deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-32003
Published: 2022-06-02
Description: Badminton Center Management System v1.0 is vulnerable to SQL Injection via /bcms/admin/courts/view_court.php?id=.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/badminton-center-management-system/SQLi-13.md; https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/badminton-center-management-system/SQLi-13.md
CVE: CVE-2022-32004
Published: 2022-06-02
Description: Badminton Center Management System v1.0 is vulnerable to SQL Injection via bcms/admin/products/manage_product.php?id=.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/badminton-center-management-system/SQLi-16.md; https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/badminton-center-management-system/SQLi-16.md
CVE: CVE-2022-32005
Published: 2022-06-02
Description: Badminton Center Management System v1.0 is vulnerable to SQL Injection via bcms/admin/services/manage_service.php?id=.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/badminton-center-management-system/SQLi-18.md.; https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/badminton-center-management-system/SQLi-18.md.
CVE: CVE-2022-32006
Published: 2022-06-02
Description: Badminton Center Management System v1.0 is vulnerable to SQL Injection via /bcms/admin/services/view_service.php?id=.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/badminton-center-management-system/SQLi-17.md; https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/badminton-center-management-system/SQLi-17.md
CVE: CVE-2022-31985
Published: 2022-06-02
Description: Badminton Center Management System v1.0 is vulnerable to SQL Injection via /bcms/admin/?page=reports/daily_sales_report&date=.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/badminton-center-management-system/SQLi-2.md; https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/badminton-center-management-system/SQLi-2.md
CVE: CVE-2022-31986
Published: 2022-06-02
Description: Badminton Center Management System v1.0 is vulnerable to SQL Injection via /bcms/admin/?page=reports/daily_court_rental_report&date=.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/badminton-center-management-system/SQLi-1.md; https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/badminton-center-management-system/SQLi-1.md
CVE: CVE-2022-31988
Published: 2022-06-02
Description: Badminton Center Management System v1.0 is vulnerable to SQL Injection via bcms/admin/?page=reports/daily_services_report&date=.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/badminton-center-management-system/SQLi-3.md; https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/badminton-center-management-system/SQLi-3.md
CVE: CVE-2022-31989
Published: 2022-06-02
Description: Badminton Center Management System v1.0 is vulnerable to SQL Injection via /bcms/admin/?page=user/manage_user&id=.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/badminton-center-management-system/SQLi-4.md; https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/badminton-center-management-system/SQLi-4.md
CVE: CVE-2022-31990
Published: 2022-06-02
Description: Badminton Center Management System v1.0 is vulnerable to SQL Injection via bcms/classes/Master.php?f=delete_product.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/badminton-center-management-system/SQLi-6.md; https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/badminton-center-management-system/SQLi-6.md
CVE: CVE-2022-31991
Published: 2022-06-02
Description: Badminton Center Management System v1.0 is vulnerable to SQL Injection via bcms/classes/Master.php?f=delete_court.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/badminton-center-management-system/SQLi-5.md; https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/badminton-center-management-system/SQLi-5.md
CVE: CVE-2022-31992
Published: 2022-06-02
Description: Badminton Center Management System v1.0 is vulnerable to SQL Injection via /bcms/admin/?page=court_rentals/view_court_rental&id=.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/badminton-center-management-system/SQLi-8.md; https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/badminton-center-management-system/SQLi-8.md
CVE: CVE-2022-31993
Published: 2022-06-02
