deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-2246
Published: 2022-06-28
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. Reason: This CVE has been rejected as it was incorrectly assigned. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2022-31883
Published: 2022-06-28
Description: Marval MSM v14.19.0.12476 is has an Insecure Direct Object Reference (IDOR) vulnerability. A low privilege user is able to see other users API Keys including the Admins API Keys.
CVSS Score: 8.8 (HIGH)
CWE: CWE-639
References: https://cyber-guy.gitbook.io/cyber-guy/pocs/marval-msm/idor-leads-to-unauthorized-access-to-api-keys; https://drive.google.com/drive/folders/17Q8ItseCzj5W7wlD6ZFqL0y1N5Emxz4_?usp=sharing; https://marvalglobal.com/
CVE: CVE-2022-31885
Published: 2022-06-28
Description: Marval MSM v14.19.0.12476 is vulnerable to OS Command Injection due to the insecure handling of VBScripts.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://cyber-guy.gitbook.io/cyber-guy/pocs/marval-msm/os-command-injection; https://drive.google.com/drive/folders/1Qa-6-LUzEnduSGfWLUjVLCyKr5wuEu5k?usp=sharing; https://marvalglobal.com/
CVE: CVE-2022-31886
Published: 2022-06-28
Description: Marval MSM v14.19.0.12476 is vulnerable to Cross Site Request Forgery (CSRF). An attacker can disable the 2FA by sending the user a malicious form.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://cyber-guy.gitbook.io/cyber-guy/pocs/marval-msm/2fa-bypass-via-x-csrf; https://drive.google.com/drive/folders/1Zy5Oa-maLo0ACfLz90uvxqxwG18DwAZY; https://marvalglobal.com/
CVE: CVE-2020-19896
Published: 2022-06-28
Description: File inclusion vulnerability in Minicms v1.9 allows remote attackers to execute arbitary PHP code via post-edit.php.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/bg5sbk/MiniCMS/issues/36; https://github.com/bg5sbk/MiniCMS/issues/36
CVE: CVE-2020-19897
Published: 2022-06-28
Description: A reflected Cross Site Scripting (XSS) in wuzhicms v4.1.0 allows remote attackers to execute arbitrary web script or HTML via the imgurl parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/wuzhicms/wuzhicms/issues/183; https://github.com/wuzhicms/wuzhicms/issues/183
CVE: CVE-2021-41559
Published: 2022-06-28
Description: Silverstripe silverstripe/framework 4.8.1 has a quadratic blowup in Convert::xml2array() that enables a remote attack via a crafted XML document.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-776
References: https://github.com/silverstripe/silverstripe-framework/releases; https://www.silverstripe.org/download/security-releases/; https://www.silverstripe.org/download/security-releases/cve-2021-41559
CVE: CVE-2022-24444
Published: 2022-06-28
Description: Silverstripe silverstripe/framework through 4.10 allows Session Fixation.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-384
References: https://docs.silverstripe.org/en/4/changelogs/4.10.1/; https://forum.silverstripe.org/c/releases; https://www.silverstripe.org/blog/tag/release
CVE: CVE-2022-25238
Published: 2022-06-28
Description: Silverstripe silverstripe/framework through 4.10.0 allows XSS, inside of script tags that can can be added to website content via XHR by an authenticated CMS user if the cwp-core module is not installed on the sanitise_server_side contig is not set to true in project code.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://docs.silverstripe.org/en/4/changelogs/4.10.1/; https://forum.silverstripe.org/c/releases; https://www.silverstripe.org/blog/tag/release
CVE: CVE-2022-29858
Published: 2022-06-28
Description: Silverstripe silverstripe/assets through 1.10 is vulnerable to improper access control that allows protected images to be published by changing an existing image short code on website content.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-287
References: https://forum.silverstripe.org/c/releases; https://github.com/silverstripe/silverstripe-assets/commit/5f6a73b010c01587ffbfb954441f6b7cbb54e767; https://huntr.dev/bounties/90e17d95-9f2f-44eb-9f26-49fa13a41d5a/
CVE: CVE-2022-31884
Published: 2022-06-28
Description: Marval MSM v14.19.0.12476 has an Improper Access Control vulnerability which allows a low privilege user to delete other users API Keys including high privilege and the Administrator users API Keys.
