deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-40363
Published: 2022-09-29
Description: A buffer overflow in the component nfc_device_load_mifare_ul_data of Flipper Devices Inc., Flipper Zero before v0.65.2 allows attackers to cause a Denial of Service (DoS) via a crafted NFC file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://github.com/flipperdevices/flipperzero-firmware/pull/1697; https://vvx7.io/posts/2022/09/your-amiibos-haunted/; https://github.com/flipperdevices/flipperzero-firmware/pull/1697
CVE: CVE-2022-40890
Published: 2022-09-29
Description: A vulnerability in /src/amf/amf-context.c in Open5GS 2.4.10 and earlier leads to AMF denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-404, CWE-404
References: https://github.com/ToughRunner/Open5gs_bugreport; https://github.com/ToughRunner/Open5gs_bugreport
CVE: CVE-2022-40407
Published: 2022-09-29
Description: A zip slip vulnerability in the file upload function of Chamilo v1.11 allows attackers to execute arbitrary code via a crafted Zip file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434, CWE-434
References: https://github.com/alexmackey/security-research/blob/main/chamilo/ChamiloRceViaZipSlip.md; https://github.com/chamilo/chamilo-lms; https://support.chamilo.org/projects/chamilo-18/wiki/Security_issues#Issue-94-2022-09-06-High-impact-Moderate-risk-Authenticated-RCE-via-zipslip-attack-in-file-upload
CVE: CVE-2022-40408
Published: 2022-09-29
Description: FeehiCMS v2.1.1 was discovered to contain a cross-site scripting (XSS) vulnerability via a crafted payload injected into the Comment box under the Single Page module.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/liufee/feehicms/issues/3; https://github.com/liufee/feehicms/issues/3
CVE: CVE-2022-38732
Published: 2022-09-29
Description: SnapCenter versions prior to 4.7 shipped without Content Security Policy (CSP) implemented which could allow certain types of attacks that otherwise would be prevented.
CVSS Score: 7.5 (HIGH)
CWE: CWE-358
References: https://security.netapp.com/advisory/NTAP-20[PII_REDACTED]/; https://security.netapp.com/advisory/NTAP-20[PII_REDACTED]/
CVE: CVE-2022-39252
Published: 2022-09-29
Description: matrix-rust-sdk is an implementation of a Matrix client-server library in Rust, and matrix-sdk-crypto is the Matrix encryption library. Prior to version 0.6, when a user requests a room key from their devices, the software correctly remembers the request. When the user receives a forwarded room key, the software accepts it without checking who the room key came from. This allows homeservers to try to insert room keys of questionable validity, potentially mounting an impersonation attack. Version 0.6 fixes this issue.
CVSS Score: 8.6 (HIGH)
CWE: CWE-287, CWE-322
References: https://github.com/matrix-org/matrix-rust-sdk/commit/093fb5d0aa21c0b5eaea6ec96b477f1075271cbb; https://github.com/matrix-org/matrix-rust-sdk/commit/41449d2cc360e347f5d4e1c154ec1e3185f11acd; https://github.com/matrix-org/matrix-rust-sdk/releases/tag/matrix-sdk-0.6.0
CVE: CVE-2022-39254
Published: 2022-09-29
Description: matrix-nio is a Python Matrix client library, designed according to sans I/O principles. Prior to version 0.20, when a users requests a room key from their devices, the software correctly remember the request. Once they receive a forwarded room key, they accept it without checking who the room key came from. This allows homeservers to try to insert room keys of questionable validity, potentially mounting an impersonation attack. Version 0.20 fixes the issue.
CVSS Score: 8.6 (HIGH)
CWE: CWE-287, CWE-322
References: https://github.com/poljar/matrix-nio/commit/b1cbf234a831daa160673defd596e6450e9c29f0; https://github.com/poljar/matrix-nio/security/advisories/GHSA-w4pr-4vjg-hffh; https://github.com/poljar/matrix-nio/commit/b1cbf234a831daa160673defd596e6450e9c29f0
CVE: CVE-2022-39168
Published: 2022-09-29
Description: IBM Robotic Process Automation Clients are vulnerable to proxy credentials being exposed in upgrade logs. IBM X-Force ID: 235422.
