deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-33728
Published: 2022-08-05
Description: Exposure of sensitive information in Bluetooth prior to SMR Aug-2022 Release 1 allows local attackers to access connected BT macAddress via Settings.Gloabal.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=08; https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=08
CVE: CVE-2022-33729
Published: 2022-08-05
Description: Improper restriction of broadcasting Intent in ConfirmConnectActivity of?NFC prior to SMR Aug-2022 Release 1 leaks MAC address of the connected Bluetooth device.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-20
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=08; https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=08
CVE: CVE-2022-33730
Published: 2022-08-05
Description: Heap-based buffer overflow vulnerability in Samsung Dex for PC prior to SMR Aug-2022 Release 1 allows arbitrary code execution by physical attackers.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=08; https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=08
CVE: CVE-2022-33731
Published: 2022-08-05
Description: Improper access control vulnerability in DesktopSystemUI prior to SMR Aug-2022 Release 1 allows attackers to enable and disable arbitrary components.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-284
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=08; https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=08
CVE: CVE-2022-33732
Published: 2022-08-05
Description: Improper access control vulnerability in Samsung Dex for PC prior to SMR Aug-2022 Release 1 allows local attackers to scan and connect to PC by unprotected binder call.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-287
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=08; https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=08
CVE: CVE-2022-33733
Published: 2022-08-05
Description: Sensitive information exposure in onCharacteristicRead in Charm by Samsung prior to version 1.2.3 allows attacker to get bluetooth connection information without permission.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-927
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=08; https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=08
CVE: CVE-2022-33734
Published: 2022-08-05
Description: Sensitive information exposure in onCharacteristicChanged in Charm by Samsung prior to version 1.2.3 allows attacker to get bluetooth connection information without permission.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-927
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=08; https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=08
CVE: CVE-2022-34768
Published: 2022-08-05
Description: insert HTML / js code inside input how to get to the vulnerable input : Workers &gt; worker nickname &gt; inject in this input the code.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://www.gov.il/en/departments/faq/cve_advisories; https://www.gov.il/en/departments/faq/cve_advisories
CVE: CVE-2022-34769
Published: 2022-08-05
Description: Michlol - rashim web interface Insecure direct object references (IDOR).
First of all, the attacker needs to login.
After he performs log into the system there are some functionalities that the specific user is not allowed to perform.
However all the attacker needs to do in order to achieve his goals is to change the value of the ptMsl parameter and then
the attacker can access sensitive data that he not supposed to access because its belong to another user.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-78
References: https://www.gov.il/en/Departments/faq/cve_advisories; https://www.gov.il/en/Departments/faq/cve_advisories
CVE: CVE-2022-36284
Published: 2022-08-05
Description: Authenticated IDOR vulnerability in StoreApps Affiliate For WooCommerce premium plugin <= 4.7.0 at WordPress allows an attacker to change the PayPal email. WooCommerce PayPal Payments plugin (free) should be at least installed to get the extra input field on the user profile page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-639, CWE-639
References: https://dzv365zjfbd8v.cloudfront.net/changelogs/affiliate-for-woocommerce/changelog.txt; https://patchstack.com/database/vulnerability/affiliate-for-woocommerce/wordpress-affiliate-for-woocommerce-premium-plugin-4-7-0-authenticated-idor-vulnerability-leading-to-paypal-email-change; https://dzv365zjfbd8v.cloudfront.net/changelogs/affiliate-for-woocommerce/changelog.txt
CVE: CVE-2022-36296
Published: 2022-08-05
Description: Broken Authentication vulnerability in JumpDEMAND Inc. ActiveDEMAND plugin <= 0.2.27 at WordPress allows unauthenticated post update/create/delete.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-287, CWE-287
References: https://patchstack.com/database/vulnerability/activedemand/wordpress-activedemand-plugin-0-2-27-broken-authentication-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/activedemand/wordpress-activedemand-plugin-0-2-27-broken-authentication-vulnerability?_s_id=cve
CVE: CVE-2022-36829
Published: 2022-08-05
Description: PendingIntent hijacking vulnerability in releaseAlarm in Charm by Samsung prior to version 1.2.3 allows local attackers to access files without permission via implicit intent.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-927
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=08; https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=08
CVE: CVE-2022-36830
Published: 2022-08-05
Description: PendingIntent hijacking vulnerability in cancelAlarmManager in Charm by Samsung prior to version 1.2.3 allows local attackers to access files without permission via implicit intent.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-927
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=08; https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=08
CVE: CVE-2022-36831
Published: 2022-08-05
Description: Path traversal vulnerability in UriFileUtils of Samsung Notes prior to version 4.3.14.39 allows attacker to access some file as Samsung Notes permission.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=08; https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=08
CVE: CVE-2022-36832
Published: 2022-08-05
Description: Improper access control vulnerability in WebApp in Cameralyzer prior to versions 3.2.22, 3.3.22, 3.4.22 and 3.5.51 allows attackers to access external storage as Cameralyzer privilege.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-284
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=08; https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=08
CVE: CVE-2022-36833
Published: 2022-08-05
Description: Improper Privilege Management vulnerability in Game Optimizing Service prior to versions 3.3.04.0 in Android 10, and 3.5.04.8 in Android 11 and above allows local attacker to execute hidden function for developer by changing package name.
