deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-31273
Published: 2022-06-14
Description: An issue in TopIDP3000 Topsec Operating System tos_3.3.005.665b.15_smpidp allows attackers to perform a brute-force attack via a crafted session_id cookie.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-307
References: https://github.com/jhhua/issus/blob/main/1.pdf; https://github.com/jhhua/issus/blob/main/1.pdf
CVE: CVE-2021-40660
Published: 2022-06-14
Description: An issue was discovered in Delight Nashorn Sandbox 0.2.0. There is an ReDoS vulnerability that can be exploited to launching a denial of service (DoS) attack.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1333
References: https://github.com/javadelight/delight-nashorn-sandbox/issues/117; https://github.com/javadelight/delight-nashorn-sandbox/issues/117
CVE: CVE-2022-27889
Published: 2022-06-14
Description: The Multipass service was found to have code paths that could be abused to cause a denial of service for authentication or authorization operations. A malicious attacker could perform an application-level denial of service attack, potentially causing authentication and/or authorization operations to fail for the duration of the attack. This could lead to performance degradation or login failures for customer Palantir Foundry environments. This vulnerability is resolved in Multipass 3.647.0. This issue affects: Palantir Foundry Multipass versions prior to 3.647.0.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-400, CWE-913
References: https://github.com/palantir/security-bulletins/blob/main/PLTRSEC-2022-02.md; https://github.com/palantir/security-bulletins/blob/main/PLTRSEC-2022-02.md
CVE: CVE-2022-31308
Published: 2022-06-14
Description: A vulnerability in live_mfg.shtml of WAVLINK AERIAL X 1200M M79X3.V5030.191012 allows attackers to obtain sensitive router information via execution of the exec cmd function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://github.com/pghuanghui/CVE_Request/blob/main/WAVLINK%20AC1200.md; https://github.com/pghuanghui/CVE_Request/blob/main/WAVLINK%20AC1200.md
CVE: CVE-2022-31309
Published: 2022-06-14
Description: A vulnerability in live_check.shtml of WAVLINK AERIAL X 1200M M79X3.V5030.180719 allows attackers to obtain sensitive router information via execution of the exec cmd function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://github.com/pghuanghui/CVE_Request/blob/main/WAVLINK%20AC1200_check_live.md; https://github.com/pghuanghui/CVE_Request/blob/main/WAVLINK%20AC1200_check_live.md
CVE: CVE-2022-31311
Published: 2022-06-14
Description: An issue in adm.cgi of WAVLINK AERIAL X 1200M M79X3.V5030.180719 allows attackers to execute arbitrary commands via a crafted POST request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/pghuanghui/CVE_Request/blob/main/AERIAL%20X%201200_Command%20Execution%20Vulnerability.md; https://github.com/pghuanghui/CVE_Request/blob/main/AERIAL%20X%201200_Command%20Execution%20Vulnerability.md
CVE: CVE-2022-31845
Published: 2022-06-14
Description: A vulnerability in live_check.shtml of WAVLINK WN535 G3 M35G3R.V5030.180927 allows attackers to obtain sensitive router information via execution of the exec cmd function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-668
References: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-30489; https://github.com/pghuanghui/CVE_Request/blob/main/WAVLINK%20WN535%20G3__check_live.md; https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-30489
CVE: CVE-2022-31846
Published: 2022-06-14
Description: A vulnerability in live_mfg.shtml of WAVLINK WN535 G3 M35G3R.V5030.180927 allows attackers to obtain sensitive router information via execution of the exec cmd function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-668
References: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-30489; https://github.com/pghuanghui/CVE_Request/blob/main/WAVLINK%20WN535%20G3__live_mfg.md; https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-30489
CVE: CVE-2022-31847
Published: 2022-06-14
Description: A vulnerability in /cgi-bin/ExportAllSettings.sh of WAVLINK WN579 X3 M79X3.V5030.180719 allows attackers to obtain sensitive router information via a crafted POST request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-425
References: https://github.com/pghuanghui/CVE_Request/blob/main/WAVLINK%20WN579%20X3__Sensitive%20information%20leakage.md; https://github.com/pghuanghui/CVE_Request/blob/main/WAVLINK%20WN579%20X3__Sensitive%20information%20leakage.md
CVE: CVE-2022-32336
Published: 2022-06-14
Description: Fast Food Ordering System v1.0 is vulnerable to SQL Injection via /ffos/admin/menus/view_menu.php?id=.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/fast-food-ordering-system/SQLi-6.md; https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/fast-food-ordering-system/SQLi-6.md