Description: Badminton Center Management System v1.0 is vulnerable to SQL Injection via /bcms/classes/Master.php?f=delete_service.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/badminton-center-management-system/SQLi-7.md; https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/badminton-center-management-system/SQLi-7.md
CVE: CVE-2022-31994
Published: 2022-06-02
Description: Badminton Center Management System v1.0 is vulnerable to SQL Injection via /bcms/admin/?page=sales/view_details&id.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/badminton-center-management-system/SQLi-9.md; https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/badminton-center-management-system/SQLi-9.md
CVE: CVE-2022-32007
Published: 2022-06-02
Description: Complete Online Job Search System v1.0 is vulnerable to SQL Injection via /eris/admin/company/index.php?view=edit&id=.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/campcodes.com/online-job-search-system/SQLi-2.md; https://github.com/k0xx11/bug_report/blob/main/vendors/campcodes.com/online-job-search-system/SQLi-2.md
CVE: CVE-2022-32008
Published: 2022-06-02
Description: Complete Online Job Search System v1.0 is vulnerable to SQL Injection via eris/admin/vacancy/index.php?view=edit&id=.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/campcodes.com/online-job-search-system/SQLi-3.md; https://github.com/k0xx11/bug_report/blob/main/vendors/campcodes.com/online-job-search-system/SQLi-3.md
CVE: CVE-2022-32010
Published: 2022-06-02
Description: Complete Online Job Search System v1.0 is vulnerable to SQL Injection via /eris/admin/user/index.php?view=edit&id=.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/campcodes.com/online-job-search-system/SQLi-7.md; https://github.com/k0xx11/bug_report/blob/main/vendors/campcodes.com/online-job-search-system/SQLi-7.md
CVE: CVE-2022-32011
Published: 2022-06-02
Description: Complete Online Job Search System v1.0 is vulnerable to SQL Injection via /eris/admin/applicants/index.php?view=view&id=.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/campcodes.com/online-job-search-system/SQLi-5.md; https://github.com/k0xx11/bug_report/blob/main/vendors/campcodes.com/online-job-search-system/SQLi-5.md
CVE: CVE-2022-32012
Published: 2022-06-02
Description: Complete Online Job Search System v1.0 is vulnerable to SQL Injection via /eris/admin/employee/index.php?view=edit&id=.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/campcodes.com/online-job-search-system/SQLi-4.md; https://github.com/k0xx11/bug_report/blob/main/vendors/campcodes.com/online-job-search-system/SQLi-4.md
CVE: CVE-2022-32013
Published: 2022-06-02
Description: Complete Online Job Search System v1.0 is vulnerable to SQL Injection via eris/admin/category/index.php?view=edit&id=.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/campcodes.com/online-job-search-system/SQLi-6.md; https://github.com/k0xx11/bug_report/blob/main/vendors/campcodes.com/online-job-search-system/SQLi-6.md
CVE: CVE-2022-32014
Published: 2022-06-02
Description: Complete Online Job Search System v1.0 is vulnerable to SQL Injection via /eris/index.php?q=result&searchfor=byfunction.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/campcodes.com/online-job-search-system/SQLi-9.md; https://github.com/k0xx11/bug_report/blob/main/vendors/campcodes.com/online-job-search-system/SQLi-9.md
CVE: CVE-2022-32015
Published: 2022-06-02
Description: Complete Online Job Search System v1.0 is vulnerable to SQL Injection via /eris/index.php?q=category&search=.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/campcodes.com/online-job-search-system/SQLi-8.md; https://github.com/k0xx11/bug_report/blob/main/vendors/campcodes.com/online-job-search-system/SQLi-8.md
CVE: CVE-2022-32016
Published: 2022-06-02
Description: Complete Online Job Search System v1.0 is vulnerable to SQL Injection via /eris/index.php?q=result&searchfor=bycompany.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/campcodes.com/online-job-search-system/SQLi-10.md; https://github.com/k0xx11/bug_report/blob/main/vendors/campcodes.com/online-job-search-system/SQLi-10.md
CVE: CVE-2022-32017
Published: 2022-06-02