CVSS Score: 7.3 (HIGH)
CWE: CWE-269, CWE-269
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=08; https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=08
CVE: CVE-2022-36834
Published: 2022-08-05
Description: Exposure of Sensitive Information vulnerability in Game Launcher prior to version 6.0.07 allows local attacker to access app data with user interaction.
CVSS Score: 3.3 (LOW)
CWE: CWE-200, CWE-200
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=08; https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=08
CVE: CVE-2022-36835
Published: 2022-08-05
Description: Implicit Intent hijacking vulnerability in Samsung Internet Browser prior to version 17.0.7.34 allows attackers to access arbitrary files.
CVSS Score: 3.3 (LOW)
CWE: CWE-200
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=08; https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=08
CVE: CVE-2022-36836
Published: 2022-08-05
Description: Unprotected provider vulnerability in Charm by Samsung prior to version 1.2.3 allows attackers to read connection state without permission.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=08; https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=08
CVE: CVE-2022-36837
Published: 2022-08-05
Description: Intent redirection vulnerability using implicit intent in Samsung email prior to version 6.1.70.20 allows attacker to get sensitive information.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-285
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=08; https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=08
CVE: CVE-2022-36838
Published: 2022-08-05
Description: Implicit Intent hijacking vulnerability in Galaxy Wearable prior to version 2.2.50 allows attacker to get sensitive information.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-285
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=08; https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=08
CVE: CVE-2022-36839
Published: 2022-08-05
Description: SQL injection vulnerability via IAPService in Samsung Checkout prior to version 5.0.53.1 allows attackers to access IAP information.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=08; https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=08
CVE: CVE-2022-36840
Published: 2022-08-05
Description: DLL hijacking vulnerability in Samsung Update Setup prior to version 2.2.9.50 allows attackers to execute arbitrary code.
CVSS Score: 4.5 (MEDIUM)
CWE: CWE-427, CWE-427
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=08; https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=08
CVE: CVE-2018-1076
Published: 2022-08-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2019-10204
Published: 2022-08-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2021-28511
Published: 2022-08-05
Description: This advisory documents the impact of an internally found vulnerability in Arista EOS for security ACL bypass. The impact of this vulnerability is that the security ACL drop rule might be bypassed if a NAT ACL rule filter with permit action matches the packet flow. This could allow a host with an IP address in a range that matches the range allowed by a NAT ACL and a range denied by a Security ACL to be forwarded incorrectly as it should have been denied by the Security ACL. This can enable an ACL bypass.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-284
References: https://www.arista.com/en/support/advisories-notices/security-advisory/15862-security-advisory-0078; https://www.arista.com/en/support/advisories-notices/security-advisory/15862-security-advisory-0078
CVE: CVE-2022-1158
Published: 2022-08-05
Description: A flaw was found in KVM. When updating a guest's page table entry, vm_pgoff was improperly used as the offset to get the page's pfn. As vaddr and vm_pgoff are controllable by user-mode processes, this flaw allows unprivileged local users on the host to write outside the userspace region and potentially corrupt the kernel, resulting in a denial of service condition.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://bugzilla.redhat.com/show_bug.cgi?id=2069793; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.openwall.com/lists/oss-security/2022/04/08/4
CVE: CVE-2022-1973
Published: 2022-08-05
Description: A use-after-free flaw was found in the Linux kernel in log_replay in fs/ntfs3/fslog.c in the NTFS journal. This flaw allows a local attacker to crash the system and leads to a kernel information leak problem.
CVSS Score: 7.1 (HIGH)
CWE: CWE-416, CWE-416
References: https://bugzilla.redhat.com/show_bug.cgi?id=2092542; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://bugzilla.redhat.com/show_bug.cgi?id=2092542
CVE: CVE-2022-27535
Published: 2022-08-05
Description: Kaspersky VPN Secure Connection for Windows version up to 21.5 was vulnerable to arbitrary file deletion via abuse of its 'Delete All Service Data And Reports' feature by the local authenticated attacker.
