deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-37056
Published: 2022-08-28
Description: D-Link GO-RT-AC750 GORTAC750_revA_v101b03 and GO-RT-AC750_revB_FWv200b02 is vulnerable to Command Injection via /cgibin, hnap_main,
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://drive.google.com/file/d/127tqMUvAxQ4OlycoSNtcP0x2282Y75GJ/view?usp=sharing; https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10308; https://www.dlink.com/en/security-bulletin/
CVE: CVE-2022-38555
Published: 2022-08-28
Description: Linksys E1200 v1.0.04 is vulnerable to Buffer Overflow via ej_get_web_page_name.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: http://linksys.com; https://github.com/xxy1126/Vuln/tree/main/1; http://linksys.com
CVE: CVE-2022-38562
Published: 2022-08-28
Description: Tenda M3 V1.0.0.12(4856) was discovered to contain a heap buffer overflow vulnerability in the function formSetFixTools. This vulnerability allows attackers to cause a Denial of Service (DoS) via the lan parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://github.com/xxy1126/Vuln/tree/main/Tenda%20M3/formSetFixTools_lan; https://github.com/xxy1126/Vuln/tree/main/Tenda%20M3/formSetFixTools_lan
CVE: CVE-2022-38563
Published: 2022-08-28
Description: Tenda M3 V1.0.0.12(4856) was discovered to contain a heap buffer overflow vulnerability in the function formSetFixTools. This vulnerability allows attackers to cause a Denial of Service (DoS) via the MACAddr parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://github.com/xxy1126/Vuln/tree/main/Tenda%20M3/formSetFixTools_Mac; https://github.com/xxy1126/Vuln/tree/main/Tenda%20M3/formSetFixTools_Mac
CVE: CVE-2022-38564
Published: 2022-08-28
Description: Tenda M3 V1.0.0.12(4856) was discovered to contain a buffer overflow vulnerability in the function formSetPicListItem. This vulnerability allows attackers to cause a Denial of Service (DoS) via the adItemUID parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://github.com/xxy1126/Vuln/tree/main/Tenda%20M3/formSetPicListItem; https://github.com/xxy1126/Vuln/tree/main/Tenda%20M3/formSetPicListItem
CVE: CVE-2022-38565
Published: 2022-08-28
Description: Tenda M3 V1.0.0.12(4856) was discovered to contain a heap buffer overflow vulnerability in the function formEmailTest. This vulnerability allows attackers to cause a Denial of Service (DoS) via the mailpwd parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://github.com/xxy1126/Vuln/tree/main/Tenda%20M3/formEmailTest-mailpwd; https://github.com/xxy1126/Vuln/tree/main/Tenda%20M3/formEmailTest-mailpwd
CVE: CVE-2022-38566
Published: 2022-08-28
Description: Tenda M3 V1.0.0.12(4856) was discovered to contain a heap buffer overflow vulnerability in the function formEmailTest. This vulnerability allows attackers to cause a Denial of Service (DoS) via the mailname parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://github.com/xxy1126/Vuln/tree/main/Tenda%20M3/formEmailTest-mailname; https://github.com/xxy1126/Vuln/tree/main/Tenda%20M3/formEmailTest-mailname
CVE: CVE-2022-38567
Published: 2022-08-28
Description: Tenda M3 V1.0.0.12(4856) was discovered to contain a stack overflow vulnerability in the function formSetAdConfigInfo. This vulnerability allows attackers to cause a Denial of Service (DoS) via the authIPs parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://github.com/xxy1126/Vuln/tree/main/Tenda%20M3/formSetAdConfigInfo_; https://github.com/xxy1126/Vuln/tree/main/Tenda%20M3/formSetAdConfigInfo_
CVE: CVE-2022-38568
Published: 2022-08-28
Description: Tenda M3 V1.0.0.12(4856) was discovered to contain a heap buffer overflow vulnerability in the function formSetFixTools. This vulnerability allows attackers to cause a Denial of Service (DoS) via the hostname parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://github.com/xxy1126/Vuln/tree/main/Tenda%20M3/formSetFixTools_hostname; https://github.com/xxy1126/Vuln/tree/main/Tenda%20M3/formSetFixTools_hostname
CVE: CVE-2022-38569
Published: 2022-08-28