CVE: CVE-2022-30931
Published: 2022-06-14
Description: Employee Leaves Management System (ELMS) V 2.1 is vulnerable to Cross Site Request Forgery (CSRF) via /myprofile.php.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://medium.com/%40niteshbiwal2011/my-first-cve-2022-30931-e70b9cbecbba; https://www.acunetix.com/vulnerabilities/web/possible-csrf-cross-site-request-forgery/; https://medium.com/%40niteshbiwal2011/my-first-cve-2022-30931-e70b9cbecbba
CVE: CVE-2022-32328
Published: 2022-06-14
Description: Fast Food Ordering System v1.0 is vulnerable to Delete any file. via /ffos/classes/Master.php?f=delete_img.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-22
References: https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/fast-food-ordering-system/delet-file-1.md; https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/fast-food-ordering-system/delet-file-1.md
CVE: CVE-2022-32330
Published: 2022-06-14
Description: Fast Food Ordering System v1.0 is vulnerable to SQL Injection via /ffos/classes/Master.php?f=delete_menu.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/fast-food-ordering-system/SQLi-2.md; https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/fast-food-ordering-system/SQLi-2.md
CVE: CVE-2022-32331
Published: 2022-06-14
Description: Fast Food Ordering System v1.0 is vulnerable to SQL Injection via /ffos/admin/categories/view_category.php?id=.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/fast-food-ordering-system/SQLi-4.md; https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/fast-food-ordering-system/SQLi-4.md
CVE: CVE-2022-32332
Published: 2022-06-14
Description: Fast Food Ordering System v1.0 is vulnerable to SQL Injection via /ffos/classes/Master.php?f=delete_category.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/fast-food-ordering-system/SQLi-1.md; https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/fast-food-ordering-system/SQLi-1.md
CVE: CVE-2022-32333
Published: 2022-06-14
Description: Fast Food Ordering System v1.0 is vulnerable to SQL Injection via /ffos/admin/sales/receipt.php?id=.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/fast-food-ordering-system/SQLi-3.md; https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/fast-food-ordering-system/SQLi-3.md
CVE: CVE-2022-32334
Published: 2022-06-14
Description: Fast Food Ordering System v1.0 is vulnerable to SQL Injection via /ffos/admin/categories/manage_category.php?id=.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/fast-food-ordering-system/SQLi-5.md; https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/fast-food-ordering-system/SQLi-5.md
CVE: CVE-2022-32335
Published: 2022-06-14
Description: Fast Food Ordering System v1.0 is vulnerable to SQL Injection via /ffos/admin/menus/manage_menu.php?id=.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/fast-food-ordering-system/SQLi-7.md; https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/fast-food-ordering-system/SQLi-7.md
CVE: CVE-2022-32338
Published: 2022-06-14
Description: Hospital's Patient Records Management System v1.0 is vulnerable to SQL Injection via /hprms/admin/doctors/manage_doctor.php?id=.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/hospitals-patient-records-management-system/SQLi-5.md; https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/hospitals-patient-records-management-system/SQLi-5.md
CVE: CVE-2022-32339
Published: 2022-06-14
Description: Hospital's Patient Records Management System v1.0 is vulnerable to SQL Injection via /hprms/admin/doctors/view_doctor.php?id=.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/hospitals-patient-records-management-system/SQLi-4.md; https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/hospitals-patient-records-management-system/SQLi-4.md
CVE: CVE-2022-32340
Published: 2022-06-14
Description: Hospital's Patient Records Management System v1.0 is vulnerable to SQL Injection via /hprms/admin/?page=patients/view_patient&id=.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/hospitals-patient-records-management-system/SQLi-3.md; https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/hospitals-patient-records-management-system/SQLi-3.md
CVE: CVE-2022-32341
Published: 2022-06-14
Description: Hospital's Patient Records Management System v1.0 is vulnerable to SQL Injection via /hprms/admin/?page=user/manage_user&id=.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/hospitals-patient-records-management-system/SQLi-2.md.; https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/hospitals-patient-records-management-system/SQLi-2.md.
