deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-3474
Published: 2022-10-26
Description: A bad credential handling in the remote assets API for Bazel versions prior to 5.3.2 and 4.2.3 sends all user-provided credentials instead of only the required ones for the requests. We recommend upgrading to versions later than or equal to 5.3.2 or 4.2.3.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-522, CWE-522
References: https://github.com/bazelbuild/bazel/security/advisories/GHSA-mxr8-q875-rhwq; https://github.com/bazelbuild/bazel/security/advisories/GHSA-mxr8-q875-rhwq
CVE: CVE-2022-3662
Published: 2022-10-26
Description: A vulnerability was found in Axiomatic Bento4. It has been declared as critical. This vulnerability affects the function GetOffset of the file Ap4Sample.h of the component mp42hls. The manipulation leads to use after free. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-212002 is the identifier assigned to this vulnerability.
CVSS Score: 7.3 (HIGH)
CWE: CWE-119, CWE-416
References: https://github.com/axiomatic-systems/Bento4/files/9817606/mp42hls_cuaf_Ap4Sample99.zip; https://github.com/axiomatic-systems/Bento4/issues/802; https://vuldb.com/?id.212002
CVE: CVE-2022-3663
Published: 2022-10-26
Description: A vulnerability was found in Axiomatic Bento4. It has been rated as problematic. This issue affects the function AP4_StsdAtom of the file Ap4StsdAtom.cpp of the component MP4fragment. The manipulation leads to null pointer dereference. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-212003.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-404, CWE-476
References: https://github.com/axiomatic-systems/Bento4/files/9817303/mp4fragment_npd_Ap4StsdAtom.cpp75.zip; https://github.com/axiomatic-systems/Bento4/issues/800; https://vuldb.com/?id.212003
CVE: CVE-2022-3664
Published: 2022-10-26
Description: A vulnerability classified as critical has been found in Axiomatic Bento4. Affected is the function AP4_BitStream::WriteBytes of the file Ap4BitStream.cpp of the component avcinfo. The manipulation leads to heap-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-212004.
CVSS Score: 7.3 (HIGH)
CWE: CWE-119, CWE-787
References: https://github.com/axiomatic-systems/Bento4/files/9746288/avcinfo_poc1.zip; https://github.com/axiomatic-systems/Bento4/issues/794; https://vuldb.com/?id.212004
CVE: CVE-2022-3665
Published: 2022-10-26
Description: A vulnerability classified as critical was found in Axiomatic Bento4. Affected by this vulnerability is an unknown functionality of the file AvcInfo.cpp of the component avcinfo. The manipulation leads to heap-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-212005 was assigned to this vulnerability.
CVSS Score: 7.3 (HIGH)
CWE: CWE-119, CWE-787
References: https://github.com/axiomatic-systems/Bento4/files/9746311/avcinfo_poc2.zip; https://github.com/axiomatic-systems/Bento4/issues/794; https://vuldb.com/?id.212005
CVE: CVE-2022-3666
Published: 2022-10-26
Description: A vulnerability, which was classified as critical, has been found in Axiomatic Bento4. Affected by this issue is the function AP4_LinearReader::Advance of the file Ap4LinearReader.cpp of the component mp42ts. The manipulation leads to use after free. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-212006 is the identifier assigned to this vulnerability.
CVSS Score: 7.3 (HIGH)
CWE: CWE-119, CWE-416
References: https://github.com/axiomatic-systems/Bento4/files/9744391/mp42ts_poc.zip; https://github.com/axiomatic-systems/Bento4/issues/793; https://vuldb.com/?id.212006
CVE: CVE-2022-3667
Published: 2022-10-26
Description: A vulnerability, which was classified as critical, was found in Axiomatic Bento4. This affects the function AP4_MemoryByteStream::WritePartial of the file Ap4ByteStream.cpp of the component mp42aac. The manipulation leads to heap-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-212007.