CVSS Score: 7.8 (HIGH)
References: https://forum.kaspersky.com/topic/kaspersky-statement-on-cve-2022-27535-26742/; https://support.kaspersky.com/general/vulnerability.aspx?el=12430#050822; https://www.synopsys.com/blogs/software-security/cyrc-advisory-kasperksy-vpn-microsoft-windows/
CVE: CVE-2022-28880
Published: 2022-08-05
Description: A Denial-of-Service vulnerability was discovered in the F-Secure Atlant and in certain WithSecure products while scanning fuzzed PE32-bit files it is possible that can crash the scanning engine. The exploit can be triggered remotely by an attacker.
CVSS Score: 4.3 (MEDIUM)
References: https://www.f-secure.com/en/home/support/vulnerability-reward-program/hall-of-fame; https://www.withsecure.com/en/expertise/people; https://www.f-secure.com/en/home/support/vulnerability-reward-program/hall-of-fame
CVE: CVE-2022-29071
Published: 2022-08-05
Description: This advisory documents an internally found vulnerability in the on premises deployment model of Arista CloudVision Portal (CVP) where under a certain set of conditions, user passwords can be leaked in the Audit and System logs. The impact of this vulnerability is that the CVP user login passwords might be leaked to other authenticated users.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200, CWE-532
References: https://www.arista.com/en/support/advisories-notices/security-advisory/15865-security-advisory-0079; https://www.arista.com/en/support/advisories-notices/security-advisory/15865-security-advisory-0079
CVE: CVE-2022-2668
Published: 2022-08-05
Description: An issue was discovered in Keycloak that allows arbitrary Javascript to be uploaded for the SAML protocol mapper even if the UPLOAD_SCRIPTS feature is disabled
CVSS Score: 7.2 (HIGH)
References: https://access.redhat.com/security/cve/CVE-2022-2668; https://access.redhat.com/security/cve/CVE-2022-2668
CVE: CVE-2022-2675
Published: 2022-08-05
Description: Using off-the-shelf commodity hardware, the Unitree Go 1 robotics platform version H0.1.7 and H0.1.9 (using firmware version 0.1.35) can be powered down by an attacker within normal RF range without authentication. Other versions may be affected, such as the A1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-285
References: https://fccid.io/2A5PE-YUSHU001/Users-Manual/User-Manual-5810729; https://twitter.com/d0tslash/status/[PII_REDACTED]62394370; https://www.mybotshop.de/Datasheet/Unitree_A1_User_Manual_v1.0.pdf
CVE: CVE-2022-37398
Published: 2022-08-05
Description: A stack-based buffer overflow vulnerability was found inside ADM when using WebDAV due to the lack of data size validation. An attacker can exploit this vulnerability to run arbitrary code. Affected ADM versions include: 3.5.9.RUE3 and below, 4.0.5.RVI1 and below as well as 4.1.0.RJD1 and below.
CVSS Score: 7.1 (HIGH)
CWE: CWE-121, CWE-787
References: https://www.asustor.com/security/security_advisory_detail?id=12; https://www.asustor.com/security/security_advisory_detail?id=12
CVE: CVE-2022-22299
Published: 2022-08-05
Description: A format string vulnerability [CWE-134] in the command line interpreter of FortiADC version 6.0.0 through 6.0.4, FortiADC version 6.1.0 through 6.1.5, FortiADC version 6.2.0 through 6.2.1, FortiProxy version 1.0.0 through 1.0.7, FortiProxy version 1.1.0 through 1.1.6, FortiProxy version 1.2.0 through 1.2.13, FortiProxy version 2.0.0 through 2.0.7, FortiProxy version 7.0.0 through 7.0.1, FortiOS version 6.0.0 through 6.0.14, FortiOS version 6.2.0 through 6.2.10, FortiOS version 6.4.0 through 6.4.8, FortiOS version 7.0.0 through 7.0.2, FortiMail version 6.4.0 through 6.4.5, FortiMail version 7.0.0 through 7.0.2 may allow an authenticated user to execute unauthorized code or commands via specially crafted command arguments.
