deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-0882
Published: 2023-02-17
Description: Improper Input Validation, Authorization Bypass Through User-Controlled Key vulnerability in Kron Tech Single Connect on Windows allows Privilege Abuse. This issue affects Single Connect: 2.16.
CVSS Score: 8.8 (HIGH)
CWE: CWE-639, CWE-639
References: https://docs.krontech.com/singleconnect-2-16/update-patch-rdp-proxy-idor-vulnerability; https://www.usom.gov.tr/bildirim/tr-23-0092; https://docs.krontech.com/singleconnect-2-16/update-patch-rdp-proxy-idor-vulnerability
CVE: CVE-2022-40347
Published: 2023-02-17
Description: SQL Injection vulnerability in Intern Record System version 1.0 in /intern/controller.php in 'phone', 'email', 'deptType' and 'name' parameters, allows attackers to execute arbitrary code and gain sensitive information.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: http://packetstormsecurity.com/files/171740/Intern-Record-System-1.0-SQL-Injection.html; https://code-projects.org/intern-record-system-in-php-with-source-code/; https://download-media.code-projects.org/2020/03/Intern_Record_System_In_PHP_With_Source_Code.zip
CVE: CVE-2023-23586
Published: 2023-02-17
Description: Due to a vulnerability in the io_uring subsystem, it is possible to leak kernel memory information to the user process. timens_install calls current_is_single_threaded to determine if the current process is single-threaded, but this call does not consider io_uring's io_worker threads, thus it is possible to insert a time namespace's vvar page to process's memory space via a page fault. When this time namespace is destroyed, the vvar page is also freed, but not removed from the process' memory, and a next page allocated by the kernel will be still available from the user-space process and can leak memory contents via this (read-only) use-after-free vulnerability. We recommend upgrading past version 5.10.161 or commit  788d0824269bef539fe31a785b1517882eafed93 https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/io_uring 

CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416, CWE-416
References: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/io_uring?h=linux-5.10.y&id=788d0824269bef539fe31a785b1517882eafed93; https://kernel.dance/#788d0824269bef539fe31a785b1517882eafed93; https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/io_uring?h=linux-5.10.y&id=788d0824269bef539fe31a785b1517882eafed93
CVE: CVE-2022-32972
Published: 2023-02-17
Description: Infoblox BloxOne Endpoint for Windows through 2.2.7 allows DLL injection that can result in local privilege escalation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427, CWE-427
References: https://community.infoblox.com/t5/trending-kb-articles/cve-2022-32972-infoblox-bloxone-endpoint-for-windows-local/ba-p/24912; https://infoblox.com; https://community.infoblox.com/t5/trending-kb-articles/cve-2022-32972-infoblox-bloxone-endpoint-for-windows-local/ba-p/24912
CVE: CVE-2022-40032
Published: 2023-02-17
Description: SQL Injection vulnerability in Simple Task Managing System version 1.0 in login.php in 'username' and 'password' parameters, allows attackers to execute arbitrary code and gain sensitive information.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: http://packetstormsecurity.com/files/171739/Simple-Task-Managing-System-1.0-SQL-Injection.html; https://github.com/h4md153v63n/CVE-2022-40032_Simple-Task-Managing-System-V1.0-SQL-Injection-Vulnerability-Unauthenticated; https://www.sourcecodester.com/php/15624/simple-task-managing-system-php-mysqli-free-source-code.html
CVE: CVE-2020-29168
Published: 2023-02-17
Description: SQL Injection vulnerability in Projectworlds Online Doctor Appointment Booking System, allows attackers to gain sensitive information via the q parameter to the getuser.php endpoint.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://projectworlds.in/free-projects/php-projects/online-doctor-appointment-booking-system-php-and-mysql/%2C; https://projectworlds.in/wp-content/uploads/2020/05/PHP-Doctor-Appointment-System.zip; https://www.exploit-db.com/exploits/49059
CVE: CVE-2022-45701
Published: 2023-02-17
Description: Arris TG2482A firmware through 9.1.103GEM9 allow Remote Code Execution (RCE) via the ping utility feature.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: http://arris.com; https://packetstormsecurity.com/files/171001/Arris-Router-Firmware-9.1.103-Remote-Code-Execution.htmlhttps://github.com/yerodin/CVE-2022-45701; http://arris.com
CVE: CVE-2023-23899
Published: 2023-02-17
Description: Cross-Site Request Forgery (CSRF) vulnerability in HasThemes Extensions For CF7 plugin <= 2.0.8 versions leads to arbitrary plugin activation.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://patchstack.com/database/vulnerability/extensions-for-cf7/wordpress-extensions-for-cf7-contact-form-7-database-conditional-fields-and-redirection-plugin-2-0-8-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/extensions-for-cf7/wordpress-extensions-for-cf7-contact-form-7-database-conditional-fields-and-redirection-plugin-2-0-8-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-24329
Published: 2023-02-17
Description: An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-20
References: https://github.com/python/cpython/issues/102153; https://github.com/python/cpython/pull/99421; https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html
CVE: CVE-2023-24388
Published: 2023-02-17
Description: Cross-Site Request Forgery (CSRF) vulnerability in WpDevArt Booking calendar, Appointment Booking System plugin <= 3.2.3 versions affects plugin forms actions (create, duplicate, edit, delete).