CVSS Score: 7.3 (HIGH)
CWE: CWE-119, CWE-787
References: https://github.com/17ssDP/fuzzer_crashes/blob/main/Bento4/mp42aac-hbo-01; https://github.com/axiomatic-systems/Bento4/issues/789; https://vuldb.com/?id.212007
CVE: CVE-2022-3668
Published: 2022-10-26
Description: A vulnerability has been found in Axiomatic Bento4 and classified as problematic. This vulnerability affects the function AP4_AtomFactory::CreateAtomFromStream of the component mp4edit. The manipulation leads to memory leak. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-212008.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-404, CWE-401
References: https://github.com/axiomatic-systems/Bento4/files/9640968/Bug_1_POC.zip; https://github.com/axiomatic-systems/Bento4/issues/776; https://vuldb.com/?id.212008
CVE: CVE-2022-3669
Published: 2022-10-26
Description: A vulnerability was found in Axiomatic Bento4 and classified as problematic. This issue affects the function AP4_AvccAtom::Create of the component mp4edit. The manipulation leads to memory leak. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-212009 was assigned to this vulnerability.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-404, CWE-401
References: https://github.com/axiomatic-systems/Bento4/files/9675042/Bug_2_POC.zip; https://github.com/axiomatic-systems/Bento4/issues/776; https://vuldb.com/?id.212009
CVE: CVE-2022-3670
Published: 2022-10-26
Description: A vulnerability was found in Axiomatic Bento4. It has been classified as critical. Affected is the function WriteSample of the component mp42hevc. The manipulation leads to heap-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-212010 is the identifier assigned to this vulnerability.
CVSS Score: 7.3 (HIGH)
CWE: CWE-119, CWE-787
References: https://github.com/axiomatic-systems/Bento4/files/9675049/Bug_3_POC.zip; https://github.com/axiomatic-systems/Bento4/issues/776; https://vuldb.com/?id.212010
CVE: CVE-2022-42998
Published: 2022-10-26
Description: D-Link DIR-816 A2 1.10 B05 was discovered to contain a stack overflow via the srcip parameter at /goform/form2IPQoSTcAdd.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://github.com/hunzi0/VulInfo/tree/main/D-Link/DIR-816/form2IPQoSTcAdd; https://www.dlink.com/en/security-bulletin/; https://github.com/hunzi0/VulInfo/tree/main/D-Link/DIR-816/form2IPQoSTcAdd
CVE: CVE-2022-42999
Published: 2022-10-26
Description: D-Link DIR-816 A2 1.10 B05 was discovered to contain multiple command injection vulnerabilities via the admuser and admpass parameters at /goform/setSysAdm.
CVSS Score: 7.5 (HIGH)
CWE: CWE-78, CWE-78
References: https://github.com/hunzi0/VulInfo/tree/main/D-Link/DIR-816/setSysAdm; https://www.dlink.com/en/security-bulletin/; https://github.com/hunzi0/VulInfo/tree/main/D-Link/DIR-816/setSysAdm
CVE: CVE-2022-43000
Published: 2022-10-26
Description: D-Link DIR-816 A2 1.10 B05 was discovered to contain a stack overflow via the wizardstep4_pskpwd parameter at /goform/form2WizardStep4.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://github.com/hunzi0/VulInfo/tree/main/D-Link/DIR-816/form2WizardStep4; https://www.dlink.com/en/security-bulletin/; https://github.com/hunzi0/VulInfo/tree/main/D-Link/DIR-816/form2WizardStep4
CVE: CVE-2022-43001
Published: 2022-10-26
Description: D-Link DIR-816 A2 1.10 B05 was discovered to contain a stack overflow via the pskValue parameter in the setSecurity function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://github.com/hunzi0/VulInfo/tree/main/D-Link/DIR-816/setSecurity; https://www.dlink.com/en/security-bulletin/; https://github.com/hunzi0/VulInfo/tree/main/D-Link/DIR-816/setSecurity
CVE: CVE-2022-43002
Published: 2022-10-26
Description: D-Link DIR-816 A2 1.10 B05 was discovered to contain a stack overflow via the wizardstep54_pskpwd parameter at /goform/form2WizardStep54.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://github.com/hunzi0/VulInfo/tree/main/D-Link/DIR-816/form2WizardStep54; https://www.dlink.com/en/security-bulletin/; https://github.com/hunzi0/VulInfo/tree/main/D-Link/DIR-816/form2WizardStep54
CVE: CVE-2022-43003
Published: 2022-10-26
Description: D-Link DIR-816 A2 1.10 B05 was discovered to contain a stack overflow via the pskValue parameter in the setRepeaterSecurity function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://github.com/hunzi0/VulInfo/tree/main/D-Link/DIR-816/setRepeaterSecurity; https://www.dlink.com/en/security-bulletin/; https://github.com/hunzi0/VulInfo/tree/main/D-Link/DIR-816/setRepeaterSecurity
CVE: CVE-2022-39286
Published: 2022-10-26
Description: Jupyter Core is a package for the core common functionality of Jupyter projects. Jupyter Core prior to version 4.11.2 contains an arbitrary code execution vulnerability in `jupyter_core` that stems from `jupyter_core` executing untrusted files in CWD. This vulnerability allows one user to run code as another. Version 4.11.2 contains a patch for this issue. There are no known workarounds.
