deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-34854
Published: 2023-02-16
Description: Improper access control in the Intel(R) SUR software before version 2.4.8902 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS Score: 6.7 (MEDIUM)
References: http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00729.html; http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00729.html
CVE: CVE-2022-34864
Published: 2023-02-16
Description: Out-of-bounds read in the Intel(R) Trace Analyzer and Collector software before version 2021.5 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-125
References: http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00733.html; http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00733.html
CVE: CVE-2022-35729
Published: 2023-02-16
Description: Out of bounds read in firmware for OpenBMC in some Intel(R) platforms before version 0.72 may allow unauthenticated user to potentially enable denial of service via network access.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00737.html; http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00737.html
CVE: CVE-2022-35883
Published: 2023-02-16
Description: NULL pointer dereference in the Intel(R) Media SDK software before version 22.2.2 may allow an authenticated user to potentially enable denial of service via local access.
CVSS Score: 2.2 (LOW)
CWE: CWE-476
References: http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00731.html; http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00731.html
CVE: CVE-2022-36287
Published: 2023-02-16
Description: Uncaught exception in the FCS Server software maintained by Intel before version 1.1.79.3 may allow a privileged user to potentially enable denial of service via physical access.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-755
References: http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00739.html; http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00739.html
CVE: CVE-2022-36289
Published: 2023-02-16
Description: Protection mechanism failure in the Intel(R) Media SDK software before version 22.2.2 may allow an authenticated user to potentially enable denial of service via local access.
CVSS Score: 2.8 (LOW)
References: http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00731.html; http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00731.html
CVE: CVE-2022-36369
Published: 2023-02-16
Description: Improper access control in some QATzip software maintained by Intel(R) before version 1.0.9 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS Score: 7.8 (HIGH)
References: http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00765.html; http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00765.html
CVE: CVE-2022-36382
Published: 2023-02-16
Description: Out-of-bounds write in firmware for some Intel(R) Ethernet Network Controllers and Adapters E810 Series before version 1.7.0.8 and some Intel(R) Ethernet 700 Series Controllers and Adapters before version 9.101 may allow a privileged user to potentially enable denial of service via local access.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-787
References: http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00754.html; http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00754.html
CVE: CVE-2022-36397
Published: 2023-02-16
Description: Incorrect default permissions in the software installer for some Intel(R) QAT drivers for Linux before version 4.17 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS Score: 7.3 (HIGH)
CWE: CWE-276
References: http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00751.html; http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00751.html
CVE: CVE-2022-36416
Published: 2023-02-16
Description: Protection mechanism failure in the Intel(R) Ethernet 500 Series Controller drivers for VMware before version 1.10.0.13 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS Score: 4.4 (MEDIUM)
References: http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00750.html; http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00750.html
CVE: CVE-2022-36797
Published: 2023-02-16
Description: Protection mechanism failure in the Intel(R) Ethernet 500 Series Controller drivers for VMware before version 1.10.0.1 may allow an authenticated user to potentially enable denial of service via local access.
CVSS Score: 3.3 (LOW)
References: http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00750.html; http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00750.html
CVE: CVE-2022-37340
Published: 2023-02-16
Description: Uncontrolled search path in some Intel(R) QAT drivers for Windows before version 1.6 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-427
References: http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00751.html; http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00751.html
CVE: CVE-2022-38056
Published: 2023-02-16
Description: Improper neutralization in the Intel(R) EMA software before version 1.8.1.0 may allow a privileged user to potentially enable escalation of privilege via network access.
