deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-31910
Published: 2022-06-16
Description: Online Tutor Portal Site v1.0 is vulnerable to Cross Site Scripting (XSS). via /otps/classes/Master.php.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/mikeccltt/0525/blob/main/online-tutor-portal-site/xss.md; https://github.com/mikeccltt/0525/blob/main/online-tutor-portal-site/xss.md
CVE: CVE-2022-31911
Published: 2022-06-16
Description: Online Discussion Forum Site v1.0 is vulnerable to SQL Injection via /odfs/classes/Master.php?f=delete_team.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/mikeccltt/0525/blob/main/online-discussion-forum-site/sql.md; https://github.com/mikeccltt/0525/blob/main/online-discussion-forum-site/sql.md
CVE: CVE-2022-31912
Published: 2022-06-16
Description: Online Tutor Portal Site v1.0 is vulnerable to SQL Injection via /otps/classes/Master.php?f=delete_team.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/mikeccltt/0525/blob/main/online-tutor-portal-site/sql.md; https://github.com/mikeccltt/0525/blob/main/online-tutor-portal-site/sql.md
CVE: CVE-2022-31913
Published: 2022-06-16
Description: Online Discussion Forum Site v1.0 is vulnerable to Cross Site Scripting (XSS) via /odfs/classes/Master.php?f=save_category, name.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/mikeccltt/0525/blob/main/online-discussion-forum-site/xss.md; https://github.com/mikeccltt/0525/blob/main/online-discussion-forum-site/xss.md
CVE: CVE-2022-22953
Published: 2022-06-16
Description: VMware HCX update addresses an information disclosure vulnerability. A malicious actor with network user access to the VMware HCX appliance may be able to gain access to sensitive information.
CVSS Score: 6.5 (MEDIUM)
References: https://www.vmware.com/security/advisories/VMSA-2022-0017.html; https://www.vmware.com/security/advisories/VMSA-2022-0017.html
CVE: CVE-2022-27531
Published: 2022-06-16
Description: A maliciously crafted TIF file can be forced to read beyond allocated boundaries in Autodesk 3ds Max 2022, and 2021 when parsing the TIF files. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0010; https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0010
CVE: CVE-2022-27532
Published: 2022-06-16
Description: A maliciously crafted TIF file in Autodesk 3ds Max 2022 and 2021 can be used to write beyond the allocated buffer while parsing TIF files. This vulnerability in conjunction with other vulnerabilities could lead to arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0010; https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0010
CVE: CVE-2022-31291
Published: 2022-06-16
Description: An issue in dlt_config_file_parser.c of dlt-daemon v2.18.8 allows attackers to cause a double free via crafted TCP packets.
CVSS Score: 7.5 (HIGH)
CWE: CWE-415
References: https://github.com/COVESA/dlt-daemon/pull/376/commits; https://lists.debian.org/debian-lts-announce/2022/12/msg00016.html; https://github.com/COVESA/dlt-daemon/pull/376/commits
CVE: CVE-2022-31914
Published: 2022-06-16
Description: Zoo Management System v1.0 is vulnerable to Cross Site Scripting (XSS) via zms/admin/public_html/save_animal?an_id=24.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/mikeccltt/0525/blob/main/zoo-management-system/xss.md; https://github.com/mikeccltt/0525/blob/main/zoo-management-system/xss.md
CVE: CVE-2021-3675
Published: 2022-06-16
Description: Improper Input Validation vulnerability in synaTEE.signed.dll of Synaptics Fingerprint Driver allows a local authorized attacker to overwrite a heap tag, with potential loss of confidentiality. This issue affects: Synaptics Synaptics Fingerprint Driver 5.1.xxx.26 versions prior to xxx=340 on x86/64; 5.2.xxxx.26 versions prior to xxxx=3541 on x86/64; 5.2.2xx.26 versions prior to xx=29 on x86/64; 5.2.3xx.26 versions prior to xx=25 on x86/64; 5.3.xxxx.26 versions prior to xxxx=3543 on x86/64; 5.5.xx.1058 versions prior to xx=44 on x86/64; 5.5.xx.1102 versions prior to xx=34 on x86/64; 5.5.xx.1116 versions prior to xx=14 on x86/64; 6.0.xx.1104 versions prior to xx=50 on x86/64; 6.0.xx.1108 versions prior to xx=31 on x86/64; 6.0.xx.1111 versions prior to xx=58 on x86/64.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20, CWE-787
References: https://support.hp.com/us-en/document/ish_6[PII_REDACTED]191-16/hpsbhf03797; https://support.lenovo.com/us/en/product_security/LEN-68054; https://synaptics.com/sites/default/files/2022-06/fingerprint-driver-SGX-security-brief-2022-06-14.pdf