Description: Complete Online Job Search System v1.0 is vulnerable to SQL Injection via /eris/index.php?q=result&searchfor=bytitle.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/campcodes.com/online-job-search-system/SQLi-11.md; https://github.com/k0xx11/bug_report/blob/main/vendors/campcodes.com/online-job-search-system/SQLi-11.md
CVE: CVE-2022-32018
Published: 2022-06-02
Description: Complete Online Job Search System v1.0 is vulnerable to SQL Injection via /eris/index.php?q=hiring&search=.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/campcodes.com/online-job-search-system/SQLi-12.md; https://github.com/k0xx11/bug_report/blob/main/vendors/campcodes.com/online-job-search-system/SQLi-12.md
CVE: CVE-2022-32020
Published: 2022-06-02
Description: Car Rental Management System v1.0 is vulnerable to Arbitrary code execution via ip/car-rental-management-system/admin/ajax.php?action=save_settings.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/k0xx11/bug_report/blob/main/vendors/campcodes.com/car-rental-management-system/RCE-2.md; https://github.com/k0xx11/bug_report/blob/main/vendors/campcodes.com/car-rental-management-system/RCE-2.md
CVE: CVE-2022-32021
Published: 2022-06-02
Description: Car Rental Management System v1.0 is vulnerable to SQL Injection via /car-rental-management-system/admin/manage_movement.php?id=.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/campcodes.com/car-rental-management-system/SQLi-3.md; https://github.com/k0xx11/bug_report/blob/main/vendors/campcodes.com/car-rental-management-system/SQLi-3.md
CVE: CVE-2022-32022
Published: 2022-06-02
Description: Car Rental Management System v1.0 is vulnerable to SQL Injection via /ip/car-rental-management-system/admin/ajax.php?action=login.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/campcodes.com/car-rental-management-system/SQLi-1.md.; https://github.com/k0xx11/bug_report/blob/main/vendors/campcodes.com/car-rental-management-system/SQLi-1.md; https://github.com/k0xx11/bug_report/blob/main/vendors/campcodes.com/car-rental-management-system/SQLi-1.md.
CVE: CVE-2022-32024
Published: 2022-06-02
Description: Car Rental Management System v1.0 is vulnerable to SQL Injection via car-rental-management-system/booking.php?car_id=.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/campcodes.com/car-rental-management-system/SQLi-4.md; https://github.com/k0xx11/bug_report/blob/main/vendors/campcodes.com/car-rental-management-system/SQLi-4.md
CVE: CVE-2022-32025
Published: 2022-06-02
Description: Car Rental Management System v1.0 is vulnerable to SQL Injection via /car-rental-management-system/admin/view_car.php?id=.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/campcodes.com/car-rental-management-system/SQLi-6.md; https://github.com/k0xx11/bug_report/blob/main/vendors/campcodes.com/car-rental-management-system/SQLi-6.md
CVE: CVE-2022-32026
Published: 2022-06-02
Description: Car Rental Management System v1.0 is vulnerable to SQL Injection via /car-rental-management-system/admin/manage_booking.php?id=.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/campcodes.com/car-rental-management-system/SQLi-5.md; https://github.com/k0xx11/bug_report/blob/main/vendors/campcodes.com/car-rental-management-system/SQLi-5.md
CVE: CVE-2022-32027
Published: 2022-06-02
Description: Car Rental Management System v1.0 is vulnerable to SQL Injection via /car-rental-management-system/admin/index.php?page=manage_car&id=.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/campcodes.com/car-rental-management-system/SQLi-7.md; https://github.com/k0xx11/bug_report/blob/main/vendors/campcodes.com/car-rental-management-system/SQLi-7.md
CVE: CVE-2022-32028
Published: 2022-06-02
Description: Car Rental Management System v1.0 is vulnerable to SQL Injection via /car-rental-management-system/admin/manage_user.php?id=.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/campcodes.com/car-rental-management-system/SQLi-8.md; https://github.com/k0xx11/bug_report/blob/main/vendors/campcodes.com/car-rental-management-system/SQLi-8.md
CVE: CVE-2022-31018
Published: 2022-06-02