Description: Tenda M3 V1.0.0.12(4856) was discovered to contain a stack overflow in the function formDelAd.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://github.com/xxy1126/Vuln/tree/main/Tenda%20M3/formDelAd; https://github.com/xxy1126/Vuln/tree/main/Tenda%20M3/formDelAd
CVE: CVE-2022-38570
Published: 2022-08-28
Description: Tenda M3 V1.0.0.12(4856) was discovered to contain a stack overflow in the function formDelPushedAd. This vulnerability allows attackers to cause a Denial of Service (DoS) via the adPushUID parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://github.com/xxy1126/Vuln/tree/main/Tenda%20M3/formDelPushedAd; https://github.com/xxy1126/Vuln/tree/main/Tenda%20M3/formDelPushedAd
CVE: CVE-2022-38571
Published: 2022-08-28
Description: Tenda M3 V1.0.0.12(4856) was discovered to contain a buffer overflow in the function formSetGuideListItem.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://github.com/xxy1126/Vuln/tree/main/Tenda%20M3/formSetGuideListItem; https://github.com/xxy1126/Vuln/tree/main/Tenda%20M3/formSetGuideListItem
CVE: CVE-2022-36704
Published: 2022-08-28
Description: Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the Id parameter at /librarian/studentdetails.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/kingbhob02/library-management-system/SQLi-1.md; https://github.com/k0xx11/bug_report/blob/main/vendors/kingbhob02/library-management-system/SQLi-1.md
CVE: CVE-2022-36705
Published: 2022-08-28
Description: Ingredients Stock Management System v1.0 was discovered to contain a SQL injection vulnerability via the Id parameter at /stocks/manage_waste.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/k0xx11/vul-wiki/blob/master/vendors/oretnom23/ingredients-stock-management-system/SQLi-15.md; https://github.com/k0xx11/vul-wiki/blob/master/vendors/oretnom23/ingredients-stock-management-system/SQLi-15.md
CVE: CVE-2022-36706
Published: 2022-08-28
Description: Ingredients Stock Management System v1.0 was discovered to contain a SQL injection vulnerability via the Id parameter at /stocks/manage_stockout.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/k0xx11/vul-wiki/blob/master/vendors/oretnom23/ingredients-stock-management-system/SQLi-16.md; https://github.com/k0xx11/vul-wiki/blob/master/vendors/oretnom23/ingredients-stock-management-system/SQLi-16.md
CVE: CVE-2022-36707
Published: 2022-08-28
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2022-2214. Reason: This candidate is a reservation duplicate of CVE-2022-2214. Notes: All CVE users should reference CVE-2022-2214 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2022-36708
Published: 2022-08-28
Description: Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the Id parameter at /student/bookdetails.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/kingbhob02/library-management-system/SQLi-3.md; https://github.com/k0xx11/bug_report/blob/main/vendors/kingbhob02/library-management-system/SQLi-3.md
CVE: CVE-2022-36572
Published: 2022-08-29
Description: Sinsiu Sinsiu Enterprise Website System v1.1.1.0 was discovered to contain a remote code execution (RCE) vulnerability via the component /upload/admin.php?/deal/.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/BreakALegCml/try/blob/main/SinSiuEnterpriseWebsiteSystem; https://github.com/BreakALegCml/try/blob/main/SinSiuEnterpriseWebsiteSystem
CVE: CVE-2022-36573
Published: 2022-08-29
Description: A cross-site scripting (XSS) vulnerability in Pagekit CMS v1.0.18 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Markdown text box under /blog/post/edit.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/pagekit/pagekit/issues/968; https://github.com/pagekit/pagekit/issues/968
CVE: CVE-2022-36610
Published: 2022-08-29
Description: TOTOLINK A720R V4.1.5cu.532_B20210610 was discovered to contain a hardcoded password for root at /etc/shadow.sample.
CVSS Score: 7.8 (HIGH)
CWE: CWE-798
References: https://github.com/whiter6666/CVE/blob/main/TOTOLINK_A720R/hard_code.md; https://github.com/whiter6666/CVE/blob/main/TOTOLINK_A720R/hard_code.md
CVE: CVE-2022-36611
Published: 2022-08-29
Description: TOTOLINK A800R V4.1.2cu.5137_B20200730 was discovered to contain a hardcoded password for root at /etc/shadow.sample.