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://patchstack.com/database/vulnerability/booking-calendar/wordpress-booking-calendar-appointment-booking-system-plugin-3-2-3-cross-site-request-forgery-csrf?_s_id=cve; https://patchstack.com/database/vulnerability/booking-calendar/wordpress-booking-calendar-appointment-booking-system-plugin-3-2-3-cross-site-request-forgery-csrf?_s_id=cve
CVE: CVE-2022-47986
Published: 2023-02-17
Description: IBM Aspera Faspex 4.4.2 Patch Level 1 and earlier could allow a remote attacker to execute arbitrary code on the system, caused by a YAML deserialization flaw. By sending a specially crafted obsolete API call, an attacker could exploit this vulnerability to execute arbitrary code on the system. The obsolete API call was removed in Faspex 4.4.2 PL2. IBM X-Force ID: 243512.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: http://packetstormsecurity.com/files/171772/IBM-Aspera-Faspex-4.4.1-YAML-Deserialization.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/243512; https://www.ibm.com/support/pages/node/6952319
CVE: CVE-2023-23007
Published: 2023-02-17
Description: An issue was discovered in ESPCMS P8.21120101 after logging in to the background, there is a SQL injection vulnerability in the function node where members are added.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://gitee.com/earclink/espcms/issues/I680WG; https://gitee.com/earclink/espcms/issues/I680WG
CVE: CVE-2022-36775
Published: 2023-02-17
Description: IBM Security Verify Access 10.0.0.0, 10.0.1.0, 10.0.2.0, 10.0.3.0, and10.0.4.0 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers.  This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking.  IBM X-Force ID:  233576.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-74
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/233576; https://www.ibm.com/support/pages/node/6953617; https://exchange.xforce.ibmcloud.com/vulnerabilities/233576
CVE: CVE-2022-43927
Published: 2023-02-17
Description: IBM Db2 for Linux, UNIX and Windows 10.5, 11.1, and 11.5 is vulnerable to information Disclosure due to improper privilege management when a specially crafted table access is used.  IBM X-Force ID:  241671.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-200, CWE-269
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/241671; https://www.ibm.com/support/pages/node/6953759; https://exchange.xforce.ibmcloud.com/vulnerabilities/241671
CVE: CVE-2022-43929
Published: 2023-02-17
Description: 
IBM Db2 for Linux, UNIX and Windows 11.1 and 11.5 may be vulnerable to a Denial of Service when executing a specially crafted 'Load' command. IBM X-Force ID: 241676.


CVSS Score: 4.9 (MEDIUM)
CWE: CWE-20
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/241676; https://www.ibm.com/support/pages/node/6953763; https://exchange.xforce.ibmcloud.com/vulnerabilities/241676
CVE: CVE-2023-0822
Published: 2023-02-17
Description: 
The affected product DIAEnergie (versions prior to v1.9.03.001) contains improper authorization, which could allow an unauthorized user to bypass authorization and access privileged functionality. 