CVE: CVE-2022-32342
Published: 2022-06-14
Description: Hospital's Patient Records Management System v1.0 is vulnerable to SQL Injection via /hprms/admin/room_types/view_room_type.php?id=.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/hospitals-patient-records-management-system/SQLi-6.md; https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/hospitals-patient-records-management-system/SQLi-6.md
CVE: CVE-2022-32343
Published: 2022-06-14
Description: Hospital's Patient Records Management System v1.0 is vulnerable to SQL Injection via hprms/admin/room_types/manage_room_type.php?id=.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/hospitals-patient-records-management-system/SQLi-7.md; https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/hospitals-patient-records-management-system/SQLi-7.md
CVE: CVE-2022-32344
Published: 2022-06-14
Description: Hospital's Patient Records Management System v1.0 is vulnerable to SQL Injection via /hprms/classes/Master.php?f=delete_patient.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/hospitals-patient-records-management-system/SQLi-10.md; https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/hospitals-patient-records-management-system/SQLi-10.md
CVE: CVE-2022-32345
Published: 2022-06-14
Description: Hospital's Patient Records Management System v1.0 is vulnerable to SQL Injection via /hprms/admin/rooms/manage_room.php?id=.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/hospitals-patient-records-management-system/SQLi-9.md; https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/hospitals-patient-records-management-system/SQLi-9.md
CVE: CVE-2022-32346
Published: 2022-06-14
Description: Hospital's Patient Records Management System v1.0 is vulnerable to SQL Injection via /hprms/admin/rooms/view_room.php?id=.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/hospitals-patient-records-management-system/SQLi-8.md.; https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/hospitals-patient-records-management-system/SQLi-8.md.
CVE: CVE-2022-32347
Published: 2022-06-14
Description: Hospital's Patient Records Management System v1.0 is vulnerable to SQL Injection via /hprms/classes/Master.php?f=delete_room.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/hospitals-patient-records-management-system/SQLi-13.md; https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/hospitals-patient-records-management-system/SQLi-13.md
CVE: CVE-2022-32348
Published: 2022-06-14
Description: Hospital's Patient Records Management System v1.0 is vulnerable to SQL Injection via /hprms/classes/Master.php?f=delete_doctor.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/hospitals-patient-records-management-system/SQLi-11.md; https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/hospitals-patient-records-management-system/SQLi-11.md
CVE: CVE-2022-32349
Published: 2022-06-14
Description: Hospital's Patient Records Management System v1.0 is vulnerable to SQL Injection via /hprms/classes/Master.php?f=delete_patient_history.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/hospitals-patient-records-management-system/SQLi-14.md; https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/hospitals-patient-records-management-system/SQLi-14.md
CVE: CVE-2022-32350
Published: 2022-06-14
Description: Hospital's Patient Records Management System v1.0 is vulnerable to SQL Injection via /hprms/classes/Master.php?f=delete_room_type.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/hospitals-patient-records-management-system/SQLi-12.md; https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/hospitals-patient-records-management-system/SQLi-12.md
CVE: CVE-2022-32351
Published: 2022-06-14
Description: Hospital's Patient Records Management System v1.0 is vulnerable to SQL Injection via /hprms/classes/Master.php?f=delete_message.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/hospitals-patient-records-management-system/SQLi-16.md; https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/hospitals-patient-records-management-system/SQLi-16.md
CVE: CVE-2022-32352
Published: 2022-06-14
Description: Hospital's Patient Records Management System v1.0 is vulnerable to SQL Injection via /hprms/classes/Master.php?f=delete_patient_admission.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/hospitals-patient-records-management-system/SQLi-15.md; https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/hospitals-patient-records-management-system/SQLi-15.md