CVSS Score: 3.8 (LOW)
References: http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00764.html; http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00764.html
CVE: CVE-2022-38090
Published: 2023-02-16
Description: Improper isolation of shared resources in some Intel(R) Processors when using Intel(R) Software Guard Extensions may allow a privileged user to potentially enable information disclosure via local access.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-922
References: http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00767.html; http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00767.html
CVE: CVE-2022-41314
Published: 2023-02-16
Description: Uncontrolled search path in some Intel(R) Network Adapter installer software may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-427
References: http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00770.html; http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00770.html
CVE: CVE-2022-41614
Published: 2023-02-16
Description: Insufficiently protected credentials in the Intel(R) ON Event Series Android application before version 2.0 may allow an authenticated user to potentially enable information disclosure via local access.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-522
References: http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00776.html; http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00776.html
CVE: CVE-2022-48324
Published: 2023-02-16
Description: Multiple Cross Site Scripting (XSS) vulnerabilities in Mapos 4.39.0 allow attackers to execute arbitrary code. Affects the following parameters: (1) pesquisa, (2) data, (3) data2, (4) nome, (5) descricao, (6) idDocumentos, (7) id in file application/controllers/Arquivos.php; (8) senha, (9) nomeCliente, (10) contato, (11) documento, (12) telefone, (13) celular, (14) email, (15) rua, (16) numero, (17) complemento, (18) bairro, (19) cidade, (20) estado, (21) cep, (22) idClientes, (23) id in file application/controllers/Clientes.php; (24) id, (25) tipo, (26) forma_pagamento, (27) gateway_de_pagamento, (28) excluir_id, (29) confirma_id, (30) cancela_id in file application/controllers/Cobrancas.php; (31) vencimento_de, (32) vencimento_ate, (33) cliente, (34) tipo, (35) status, (36) valor_desconto, (37) desconto, (38) periodo, (39) per_page, (40) urlAtual, (41) vencimento, (42) recebimento, (43) valor, (44) recebido, (45) formaPgto, (46) desconto_parc, (47) entrada, (48) qtdparcelas_parc, (49) valor_parc, (50) dia_pgto, (51) dia_base_pgto, (52) comissao, (53) descricao_parc, (54) cliente_parc, (55) observacoes_parc, (56) formaPgto_parc, (57) tipo_parc, (58) pagamento, (59) pago, (60) valor_desconto_editar, (61) descricao, (62) fornecedor, (63) observacoes, (64) id in file application/controllers/Financeiro.php; (65) refGarantia, (66) textoGarantia, (67) idGarantias in file application/controllers/Garantias.php; (68) email, (69) senha in file application/controllers/Login.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://gist.github.com/enferas/7c7f0a3c6cb30939d9039043c0b86ea8; https://github.com/RamonSilva20/mapos/issues/2010; https://github.com/RamonSilva20/mapos/pull/2015#pullrequestreview[PII_REDACTED]
CVE: CVE-2022-48325
Published: 2023-02-16
Description: Multiple Cross Site Scripting (XSS) vulnerabilities in Mapos 4.39.0 allow attackers to execute arbitrary code. Affects the following parameters: (1) year, (2) oldSenha, (3) novaSenha, (4) termo, (5) nome, (6) cnpj, (7) ie, (8) cep, (9) logradouro, (10) numero, (11) bairro, (12) cidade, (13) uf, (14) telefone, (15) email, (16) id, (17) app_name, (18) per_page, (19) app_theme, (20) os_notification, (21) email_automatico, (22) control_estoque, (23) notifica_whats, (24) control_baixa, (25) control_editos, (26) control_edit_vendas, (27) control_datatable, (28) pix_key, (29) os_status_list, (30) control_2vias, (31) status, (32) start, (33) end in file application/controllers/Mapos.php; (34) token, (35) senha, (36) email, (37) nomeCliente, (38) documento, (39) telefone, (40) celular, (41) rua, (42) numero, (43) complemento, (44) bairro, (45) cidade, (46) estado, (47) cep, (48) idClientes, (49) descricaoProduto, (50) defeito in file application/controllers/Mine.php; (51) pesquisa, (52) status, (53) data, (54) data2, (55) dataInicial, (56) dataFinal, (57) termoGarantia, (58) garantias_id, (59) clientes_id, (60) usuarios_id, (61) idOs, (62) garantia, (63) descricaoProduto, (64) defeito, (65) observacoes, (66) laudoTecnico, (67) id, (68) preco, (69) quantidade, (70) idProduto, (71) idOsProduto, (72) produto, (73) idServico, (74) idOsServico, (75) desconto, (76) tipoDesconto, (77) resultado, (78) vencimento, (79) recebimento, (80) os_id, (81) valor, (82) recebido, (83) formaPgto, (84) tipo, (85) anotacao, (86) idAnotacao in file application/controllers/Os.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://gist.github.com/enferas/7c7f0a3c6cb30939d9039043c0b86ea8; https://github.com/RamonSilva20/mapos/issues/2010; https://github.com/RamonSilva20/mapos/pull/2015#pullrequestreview[PII_REDACTED]
CVE: CVE-2022-48326
Published: 2023-02-16