CVSS Score: 8.8 (HIGH)
CWE: CWE-285, CWE-552
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-298-06; https://www.cisa.gov/uscert/ics/advisories/icsa-22-298-06
CVE: CVE-2023-0895
Published: 2023-02-17
Description: The WP Coder – add custom html, css and js code plugin for WordPress is vulnerable to time-based SQL Injection via the ‘id’ parameter in versions up to, and including, 2.5.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers with administrative privileges to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://plugins.trac.wordpress.org/changeset?old=2757782&old_path=wp-coder%2Ftrunk%2Fadmin%2Fpartials%2Finclude-data.php&new=&new_path=wp-coder%2Ftrunk%2Fadmin%2Fpartials%2Finclude-data.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/e4b6a9cd-4d29-4bd8-afa3-b5d455ad8340?source=cve; https://plugins.trac.wordpress.org/changeset?old=2757782&old_path=wp-coder%2Ftrunk%2Fadmin%2Fpartials%2Finclude-data.php&new=&new_path=wp-coder%2Ftrunk%2Fadmin%2Fpartials%2Finclude-data.php
CVE: CVE-2023-22868
Published: 2023-02-17
Description: IBM Aspera Faspex 4.4.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.  IBM X-Force ID:  244117.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/244117; https://www.ibm.com/support/pages/node/6952319; https://exchange.xforce.ibmcloud.com/vulnerabilities/244117
CVE: CVE-2023-24369
Published: 2023-02-17
Description: A cross-site scripting (XSS) vulnerability in UJCMS v4.1.3 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the URL parameter under the Add New Articles function.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/ujcms/ujcms/issues/3; https://github.com/ujcms/ujcms/issues/3
CVE: CVE-2023-24964
Published: 2023-02-17
Description: IBM InfoSphere Information Server 11.7 could allow a local user to obtain sensitive information from a log files.  IBM X-Force ID:  246463.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-312
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/246463; https://www.ibm.com/support/pages/node/6953519; https://exchange.xforce.ibmcloud.com/vulnerabilities/246463
CVE: CVE-2020-19824
Published: 2023-02-17
Description: An issue in MPV v.0.29.1 fixed in v0.30 allows attackers to execute arbitrary code and crash program via the ao_c parameter.
CVSS Score: 7.0 (HIGH)
CWE: CWE-362, CWE-362
References: https://github.com/mpv-player/mpv/issues/6808; https://lists.debian.org/debian-lts-announce/2023/03/msg00009.html; https://github.com/mpv-player/mpv/issues/6808
CVE: CVE-2021-32142
Published: 2023-02-17
Description: Buffer Overflow vulnerability in LibRaw linux/unix v0.20.0 allows attacker to escalate privileges via the LibRaw_buffer_datastream::gets(char*, int) in /src/libraw/src/libraw_datastream.cpp.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://github.com/LibRaw/LibRaw/commit/bc3aaf4223fdb70d52d470dae65c5a7923ea2a49; https://github.com/LibRaw/LibRaw/issues/400; https://github.com/gtt1995
CVE: CVE-2021-32163
Published: 2023-02-17
Description: Authentication vulnerability in MOSN v.0.23.0 allows attacker to escalate privileges via case-sensitive JWT authorization.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-863, CWE-863
References: https://github.com/mosn/mosn/issues/1633; https://github.com/mosn/mosn/pull/1637; https://github.com/mosn/mosn/issues/1633
CVE: CVE-2021-32419
Published: 2023-02-17
Description: An issue in Schism Tracker v20200412 fixed in v.20200412 allows attacker to obtain sensitive information via the fmt_mtm_load_song function in fmt/mtm.c.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://github.com/schismtracker/schismtracker/commit/1e2cc389a2a058fd13d99460c11115a6f7f7a6a4; https://github.com/schismtracker/schismtracker/issues/249; https://github.com/schismtracker/schismtracker/commit/1e2cc389a2a058fd13d99460c11115a6f7f7a6a4
CVE: CVE-2021-32441
Published: 2023-02-17
Description: SQL Injection vulnerability in Exponent-CMS v.2.6.0 fixed in 2.7.0 allows attackers to gain access to sensitive information via the selectValue function in the expConfig class.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/exponentcms/exponent-cms/issues/1542; https://github.com/pang0lin/CVEproject/blob/main/ExponentCMS_v2.6.0_sqli.md; https://github.com/exponentcms/exponent-cms/issues/1542
CVE: CVE-2021-33226
Published: 2023-02-17
Description: Buffer Overflow vulnerability in Saltstack v.3003 and before allows attacker to execute arbitrary code via the func variable in salt/salt/modules/status.py file. NOTE: this is disputed by third parties because an attacker cannot influence the eval input
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120, CWE-120
References: https://bugzilla.suse.com/show_bug.cgi?id=1208473; https://github.com/saltstack/salt/blob/master/salt/modules/status.py; https://bugzilla.suse.com/show_bug.cgi?id=1208473
CVE: CVE-2021-33237
Published: 2023-02-17
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. Consult IDs: CVE-2021-36686. Reason: This candidate is a duplicate of CVE-2021-36686. Notes: All CVE users should reference CVE-2021-36686 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2021-33391
Published: 2023-02-17
Description: An issue in HTACG HTML Tidy v5.7.28 allows attacker to execute arbitrary code via the -g option of the CleanNode() function in gdoc.c.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416, CWE-416
References: https://github.com/htacg/tidy-html5/issues/946; https://github.com/htacg/tidy-html5/issues/946
CVE: CVE-2021-33926
Published: 2023-02-17
Description: An issue in Plone CMS v. 5.2.4, 5.2.3, 5.2.2, 5.2.1, 5.2.0, 5.1rc2, 5.1rc1, 5.1b4, 5.1b3, 5.1b2, 5.1a2, 5.1a1, 5.1.7, 5.1.6, 5.1.5, 5.1.4, 5.1.2, 5.1.1 5.1, 5.0rc3, 5.0rc2, 5.0rc1, 5.0.9, 5.0.8, 5.0.7, 5.0.6, 5.0.5, 5.0.4, 5.0.3, 5.0.2, 5.0.10, 5.0.1, 5.0, 4.3.9, 4.3.8, 4.3.7, 4.3.6, 4.3.5, 4.3.4, 4.3.3, 4.3.20, 4 allows attacker to access sensitive information via the RSS feed protlet.