CVE: CVE-2021-42675
Published: 2022-06-14
Description: Kreado Kreasfero 1.5 does not properly sanitize uploaded files to the media directory. One can upload a malicious PHP file and obtain remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: http://kreado.com; http://kreasfero.com; https://twitter.com/1ofThegutHakrs/status/[PII_REDACTED]88128768
CVE: CVE-2022-27668
Published: 2022-06-14
Description: Depending on the configuration of the route permission table in file 'saprouttab', it is possible for an unauthenticated attacker to execute SAProuter administration commands in SAP NetWeaver and ABAP Platform - versions KERNEL 7.49, 7.77, 7.81, 7.85, 7.86, 7.87, 7.88, KRNL64NUC 7.49, KRNL64UC 7.49, SAP_ROUTER 7.53, 7.22, from a remote client, for example stopping the SAProuter, that could highly impact systems availability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-863, CWE-863
References: http://packetstormsecurity.com/files/168406/SAP-SAProuter-Improper-Access-Control.html; http://seclists.org/fulldisclosure/2022/Sep/17; https://launchpad.support.sap.com/#/notes/3158375
CVE: CVE-2022-29612
Published: 2022-06-14
Description: SAP NetWeaver, ABAP Platform and SAP Host Agent - versions KERNEL 7.22, 7.49, 7.53, 7.77, 7.81, 7.85, 7.86, 7.87, 7.88, 8.04, KRNL64NUC 7.22, 7.22EXT, 7.49, KRNL64UC 7.22, 7.22EXT, 7.49, 7.53, 8.04, SAPHOSTAGENT 7.22, allows an authenticated user to misuse a function of sapcontrol webfunctionality(startservice) in Kernel which enables malicious users to retrieve information. On successful exploitation, an attacker can obtain technical information like system number or physical address, which is otherwise restricted, causing a limited impact on the confidentiality of the application.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-918
References: https://launchpad.support.sap.com/#/notes/3194674; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3194674
CVE: CVE-2022-30930
Published: 2022-06-14
Description: Tourism Management System Version: V 3.2 is affected by: Cross Site Request Forgery (CSRF).
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://medium.com/%40pmmali/my-second-cve-2022-30930-4f9aab047518; https://www.acunetix.com/vulnerabilities/web/possible-csrf-cross-site-request-forgery/; https://medium.com/%40pmmali/my-second-cve-2022-30930-4f9aab047518
CVE: CVE-2022-31289
Published: 2022-06-14
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2022-31403
Published: 2022-06-14
Description: ITOP v3.0.1 was discovered to contain a cross-site scripting (XSS) vulnerability via /itop/pages/ajax.render.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/IbrahimEkimIsik/CVE/blob/main/CVE-2022-31403; https://sourceforge.net/projects/itop/; https://www.itophub.io/
CVE: CVE-2022-32337
Published: 2022-06-14
Description: Hospital's Patient Records Management System v1.0 is vulnerable to SQL Injection via /hprms/admin/patients/manage_patient.php?id=.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/hospitals-patient-records-management-system/SQLi-1.md; https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/hospitals-patient-records-management-system/SQLi-1.md
CVE: CVE-2022-32557
Published: 2022-06-14
Description: An issue was discovered in Couchbase Server before 7.0.4. The Index Service does not enforce authentication for TCP/TLS servers.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306
References: https://docs.couchbase.com/server/current/release-notes/relnotes.html; https://forums.couchbase.com/tags/security; https://www.couchbase.com/alerts
CVE: CVE-2022-32559
Published: 2022-06-14
Description: An issue was discovered in Couchbase Server before 7.0.4. Random HTTP requests lead to leaked metrics.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-770
References: https://docs.couchbase.com/server/current/release-notes/relnotes.html; https://forums.couchbase.com/tags/security; https://www.couchbase.com/alerts
CVE: CVE-2022-32561
Published: 2022-06-14
Description: An issue was discovered in Couchbase Server before 6.6.5 and 7.x before 7.0.4. Previous mitigations for CVE-2018-15728 were found to be insufficient when it was discovered that diagnostic endpoints could still be accessed from the network.