Description: Play Framework is a web framework for Java and Scala. A denial of service vulnerability has been discovered in verions 2.8.3 through 2.8.15 of Play's forms library, in both the Scala and Java APIs. This can occur when using either the `Form#bindFromRequest` method on a JSON request body or the `Form#bind` method directly on a JSON value. If the JSON data being bound to the form contains a deeply-nested JSON object or array, the form binding implementation may consume all available heap space and cause an `OutOfMemoryError`. If executing on the default dispatcher and `akka.jvm-exit-on-fatal-error` is enabled—as it is by default—then this can crash the application process. `Form.bindFromRequest` is vulnerable when using any body parser that produces a type of `AnyContent` or `JsValue` in Scala, or one that can produce a `JsonNode` in Java. This includes Play's default body parser. This vulnerability been patched in version 2.8.16. There is now a global limit on the depth of a JSON object that can be parsed, which can be configured by the user if necessary. As a workaround, applications that do not need to parse a request body of type `application/json` can switch from the default body parser to another body parser that supports only the specific type of body they expect.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://github.com/playframework/playframework/pull/11301; https://github.com/playframework/playframework/releases/tag/2.8.16; https://github.com/playframework/playframework/security/advisories/GHSA-v8x6-59g4-5g3w
CVE: CVE-2021-38221
Published: 2022-06-02
Description: bbs-go <= 3.3.0 including Custom Edition is vulnerable to stored XSS.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/mlogclub/bbs-go/issues/112; https://github.com/mlogclub/bbs-go/pull/113; https://github.com/mlogclub/bbs-go/issues/112
CVE: CVE-2021-45981
Published: 2022-06-02
Description: NetScout nGeniusONE 6.3.2 allows an XML External Entity (XXE) attack.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-611
References: https://netscout.com; https://www.netscout.com/securityadvisories; https://netscout.com
CVE: CVE-2021-45982
Published: 2022-06-02
Description: NetScout nGeniusONE 6.3.2 allows Arbitrary File Upload by a privileged user.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://netscout.com; https://www.netscout.com/securityadvisories; https://netscout.com
CVE: CVE-2021-45983
Published: 2022-06-02
Description: NetScout nGeniusONE 6.3.2 allows Java RMI Code Execution.
CVSS Score: 9.8 (CRITICAL)
References: https://netscout.com; https://www.netscout.com/securityadvisories; https://netscout.com
CVE: CVE-2022-1716
Published: 2022-06-02
Description: Keep My Notes v1.80.147 allows an attacker with physical access to the victim's device to bypass the application's password/pin lock to access user data. This is possible due to lack of adequate security controls to prevent dynamic code manipulation.
CVSS Score: 4.6 (MEDIUM)
References: http://www.kitetech.co/keepmynotes; https://fluidattacks.com/advisories/tyler/; http://www.kitetech.co/keepmynotes
CVE: CVE-2022-1979
Published: 2022-06-02
Description: A vulnerability was found in SourceCodester Product Show Room Site 1.0. It has been declared as problematic. This vulnerability affects p=contact. The manipulation of the Message textbox with the input <script>alert(1)</script> leads to cross site scripting. The attack can be initiated remotely but requires authentication. Exploit details have been disclosed to the public.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-79
References: https://github.com/Xor-Gerke/webray.com.cn/blob/main/cve/Product%20Show%20Room%20Site/%27Message%27%20Stored%20Cross-Site%20Scripting%28XSS%29.md; https://vuldb.com/?id.200950; https://github.com/Xor-Gerke/webray.com.cn/blob/main/cve/Product%20Show%20Room%20Site/%27Message%27%20Stored%20Cross-Site%20Scripting%28XSS%29.md
CVE: CVE-2022-1980
Published: 2022-06-02
Description: A vulnerability was found in SourceCodester Product Show Room Site 1.0. It has been rated as problematic. This issue affects the file /admin/?page=system_info/contact_info. The manipulation of the textbox Telephone with the input <script>alert(1)</script> leads to cross site scripting. The attack may be initiated remotely but requires authentication. Exploit details have been disclosed to the public.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-79