CVSS Score: 8.8 (HIGH)
CWE: CWE-918, CWE-918
References: https://github.com/s-kustm/Subodh/blob/master/Plone%205.2.4%20Vulnerable%20to%20bilend%20SSRF.pdf; https://plone.org/security/hotfix/20210518; https://plone.org/security/hotfix/20210518/blind-ssrf-via-feedparser-accessing-an-internal-url
CVE: CVE-2021-33948
Published: 2023-02-17
Description: SQL injection vulnerability in FantasticLBP Hotels Server v1.0 allows attacker to execute arbitrary code via the username parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/FantasticLBP/Hotels_Server/issues/14; https://github.com/FantasticLBP/Hotels_Server/issues/14
CVE: CVE-2021-33949
Published: 2023-02-17
Description: An issue in FeMiner WMS v1.1 allows attackers to execute arbitrary code via the filename parameter and the exec function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://github.com/FeMiner/wms/issues/10; https://github.com/FeMiner/wms/issues/10
CVE: CVE-2021-33950
Published: 2023-02-17
Description: An issue discovered in OpenKM v6.3.10 allows attackers to obtain sensitive information via the XMLTextExtractor function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-611, CWE-611
References: https://github.com/openkm/document-management-system/commit/ce1d82329615aea6aa9f2cc6508c1fe7891e34b5; https://github.com/openkm/document-management-system/issues/287; https://github.com/openkm/document-management-system/pull/288
CVE: CVE-2021-33983
Published: 2023-02-17
Description: Buffer Overflow vulnerability in Dvidelabs flatcc v.0.6.0 allows local attacker to execute arbitrary code via the fltacc execution of the error_ref_sym function.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120, CWE-120
References: https://github.com/dvidelabs/flatcc/issues/188; https://github.com/dvidelabs/flatcc/issues/188
CVE: CVE-2021-34164
Published: 2023-02-17
Description: Permissions vulnerability in LIZHIFAKA v.2.2.0 allows authenticated attacker to execute arbitrary commands via the set password function in the admin/index/email location.
CVSS Score: 8.8 (HIGH)
CWE: CWE-276, CWE-276
References: https://github.com/lizhipay/faka/issues/22; https://github.com/lizhipay/faka/issues/22
CVE: CVE-2021-34182
Published: 2023-02-17
Description: An issue in ttyd v.1.6.3 allows attacker to execute arbitrary code via default configuration permissions.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-276, CWE-276
References: https://github.com/tsl0922/ttyd/issues/692; https://github.com/tsl0922/ttyd/issues/692
CVE: CVE-2021-35261
Published: 2023-02-17
Description: File Upload Vulnerability in Yupoxion BearAdmin before commit[PII_REDACTED]8b0a914eb4d726e200fd506b73b075 allows attacker to execute arbitrary remote code via the Upfile function of the extend/tools/Ueditor endpoint.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434, CWE-434
References: https://github.com/yupoxiong/BearAdmin/issues/16; https://github.com/yupoxiong/BearAdmin/issues/16
CVE: CVE-2021-3172
Published: 2023-02-17
Description: An issue in Php-Fusion v9.03.90 fixed in v9.10.00 allows authenticated attackers to cause a Distributed Denial of Service via the Polling feature.