CVE: CVE-2021-41420
Published: 2022-06-16
Description: A stored XSS vulnerability in MaianAffiliate v.1.0 allows an authenticated attacker for arbitrary JavaScript code execution in the context of authenticated and unauthenticated users through the MaianAffiliate admin panel.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/mari0x00/MaianAffiliate-Code-execution-and-XSS/blob/main/README.md; https://www.maianaffiliate.com/; https://github.com/mari0x00/MaianAffiliate-Code-execution-and-XSS/blob/main/README.md
CVE: CVE-2021-41421
Published: 2022-06-16
Description: A PHP code injection vulnerability in MaianAffiliate v.1.0 allows an authenticated attacker to gain RCE through the MaianAffiliate admin panel.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-434
References: https://github.com/mari0x00/MaianAffiliate-Code-execution-and-XSS/blob/main/README.md; https://www.maianaffiliate.com/; https://github.com/mari0x00/MaianAffiliate-Code-execution-and-XSS/blob/main/README.md
CVE: CVE-2022-1642
Published: 2022-06-16
Description: A program using swift-corelibs-foundation is vulnerable to a denial of service attack caused by a potentially malicious source producing a JSON document containing a type mismatch. This vulnerability is caused by the interaction between a deserialization mechanism offered by the Swift standard library, the Codable protocol; and the JSONDecoder class offered by swift-corelibs-foundation, which can deserialize types that adopt the Codable protocol based on the content of a provided JSON document. When a type that adopts Codable requests the initialization of a field with an integer value, the JSONDecoder class uses a type-erased container with different accessor methods to attempt and coerce a corresponding JSON value and produce an integer. In the case the JSON value was a numeric literal with a floating-point portion, JSONDecoder used different type-eraser methods during validation than it did during the final casting of the value. The checked casting produces a deterministic crash due to this mismatch. The JSONDecoder class is often wrapped by popular Swift-based web frameworks to parse the body of HTTP requests and perform basic type validation. This makes the attack low-effort: sending a specifically crafted JSON document during a request to these endpoints will cause them to crash. The attack does not have any confidentiality or integrity risks in and of itself; the crash is produced deterministically by an abort function that ensures that execution does not continue in the face of this violation of assumptions. However, unexpected crashes can lead to violations of invariants in services, so it's possible that this attack can be used to trigger error conditions that escalate the risk. Producing a denial of service may also be the goal of an attacker in itself. This issue is solved in Swift 5.6.2 for Linux and Windows. This issue was solved by ensuring that the same methods are invoked both when validating and during casting, so that no type mismatch occurs. Swift for Linux and Windows versions are not ABI-interchangeable. To upgrade a service, its owner must update to this version of the Swift toolchain, then recompile and redeploy their software. The new version of Swift includes an updated swift-corelibs-foundation package. Versions of Swift running on Darwin-based operating systems are not affected.
CVSS Score: 7.5 (HIGH)
CWE: CWE-241, CWE-351, CWE-704, CWE-704
References: https://github.com/apple/swift-corelibs-foundation/security/advisories/GHSA-239c-6cv2-wwx8; https://github.com/apple/swift-corelibs-foundation/security/advisories/GHSA-239c-6cv2-wwx8
CVE: CVE-2022-29862
Published: 2022-06-16
Description: An infinite loop in OPC UA .NET Standard Stack 1.04.368 allows a remote attackers to cause the application to hang via a crafted message.
CVSS Score: 7.5 (HIGH)
CWE: CWE-835
References: https://files.opcfoundation.org/SecurityBulletins/OPC%20Foundation%20Security%20Bulletin%20CVE-2022-29862.pdf; https://opcfoundation.org/security/; https://files.opcfoundation.org/SecurityBulletins/OPC%20Foundation%20Security%20Bulletin%20CVE-2022-29862.pdf
CVE: CVE-2022-29865
Published: 2022-06-16