CVSS Score: 4.9 (MEDIUM)
References: https://docs.couchbase.com/server/current/release-notes/relnotes.html; https://forums.couchbase.com/tags/security; https://www.couchbase.com/alerts
CVE: CVE-2022-21504
Published: 2022-06-14
Description: The code in UEK6 U3 was missing an appropiate file descriptor count to be missing. This resulted in a use count error that allowed a file descriptor to a socket to be closed and freed while it was still in use by another portion of the kernel. An attack with local access can operate on the socket, and cause a denial of service. CVSS 3.1 Base Score 5.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416
References: https://github.com/oracle/linux-uek/commit/49c68f5f892d8c2be00e0a89ff2a035422c03b59; https://github.com/oracle/linux-uek/commit/49c68f5f892d8c2be00e0a89ff2a035422c03b59
CVE: CVE-2022-29238
Published: 2022-06-14
Description: Jupyter Notebook is a web-based notebook environment for interactive computing. Prior to version 6.4.12, authenticated requests to the notebook server with `ContentsManager.allow_hidden = False` only prevented listing the contents of hidden directories, not accessing individual hidden files or files in hidden directories (i.e. hidden files were 'hidden' but not 'inaccessible'). This could lead to notebook configurations allowing authenticated access to files that may reasonably be expected to be disallowed. Because fully authenticated requests are required, this is of relatively low impact. But if a server's root directory contains sensitive files whose only protection from the server is being hidden (e.g. `~/.ssh` while serving $HOME), then any authenticated requests could access files if their names are guessable. Such contexts also necessarily have full access to the server and therefore execution permissions, which also generally grants access to all the same files. So this does not generally result in any privilege escalation or increase in information access, only an additional, unintended means by which the files could be accessed. Version 6.4.12 contains a patch for this issue. There are currently no known workarounds.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-425
References: https://github.com/jupyter/notebook/security/advisories/GHSA-v7vq-3x77-87vg; https://github.com/jupyter/notebook/security/advisories/GHSA-v7vq-3x77-87vg
CVE: CVE-2022-30903
Published: 2022-06-14
Description: Nokia "G-2425G-A" Bharti Airtel Routers Hardware version "3FE48299DEAA" Software Version "3FE49362IJHK42" is vulnerable to Cross-Site Scripting (XSS) via the admin->Maintenance>Device Management.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://medium.com/%40shubhamvpandey/xss-found-in-nokia-g-2425g-a-home-wifi-router-f4fae083ed97; https://youtu.be/CxBo_gQffOY; https://medium.com/%40shubhamvpandey/xss-found-in-nokia-g-2425g-a-home-wifi-router-f4fae083ed97
CVE: CVE-2022-32364
Published: 2022-06-14
Description: Product Show Room Site v1.0 is vulnerable to SQL Injection via /psrs/admin/?page=products/manage_product&id=.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/product-show-room-site/SQLi-7.md; https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/product-show-room-site/SQLi-7.md
CVE: CVE-2022-32365
Published: 2022-06-14
Description: Product Show Room Site v1.0 is vulnerable to SQL Injection via /psrs/admin/fields/manage_field.php?id=.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/product-show-room-site/SQLi-11.md; https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/product-show-room-site/SQLi-11.md
CVE: CVE-2022-32366
Published: 2022-06-14
Description: Product Show Room Site v1.0 is vulnerable to SQL Injection via /psrs/admin/fields/view_field.php?id=.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/product-show-room-site/SQLi-10.md; https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/product-show-room-site/SQLi-10.md
CVE: CVE-2022-32367
Published: 2022-06-14
Description: Product Show Room Site v1.0 is vulnerable to SQL Injection via /psrs/admin/?page=inquiries/view_inquiry&id=.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/product-show-room-site/SQLi-12.md; https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/product-show-room-site/SQLi-12.md