CVSS Score: 8.1 (HIGH)
CWE: CWE-732
References: https://github.com/PHPFusion/PHPFusion/commit/7b8df6925cc7cfd8585d4f34d9120ff3a2e5753e; https://github.com/PHPFusion/PHPFusion/issues/2351; https://github.com/PHPFusion/PHPFusion/commit/7b8df6925cc7cfd8585d4f34d9120ff3a2e5753e
CVE: CVE-2022-20803
Published: 2023-02-17
Description: A vulnerability in the OLE2 file parser of Clam AntiVirus (ClamAV) versions 0.104.0 through 0.104.2 could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device.The vulnerability is due to incorrect use of the realloc function that may result in a double-free. An attacker could exploit this vulnerability by submitting a crafted OLE2 file to be scanned by ClamAV on the affected device. An exploit could allow the attacker to cause the ClamAV scanning process to crash, resulting in a denial of service condition.
CVSS Score: 8.6 (HIGH)
CWE: CWE-415, CWE-415
References: https://blog.clamav.net/2022/05/clamav-01050-01043-01036-released.html; https://security.gentoo.org/glsa/202310-01; https://blog.clamav.net/2022/05/clamav-01050-01043-01036-released.html
CVE: CVE-2022-40232
Published: 2023-02-17
Description: 
IBM Sterling B2B Integrator Standard Edition 6.1.0.0 through 6.1.1.1, and 6.1.2.0 could allow an authenticated user to perform actions they should not have access to due to improper permission controls. IBM X-Force ID: 235597.


CVSS Score: 6.3 (MEDIUM)
CWE: CWE-276
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/235597; https://www.ibm.com/support/pages/node/6954465; https://exchange.xforce.ibmcloud.com/vulnerabilities/235597
CVE: CVE-2022-41734
Published: 2023-02-17
Description: IBM Maximo Asset Management 7.6.1.2 and 7.6.1.3 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser.  This information could be used in further attacks against the system.  IBM X-Force ID:  237587.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200, CWE-312
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/237587; https://www.ibm.com/support/pages/node/6857605; https://exchange.xforce.ibmcloud.com/vulnerabilities/237587
CVE: CVE-2022-43930
Published: 2023-02-17
Description: IBM Db2 for Linux, UNIX and Windows 10.5, 11.1, and 11.5 is vulnerable to an Information Disclosure as sensitive information may be included in a log file.  IBM X-Force ID:  241677.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-200, CWE-532
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/241677; https://www.ibm.com/support/pages/node/6953755; https://exchange.xforce.ibmcloud.com/vulnerabilities/241677
CVE: CVE-2023-24785
Published: 2023-02-17
Description: An issue in Giorgio Tani peazip v.9.0.0 allows attackers to cause a denial of service via the End of Archive tag function of the peazip/pea UNPEA feature.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-770, CWE-770
References: https://sourceforge.net/p/peazip/tickets/734/; https://sourceforge.net/p/peazip/tickets/734/
CVE: CVE-2023-26020
Published: 2023-02-17
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crafter Studio on Linux, MacOS, Windows, x86, ARM, 64 bit allows SQL Injection.This issue affects CrafterCMS v4.0 from 4.0.0 through 4.0.1, and v3.1 from 3.1.0 through 3.1.26.


CVSS Score: 5.7 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://docs.craftercms.org/en/4.0/security/advisory.html#cv[PII_REDACTED]; https://docs.craftercms.org/en/4.0/security/advisory.html#cv[PII_REDACTED]
CVE: CVE-2022-34351
Published: 2023-02-17
Description: IBM QRadar SIEM 7.4 and 7.5 is vulnerable to information exposure allowing a non-tenant user with a specific domain security profile assigned to see some data from other domains.  IBM X-Force ID:  230402.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-200, CWE-312
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/230402; https://www.ibm.com/support/pages/node/6955059; https://exchange.xforce.ibmcloud.com/vulnerabilities/230402
CVE: CVE-2022-40231
Published: 2023-02-17
Description: IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.7 and 6.1.0.0 through 6.1.2.0 could allow an authenticated user to perform unauthorized actions due to improper access controls.  IBM X-Force ID:  235533.
CVSS Score: 4.3 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/235533; https://www.ibm.com/support/pages/node/6954771; https://exchange.xforce.ibmcloud.com/vulnerabilities/235533
CVE: CVE-2022-43579
Published: 2023-02-17
Description: IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.7 and 6.1.0.0 through 6.1.2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.  IBM X-Force ID:  238684.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/238684; https://www.ibm.com/support/pages/node/6954765; https://exchange.xforce.ibmcloud.com/vulnerabilities/238684
CVE: CVE-2023-23279
Published: 2023-02-17
Description: Canteen Management System 1.0 is vulnerable to SQL Injection via /php_action/getOrderReport.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://hackmd.io/mG658E9iSW6TkbS8xAuUNg; https://hackmd.io/mG658E9iSW6TkbS8xAuUNg