CVSS Score: 8.8 (HIGH)
CWE: CWE-250, CWE-269, CWE-427
References: https://github.com/jupyter/jupyter_core/commit/1118c8ce01800cb689d51f655f5ccef19516e283; https://github.com/jupyter/jupyter_core/security/advisories/GHSA-m678-f26j-3hrp; https://lists.debian.org/debian-lts-announce/2022/11/msg00022.html
CVE: CVE-2022-39348
Published: 2022-10-26
Description: Twisted is an event-based framework for internet applications. Started with version 0.9.4, when the host header does not match a configured host `twisted.web.vhost.NameVirtualHost` will return a `NoResource` resource which renders the Host header unescaped into the 404 response allowing HTML and script injection. In practice this should be very difficult to exploit as being able to modify the Host header of a normal HTTP request implies that one is already in a privileged position. This issue was fixed in version 22.10.0rc1. There are no known workarounds.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-80, CWE-79
References: https://github.com/twisted/twisted/commit/f2f5e81c03f14e253e85fe457e646130780db40b; https://github.com/twisted/twisted/commit/f49041bb67792506d85aeda9cf6157e92f8048f4; https://github.com/twisted/twisted/security/advisories/GHSA-vg46-2rrj-3647
CVE: CVE-2022-39355
Published: 2022-10-26
Description: Discourse Patreon enables syncronization between Discourse Groups and Patreon rewards. On sites with Patreon login enabled, an improper authentication vulnerability could be used to take control of a victim's forum account. This vulnerability is patched in commit number 846d012151514b35ce42a1636c7d70f6dcee879e of the discourse-patreon plugin. Out of an abundance of caution, any Discourse accounts which have logged in with an unverified-email Patreon account will be logged out and asked to verify their email address on their next login. As a workaround, disable the patreon integration and log out all users with associated Patreon accounts.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-287, CWE-287
References: https://github.com/discourse/discourse-patreon/commit/846d012151514b35ce42a1636c7d70f6dcee879e; https://github.com/discourse/discourse-patreon/security/advisories/GHSA-fvj9-f67v-qpr4; https://github.com/discourse/discourse-patreon/commit/846d012151514b35ce42a1636c7d70f6dcee879e
CVE: CVE-2022-3704
Published: 2022-10-26
Description: A vulnerability classified as problematic has been found in Ruby on Rails. This affects an unknown part of the file actionpack/lib/action_dispatch/middleware/templates/routes/_table.html.erb. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The real existence of this vulnerability is still doubted at the moment. The name of the patch is be177e4566747b73ff63fd5f529fab564e475ed4. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-212319. NOTE: Maintainer declares that there isn’t a valid attack vector. The issue was wrongly reported as a security vulnerability by a non-member of the Rails team.
CVSS Score: 3.5 (LOW)
CWE: CWE-707, CWE-79
References: https://github.com/rails/rails/commit/be177e4566747b73ff63fd5f529fab564e475ed4; https://github.com/rails/rails/issues/46244; https://vuldb.com/?id.212319
CVE: CVE-2022-3705
Published: 2022-10-26
Description: A vulnerability was found in vim and classified as problematic. Affected by this issue is the function qf_update_buffer of the file quickfix.c of the component autocmd Handler. The manipulation leads to use after free. The attack may be launched remotely. Upgrading to version 9.0.0805 is able to address this issue. The name of the patch is d0fab10ed2a86698937e3c3fed2f10bd9bb5e731. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-212324.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119, CWE-416
References: http://seclists.org/fulldisclosure/2023/Jan/19; https://github.com/vim/vim/commit/d0fab10ed2a86698937e3c3fed2f10bd9bb5e731; https://lists.debian.org/debian-lts-announce/2022/11/msg00009.html
CVE: CVE-2022-3363
Published: 2022-10-26
Description: Business Logic Errors in GitHub repository ikus060/rdiffweb prior to 2.5.0a7.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-840
References: https://github.com/ikus060/rdiffweb/commit/c27c46bac656b1da74f28eac1b52dfa5df76e6f2; https://huntr.dev/bounties/b8a40ba6-2452-4abe-a80a-2d065ee8891e; https://github.com/ikus060/rdiffweb/commit/c27c46bac656b1da74f28eac1b52dfa5df76e6f2
CVE: CVE-2022-40703
Published: 2022-10-26
Description: CWE-302 Authentication Bypass by Assumed-Immutable Data in AliveCor Kardia App version 5.17.1-754993421 and prior

 on Android allows an unauthenticated attacker with physical access to the Android device containing the app to bypass application authentication and alter information in the app.
