deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-27431
Published: 2022-05-03
Description: ARM CMSIS RTOS2 versions prior to 2.1.3 are vulnerable to integer wrap-around inosRtxMemoryAlloc (local malloc equivalent) function, which can lead to arbitrary memory allocation, resulting in unexpected behavior such as a crash or injected code execution.
CVSS Score: 7.3 (HIGH)
CWE: CWE-190
References: https://www.cisa.gov/uscert/ics/advisories/icsa-21-119-04; https://www.cisa.gov/uscert/ics/advisories/icsa-21-119-04
CVE: CVE-2021-27433
Published: 2022-05-03
Description: ARM mbed-ualloc memory library version 1.3.0 is vulnerable to integer wrap-around in function mbed_krbs, which can lead to arbitrary memory allocation, resulting in unexpected behavior such as a crash or a remote code injection/execution.
CVSS Score: 7.3 (HIGH)
CWE: CWE-190, CWE-190
References: https://github.com/ARMmbed/mbed-os/pull/14408; https://www.cisa.gov/uscert/ics/advisories/icsa-21-119-04; https://github.com/ARMmbed/mbed-os/pull/14408
CVE: CVE-2021-27435
Published: 2022-05-03
Description: ARM mbed product Version 6.3.0 is vulnerable to integer wrap-around in malloc_wrapper function, which can lead to arbitrary memory allocation, resulting in unexpected behavior such as a crash or a remote code injection/execution.
CVSS Score: 7.3 (HIGH)
CWE: CWE-190
References: https://github.com/ARMmbed/mbed-os/pull/14408; https://www.cisa.gov/uscert/ics/advisories/icsa-21-119-04; https://github.com/ARMmbed/mbed-os/pull/14408
CVE: CVE-2021-27439
Published: 2022-05-03
Description: TencentOS-tiny version 3.1.0 is vulnerable to integer wrap-around in function 'tos_mmheap_alloc incorrect calculation of effective memory allocation size. This improper memory assignment can lead to arbitrary memory allocation, resulting in unexpected behavior such as a crash or a remote code injection/execution.
CVSS Score: 7.3 (HIGH)
CWE: CWE-190
References: https://www.cisa.gov/uscert/ics/advisories/icsa-21-119-04; https://www.cisa.gov/uscert/ics/advisories/icsa-21-119-04
CVE: CVE-2022-1548
Published: 2022-05-03
Description: Mattermost Playbooks plugin 1.25 and earlier fails to properly restrict user-level permissions, which allows playbook members to escalate their membership privileges and perform actions restricted to playbook admins.
CVSS Score: 3.7 (LOW)
CWE: CWE-264
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2022-20101
Published: 2022-05-03
Description: In aee daemon, there is a possible information disclosure due to a path traversal. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06419017; Issue ID: ALPS06270870.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-22
References: https://corp.mediatek.com/product-security-bulletin/May-2022; https://corp.mediatek.com/product-security-bulletin/May-2022
CVE: CVE-2022-20102
Published: 2022-05-03
Description: In aee daemon, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06296442; Issue ID: ALPS06296405.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-862
References: https://corp.mediatek.com/product-security-bulletin/May-2022; https://corp.mediatek.com/product-security-bulletin/May-2022
CVE: CVE-2022-20103
Published: 2022-05-03
Description: In aee daemon, there is a possible information disclosure due to symbolic link following. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06383944; Issue ID: ALPS06282684.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-59
References: https://corp.mediatek.com/product-security-bulletin/May-2022; https://corp.mediatek.com/product-security-bulletin/May-2022
CVE: CVE-2022-20104
Published: 2022-05-03
Description: In aee daemon, there is a possible information disclosure due to improper access control. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06419017; Issue ID: ALPS06284104.
