 2022.1.43563 it was possible to include an iframe from a third-party domain in the issue description
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-1021, CWE-1021
References: https://www.jetbrains.com/privacy-security/issues-fixed/; https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2022-28650
Published: 2022-04-05
Description: In JetBrains YouTrack before 2022.1.43700 it was possible to inject JavaScript into Markdown in the YouTrack Classic UI
CVSS Score: 7.3 (HIGH)
CWE: CWE-79, CWE-79
References: https://www.jetbrains.com/privacy-security/issues-fixed/; https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2022-28651
Published: 2022-04-05
Description: In JetBrains IntelliJ IDEA before 2021.3.3 it was possible to get passwords from protected fields
CVSS Score: 8.4 (HIGH)
CWE: CWE-497, CWE-522
References: https://www.jetbrains.com/privacy-security/issues-fixed/; https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2022-1244
Published: 2022-04-05
Description: heap-buffer-overflow in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability is capable of inducing denial of service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-122
References: https://github.com/radareorg/radare2/commit/2b77b277d67ce061ee6ef839e7139ebc2103c1e3; https://huntr.dev/bounties/8ae2c61a-2220-47a5-bfe8-fe6d41ab1f82; https://github.com/radareorg/radare2/commit/2b77b277d67ce061ee6ef839e7139ebc2103c1e3
CVE: CVE-2022-24780
Published: 2022-04-05
Description: Combodo iTop is a web based IT Service Management tool. In versions prior to 2.7.6 and 3.0.0, users of the iTop user portal can send TWIG code to the server by forging specific http queries, and execute arbitrary code on the server using http server user privileges. This issue is fixed in versions 2.7.6 and 3.0.0. There are currently no known workarounds.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: http://packetstormsecurity.com/files/167236/iTop-Remote-Command-Execution.html; https://github.com/Combodo/iTop/commit/93f273a28778e5da8e51096f021d2dc1adbf4ef3; https://github.com/Combodo/iTop/commit/b6fac4b411b8d145fc30fa35c66b51243eafd06b
CVE: CVE-2022-24811
Published: 2022-04-05
Description: Combodi iTop is a web based IT Service Management tool. Prior to versions 2.7.6 and 3.0.0, cross-site scripting is possible for scripts outside of script tags when displaying HTML attachments. This issue is fixed in versions 2.7.6 and 3.0.0. There are currently no known workarounds.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/Combodo/iTop/commit/92a9a8c65f3cbb2cd4414ca3a3b45a5754ba57b4; https://github.com/Combodo/iTop/security/advisories/GHSA-67x5-mqg4-rvgc; https://huntr.dev/bounties/[PII_REDACTED]79-Combodo/iTop/
CVE: CVE-2022-24978
Published: 2022-04-05
Description: Zoho ManageEngine ADAudit Plus before 7055 allows authenticated Privilege Escalation on Integrated products. This occurs because a password field is present in a JSON response.