CVSS Score: 5.2 (MEDIUM)
CWE: CWE-302, CWE-287
References: https://www.cisa.gov/uscert/ics/advisories/icsma-22-298-01; https://www.cisa.gov/uscert/ics/advisories/icsma-22-298-01
CVE: CVE-2021-45475
Published: 2022-10-27
Description: Yordam Library Information Document Automation product before version 19.02 has an unauthenticated Information disclosure vulnerability.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200, CWE-200
References: https://www.usom.gov.tr/bildirim/tr-22-0669; https://www.usom.gov.tr/bildirim/tr-22-0669
CVE: CVE-2021-45476
Published: 2022-10-27
Description: Yordam Library Information Document Automation product before version 19.02 has an unauthenticated reflected XSS vulnerability.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.usom.gov.tr/bildirim/tr-22-0669; https://www.usom.gov.tr/bildirim/tr-22-0669
CVE: CVE-2022-25918
Published: 2022-10-27
Description: The package shescape from 1.5.10 and before 1.6.1 are vulnerable to Regular Expression Denial of Service (ReDoS) via the escape function in index.js, due to the usage of insecure regex in the escapeArgBash function.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-1333, CWE-1333
References: https://github.com/ericcornelissen/shescape/blob/main/src/unix.js%23L52; https://github.com/ericcornelissen/shescape/commit/552e8eab56861720b1d4e5474fb[PII_REDACTED]8f9; https://github.com/ericcornelissen/shescape/releases/tag/v1.6.1
CVE: CVE-2022-2508
Published: 2022-10-27
Description: In affected versions of Octopus Server it is possible to reveal the existence of resources in a space that the user does not have access to due to verbose error messaging.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-209, CWE-209
References: https://advisories.octopus.com/post/2022/sa2022-22/; https://advisories.octopus.com/post/2022/sa2022-22/
CVE: CVE-2022-2782
Published: 2022-10-27
Description: In affected versions of Octopus Server it is possible for a session token to be valid indefinitely due to improper validation of the session token parameters.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-613, CWE-613
References: https://advisories.octopus.com/post/2022/sa2022-21/; https://advisories.octopus.com/post/2022/sa2022-21/
CVE: CVE-2022-3714
Published: 2022-10-27
Description: A vulnerability classified as critical has been found in SourceCodester Online Medicine Ordering System 1.0. Affected is an unknown function of the file admin/?page=orders/view_order. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. VDB-212346 is the identifier assigned to this vulnerability.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-707, CWE-89
References: https://vuldb.com/?id.212346; https://vuldb.com/?id.212346
CVE: CVE-2022-3716
Published: 2022-10-27
Description: A vulnerability classified as problematic was found in SourceCodester Online Medicine Ordering System 1.0. Affected by this vulnerability is an unknown functionality of the file /omos/admin/?page=user/list. The manipulation of the argument First Name/Middle Name/Last Name leads to cross site scripting. The attack can be launched remotely. The associated identifier of this vulnerability is VDB-212347.
CVSS Score: 3.5 (LOW)
CWE: CWE-707, CWE-79
References: https://vuldb.com/?id.212347; https://vuldb.com/?id.212347
CVE: CVE-2022-3717
Published: 2022-10-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2022-3718
Published: 2022-10-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2022-3719
Published: 2022-10-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2022-42992
Published: 2022-10-27
Description: Multiple stored cross-site scripting (XSS) vulnerabilities in Train Scheduler App v1.0 allow attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Train Code, Train Name, and Destination text fields.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://oretnom23.com; http://train.com; https://github.com/draco1725/POC/blob/main/Exploit/Train%20Scheduler%20App/XSS
CVE: CVE-2022-2809
Published: 2022-10-27
Description: A vulnerability in bmcweb of OpenBMC Project allows user to cause denial of service. When fuzzing the multipart_parser code using AFL++ with address sanitizer enabled to find smallest memory corruptions possible. It detected problem in how multipart_parser handles unclosed http headers. If long enough http header is passed in the multipart form without colon there is one byte overwrite on heap. It can be conducted multiple times in a loop to cause DoS.