CVSS Score: 7.5 (HIGH)
CWE: CWE-522, CWE-522
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/235422; https://www.ibm.com/support/pages/node/6824885; https://exchange.xforce.ibmcloud.com/vulnerabilities/235422
CVE: CVE-2022-40931
Published: 2022-09-29
Description: dutchcoders Transfer.sh 1.4.0 is vulnerable to Cross Site Scripting (XSS).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/dutchcoders/transfer.sh/issues/500; https://github.com/dutchcoders/transfer.sh/pull/501; https://github.com/dutchcoders/transfer.sh/issues/500
CVE: CVE-2022-29503
Published: 2022-09-29
Description: A memory corruption vulnerability exists in the libpthread linuxthreads functionality of uClibC 0.9.33.2 and uClibC-ng 1.0.40. Thread allocation can lead to memory corruption. An attacker can create threads to trigger this vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119, CWE-770
References: https://talosintelligence.com/vulnerability_reports/TALOS-2022-1517; https://talosintelligence.com/vulnerability_reports/TALOS-2022-1517
CVE: CVE-2022-29504
Published: 2022-09-29
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2022. Notes: none
CVE: CVE-2022-40879
Published: 2022-09-29
Description: kkFileView v4.1.0 is vulnerable to Cross Site Scripting (XSS) via the parameter 'errorMsg.'
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/kekingcn/kkFileView/issues/389; https://github.com/kekingcn/kkFileView/issues/389
CVE: CVE-2022-40887
Published: 2022-09-29
Description: SourceCodester Best Student Result Management System 1.0 is vulnerable to SQL Injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/toyydsBT123/One_of_my_take_on_SourceCodester/blob/main/Best-Student-Result-Management-System_1.0.poc.md; https://github.com/toyydsBT123/One_of_my_take_on_SourceCodester/blob/main/Best-Student-Result-Management-System_1.0.poc.md
CVE: CVE-2022-39266
Published: 2022-09-29
Description: isolated-vm is a library for nodejs which gives the user access to v8's Isolate interface. In versions 4.3.6 and prior, if the untrusted v8 cached data is passed to the API through CachedDataOptions, attackers can bypass the sandbox and run arbitrary code in the nodejs process. Version 4.3.7 changes the documentation to warn users that they should not accept `cachedData` payloads from a user.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-20, CWE-693, CWE-20
References: https://github.com/laverdet/isolated-vm/commit/218e87a6d4e8cb818bea76d1ab30cd0be51920e8; https://github.com/laverdet/isolated-vm/commits/v4.3.7; https://github.com/laverdet/isolated-vm/issues/379
CVE: CVE-2022-33880
Published: 2022-09-29
Description: hms-staff.php in Projectworlds Hospital Management System Mini-Project through 2018-06-17 allows SQL injection via the type parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/projectworldsofficial/hospital-management-system-in-php/issues/7; https://github.com/projectworldsofficial/hospital-management-system-in-php/issues/7
CVE: CVE-2022-35137
Published: 2022-09-29
Description: DGIOT Lightweight industrial IoT v4.5.4 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html; https://securityblog101.blogspot.com/2022/09/cve-id-cve-2022-35137.html; https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html
CVE: CVE-2022-36066
Published: 2022-09-29
Description: Discourse is an open source discussion platform. In versions prior to 2.8.9 on the `stable` branch and prior to 2.9.0.beta10 on the `beta` and `tests-passed` branches, admins can upload a maliciously crafted Zip or Gzip Tar archive to write files at arbitrary locations and trigger remote code execution. The problem is patched in version 2.8.9 on the `stable` branch and version 2.9.0.beta10 on the `beta` and `tests-passed` branches. There are no known workarounds.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-434
References: https://github.com/discourse/discourse/commit/b27d5626d208a22c516a0adfda7554b67b493835; https://github.com/discourse/discourse/pull/18421; https://github.com/discourse/discourse/security/advisories/GHSA-grvh-qcpg-hfmv
CVE: CVE-2022-36068
Published: 2022-09-29
Description: Discourse is an open source discussion platform. In versions prior to 2.8.9 on the `stable` branch and prior to 2.9.0.beta10 on the `beta` and `tests-passed` branches, a moderator can create new and edit existing themes by using the API when they should not be able to do so. The problem is patched in version 2.8.9 on the `stable` branch and version 2.9.0.beta10 on the `beta` and `tests-passed` branches. There are no known workarounds.