CVSS Score: 8.8 (HIGH)
CWE: CWE-319, CWE-522
References: https://manageengine.com; https://pitstop.manageengine.com/portal/en/community/topic/cve-2022-24978-privilege-escalation-vulnerability-manageengine-adaudit-plus; https://manageengine.com
CVE: CVE-2022-25245
Published: 2022-04-05
Description: Zoho ManageEngine ServiceDesk Plus before 13001 allows anyone to know the organisation's default currency name.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-306
References: https://manageengine.com; https://raxis.com/blog/cve-2022-25245; https://www.manageengine.com/products/service-desk/cve-2022-25245.html
CVE: CVE-2022-25373
Published: 2022-04-05
Description: Zoho ManageEngine SupportCenter Plus before 11020 allows Stored XSS in the request history.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://manageengine.com; https://pitstop.manageengine.com/portal/en/community/topic/manageengine-supportcenter-plus-version-11-0-build-11020-released; https://raxis.com/blog/cve-2022-25373
CVE: CVE-2022-28219
Published: 2022-04-05
Description: Cewolf in Zoho ManageEngine ADAudit Plus before 7060 is vulnerable to an unauthenticated XXE attack that leads to Remote Code Execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-611
References: http://cewolf.sourceforge.net/new/index.html; http://packetstormsecurity.com/files/167997/ManageEngine-ADAudit-Plus-Path-Traversal-XML-Injection.html; https://manageengine.com
CVE: CVE-2022-23974
Published: 2022-04-05
Description: In 0.9.3 or older versions of Apache Pinot segment upload path allowed segment directories to be imported into pinot tables. In pinot installations that allow open access to the controller a specially crafted request can potentially be exploited to cause disruption in pinot service. Pinot release 0.10.0 fixes this. See https://docs.pinot.apache.org/basics/releases/0.10.0
CVSS Score: 7.5 (HIGH)
CWE: CWE-674, CWE-674
References: https://lists.apache.org/thread/3dk8pf1n02p8oj2j3czbtchyjsf8khwr; https://lists.apache.org/thread/3dk8pf1n02p8oj2j3czbtchyjsf8khwr
CVE: CVE-2022-24475
Published: 2022-04-05
Description: Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
CVSS Score: 8.3 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24475; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24475
CVE: CVE-2022-24523
Published: 2022-04-05
Description: Microsoft Edge (Chromium-based) Spoofing Vulnerability
CVSS Score: 4.3 (MEDIUM)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24523; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24523
CVE: CVE-2022-26628
Published: 2022-04-05
Description: Matrimony v1.0 was discovered to contain a SQL injection vulnerability via the Password parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/vetbossel.in/2022/Matrimony; https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/vetbossel.in/2022/Matrimony
CVE: CVE-2022-26891
Published: 2022-04-05
Description: Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
CVSS Score: 8.3 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26891; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26891
CVE: CVE-2022-26894
Published: 2022-04-05
Description: Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
CVSS Score: 8.3 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26894; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26894
CVE: CVE-2022-26895
Published: 2022-04-05
Description: Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
CVSS Score: 8.3 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26895; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26895
CVE: CVE-2022-26900
Published: 2022-04-05
Description: Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
CVSS Score: 8.3 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26900; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26900
CVE: CVE-2022-26908
Published: 2022-04-05
Description: Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
CVSS Score: 8.3 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26908; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26908
CVE: CVE-2022-26909
Published: 2022-04-05
Description: Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
CVSS Score: 8.3 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26909; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26909
CVE: CVE-2022-26912
Published: 2022-04-05
Description: Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
CVSS Score: 8.3 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26912; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26912
CVE: CVE-2022-27123
Published: 2022-04-05
Description: Employee Performance Evaluation v1.0 was discovered to contain a SQL injection vulnerability via the email parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/2022/Employee-Performance-Evaluation; https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/2022/Employee-Performance-Evaluation
CVE: CVE-2022-27124
Published: 2022-04-05
Description: Insurance Management System 1.0 was discovered to contain a SQL injection vulnerability via the username parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/itsourcecode.com/Insurance-Management-System; https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/itsourcecode.com/Insurance-Management-System
CVE: CVE-2022-27304
Published: 2022-04-05
Description: Student Grading System v1.0 was discovered to contain a SQL injection vulnerability via the user parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/2022/Student-Grading-System; https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/2022/Student-Grading-System
CVE: CVE-2022-28115
Published: 2022-04-05
Description: Online Sports Complex Booking v1.0 was discovered to contain a SQL injection vulnerability via the id parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/2022/Online-Sports-Complex-Booking; https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/2022/Online-Sports-Complex-Booking
CVE: CVE-2022-28116
Published: 2022-04-05
Description: Online Banking System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/2022/Banking-System; https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/2022/Banking-System
CVE: CVE-2022-28467
Published: 2022-04-05
Description: Online Student Admission v1.0 was discovered to contain a SQL injection vulnerability via the txtapplicationID parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/Walterjnr1/Online-Student-Admission; https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/Walterjnr1/Online-Student-Admission