CVSS Score: 7.8 (HIGH)
CWE: CWE-798
References: https://github.com/whiter6666/CVE/blob/main/TOTOLINK_A800R/hard_code.md; https://github.com/whiter6666/CVE/blob/main/TOTOLINK_A800R/hard_code.md
CVE: CVE-2022-36612
Published: 2022-08-29
Description: TOTOLINK A950RG V4.1.2cu.5204_B20210112 was discovered to contain a hardcoded password for root at /etc/shadow.sample.
CVSS Score: 7.8 (HIGH)
CWE: CWE-798
References: https://github.com/whiter6666/CVE/blob/main/TOTOLINK_A950RG/hard_code.md; https://github.com/whiter6666/CVE/blob/main/TOTOLINK_A950RG/hard_code.md
CVE: CVE-2022-36613
Published: 2022-08-29
Description: TOTOLINK N600R V4.3.0cu.7647_B20210106 was discovered to contain a hardcoded password for root at /etc/shadow.sample.
CVSS Score: 7.8 (HIGH)
CWE: CWE-798
References: https://github.com/whiter6666/CVE/blob/main/TOTOLINK_N600R/hard_code.md; https://github.com/whiter6666/CVE/blob/main/TOTOLINK_N600R/hard_code.md
CVE: CVE-2022-36614
Published: 2022-08-29
Description: TOTOLINK A860R V4.1.2cu.5182_B20201027 was discovered to contain a hardcoded password for root at /etc/shadow.sample.
CVSS Score: 7.8 (HIGH)
CWE: CWE-798
References: https://github.com/whiter6666/CVE/blob/main/TOTOLINK_A860R/hard_code.md; https://github.com/whiter6666/CVE/blob/main/TOTOLINK_A860R/hard_code.md
CVE: CVE-2022-36615
Published: 2022-08-29
Description: TOTOLINK A3000RU V4.1.2cu.5185_B20201128 was discovered to contain a hardcoded password for root at /etc/shadow.sample.
CVSS Score: 7.8 (HIGH)
CWE: CWE-798
References: https://github.com/whiter6666/CVE/blob/main/TOTOLINK_A3000RU/hard_code.md; https://github.com/whiter6666/CVE/blob/main/TOTOLINK_A3000RU/hard_code.md
CVE: CVE-2022-36616
Published: 2022-08-29
Description: TOTOLINK A810R V4.1.2cu.5182_B20201026 and V5.9c.4050_B20190424 was discovered to contain a hardcoded password for root at /etc/shadow.sample.
CVSS Score: 7.8 (HIGH)
CWE: CWE-798
References: https://github.com/whiter6666/CVE/blob/main/TOTOLINK_A810R/hard_code.md; https://github.com/whiter6666/CVE/blob/main/TOTOLINK_A810R/hard_code.md
CVE: CVE-2022-38510
Published: 2022-08-29
Description: Tenda_TX9pro V22.03.02.10 was discovered to contain a buffer overflow via the component httpd/SetNetControlList.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://github.com/whiter6666/CVE/blob/main/Tenda_TX9pro/SetNetControlList.md; https://github.com/whiter6666/CVE/blob/main/Tenda_TX9pro/SetNetControlList.md
CVE: CVE-2022-38511
Published: 2022-08-29
Description: TOTOLINK A810R V5.9c.4050_B20190424 was discovered to contain a command injection vulnerability via the component downloadFile.cgi.