CVSS Score: 7.2 (HIGH)
CWE: CWE-862
References: https://github.com/discourse/discourse/commit/ae1e536e83940d58f1c79b835c75c249121c46b6; https://github.com/discourse/discourse/pull/18418; https://github.com/discourse/discourse/security/advisories/GHSA-6crr-3662-263q
CVE: CVE-2022-39226
Published: 2022-09-29
Description: Discourse is an open source discussion platform. In versions prior to 2.8.9 on the `stable` branch and prior to 2.9.0.beta10 on the `beta` and `tests-passed` branches, a malicious actor can add large payloads of text into the Location and Website fields of a user profile, which causes issues for other users when loading that profile. A fix to limit the length of user input for these fields is included in version 2.8.9 on the `stable` branch and version 2.9.0.beta10 on the `beta` and `tests-passed` branches. There are no known workarounds.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20, CWE-770, CWE-770
References: https://github.com/discourse/discourse/commit/e69f7d2fd9c977dedbdb17f6813651e2a45bfb71; https://github.com/discourse/discourse/pull/18302; https://github.com/discourse/discourse/security/advisories/GHSA-jw3q-xg5g-qjrw
CVE: CVE-2022-40472
Published: 2022-09-29
Description: ZKTeco Xiamen Information Technology ZKBio Time 8.0.7 Build: 20[PII_REDACTED]9 was discovered to contain a CSV injection vulnerability. This vulnerability allows attackers to execute arbitrary code via a crafted payload injected into the Content text field of the Add New Message module.
CVSS Score: 8.0 (HIGH)
CWE: CWE-1236, CWE-1236
References: https://the-it-wonders.blogspot.com/2022/09/zkbio-time-csv-injection.html; https://the-it-wonders.blogspot.com/2022/09/zkbio-time-csv-injection.html
CVE: CVE-2022-39232
Published: 2022-09-29
Description: Discourse is an open source discussion platform. Starting with version 2.9.0.beta5 and prior to version 2.9.0.beta10, an incomplete quote can generate a JavaScript error which will crash the current page in the browser in some cases. Version 2.9.0.beta10 added a fix and tests to ensure incomplete quotes won't break the app. As a workaround, the quote can be fixed via the rails console.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://github.com/discourse/discourse/commit/eab33af5bf19827527fe79134d865b5c727f6530; https://github.com/discourse/discourse/pull/18311; https://github.com/discourse/discourse/security/advisories/GHSA-cv64-v73f-7wq5
CVE: CVE-2022-3364
Published: 2022-09-29
Description: Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.5.0a3.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://github.com/ikus060/rdiffweb/commit/b62c479ff6979563c7c23e7182942bc4f460a2c7; https://huntr.dev/bounties/e70ad507-1424-463b-bdf1-c4a6fbe6e720; https://github.com/ikus060/rdiffweb/commit/b62c479ff6979563c7c23e7182942bc4f460a2c7
CVE: CVE-2022-41828
Published: 2022-09-29
Description: In Amazon AWS Redshift JDBC Driver (aka amazon-redshift-jdbc-driver or redshift-jdbc42) before 2.1.0.8, the Object Factory does not check the class type when instantiating an object from a class name.