CVSS Score: 5.5 (MEDIUM)
References: https://corp.mediatek.com/product-security-bulletin/May-2022; https://corp.mediatek.com/product-security-bulletin/May-2022
CVE: CVE-2022-20105
Published: 2022-05-03
Description: In MM service, there is a possible out of bounds write due to a stack-based buffer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: DTV03330460; Issue ID: DTV03330460.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://corp.mediatek.com/product-security-bulletin/May-2022; https://corp.mediatek.com/product-security-bulletin/May-2022
CVE: CVE-2022-20106
Published: 2022-05-03
Description: In MM service, there is a possible out of bounds write due to a heap-based buffer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: DTV03330460; Issue ID: DTV03330460.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://corp.mediatek.com/product-security-bulletin/May-2022; https://corp.mediatek.com/product-security-bulletin/May-2022
CVE: CVE-2022-20107
Published: 2022-05-03
Description: In subtitle service, there is a possible application crash due to an integer overflow. This could lead to local denial of service with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: DTV03330673; Issue ID: DTV03330673.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-190
References: https://corp.mediatek.com/product-security-bulletin/May-2022; https://corp.mediatek.com/product-security-bulletin/May-2022
CVE: CVE-2022-20108
Published: 2022-05-03
Description: In voice service, there is a possible out of bounds write due to a stack-based buffer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: DTV03330702; Issue ID: DTV03330702.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://corp.mediatek.com/product-security-bulletin/May-2022; https://corp.mediatek.com/product-security-bulletin/May-2022
CVE: CVE-2022-20111
Published: 2022-05-03
Description: In ion, there is a possible use after free due to incorrect error handling. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06366069; Issue ID: ALPS06366069.
CVSS Score: 8.4 (HIGH)
CWE: CWE-755
References: https://corp.mediatek.com/product-security-bulletin/May-2022; https://corp.mediatek.com/product-security-bulletin/May-2022
CVE: CVE-2022-21743
Published: 2022-05-03
Description: In ion, there is a possible use after free due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06371108; Issue ID: ALPS06371108.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190
References: https://corp.mediatek.com/product-security-bulletin/May-2022; https://corp.mediatek.com/product-security-bulletin/May-2022
CVE: CVE-2022-27413
Published: 2022-05-03
Description: Hospital Management System v1.0 was discovered to contain a SQL injection vulnerability via the adminname parameter in admin.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/HH1F/Hospital-Management-System-V1.0-SQLi; https://github.com/HH1F/Hospital-Management-System-V1.0-SQLi
CVE: CVE-2021-43159
Published: 2022-05-04
Description: A Remote Code Execution (RCE) vulnerability exists in Ruijie Networks Ruijie RG-EW Series Routers up to ReyeeOS 1.55.1915 / EW_3.0(1)B11P55 via the setSessionTime function in /cgi-bin/luci/api/common..
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: http://ruijie.com; https://seclists.org/fulldisclosure/2022/May/0; http://ruijie.com
CVE: CVE-2021-43160
Published: 2022-05-04
Description: A Remote Code Execution (RCE) vulnerability exists in Ruijie Networks Ruijie RG-EW Series Routers up to ReyeeOS 1.55.1915 / EW_3.0(1)B11P55 via the switchFastDhcp function in /cgi-bin/luci/api/diagnose.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: http://ruijie.com; https://seclists.org/fulldisclosure/2022/May/0; http://ruijie.com
CVE: CVE-2021-43161
Published: 2022-05-04
Description: A Remote Code Execution (RCE) vulnerability exists in Ruijie Networks Ruijie RG-EW Series Routers up to ReyeeOS 1.55.1915 / EW_3.0(1)B11P55 via the doSwitchApi function in /cgi-bin/luci/api/switch.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: http://ruijie.com; https://seclists.org/fulldisclosure/2022/May/0; http://ruijie.com
CVE: CVE-2021-43162
Published: 2022-05-04
Description: A Remote Code Execution (RCE) vulnerability exists in Ruijie Networks Ruijie RG-EW Series Routers up to ReyeeOS 1.55.1915 / EW_3.0(1)B11P55 via the runPackDiagnose function in /cgi-bin/luci/api/diagnose.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: http://ruijie.com; https://seclists.org/fulldisclosure/2022/May/0; http://ruijie.com
CVE: CVE-2021-43163
Published: 2022-05-04
Description: A Remote Code Execution (RCE) vulnerability exists in Ruijie Networks Ruijie RG-EW Series Routers up to ReyeeOS 1.55.1915 / EW_3.0(1)B11P55 via the checkNet function in /cgi-bin/luci/api/auth.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: http://ruijie.com; https://seclists.org/fulldisclosure/2022/May/0; http://ruijie.com
CVE: CVE-2021-43164
Published: 2022-05-04