CVSS Score: 7.8 (HIGH)
CWE: CWE-78
References: https://github.com/whiter6666/CVE/blob/main/TOTOLINK_A810R/downloadFile.md; https://github.com/whiter6666/CVE/blob/main/TOTOLINK_A810R/downloadFile.md
CVE: CVE-2022-34668
Published: 2022-08-29
Description: NVFLARE, versions prior to 2.1.4, contains a vulnerability that deserialization of Untrusted Data due to Pickle usage may allow an unprivileged network attacker to cause Remote Code Execution, Denial Of Service, and Impact to both Confidentiality and Integrity.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502, CWE-502
References: http://packetstormsecurity.com/files/171483/NVFLARE-Unsafe-Deserialization.html; https://github.com/NVIDIA/NVFlare/security/advisories/GHSA-6qv6-q77g-7qm6; http://packetstormsecurity.com/files/171483/NVFLARE-Unsafe-Deserialization.html
CVE: CVE-2021-40326
Published: 2022-08-29
Description: Foxit PDF Reader before 11.1 and PDF Editor before 11.1, and PhantomPDF before 10.1.6, mishandle hidden and incremental data in signed documents. An attacker can write to an arbitrary file, and display controlled contents, during signature verification.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-347
References: https://www.foxit.com/support/security-bulletins.html; https://www.foxit.com/support/security-bulletins.html
CVE: CVE-2021-41780
Published: 2022-08-29
Description: Foxit PDF Reader before 11.1 and PDF Editor before 11.1, and PhantomPDF before 10.1.6, allow attackers to trigger a use-after-free and execute arbitrary code because JavaScript is mishandled.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://www.foxit.com/support/security-bulletins.html; https://www.foxit.com/support/security-bulletins.html
CVE: CVE-2021-41781
Published: 2022-08-29
Description: Foxit PDF Reader before 11.1 and PDF Editor before 11.1, and PhantomPDF before 10.1.6, allow attackers to trigger a use-after-free and execute arbitrary code because JavaScript is mishandled.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://www.foxit.com/support/security-bulletins.html; https://www.foxit.com/support/security-bulletins.html
CVE: CVE-2021-41782
Published: 2022-08-29
Description: Foxit PDF Reader before 11.1 and PDF Editor before 11.1, and PhantomPDF before 10.1.6, allow attackers to trigger a use-after-free and execute arbitrary code because JavaScript is mishandled.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://www.foxit.com/support/security-bulletins.html; https://www.foxit.com/support/security-bulletins.html
CVE: CVE-2021-41783
Published: 2022-08-29
Description: Foxit PDF Reader before 11.1 and PDF Editor before 11.1, and PhantomPDF before 10.1.6, allow attackers to trigger a use-after-free and execute arbitrary code because JavaScript is mishandled.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://www.foxit.com/support/security-bulletins.html; https://www.foxit.com/support/security-bulletins.html
CVE: CVE-2021-41784
Published: 2022-08-29
Description: Foxit PDF Reader before 11.1 and PDF Editor before 11.1, and PhantomPDF before 10.1.6, allow attackers to trigger a use-after-free and execute arbitrary code because JavaScript is mishandled.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://www.foxit.com/support/security-bulletins.html; https://www.foxit.com/support/security-bulletins.html
CVE: CVE-2021-41785
Published: 2022-08-29
Description: Foxit PDF Reader before 11.1 and PDF Editor before 11.1, and PhantomPDF before 10.1.6, allow attackers to trigger a use-after-free and execute arbitrary code because JavaScript is mishandled.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://www.foxit.com/support/security-bulletins.html; https://www.foxit.com/support/security-bulletins.html
CVE: CVE-2022-21165
Published: 2022-08-29
Description: All versions of package font-converter are vulnerable to Arbitrary Command Injection due to missing sanitization of input that potentially flows into the child_process.exec() function.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/zgec/node-js-font-converter/blob/master/index.js%23L12; https://security.snyk.io/vuln/SNYK-JS-FONTCONVERTER-2976194; https://github.com/zgec/node-js-font-converter/blob/master/index.js%23L12
CVE: CVE-2022-25641
Published: 2022-08-29
Description: Foxit PDF Reader before 11.2.2 and PDF Editor before 11.2.2, and PhantomPDF before 10.1.8, mishandle cross-reference information during compressed-object parsing within signed documents. This leads to delivery of incorrect signature information via an Incremental Saving Attack and a Shadow Attack.