Description: Multiple Cross Site Scripting (XSS) vulnerabilities in Mapos 4.39.0 allow attackers to execute arbitrary code. Affects the following parameters: (1) nome, (2) aCliente, (3) eCliente, (4) dCliente, (5) vCliente, (6) aProduto, (7) eProduto, (8) dProduto, (9) vProduto, (10) aServico, (11) eServico, (12) dServico, (13) vServico, (14) aOs, (15) eOs, (16) dOs, (17) vOs, (18) aVenda, (19) eVenda, (20) dVenda, (21) vVenda, (22) aGarantia, (23) eGarantia, (24) dGarantia, (25) vGarantia, (26) aArquivo, (27) eArquivo, (28) dArquivo, (29) vArquivo, (30) aPagamento, (31) ePagamento, (32) dPagamento, (33) vPagamento, (34) aLancamento, (35) eLancamento, (36) dLancamento, (37) vLancamento, (38) cUsuario, (39) cEmitente, (40) cPermissao, (41) cBackup, (42) cAuditoria, (43) cEmail, (44) cSistema, (45) rCliente, (46) rProduto, (47) rServico, (48) rOs, (49) rVenda, (50) rFinanceiro, (51) aCobranca, (52) eCobranca, (53) dCobranca, (54) vCobranca, (55) situacao, (56) idPermissao, (57) id in file application/controllers/Permissoes.php; (58) precoCompra, (59) precoVenda, (60) descricao, (61) unidade, (62) estoque, (63) estoqueMinimo, (64) idProdutos, (65) id, (66) estoqueAtual in file application/controllers/Produtos.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://gist.github.com/enferas/7c7f0a3c6cb30939d9039043c0b86ea8; https://github.com/RamonSilva20/mapos/issues/2010; https://github.com/RamonSilva20/mapos/pull/2015#pullrequestreview[PII_REDACTED]
CVE: CVE-2022-48327
Published: 2023-02-16
Description: Multiple Cross Site Scripting (XSS) vulnerabilities in Mapos 4.39.0 allow attackers to execute arbitrary code. Affects the following parameters: (1) dataInicial, (2) dataFinal, (3) tipocliente, (4) format, (5) precoInicial, (6) precoFinal, (7) estoqueInicial, (8) estoqueFinal, (9) de_id, (10) ate_id, (11) clientes_id, (12) origem, (13) cliente, (14) responsavel, (15) status, (16) tipo, (17) situacao in file application/controllers/Relatorios.php; (18) preco, (19) nome, (20) descricao, (21) idServicos, (22) id in file application/controllers/Servicos.php; (23) senha, (24) permissoes_id, (25) idUsuarios, (26) situacao, (27) nome, (28) rg, (29) cpf, (30) cep, (31) rua, (32) numero, (33) bairro, (34) cidade, (35) estado, (36) email, (37) telefone, (38) celular in file application/controllers/Usuarios.php; (39) dataVenda, (40) observacoes, (41) observacoes_cliente, (42) clientes_id, (43) usuarios_id, (44) idVendas, (45) id, (46) idVendasProduto, (47) preco, (48) quantidade, (49) idProduto, (50) produto, (51) desconto, (52) tipoDesconto, (53) resultado, (54) vendas_id, (55) vencimento, (56) recebimento, (57) valor, (58) recebido, (59) formaPgto, (60) tipo in file application/controllers/Vendas.php; (61) situacao, (62) periodo, (63) vencimento_de, (64) vencimento_ate, (65) tipo, (66) status, (67) cliente in file application/views/financeiro/lancamentos.php; (68) year in file application/views/mapos/painel.php; (69) pesquisa in file application/views/os/os.php; (70) etiquetaCode in file application/views/relatorios/imprimir/imprimirEtiquetas.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://gist.github.com/enferas/7c7f0a3c6cb30939d9039043c0b86ea8; https://github.com/RamonSilva20/mapos/issues/2010; https://github.com/RamonSilva20/mapos/pull/2015#pullrequestreview[PII_REDACTED]
CVE: CVE-2023-22380
Published: 2023-02-16
Description: A path traversal vulnerability was identified in GitHub Enterprise Server that allowed arbitrary file reading when building a GitHub Pages site. To exploit this vulnerability, an attacker would need permission to create and build a GitHub Pages site on the GitHub Enterprise Server instance. This vulnerability affected all versions of GitHub Enterprise Server since 3.7 and was fixed in version 3.7.6. This vulnerability was reported via the GitHub Bug Bounty program.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://docs.github.com/en/enterprise-server%403.7/admin/release-notes#3.7.6; https://docs.github.com/en/enterprise-server%403.7/admin/release-notes#3.7.6
CVE: CVE-2019-17003
Published: 2023-02-16
Description: Scanning a QR code that contained a javascript: URL would have resulted in the Javascript being executed.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://bugzilla.mozilla.org/show_bug.cgi?id=CVE-2019-17003; https://bugzilla.mozilla.org/show_bug.cgi?id=CVE-2019-17003
CVE: CVE-2020-12413
Published: 2023-02-16
Description: The Raccoon attack is a timing attack on DHE ciphersuites inherit in the TLS specification. To mitigate this vulnerability, Firefox disabled support for DHE ciphersuites.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-203, CWE-203
References: https://bugzilla.mozilla.org/show_bug.cgi?id=CVE-2020-12413; https://raccoon-attack.com/; https://bugzilla.mozilla.org/show_bug.cgi?id=CVE-2020-12413
CVE: CVE-2020-6817
Published: 2023-02-16
Description: bleach.clean behavior parsing style attributes could result in a regular expression denial of service (ReDoS). Calls to bleach.clean with an allowed tag with an allowed style attribute are vulnerable to ReDoS. For example, bleach.clean(..., attributes={'a': ['style']}).