References: https://github.com/Xor-Gerke/webray.com.cn/blob/main/cve/Product%20Show%20Room%20Site/%27Telephone%27%20Stored%20Cross-Site%20Scripting%28XSS%29.md; https://vuldb.com/?id.200951; https://github.com/Xor-Gerke/webray.com.cn/blob/main/cve/Product%20Show%20Room%20Site/%27Telephone%27%20Stored%20Cross-Site%20Scripting%28XSS%29.md
CVE: CVE-2022-1982
Published: 2022-06-02
Description: Uncontrolled resource consumption in Mattermost version 6.6.0 and earlier allows an authenticated attacker to crash the server via a crafted SVG attachment on a post.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-400, CWE-400
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2022-25163
Published: 2022-06-02
Description: Improper Input Validation vulnerability in Mitsubishi Electric MELSEC-Q Series QJ71E71-100 first 5 digits of serial number "24061" or prior, Mitsubishi Electric MELSEC-L series LJ71E71-100 first 5 digits of serial number "24061" or prior and Mitsubishi Electric MELSEC iQ-R Series RD81MES96N firmware version "08" or prior allows a remote unauthenticated attacker to cause a denial of service (DoS) condition or execute malicious code on the target products by sending specially crafted packets.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: https://jvn.jp/vu/JVNVU92561747/index.html; https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-006_en.pdf; https://jvn.jp/vu/JVNVU92561747/index.html
CVE: CVE-2022-26497
Published: 2022-06-02
Description: BigBlueButton Greenlight 2.11.1 allows XSS. A threat actor could have a username containing a JavaScript payload. The payload gets executed in the browser of the victim in the "Share room access" dialog if the victim has shared access to the particular room with the attacker previously.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/172143/Shannon-Baseband-acfg-pcfg-SDP-Attribute-Memory-Corruption.html; https://github.com/bigbluebutton/greenlight/blob/master/app/assets/javascripts/room.js#L352; https://www.mgm-sp.com/en/cve-2022-26497-bigbluebutton-greenlight-xss/
CVE: CVE-2022-26944
Published: 2022-06-02
Description: Percona XtraBackup 2.4.20 unintentionally writes the command line to any resulting backup file output. This may include sensitive arguments passed at run time. In addition, when --history is passed at run time, this command line is also written to the PERCONA_SCHEMA.xtrabackup_history table. NOTE: this issue exists because of an incomplete fix for CVE-2020-10997.
CVSS Score: 6.5 (MEDIUM)
References: https://docs.percona.com/percona-xtrabackup/2.4/release-notes/2.4/2.4.25.html; https://jira.percona.com/browse/PXB-2722; https://docs.percona.com/percona-xtrabackup/2.4/release-notes/2.4/2.4.25.html
CVE: CVE-2022-29597
Published: 2022-06-02
Description: Solutions Atlantic Regulatory Reporting System (RRS) v500 is vulnerable to Local File Inclusion (LFI). Any authenticated user has the ability to reference internal system files within requests made to the RRSWeb/maint/ShowDocument/ShowDocument.aspx page. The server will successfully respond with the file contents of the internal system file requested. This ability could allow for adversaries to extract sensitive data and/or files from the underlying file system, gain knowledge about the internal workings of the system, or access source code of the application.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://github.com/TheGetch/CVE-2022-29597; https://solutions-atlantic.com/rrs/; https://github.com/TheGetch/CVE-2022-29597
CVE: CVE-2022-29704
Published: 2022-06-02
Description: BrowsBox CMS v4.0 was discovered to contain a SQL injection vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://browsbox.com; https://www.youtube.com/watch?v=ECTu2QVAl1c; http://browsbox.com
CVE: CVE-2022-30429
Published: 2022-06-02
Description: Multiple cross-site scripting (XSS) vulnerabilities in Neos CMS allow attackers with the editor role or higher to inject arbitrary script or HTML code using the editor function, the deletion of assets, or a workspace title. The vulnerabilities were found in versions 3.3.29 and 8.0.1 and could also be present in all intermediate versions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://it-sec.de/unbekannte-schwachstellen-in-neos-cms/; https://www.neos.io/blog/xss-in-various-backend-modules.html; https://it-sec.de/unbekannte-schwachstellen-in-neos-cms/