Description: OPC UA .NET Standard Stack allows a remote attacker to bypass the application authentication check via crafted fake credentials.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: https://files.opcfoundation.org/SecurityBulletins/OPC%20Foundation%20Security%20Bulletin%20CVE-2022-29865.pdf; https://opcfoundation.org/security/; https://files.opcfoundation.org/SecurityBulletins/OPC%20Foundation%20Security%20Bulletin%20CVE-2022-29865.pdf
CVE: CVE-2022-30658
Published: 2022-06-16
Description: Adobe InDesign versions 17.2.1 (and earlier) and 16.4.1 (and earlier) are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: https://helpx.adobe.com/security/products/indesign/apsb22-30.html; https://helpx.adobe.com/security/products/indesign/apsb22-30.html
CVE: CVE-2022-30659
Published: 2022-06-16
Description: Adobe InDesign versions 17.2.1 (and earlier) and 16.4.1 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/indesign/apsb22-30.html; https://helpx.adobe.com/security/products/indesign/apsb22-30.html
CVE: CVE-2022-30660
Published: 2022-06-16
Description: Adobe InDesign versions 17.2.1 (and earlier) and 16.4.1 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/indesign/apsb22-30.html; https://helpx.adobe.com/security/products/indesign/apsb22-30.html
CVE: CVE-2022-30661
Published: 2022-06-16
Description: Adobe InDesign versions 17.2.1 (and earlier) and 16.4.1 (and earlier) are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: https://helpx.adobe.com/security/products/indesign/apsb22-30.html; https://helpx.adobe.com/security/products/indesign/apsb22-30.html
CVE: CVE-2022-30662
Published: 2022-06-16
Description: Adobe InDesign versions 17.2.1 (and earlier) and 16.4.1 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/indesign/apsb22-30.html; https://helpx.adobe.com/security/products/indesign/apsb22-30.html
CVE: CVE-2022-30663
Published: 2022-06-16
Description: Adobe InDesign versions 17.2.1 (and earlier) and 16.4.1 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/indesign/apsb22-30.html; https://helpx.adobe.com/security/products/indesign/apsb22-30.html
CVE: CVE-2022-30665
Published: 2022-06-16
Description: Adobe InDesign versions 17.2.1 (and earlier) and 16.4.1 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/indesign/apsb22-30.html; https://helpx.adobe.com/security/products/indesign/apsb22-30.html
CVE: CVE-2022-30670
Published: 2022-06-16
Description: RoboHelp Server earlier versions than RHS 11 Update 3 are affected by an Improper Authorization vulnerability which could lead to privilege escalation. An authenticated attacker could leverage this vulnerability to achieve full administrator privileges. Exploitation of this issue does not require user interaction.
CVSS Score: 8.8 (HIGH)
CWE: CWE-285
References: https://helpx.adobe.com/security/products/robohelp-server/apsb22-31.html; https://helpx.adobe.com/security/products/robohelp-server/apsb22-31.html
CVE: CVE-2022-31298
Published: 2022-06-16
Description: A cross-site scripting vulnerability in the ads comment section of Haraj v3.7 allows attackers to execute arbitrary web scripts or HTML via a crafted POST request.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://angtech.org; https://angtech.org/product/view/3; https://github.com/bigzooooz/CVE-2022-31298
CVE: CVE-2022-31382
Published: 2022-06-16
Description: Directory Management System v1.0 was discovered to contain a SQL injection vulnerability via the searchdata parameter in search-dirctory.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://directory.com; http://phpgurukul.com; https://github.com/laotun-s/POC/blob/main/CVE-2022-31382.txt
CVE: CVE-2022-31383
Published: 2022-06-16
Description: Directory Management System v1.0 was discovered to contain a SQL injection vulnerability via the editid parameter in view-directory.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://directory.com; http://phpgurukul.com; https://github.com/laotun-s/POC/blob/main/CVE-2022-31383.txt
CVE: CVE-2022-31384
Published: 2022-06-16
Description: Directory Management System v1.0 was discovered to contain a SQL injection vulnerability via the fullname parameter in add-directory.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://directory.com; http://phpgurukul.com; https://github.com/laotun-s/POC/blob/main/CVE-2022-31384.txt
CVE: CVE-2021-36827
Published: 2022-06-16
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Saturday Drive's Ninja Forms Contact Form plugin <= 3.6.9 at WordPress via "label".