CVSS Score: 5.5 (MEDIUM)
References: https://www.foxit.com/support/security-bulletins.html; https://www.foxit.com/support/security-bulletins.html
CVE: CVE-2022-25644
Published: 2022-08-29
Description: All versions of package @pendo324/get-process-by-name are vulnerable to Arbitrary Code Execution due to improper sanitization of getProcessByName function.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/pendo324/get-process-by-name-js/blob/34e8a279a94fa23acb13e302e9516ab1ea8d8731/index.js%23L27-L28; https://security.snyk.io/vuln/SNYK-JS-PENDO324GETPROCESSBYNAME-2419094; https://github.com/pendo324/get-process-by-name-js/blob/34e8a279a94fa23acb13e302e9516ab1ea8d8731/index.js%23L27-L28
CVE: CVE-2022-25921
Published: 2022-08-29
Description: All versions of package morgan-json are vulnerable to Arbitrary Code Execution due to missing sanitization of input passed to the Function constructor.
CVSS Score: 8.1 (HIGH)
References: https://github.com/indexzero/morgan-json/blob/3a76010215a4256d41687d082cd66c4f00ea5717/index.js%23L46; https://security.snyk.io/vuln/SNYK-JS-MORGANJSON-2976193; https://github.com/indexzero/morgan-json/blob/3a76010215a4256d41687d082cd66c4f00ea5717/index.js%23L46
CVE: CVE-2022-22897
Published: 2022-08-29
Description: A SQL injection vulnerability in the product_all_one_img and image_product parameters of the ApolloTheme AP PageBuilder component through 2.4.4 for PrestaShop allows unauthenticated attackers to exfiltrate database data.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://packetstormsecurity.com/files/168148/PrestaShop-Ap-Pagebuilder-2.4.4-SQL-Injection.html; https://friends-of-presta.github.io/security-advisories/modules/2023/01/05/appagebuilder.html; http://packetstormsecurity.com/files/168148/PrestaShop-Ap-Pagebuilder-2.4.4-SQL-Injection.html
CVE: CVE-2022-32548
Published: 2022-08-29
Description: An issue was discovered on certain DrayTek Vigor routers before July 2022 such as the Vigor3910 before 4.3.1.1. /cgi-bin/wlogin.cgi has a buffer overflow via the username or password to the aa or ab field.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-120
References: https://www.securityweek.com/smbs-exposed-attacks-critical-vulnerability-draytek-vigor-routers; https://www.trellix.com/en-us/about/newsroom/stories/threat-labs/rce-in-dratyek-routers.html; https://www.securityweek.com/smbs-exposed-attacks-critical-vulnerability-draytek-vigor-routers
CVE: CVE-2022-36194
Published: 2022-08-29
Description: Centreon 22.04.0 is vulnerable to Cross Site Scripting (XSS) from the function Pollers > Broker Configuration by adding a crafted payload into the name parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/168149/Centreon-22.04.0-Cross-Site-Scripting.html; https://github.com/amdsyad/poc-dump/blob/main/Stored%20XSS%20in%20name%20parameter%20in%20Centreon%20version%2022.04.0; http://packetstormsecurity.com/files/168149/Centreon-22.04.0-Cross-Site-Scripting.html
CVE: CVE-2022-3019
Published: 2022-08-29
Description: The forgot password token basically just makes us capable of taking over the account of whoever comment in an app that we can see (bruteforcing comment id's might also be an option but I wouldn't count on it, since it would take a long time to find a valid one).
CVSS Score: 8.8 (HIGH)
CWE: CWE-284, CWE-639
References: https://github.com/tooljet/tooljet/commit/45e0d3302d92df7d7f2d609c31cea71165600b79; https://huntr.dev/bounties/a610300b-ce3c-4995-8337-11942b3621bf; https://github.com/tooljet/tooljet/commit/45e0d3302d92df7d7f2d609c31cea71165600b79
CVE: CVE-2022-37059
Published: 2022-08-29
Description: Cross Site Scripting (XSS) in Admin Panel of Subrion CMS 4.2.1 allows attacker to inject arbitrary code via Login Field
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://drive.google.com/file/d/1lmU8zuyzyC9LHFXuXzamnkcLcjcfs0xE/view?usp=sharing; https://drive.google.com/file/d/1lmU8zuyzyC9LHFXuXzamnkcLcjcfs0xE/view?usp=sharing
CVE: CVE-2022-35014
Published: 2022-08-29
Description: Advancecomp v2.3 contains a segmentation fault.