CVSS Score: 8.1 (HIGH)
CWE: CWE-704, CWE-704
References: https://github.com/aws/amazon-redshift-jdbc-driver/commit/40b143b4698faf90c788ffa89f2d4d8d2ad068b5; https://github.com/aws/amazon-redshift-jdbc-driver/security/advisories/GHSA-jc69-hjw2-fm86; https://github.com/aws/amazon-redshift-jdbc-driver/commit/40b143b4698faf90c788ffa89f2d4d8d2ad068b5
CVE: CVE-2022-2778
Published: 2022-09-30
Description: In affected versions of Octopus Deploy it is possible to bypass rate limiting on login using null bytes.
CVSS Score: 9.8 (CRITICAL)
References: https://advisories.octopus.com/post/2022/sa2022-15/; https://advisories.octopus.com/post/2022/sa2022-15/
CVE: CVE-2022-21222
Published: 2022-09-30
Description: The package css-what before 2.1.3 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the usage of insecure regular expression in the re_attr variable of index.js. The exploitation of this vulnerability could be triggered via the parse function.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-1333, CWE-1333
References: https://github.com/fb55/css-what/blob/a38effd5a8f5506d75c7f8f13cbd8c76248a3860/index.js%23L12; https://lists.debian.org/debian-lts-announce/2023/03/msg00001.html; https://security.snyk.io/vuln/SNYK-JS-CSSWHAT-3035488
CVE: CVE-2022-24373
Published: 2022-09-30
Description: The package react-native-reanimated before 3.0.0-rc.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper usage of regular expression in the parser of Colors.js.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-1333, CWE-1333
References: https://github.com/software-mansion/react-native-reanimated/pull/3382; https://github.com/software-mansion/react-native-reanimated/pull/3382/commits/7adf06d0c59382d884a04be86a96eede3d0432fa; https://github.com/software-mansion/react-native-reanimated/releases/tag/3.0.0-rc.1
CVE: CVE-2022-41841
Published: 2022-09-30
Description: An issue was discovered in Bento4 through 1.6.0-639. A NULL pointer dereference occurs in AP4_File::ParseStream in Core/Ap4File.cpp, which is called from AP4_File::AP4_File.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://github.com/axiomatic-systems/Bento4/issues/779; https://github.com/axiomatic-systems/Bento4/issues/779
CVE: CVE-2022-41842
Published: 2022-09-30
Description: An issue was discovered in Xpdf 4.04. There is a crash in gfseek(_IO_FILE*, long, int) in goo/gfile.cc.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787, CWE-787
References: http://www.xpdfreader.com/download.html; https://forum.xpdfreader.com/viewtopic.php?f=1&t=42340&p=43928&hilit=gfseek#p43928; http://www.xpdfreader.com/download.html
CVE: CVE-2022-41843
Published: 2022-09-30
Description: An issue was discovered in Xpdf 4.04. There is a crash in convertToType0 in fofi/FoFiType1C.cc, a different vulnerability than CVE-2022-38928.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://forum.xpdfreader.com/viewtopic.php?f=1&t=42344; https://forum.xpdfreader.com/viewtopic.php?f=3&t=42325&sid=7b08ba9a518a99ce3c5ff40e53fc6421; https://forum.xpdfreader.com/viewtopic.php?f=1&t=42344
CVE: CVE-2022-41844
Published: 2022-09-30
Description: An issue was discovered in Xpdf 4.04. There is a crash in XRef::fetch(int, int, Object*, int) in xpdf/XRef.cc, a different vulnerability than CVE-2018-16369 and CVE-2019-16088.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787, CWE-787
References: http://www.xpdfreader.com/download.html; https://forum.xpdfreader.com/viewtopic.php?f=1&t=42340&p=43928&hilit=gfseek#p43928; https://forum.xpdfreader.com/viewtopic.php?f=3&t=42308&p=43844&hilit=XRef%3A%3Afetch#p43844
CVE: CVE-2022-41845
Published: 2022-09-30
Description: An issue was discovered in Bento4 1.6.0-639. There ie excessive memory consumption in the function AP4_Array<AP4_ElstEntry>::EnsureCapacity in Core/Ap4Array.h.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-770, CWE-770
References: https://github.com/axiomatic-systems/Bento4/issues/747; https://github.com/axiomatic-systems/Bento4/issues/770; https://github.com/axiomatic-systems/Bento4/issues/747