Description: A Remote Code Execution (RCE) vulnerability exists in Ruijie Networks Ruijie RG-EW Series Routers up to ReyeeOS 1.55.1915 / EW_3.0(1)B11P55 via the updateVersion function in /cgi-bin/luci/api/wireless.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: http://packetstormsecurity.com/files/167099/Ruijie-Reyee-Mesh-Router-Remote-Code-Execution.html; http://ruijie.com; https://seclists.org/fulldisclosure/2022/May/0
CVE: CVE-2022-24901
Published: 2022-05-04
Description: Improper validation of the Apple certificate URL in the Apple Game Center authentication adapter allows attackers to bypass authentication, making the server vulnerable to DoS attacks. The vulnerability has been fixed by improving the URL validation and adding additional checks of the resource the URL points to before downloading it.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287, CWE-295, CWE-295
References: https://github.com/parse-community/parse-server/security/advisories/GHSA-qf8x-vqjv-92gr; https://github.com/parse-community/parse-server/security/advisories/GHSA-qf8x-vqjv-92gr
CVE: CVE-2022-27420
Published: 2022-05-04
Description: Hospital Management System v1.0 was discovered to contain a SQL injection vulnerability via the patient_contact parameter in patientsearch.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/kishan0725/Hospital-Management-System/issues/19; https://github.com/kishan0725/Hospital-Management-System/issues/19
CVE: CVE-2022-27431
Published: 2022-05-04
Description: Wuzhicms v4.1.0 was discovered to contain a SQL injection vulnerability via the groupid parameter at /coreframe/app/member/admin/group.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/wuzhicms/wuzhicms/issues/200; https://github.com/wuzhicms/wuzhicms/issues/200
CVE: CVE-2022-27470
Published: 2022-05-04
Description: SDL_ttf v2.0.18 and below was discovered to contain an arbitrary memory write via the function TTF_RenderText_Solid(). This vulnerability is triggered via a crafted TTF file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/libsdl-org/SDL_ttf/commit/db1b41ab8bde6723c24b866e466cad78c2fa0448; https://github.com/libsdl-org/SDL_ttf/issues/187; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EAGMQMRQDTZFQW64JEW3O6HY3JYLAAHT/
CVE: CVE-2022-28055
Published: 2022-05-04
Description: Fusionpbx v4.4 and below contains a command injection vulnerability via the download email logs function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/fusionpbx/fusionpbx/commit/4e260b170e17705c4c9ccf787be7711b63a40868; https://github.com/fusionpbx/fusionpbx/commit/4e260b170e17705c4c9ccf787be7711b63a40868
CVE: CVE-2022-1502
Published: 2022-05-04
Description: Permissions were not properly verified in the API on projects using version control in Git. This allowed projects to be modified by users with only ProjectView permissions.
CVSS Score: 4.3 (MEDIUM)
References: https://advisories.octopus.com/post/2022/sa2022-03/; https://advisories.octopus.com/post/2022/sa2022-03/
CVE: CVE-2022-1555
Published: 2022-05-04
Description: DOM XSS in microweber ver 1.2.15 in GitHub repository microweber/microweber prior to 1.2.16. inject arbitrary js code, deface website, steal cookie...
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/microweber/microweber/commit/724e2d186a33c0c27273107dc4f160a09384877f; https://huntr.dev/bounties/d9f9b5bd-16f3-4eaa-9e36-d4958b557687; https://github.com/microweber/microweber/commit/724e2d186a33c0c27273107dc4f160a09384877f
CVE: CVE-2021-42192
Published: 2022-05-04
Description: Konga v0.14.9 is affected by an incorrect access control vulnerability where a specially crafted request can lead to privilege escalation.
CVSS Score: 8.8 (HIGH)
CWE: CWE-863
References: https://docs.google.com/document/d/1-YU9zWiDVUps3Mb6zos3996yvZ48vW_vfOvaJLLHc4I/edit?usp=sharing; https://github.com/pantsel/konga/; https://github.com/pantsel/konga/commit/d61535277aced18b5be0313ab2d124f60f649978
CVE: CVE-2022-1571
Published: 2022-05-04
Description: Cross-site scripting - Reflected in Create Subaccount in GitHub repository neorazorx/facturascripts prior to 2022.07. This vulnerability can be arbitrarily executed javascript code to steal user'cookie, perform HTTP request, get content of `same origin` page, etc ...
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/neorazorx/facturascripts/commit/482c5a82b4d79e7a19614f5a67dc24593046cefd; https://huntr.dev/bounties/4578a690-73e5-4313-840c-ee15e5329741; https://github.com/neorazorx/facturascripts/commit/482c5a82b4d79e7a19614f5a67dc24593046cefd
CVE: CVE-2021-42185
Published: 2022-05-04
Description: wdja v2.1 is affected by a SQL injection vulnerability in the foreground search function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/XingHe0/Vulnerability-Report/blob/main/wdja%20v2.1.md; https://github.com/shadoweb/wdja/issues/12; https://github.com/XingHe0/Vulnerability-Report/blob/main/wdja%20v2.1.md
CVE: CVE-2022-28096
Published: 2022-05-04
Description: Skycaiji v2.4 was discovered to contain a remote code execution (RCE) vulnerability via /SkycaijiApp/admin/controller/Develop.php.