CVSS Score: 5.5 (MEDIUM)
References: https://drive.google.com/file/d/1mglfof2gR9Xoi5OWS9x0-jJ7cSIJA5i6/view?usp=sharing; https://github.com/Cvjark/Poc/blob/main/advancecomp/CVE-2022-35014.md; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DYG2XAL4MBS7ADGJWYRUKBLDTBJFPJER/
CVE: CVE-2022-35015
Published: 2022-08-29
Description: Advancecomp v2.3 was discovered to contain a heap buffer overflow via le_uint32_read at /lib/endianrw.h.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://drive.google.com/file/d/1pxNOlyl5mWXdVwkmCD4ZuXEPxI3PZAac/view?usp=sharing; https://github.com/Cvjark/Poc/blob/main/advancecomp/CVE-2022-35015.md; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DYG2XAL4MBS7ADGJWYRUKBLDTBJFPJER/
CVE: CVE-2022-35016
Published: 2022-08-29
Description: Advancecomp v2.3 was discovered to contain a heap buffer overflow.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://drive.google.com/file/d/1oWVhoJJih6-pgbvrZsx5oFUtv-vgR0fF/view?usp=sharing; https://github.com/Cvjark/Poc/blob/main/advancecomp/CVE-2022-35016.md; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DYG2XAL4MBS7ADGJWYRUKBLDTBJFPJER/
CVE: CVE-2022-35017
Published: 2022-08-29
Description: Advancecomp v2.3 was discovered to contain a heap buffer overflow.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://drive.google.com/file/d/13WAtJtCUBH4LW5MBulyuhLFq2HQq4e_Q/view?usp=sharing; https://github.com/Cvjark/Poc/blob/main/advancecomp/CVE-2022-35017.md; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DYG2XAL4MBS7ADGJWYRUKBLDTBJFPJER/
CVE: CVE-2022-35018
Published: 2022-08-29
Description: Advancecomp v2.3 was discovered to contain a segmentation fault.
CVSS Score: 5.5 (MEDIUM)
References: https://drive.google.com/file/d/1ChqmPdrjId87582a-o5ogWyEI8goRVWJ/view?usp=sharing; https://github.com/Cvjark/Poc/blob/main/advancecomp/CVE-2022-35018.md; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DYG2XAL4MBS7ADGJWYRUKBLDTBJFPJER/
CVE: CVE-2022-35019
Published: 2022-08-29
Description: Advancecomp v2.3 was discovered to contain a segmentation fault.
CVSS Score: 5.5 (MEDIUM)
References: https://drive.google.com/file/d/1n1hltvw-kqpzZ50L6d7RGGNagwbUp0Z2/view?usp=sharing; https://github.com/Cvjark/Poc/blob/main/advancecomp/CVE-2022-35019.md; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DYG2XAL4MBS7ADGJWYRUKBLDTBJFPJER/
CVE: CVE-2022-35020
Published: 2022-08-29
Description: Advancecomp v2.3 was discovered to contain a heap buffer overflow via the component __interceptor_memcpy at /sanitizer_common/sanitizer_common_interceptors.inc.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://drive.google.com/file/d/1ScTmAEmHSHvmyDnELYV1DzQTAAAm7XS9/view?usp=sharing; https://github.com/Cvjark/Poc/blob/main/advancecomp/CVE-2022-35020.md; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DYG2XAL4MBS7ADGJWYRUKBLDTBJFPJER/
CVE: CVE-2022-36686
Published: 2022-08-29
Description: Ingredients Stock Management System v1.0 was discovered to contain a SQL injection vulnerability via the month parameter at /admin/?page=reports/stockin&month=.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/k0xx11/vul-wiki/blob/master/vendors/oretnom23/ingredients-stock-management-system/SQLi-1.md; https://github.com/k0xx11/vul-wiki/blob/master/vendors/oretnom23/ingredients-stock-management-system/SQLi-1.md
CVE: CVE-2022-36687
Published: 2022-08-29
Description: Ingredients Stock Management System v1.0 was discovered to contain an arbitrary file deletion vulnerability via the component /classes/Master.php?f=delete_img.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://github.com/k0xx11/vul-wiki/blob/master/vendors/oretnom23/ingredients-stock-management-system/delet-file-1.md; https://github.com/k0xx11/vul-wiki/blob/master/vendors/oretnom23/ingredients-stock-management-system/delet-file-1.md