CVE: CVE-2022-41846
Published: 2022-09-30
Description: An issue was discovered in Bento4 1.6.0-639. There ie excessive memory consumption in the function AP4_DataBuffer::ReallocateBuffer in Core/Ap4DataBuffer.cpp.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-770, CWE-770
References: https://github.com/axiomatic-systems/Bento4/issues/342; https://github.com/axiomatic-systems/Bento4/issues/770; https://github.com/axiomatic-systems/Bento4/issues/342
CVE: CVE-2022-41847
Published: 2022-09-30
Description: An issue was discovered in Bento4 1.6.0-639. A memory leak exists in AP4_StdcFileByteStream::Create(AP4_FileByteStream*, char const*, AP4_FileByteStream::Mode, AP4_ByteStream*&) in System/StdC/Ap4StdCFileByteStream.cpp.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401, CWE-401
References: https://github.com/axiomatic-systems/Bento4/issues/750; https://github.com/axiomatic-systems/Bento4/issues/759; https://github.com/axiomatic-systems/Bento4/issues/775
CVE: CVE-2022-41848
Published: 2022-09-30
Description: drivers/char/pcmcia/synclink_cs.c in the Linux kernel through 5.19.12 has a race condition and resultant use-after-free if a physically proximate attacker removes a PCMCIA device while calling ioctl, aka a race condition between mgslpc_ioctl and mgslpc_detach.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-362, CWE-416, CWE-362, CWE-416
References: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/log/drivers/char/pcmcia/synclink_cs.c; https://lore.kernel.org/lkml/[PII_REDACTED]0251.GA302541%40ubuntu/T/#rc85e751f467b3e6f9ccef92cfa7fb8a6cc50c270; https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/log/drivers/char/pcmcia/synclink_cs.c
CVE: CVE-2022-41849
Published: 2022-09-30
Description: drivers/video/fbdev/smscufx.c in the Linux kernel through 5.19.12 has a race condition and resultant use-after-free if a physically proximate attacker removes a USB device while calling open(), aka a race condition between ufx_ops_open and ufx_usb_disconnect.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-362, CWE-416
References: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=5610bcfe8693c02e2e4c8b31427f1bdbdecc839c; https://lists.debian.org/debian-lts-announce/2022/12/msg00031.html; https://lists.debian.org/debian-lts-announce/2022/12/msg00034.html
CVE: CVE-2022-41850
Published: 2022-09-30
Description: roccat_report_event in drivers/hid/hid-roccat.c in the Linux kernel through 5.19.12 has a race condition and resultant use-after-free in certain situations where a report is received while copying a report->value is in progress.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-362, CWE-416
References: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=cacdb14b1c8d3804a3a7d31773bc7569837b71a4; https://lists.debian.org/debian-lts-announce/2022/12/msg00031.html; https://lists.debian.org/debian-lts-announce/2022/12/msg00034.html
CVE: CVE-2022-2922
Published: 2022-09-30
Description: Relative Path Traversal in GitHub repository dnnsoftware/dnn.platform prior to 9.11.0.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-23, CWE-22
References: https://github.com/dnnsoftware/dnn.platform/commit/9b17351592fbde376506ba6705dbcc7a74a2a195; https://huntr.dev/bounties/74918f40-dc11-4218-abef-064eb71a0703; https://github.com/dnnsoftware/dnn.platform/commit/9b17351592fbde376506ba6705dbcc7a74a2a195
CVE: CVE-2022-2529
Published: 2022-09-30
Description: sflow decode package does not employ sufficient packet sanitisation which can lead to a denial of service attack. Attackers can craft malformed packets causing the process to consume large amounts of memory resulting in a denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-400, CWE-400
References: https://github.com/cloudflare/goflow/security/advisories/GHSA-9rpw-2h95-666c; https://github.com/cloudflare/goflow/security/advisories/GHSA-9rpw-2h95-666c
CVE: CVE-2022-37461
Published: 2022-09-30