CVSS Score: 7.2 (HIGH)
References: https://github.com/zorlan/skycaiji/issues/39; https://github.com/zorlan/skycaiji/issues/39
CVE: CVE-2022-28111
Published: 2022-05-04
Description: MyBatis PageHelper v1.x.x-v3.7.0 v4.0.0-v5.0.0,v5.1.0-v5.3.0 was discovered to contain a time-blind SQL injection vulnerability via the orderBy parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/pagehelper/Mybatis-PageHelper; https://github.com/pagehelper/Mybatis-PageHelper.git; https://github.com/pagehelper/Mybatis-PageHelper/issues/674
CVE: CVE-2021-32010
Published: 2022-05-04
Description: Inadequate Encryption Strength vulnerability in TLS stack of Secomea SiteManager, LinkManager, GateManager may facilitate man in the middle attacks. This issue affects: Secomea SiteManager All versions prior to 9.7. Secomea LinkManager versions prior to 9.7. Secomea GateManager versions prior to 9.7.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-326, CWE-326
References: https://www.secomea.com/support/cybersecurity-advisory/; https://www.secomea.com/support/cybersecurity-advisory/
CVE: CVE-2022-25778
Published: 2022-05-04
Description: Cross-Site Request Forgery (CSRF) vulnerability in Web UI of Secomea GateManager allows phishing attacker to issue get request in logged in user session.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://www.secomea.com/support/cybersecurity-advisory/; https://www.secomea.com/support/cybersecurity-advisory/
CVE: CVE-2022-25779
Published: 2022-05-04
Description: Logging of Excessive Data vulnerability in audit log of Secomea GateManager allows logged in user to write text entries in audit log. This issue affects: Secomea GateManager versions prior to 9.7.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-779, CWE-400
References: https://www.secomea.com/support/cybersecurity-advisory/; https://www.secomea.com/support/cybersecurity-advisory/
CVE: CVE-2022-25780
Published: 2022-05-04
Description: Information Exposure vulnerability in web UI of Secomea GateManager allows logged in user to query devices outside own scope.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://www.secomea.com/support/cybersecurity-advisory/; https://www.secomea.com/support/cybersecurity-advisory/
CVE: CVE-2022-25781
Published: 2022-05-04
Description: Cross-site Scripting (XSS) vulnerability in Web UI of Secomea GateManager allows phishing attacker to inject javascript or html into logged in user session.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.secomea.com/support/cybersecurity-advisory/; https://www.secomea.com/support/cybersecurity-advisory/
CVE: CVE-2022-25782
Published: 2022-05-04
Description: Improper Handling of Insufficient Privileges vulnerability in Web UI of Secomea GateManager allows logged in user to access and update privileged information. This issue affects: Secomea GateManager versions prior to 9.7.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-274, CWE-269
References: https://www.secomea.com/support/cybersecurity-advisory/; https://www.secomea.com/support/cybersecurity-advisory/
CVE: CVE-2022-25783
Published: 2022-05-04
Description: Insufficient Logging vulnerability in web server of Secomea GateManager allows logged in user to issue improper queries without logging. This issue affects: Secomea GateManager versions prior to 9.7.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-778
References: https://www.secomea.com/support/cybersecurity-advisory/; https://www.secomea.com/support/cybersecurity-advisory/
CVE: CVE-2022-25784
Published: 2022-05-04
Description: Cross-site Scripting (XSS) vulnerability in Web GUI of SiteManager allows logged-in user to inject scripting. This issue affects: Secomea SiteManager all versions prior to 9.7.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-79, CWE-79
References: https://www.secomea.com/support/cybersecurity-advisory/; https://www.secomea.com/support/cybersecurity-advisory/
CVE: CVE-2022-25785
Published: 2022-05-04
Description: Stack-based Buffer Overflow vulnerability in SiteManager allows logged-in or local user to cause arbitrary code execution. This issue affects: Secomea SiteManager all versions prior to 9.7.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-121, CWE-787
References: https://www.secomea.com/support/cybersecurity-advisory/; https://www.secomea.com/support/cybersecurity-advisory/
CVE: CVE-2022-25787
Published: 2022-05-04
Description: Information Exposure Through Query Strings in GET Request vulnerability in LMM API of Secomea GateManager allows system administrator to hijack connection. This issue affects: Secomea GateManager all versions prior to 9.7.