CVSS Score: 7.8 (HIGH)
CWE: CWE-134
References: https://fortiguard.com/psirt/FG-IR-21-235; https://fortiguard.com/psirt/FG-IR-21-235
CVE: CVE-2022-2676
Published: 2022-08-05
Description: A vulnerability was found in SourceCodester Electronic Medical Records System and classified as critical. Affected by this issue is some unknown functionality of the component POST Request Handler. The manipulation of the argument user_email leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-205664.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/Hanfu-l/Cve-vulnerability-mining/blob/main/Electronic%20Medical%20Records%20System/Electronic%20Medical%20Records%20System-loginpage-Sqlinjection.pdf; https://vuldb.com/?id.205664; https://github.com/Hanfu-l/Cve-vulnerability-mining/blob/main/Electronic%20Medical%20Records%20System/Electronic%20Medical%20Records%20System-loginpage-Sqlinjection.pdf
CVE: CVE-2022-2677
Published: 2022-08-05
Description: A vulnerability was found in SourceCodester Apartment Visitor Management System 1.0. It has been classified as critical. This affects an unknown part of the file index.php. The manipulation of the argument username with the input ' AND (SELECT 4955 FROM (SELECT(SLEEP(5)))RSzF) AND 'htiy'='htiy leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-205665 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://github.com/anx0ing/CVE_demo/blob/main/2022/Apartment%20Visitor%20Management%20System-SQL%20injections.md; https://vuldb.com/?id.205665; https://github.com/anx0ing/CVE_demo/blob/main/2022/Apartment%20Visitor%20Management%20System-SQL%20injections.md
CVE: CVE-2022-2678
Published: 2022-08-05
Description: A vulnerability was found in SourceCodester Alphaware Simple E-Commerce System. It has been declared as critical. This vulnerability affects unknown code of the file admin_feature.php of the component Background Management Page. The manipulation leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-205666 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-434
References: https://github.com/895515845/Alphaware-E-Commerce-System/blob/main/Alphaware_file.md; https://vuldb.com/?id.205666; https://github.com/895515845/Alphaware-E-Commerce-System/blob/main/Alphaware_file.md
CVE: CVE-2022-2679
Published: 2022-08-05
Description: A vulnerability was found in SourceCodester Interview Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /viewReport.php. The manipulation of the argument id with the input (UPDATEXML(9729,CONCAT(0x2e,0x716b707071,(SELECT (ELT(9729=9729,1))),0x7162766a71),7319)) leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-205667.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/anx0ing/CVE_demo/blob/main/2022/Interview%20Management%20System-SQL%20injections.md; https://vuldb.com/?id.205667; https://github.com/anx0ing/CVE_demo/blob/main/2022/Interview%20Management%20System-SQL%20injections.md
CVE: CVE-2022-2680
Published: 2022-08-05
Description: A vulnerability classified as critical has been found in SourceCodester Church Management System 1.0. Affected is an unknown function of the file /login.php. The manipulation of the argument username with the input ' OR (SELECT 7064 FROM(SELECT COUNT(*),CONCAT(0x71627a7671,(SELECT (ELT(7064=7064,1))),0x716b707871,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- jURL leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-205668.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/anx0ing/CVE_demo/blob/main/2022/Church%20Management%20System-SQL%20injections.md; https://vuldb.com/?id.205668; https://github.com/anx0ing/CVE_demo/blob/main/2022/Church%20Management%20System-SQL%20injections.md
CVE: CVE-2022-2681
Published: 2022-08-05
Description: A vulnerability classified as problematic was found in SourceCodester Online Student Admission System. Affected by this vulnerability is an unknown functionality of the file edit-profile.php of the component Student User Page. The manipulation with the input <script>alert(/xss/)</script> leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-205669 was assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/895515845/Online-Student-Admission-System; https://vuldb.com/?id.205669; https://github.com/895515845/Online-Student-Admission-System
CVE: CVE-2022-2682
Published: 2022-08-05
Description: A vulnerability, which was classified as problematic, has been found in SourceCodester Alphaware Simple E-Commerce System. Affected by this issue is some unknown functionality of the file stockin.php. The manipulation of the argument id with the input '"><script>alert(/xss/)</script> leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-205670 is the identifier assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/895515845/Alphaware-E-Commerce-System/blob/main/Alphaware_xss.md; https://vuldb.com/?id.205670; https://github.com/895515845/Alphaware-E-Commerce-System/blob/main/Alphaware_xss.md
CVE: CVE-2022-2683
Published: 2022-08-05
Description: A vulnerability, which was classified as problematic, was found in SourceCodester Simple Food Ordering System 1.0. This affects an unknown part of the file /login.php. The manipulation of the argument email/password with the input "><ScRiPt>alert(1)</sCrIpT> leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-205671.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/anx0ing/CVE_demo/blob/main/2022/Simple%20Food%20Ordering%20System-XSS.md; https://vuldb.com/?id.205671; https://github.com/anx0ing/CVE_demo/blob/main/2022/Simple%20Food%20Ordering%20System-XSS.md
CVE: CVE-2022-2684
Published: 2022-08-05
Description: A vulnerability has been found in SourceCodester Apartment Visitor Management System 1.0 and classified as problematic. This vulnerability affects unknown code of the file /manage-apartment.php. The manipulation of the argument Apartment Number with the input <script>alert(1)</script> leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-205672.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-79
References: https://github.com/anx0ing/CVE_demo/blob/main/2022/Apartment%20Visitor%20Management%20System-XSS.md; https://vuldb.com/?id.205672; https://github.com/anx0ing/CVE_demo/blob/main/2022/Apartment%20Visitor%20Management%20System-XSS.md