Description: Multiple cross-site scripting (XSS) vulnerabilities in Canon Medical Vitrea View 7.x before 7.7.6 allow remote attackers to inject arbitrary web script or HTML via (1) the input after the error subdirectory to the /vitrea-view/error/ subdirectory, or the (2) groupID, (3) offset, or (4) limit parameter to an Administrative Panel (Group and Users) page. There is a risk of an attacker retrieving patient information.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=30693; https://www.vitalimages.com/customer-success-support-program/vital-images-software-security-updates/; https://www.vitalimages.com/vitrea-vision/vitrea-view/
CVE: CVE-2022-3371
Published: 2022-09-30
Description: Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.5.0a3.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://github.com/ikus060/rdiffweb/commit/b62c479ff6979563c7c23e7182942bc4f460a2c7; https://huntr.dev/bounties/4e8f6136-50c7-4fa1-ac98-699bcb7b35ce; https://github.com/ikus060/rdiffweb/commit/b62c479ff6979563c7c23e7182942bc4f460a2c7
CVE: CVE-2022-23726
Published: 2022-09-30
Description: PingCentral versions prior to listed versions expose Spring Boot actuator endpoints that with administrative authentication return large amounts of sensitive environmental and application information.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-200, CWE-732
References: https://docs.pingidentity.com/bundle/pingcentral-110/page/sdd[PII_REDACTED]85.html; https://www.pingidentity.com/en/resources/downloads/pingcentral.html; https://docs.pingidentity.com/bundle/pingcentral-110/page/sdd[PII_REDACTED]85.html
CVE: CVE-2022-41437
Published: 2022-09-30
Description: Billing System Project v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the component /php_action/createProduct.php.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434, CWE-434
References: https://github.com/chi645190147/bug_report/blob/main/vendors/mayuri_k/billing-system-project/RCE-1.md; https://github.com/chi645190147/bug_report/blob/main/vendors/mayuri_k/billing-system-project/RCE-1.md
CVE: CVE-2022-41439
Published: 2022-09-30
Description: Billing System Project v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /phpinventory/edituser.php.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/chi645190147/bug_report/blob/main/vendors/mayuri_k/billing-system-project/SQLi-2.md; https://github.com/chi645190147/bug_report/blob/main/vendors/mayuri_k/billing-system-project/SQLi-2.md
CVE: CVE-2022-41440
Published: 2022-09-30
Description: Billing System Project v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /phpinventory/editcategory.php.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/chi645190147/bug_report/blob/main/vendors/mayuri_k/billing-system-project/SQLi-1.md; https://github.com/chi645190147/bug_report/blob/main/vendors/mayuri_k/billing-system-project/SQLi-1.md
CVE: CVE-2021-36830
Published: 2022-09-30
Description: Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Comment Guestbook plugin <= 0.8.0 at WordPress.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/comment-guestbook/wordpress-comment-guestbook-plugin-0-8-0-authenticated-stored-cross-site-scripting-xss-vulnerability?_s_id=cve; https://wordpress.org/plugins/comment-guestbook/; https://patchstack.com/database/vulnerability/comment-guestbook/wordpress-comment-guestbook-plugin-0-8-0-authenticated-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2021-36839
Published: 2022-09-30
Description: Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Social Media Follow Buttons Bar plugin <= 4.73 at WordPress.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/social-media-buttons-toolbar/wordpress-social-media-follow-buttons-bar-plugin-4-73-authenticated-stored-cross-site-scripting-xss-vulnerability?_s_id=cve; https://wordpress.org/plugins/social-media-buttons-toolbar/; https://patchstack.com/database/vulnerability/social-media-buttons-toolbar/wordpress-social-media-follow-buttons-bar-plugin-4-73-authenticated-stored-cross-site-scripting-xss-vulnerability?_s_id=cve