CVSS Score: 8.2 (HIGH)
CWE: CWE-122, CWE-229, CWE-787
References: https://github.com/openbmc/bmcweb; https://github.com/openbmc/bmcweb
CVE: CVE-2022-36182
Published: 2022-10-27
Description: Hashicorp Boundary v0.8.0 is vulnerable to Clickjacking which allow for the interception of login credentials, re-direction of users to malicious sites, or causing users to perform malicious actions on the site.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-1021, CWE-1021
References: https://owasp.org/www-community/attacks/Clickjacking; https://packetstormsecurity.com/files/168654/Hashicorp-Boundary-Clickjacking.html; https://owasp.org/www-community/attacks/Clickjacking
CVE: CVE-2022-3409
Published: 2022-10-27
Description: A vulnerability in bmcweb of OpenBMC Project allows user to cause denial of service. This vulnerability was identified during mitigation for CVE-2022-2809. When fuzzing the multipart_parser code using AFL++ with address sanitizer enabled to find smallest memory corruptions possible. It detected problem in how multipart_parser handles unclosed http headers. If long enough http header is passed in the multipart form without colon there is one byte overwrite on heap. It can be conducted multiple times in a loop to cause DoS.
CVSS Score: 8.2 (HIGH)
CWE: CWE-121, CWE-229, CWE-787
References: https://github.com/openbmc/bmcweb; https://github.com/openbmc/bmcweb
CVE: CVE-2022-38744
Published: 2022-10-27
Description: 
An unauthenticated attacker with network access to a victim's Rockwell Automation FactoryTalk Alarm and 
Events service could open a connection, causing the service to fault and become unavailable. The affected port 
could be used as a server ping port and uses messages structured with XML.



CVSS Score: 7.5 (HIGH)
CWE: CWE-287, CWE-287
References: https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1136876; https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1136876
CVE: CVE-2022-39329
Published: 2022-10-27
Description: Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Nextcloud Server and Nextcloud Enterprise Server prior to versions 23.0.9 and 24.0.5 are vulnerable to exposure of information that cannot be controlled by administrators without direct database access. Versions 23.0.9 and 24.0.5 contains patches for this issue. No known workarounds are available.
CVSS Score: 3.5 (LOW)
CWE: CWE-284, CWE-285, CWE-862
References: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-8f3p-rcm5-mrg3; https://github.com/nextcloud/server/pull/33643; https://hackerone.com/reports/1675014
CVE: CVE-2022-39330
Published: 2022-10-27
Description: Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Nextcloud Server prior to versions 23.0.10 and 24.0.6 and Nextcloud Enterprise Server prior to versions 22.2.10, 23.0.10, and 24.0.6 are vulnerable to a logged-in attacker slowing down the system by generating a lot of database/cpu load. Nextcloud Server versions 23.0.10 and 24.0.6 and Nextcloud Enterprise Server versions 22.2.10, 23.0.10, and 24.0.6 contain patches for this issue. As a workaround, disable the Circles app.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-400, CWE-400
References: https://github.com/nextcloud/circles/pull/1147; https://github.com/nextcloud/security-advisories/security/advisories/GHSA-wxx7-w5p4-7x4c; https://hackerone.com/reports/1688199
CVE: CVE-2022-42991
Published: 2022-10-27
Description: A stored cross-site scripting (XSS) vulnerability in Simple Online Public Access Catalog v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Edit Account Full Name field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://oretnom23.com; http://simple.com; https://github.com/draco1725/POC/blob/main/Exploit/Simple%20Online%20Public%20Access%20Catalog/XSS
CVE: CVE-2022-42993
Published: 2022-10-27
Description: Password Storage Application v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Setup page.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://oretnom23.com; http://password.com; https://github.com/draco1725/POC/blob/main/Exploit/Password%20Storage%20Application/XSS