CVSS Score: 7.5 (HIGH)
CWE: CWE-1333, CWE-1333
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1623633; https://github.com/mozilla/bleach/security/advisories/GHSA-vqhp-cxgc-6wmm; https://bugzilla.mozilla.org/show_bug.cgi?id=1623633
CVE: CVE-2021-23980
Published: 2023-02-16
Description: A mutation XSS affects users calling bleach.clean with all of: svg or math in the allowed tags p or br in allowed tags style, title, noscript, script, textarea, noframes, iframe, or xmp in allowed tags the keyword argument strip_comments=False Note: none of the above tags are in the default allowed tags and strip_comments defaults to True.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://bugzilla.mozilla.org/show_bug.cgi?id=CVE-2021-23980; https://github.com/mozilla/bleach/security/advisories/GHSA-vv2x-vrpj-qqpq; https://bugzilla.mozilla.org/show_bug.cgi?id=CVE-2021-23980
CVE: CVE-2021-43529
Published: 2023-02-16
Description: Thunderbird versions prior to 91.3.0 are vulnerable to the heap overflow described in CVE-2021-43527 when processing S/MIME messages. Thunderbird versions 91.3.0 and later will not call the vulnerable code when processing S/MIME messages that contain certificates with DER-encoded DSA or RSA-PSS signatures.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://bugzilla.mozilla.org/show_bug.cgi?id=CVE-2021-43529; https://bugzilla.mozilla.org/show_bug.cgi?id=CVE-2021-43529
CVE: CVE-2022-0637
Published: 2023-02-16
Description: open redirect in pollbot (pollbot.services.mozilla.com) in versions before 1.4.6
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601, CWE-601
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1753838; https://bugzilla.mozilla.org/show_bug.cgi?id=1753838
CVE: CVE-2022-44299
Published: 2023-02-16
Description: SiteServerCMS 7.1.3 sscms has a file read vulnerability.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://github.com/siteserver/cms/issues/3491; https://github.com/siteserver/cms/issues/3491
CVE: CVE-2022-47703
Published: 2023-02-16
Description: TIANJIE CPE906-3 is vulnerable to password disclosure. This is present on Software Version WEB5.0_LCD_20200513, Firmware Version MV8.003, and Hardware Version CPF906-V5.0_LCD_20200513.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306, CWE-306
References: https://github.com/OlivierLaflamme/cve/blob/main/TIANJIE/CPE906-3/unauth_password_disclosure.md; https://github.com/OlivierLaflamme/cve/blob/main/TIANJIE/CPE906-3/unauth_password_disclosure.md
CVE: CVE-2023-0821
Published: 2023-02-16
Description: HashiCorp Nomad and Nomad Enterprise 1.2.15 up to 1.3.8, and 1.4.3 jobs using a maliciously compressed artifact stanza source can cause excessive disk usage. Fixed in 1.2.16, 1.3.9, and 1.4.4.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-409
References: https://discuss.hashicorp.com/t/hcsec-2023-05-nomad-client-vulnerable-to-decompression-bombs-in-artifact-block/50292; https://discuss.hashicorp.com/t/hcsec-2023-05-nomad-client-vulnerable-to-decompression-bombs-in-artifact-block/50292
CVE: CVE-2023-0877
Published: 2023-02-17
Description: Code Injection in GitHub repository froxlor/froxlor prior to 2.0.11.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: https://github.com/froxlor/froxlor/commit/aa48ffca2bcaf7ae57be3b8147bb3138abdab984; https://huntr.dev/bounties/b29cf038-06f1-4fb0-9437-08f2991f92a8; https://github.com/froxlor/froxlor/commit/aa48ffca2bcaf7ae57be3b8147bb3138abdab984
CVE: CVE-2023-0878
Published: 2023-02-17
Description: Cross-site Scripting (XSS) - Generic in GitHub repository nuxt/framework prior to 3.2.1.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/nuxt/framework/commit/7aa35ff958eec0c7d071d3fcd481db57281dbcd9; https://huntr.dev/bounties/a892caf7-b8c2-4638-8cee-eb779d51066a; https://github.com/nuxt/framework/commit/7aa35ff958eec0c7d071d3fcd481db57281dbcd9
CVE: CVE-2023-0879
Published: 2023-02-17
Description: Cross-site Scripting (XSS) - Stored in GitHub repository btcpayserver/btcpayserver prior to 1.7.12.