CVSS Score: 7.5 (HIGH)
CWE: CWE-598, CWE-200
References: https://www.secomea.com/support/cybersecurity-advisory/; https://www.secomea.com/support/cybersecurity-advisory/
CVE: CVE-2022-27903
Published: 2022-05-04
Description: An OS Command Injection vulnerability in the configuration parser of Eve-NG Professional through 4.0.1-65 and Eve-NG Community through 2.0.3-112 allows a remote authenticated attacker to execute commands as root by editing virtualization command parameters of imported UNL files.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://www.eve-ng.net/; https://www.eve-ng.net/index.php/documentation/release-notes/; https://www.eve-ng.net/
CVE: CVE-2022-28066
Published: 2022-05-04
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2022-26280. Reason: This candidate is a duplicate of CVE-2022-26280. Notes: All CVE users should reference CVE-2022-26280 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2022-28067
Published: 2022-05-04
Description: An incorrect access control issue in Sandboxie Classic v5.55.13 allows attackers to cause a Denial of Service (DoS) in the Sandbox via a crafted executable.
CVSS Score: 8.6 (HIGH)
References: https://github.com/sandboxie-plus/Sandboxie/issues/1714; https://github.com/sandboxie-plus/Sandboxie/issues/1714
CVE: CVE-2022-28076
Published: 2022-05-04
Description: Seacms v11.6 was discovered to contain a remote command execution (RCE) vulnerability via the Mail Server Settings.
CVSS Score: 7.2 (HIGH)
References: https://github.com/likCodinG/seacms_vul/issues/1; https://github.com/likCodinG/seacms_vul/issues/1
CVE: CVE-2022-28081
Published: 2022-05-04
Description: A reflected cross-site scripting (XSS) vulnerability in the component Query.php of arPHP v3.6.0 allows attackers to execute arbitrary web scripts.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://albarbari.com/2022/03/24/arPHP-xss.html; https://albarbari.com/2022/03/24/arPHP-xss.html
CVE: CVE-2022-28082
Published: 2022-05-04
Description: Tenda AX12 v22.03.01.21_CN was discovered to contain a stack overflow via the list parameter at /goform/SetNetControlList.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/eeeeeeeeeeeeeeeea/IOT-vulhub/tree/main/TendaAX12; https://github.com/eeeeeeeeeeeeeeeea/IOT-vulhub/tree/main/TendaAX12
CVE: CVE-2022-28090
Published: 2022-05-04
Description: Jspxcms v10.2.0 allows attackers to execute a Server-Side Request Forgery (SSRF) via /cmscp/ext/collect/fetch_url.do?url=.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-918
References: https://gitee.com/jspxcms/Jspxcms/issues/I4ZKDR; https://gitee.com/jspxcms/Jspxcms/issues/I4ZKDR
CVE: CVE-2022-28099
Published: 2022-05-04
Description: Poultry Farm Management System v1.0 was discovered to contain a SQL injection vulnerability via the Item parameter at /farm/store.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/IbrahimEkimIsik/CVE-2022-28099/blob/main/SQL%20Injection%20For%20Poultry%20Farm%20Management%20system%201.0; https://www.sourcecodester.com/php/15230/poultry-farm-management-system-free-download.html; https://www.sourcecodester.com/sites/default/files/download/oretnom23/Redcock-Farm.zip
CVE: CVE-2022-28508
Published: 2022-05-04
Description: An XSS issue was discovered in browser_search_plugin.php in MantisBT before 2.25.2. Unescaped output of the return parameter allows an attacker to inject code into a hidden input field.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/YavuzSahbaz/CVE-2022-28508/blob/main/MantisBT%202.25.2%20XSS%20vulnurability; https://mantisbt.org/; https://sourceforge.net/projects/mantisbt/
CVE: CVE-2022-27461
Published: 2022-05-04
Description: In nopCommerce 4.50.1, an open redirect vulnerability can be triggered by luring a user to authenticate to a nopCommerce page by clicking on a crafted link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: http://nopcommerce.com; https://tf1t.gitbook.io/mycve/nopcommerce/open-redirect-on-nopcommerce-4.50.1; http://nopcommerce.com
CVE: CVE-2022-28487
Published: 2022-05-04
Description: Tcpreplay version 4.4.1 contains a memory leakage flaw in fix_ipv6_checksums() function. The highest threat from this vulnerability is to data confidentiality.
CVSS Score: 7.5 (HIGH)
CWE: CWE-401
References: https://github.com/appneta/tcpreplay/issues/723; https://github.com/appneta/tcpreplay/pull/720; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5B75AFRJUGOYHCFG2ZV2JKSUPA6MSCT5/