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/ninja-forms/wordpress-ninja-forms-contact-form-plugin-3-6-9-authenticated-stored-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/ninja-forms/wordpress-ninja-forms-contact-form-plugin-3-6-9-authenticated-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2021-41487
Published: 2022-06-16
Description: NOKIA VitalSuite SPM 2020 is affected by SQL injection through UserName'.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://twitter.com/exploitdb/status/[PII_REDACTED]36748032; https://www.exploit-db.com/exploits/48528; https://twitter.com/exploitdb/status/[PII_REDACTED]36748032
CVE: CVE-2022-29863
Published: 2022-06-16
Description: OPC UA .NET Standard Stack 1.04.368 allows remote attacker to cause a crash via a crafted message that triggers excessive memory allocation.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://files.opcfoundation.org/SecurityBulletins/OPC%20Foundation%20Security%20Bulletin%20CVE-2022-29863.pdf; https://opcfoundation.org/security/; https://files.opcfoundation.org/SecurityBulletins/OPC%20Foundation%20Security%20Bulletin%20CVE-2022-29863.pdf
CVE: CVE-2022-29864
Published: 2022-06-16
Description: OPC UA .NET Standard Stack 1.04.368 allows a remote attacker to cause a server to crash via a large number of messages that trigger Uncontrolled Resource Consumption.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://files.opcfoundation.org/SecurityBulletins/OPC%20Foundation%20Security%20Bulletin%20CVE-2022-29864.pdf; https://opcfoundation.org/security/; https://files.opcfoundation.org/SecurityBulletins/OPC%20Foundation%20Security%20Bulletin%20CVE-2022-29864.pdf
CVE: CVE-2022-29866
Published: 2022-06-16
Description: OPC UA .NET Standard Stack 1.04.368 allows a remote attacker to exhaust the memory resources of a server via a crafted request that triggers Uncontrolled Resource Consumption.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://files.opcfoundation.org/SecurityBulletins/OPC%20Foundation%20Security%20Bulletin%20CVE-2022-29866.pdf; https://opcfoundation.org/security/; https://files.opcfoundation.org/SecurityBulletins/OPC%20Foundation%20Security%20Bulletin%20CVE-2022-29866.pdf
CVE: CVE-2022-2085
Published: 2022-06-16
Description: A NULL pointer dereference vulnerability was found in Ghostscript, which occurs when it tries to render a large number of bits in memory. When allocating a buffer device, it relies on an init_device_procs defined for the device that uses it as a prototype that depends upon the number of bits per pixel. For bpp > 64, mem_x_device is used and does not have an init_device_procs defined. This flaw allows an attacker to parse a large number of bits (more than 64 bits per pixel), which triggers a NULL pointer dereference flaw, causing an application to crash.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: http://git.ghostscript.com/?p=ghostpdl.git%3Bh=ae1061d948d88667bdf51d47d918c4684d0f67df; https://bugs.ghostscript.com/show_bug.cgi?id=704945; https://bugzilla.redhat.com/show_bug.cgi?id=2095261
CVE: CVE-2022-30650
Published: 2022-06-16
Description: Adobe InCopy versions 17.2 (and earlier) and 16.4.1 (and earlier) are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: https://helpx.adobe.com/security/products/incopy/apsb22-29.html; https://helpx.adobe.com/security/products/incopy/apsb22-29.html
CVE: CVE-2022-30651
Published: 2022-06-16
Description: Adobe InCopy versions 17.2 (and earlier) and 16.4.1 (and earlier) are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/incopy/apsb22-29.html; https://helpx.adobe.com/security/products/incopy/apsb22-29.html
CVE: CVE-2022-30652
Published: 2022-06-16
Description: Adobe InCopy versions 17.2 (and earlier) and 16.4.1 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/incopy/apsb22-29.html; https://helpx.adobe.com/security/products/incopy/apsb22-29.html
CVE: CVE-2022-30653
Published: 2022-06-16
Description: Adobe InCopy versions 17.2 (and earlier) and 16.4.1 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/incopy/apsb22-29.html; https://helpx.adobe.com/security/products/incopy/apsb22-29.html
CVE: CVE-2022-30654
Published: 2022-06-16
Description: Adobe InCopy versions 17.2 (and earlier) and 16.4.1 (and earlier) are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: https://helpx.adobe.com/security/products/incopy/apsb22-29.html; https://helpx.adobe.com/security/products/incopy/apsb22-29.html
CVE: CVE-2022-30655
Published: 2022-06-16
Description: Adobe InCopy versions 17.2 (and earlier) and 16.4.1 (and earlier) are affected by a Use-After-Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://helpx.adobe.com/security/products/incopy/apsb22-29.html; https://helpx.adobe.com/security/products/incopy/apsb22-29.html
CVE: CVE-2022-30656
Published: 2022-06-16
Description: Adobe InCopy versions 17.2 (and earlier) and 16.4.1 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/incopy/apsb22-29.html; https://helpx.adobe.com/security/products/incopy/apsb22-29.html
CVE: CVE-2022-30657
Published: 2022-06-16
Description: Adobe InCopy versions 17.2 (and earlier) and 16.4.1 (and earlier) are affected by a Use-After-Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://helpx.adobe.com/security/products/incopy/apsb22-29.html; https://helpx.adobe.com/security/products/incopy/apsb22-29.html
CVE: CVE-2022-30664
Published: 2022-06-16
Description: Adobe Animate version 22.0.5 (and earlier) is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/animate/apsb22-24.html; https://helpx.adobe.com/security/products/animate/apsb22-24.html
CVE: CVE-2022-31294
Published: 2022-06-16
Description: An issue in the save_users() function of Online Discussion Forum Site 1 allows unauthenticated attackers to arbitrarily create or update user accounts.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://github.com/bigzooooz/CVE-2022-31294; https://www.sourcecodester.com/php/15337/online-discussion-forum-site-phpoop-free-source-code.html; https://github.com/bigzooooz/CVE-2022-31294
CVE: CVE-2022-31301
Published: 2022-06-16
Description: Haraj v3.7 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Post Ads component.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://angtech.org; https://angtech.org/product/view/3; https://github.com/bigzooooz/CVE-2022-31301