CVSS Score: 6.3 (MEDIUM)
CWE: CWE-79
References: https://github.com/btcpayserver/btcpayserver/pull/4635/commits/f2f3b245c4d8980d8e54e4708c796df82332c3d7; https://huntr.dev/bounties/9464e3c6-961d-4e23-8b3d-07cbb31de541; https://github.com/btcpayserver/btcpayserver/pull/4635/commits/f2f3b245c4d8980d8e54e4708c796df82332c3d7
CVE: CVE-2023-0880
Published: 2023-02-17
Description: Misinterpretation of Input in GitHub repository thorsten/phpmyfaq prior to 3.1.11.


CVSS Score: 8.3 (HIGH)
CWE: CWE-115
References: https://github.com/thorsten/phpmyfaq/commit/a67dca41576834a1ddfee61b9e799b686b75d4fa; https://huntr.dev/bounties/14fc4841-0f5d-4e12-bf9e-1b60d2ac6a6c; https://github.com/thorsten/phpmyfaq/commit/a67dca41576834a1ddfee61b9e799b686b75d4fa
CVE: CVE-2023-23695
Published: 2023-02-17
Description: 
Dell Secure Connect Gateway (SCG) version 5.14.00.12 contains a broken cryptographic algorithm vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability by performing MitM attacks and let attackers obtain sensitive information.


CVSS Score: 5.9 (MEDIUM)
CWE: CWE-327, CWE-327
References: https://www.dell.com/support/kbdoc/en-us/000208462/dsa-2023-020-dell-secure-connect-gateway-security-update-for-multiple-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000208462/dsa-2023-020-dell-secure-connect-gateway-security-update-for-multiple-vulnerabilities
CVE: CVE-2023-24078
Published: 2023-02-17
Description: Real Time Logic FuguHub v8.1 and earlier was discovered to contain a remote code execution (RCE) vulnerability via the component /FuguHub/cmsdocs/.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94, CWE-94
References: http://packetstormsecurity.com/files/173279/FuguHub-8.1-Remote-Code-Execution.html; https://github.com/ojan2021/Fuguhub-8.1-RCE; http://packetstormsecurity.com/files/173279/FuguHub-8.1-Remote-Code-Execution.html
CVE: CVE-2023-24219
Published: 2023-02-17
Description: LuckyframeWEB v3.5 was discovered to contain a SQL injection vulnerability via the dataScope parameter at /system/UserMapper.xml.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/seagull1985/LuckyFrameWeb/issues/24; https://github.com/seagull1985/LuckyFrameWeb/issues/24
CVE: CVE-2023-24220
Published: 2023-02-17
Description: LuckyframeWEB v3.5 was discovered to contain a SQL injection vulnerability via the dataScope parameter at /system/RoleMapper.xml.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/seagull1985/LuckyFrameWeb/issues/22; https://github.com/seagull1985/LuckyFrameWeb/issues/22
CVE: CVE-2023-24221
Published: 2023-02-17
Description: LuckyframeWEB v3.5 was discovered to contain a SQL injection vulnerability via the dataScope parameter at /system/DeptMapper.xml.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/seagull1985/LuckyFrameWeb/issues/23; https://github.com/seagull1985/LuckyFrameWeb/issues/23
CVE: CVE-2023-0883
Published: 2023-02-17
Description: A vulnerability has been found in SourceCodester Online Pizza Ordering System 1.0 and classified as critical. This vulnerability affects unknown code of the file /php-opos/index.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-221350 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/awans2023/CVE; https://vuldb.com/?ctiid.221350; https://vuldb.com/?id.221350
CVE: CVE-2023-0887
Published: 2023-02-17
Description: A vulnerability was found in phjounin TFTPD64-SE 4.64 and classified as critical. This issue affects some unknown processing of the file tftpd64_svc.exe. The manipulation leads to unquoted search path. An attack has to be approached locally. The complexity of an attack is rather high. The exploitation is known to be difficult. The associated identifier of this vulnerability is VDB-221351.
CVSS Score: 7.0 (HIGH)
CWE: CWE-428
References: https://vuldb.com/?ctiid.221351; https://vuldb.com/?id.221351; https://vuldb.com/?ctiid.221351