CVSS Score: 6.5 (MEDIUM)
References: https://cyber-guy.gitbook.io/cyber-guy/pocs/marval-msm/unauthorized-delete-add-api-users-api-keys; https://drive.google.com/drive/folders/1lFM9cVUqTlKyDI2azmI1rIF4HoZBt_4i?usp=sharing; https://marvalglobal.com/
CVE: CVE-2022-31887
Published: 2022-06-28
Description: Marval MSM v14.19.0.12476 has a 0-Click Account Takeover vulnerability which allows an attacker to change any user's password in the organization, this means that the user can also escalate achieve Privilege Escalation by changing the administrator password.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-522
References: https://cyber-guy.gitbook.io/cyber-guy/pocs/marval-msm/0-click-account-takeover; https://drive.google.com/drive/folders/12nb9KvckzhUNv4RtjlaeZi8QeFqwvkMX?usp=sharing; https://marvalglobal.com/
CVE: CVE-2022-32532
Published: 2022-06-29
Description: Apache Shiro before 1.9.1, A RegexRequestMatcher can be misconfigured to be bypassed on some servlet containers. Applications using RegExPatternMatcher with `.` in the regular expression are possibly vulnerable to an authorization bypass.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-863, CWE-863
References: https://lists.apache.org/thread/y8260dw8vbm99oq7zv6y3mzn5ovk90xh; https://lists.apache.org/thread/y8260dw8vbm99oq7zv6y3mzn5ovk90xh
CVE: CVE-2022-28803
Published: 2022-06-29
Description: In SilverStripe Framework through 2022-04-07, Stored XSS can occur in javascript link tags added via XMLHttpRequest (XHR).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://silverstripe.org; https://www.silverstripe.org/download/security-releases/cve-2022-28803; https://silverstripe.org
CVE: CVE-2022-29269
Published: 2022-06-29
Description: In Nagios XI through 5.8.5, in the schedule report function, an authenticated attacker is able to inject HTML tags that lead to the reformatting/editing of emails from an official email address.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://assets.nagios.com/downloads/nagiosxi/CHANGES-5.TXT; https://github.com/4LPH4-NL/CVEs; https://github.com/sT0wn-nl/CVEs/blob/master/README.md#nagios-xi
CVE: CVE-2022-29270
Published: 2022-06-29
Description: In Nagios XI through 5.8.5, it is possible for a user without password verification to change his e-mail address.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-306
References: https://assets.nagios.com/downloads/nagiosxi/CHANGES-5.TXT; https://github.com/4LPH4-NL/CVEs; https://github.com/sT0wn-nl/CVEs/blob/master/README.md#nagios-xi
CVE: CVE-2022-29271
Published: 2022-06-29
Description: In Nagios XI through 5.8.5, a read-only Nagios user (due to an incorrect permission check) is able to schedule downtime for any host/services. This allows an attacker to permanently disable all monitoring checks.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-863
References: https://assets.nagios.com/downloads/nagiosxi/CHANGES-5.TXT; https://github.com/4LPH4-NL/CVEs; https://github.com/sT0wn-nl/CVEs/blob/master/README.md#nagios-xi
CVE: CVE-2022-29272
Published: 2022-06-29
Description: In Nagios XI through 5.8.5, an open redirect vulnerability exists in the login function that could lead to spoofing.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://assets.nagios.com/downloads/nagiosxi/CHANGES-5.TXT; https://github.com/4LPH4-NL/CVEs; https://github.com/sT0wn-nl/CVEs/blob/master/README.md#nagios-xi
CVE: CVE-2022-31266
Published: 2022-06-29
Description: In ILIAS through 7.10, lack of verification when changing an email address (on the Profile Page) allows remote attackers to take over accounts.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-306
References: https://medium.com/%40bcksec/in-ilias-through-7-10-620c0de685ee; https://www.bcksec.com/services/; https://medium.com/%40bcksec/in-ilias-through-7-10-620c0de685ee
CVE: CVE-2022-31897
Published: 2022-06-29
Description: SourceCodester Zoo Management System 1.0 is vulnerable to Cross Site Scripting (XSS) via public_html/register_visitor?msg=.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://sourcecodester.com; https://packetstormsecurity.com/files/167572/Zoo-Management-System-1.0-Cross-Site-Scripting.html; http://sourcecodester.com
CVE: CVE-2017-20108
Published: 2022-06-29
Description: A vulnerability classified as problematic has been found in Easy Table Plugin 1.6. This affects an unknown part of the file /wordpress/wp-admin/options-general.php. The manipulation with the input "><script>alert(1)</script> leads to basic cross site scripting. It is possible to initiate the attack remotely.
CVSS Score: 3.5 (LOW)
CWE: CWE-80, CWE-79
References: http://seclists.org/fulldisclosure/2017/Feb/24; https://vuldb.com/?id.97119; http://seclists.org/fulldisclosure/2017/Feb/24
CVE: CVE-2017-20109
Published: 2022-06-29
Description: A vulnerability classified as problematic was found in Teleopti WFM up to 7.1.0. Affected by this vulnerability is an unknown functionality of the file /TeleoptiWFM/Administration/GetOneTenant of the component Administration. The manipulation leads to information disclosure (Credentials). The attack can be launched remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200, CWE-319
References: http://seclists.org/fulldisclosure/2017/Feb/13; https://vuldb.com/?id.96805; http://seclists.org/fulldisclosure/2017/Feb/13
CVE: CVE-2017-20110
Published: 2022-06-29
Description: A vulnerability, which was classified as problematic, has been found in Teleopti WFM up to 7.1.0. Affected by this issue is some unknown functionality of the component Administration. The manipulation as part of JSON leads to information disclosure (Credentials). The attack may be launched remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://seclists.org/fulldisclosure/2017/Feb/13; https://vuldb.com/?id.96806; http://seclists.org/fulldisclosure/2017/Feb/13
CVE: CVE-2017-20111
Published: 2022-06-29
Description: A vulnerability, which was classified as critical, was found in Teleopti WFM 7.1.0. This affects an unknown part of the component Administration. The manipulation leads to improper privilege management. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue.
CVSS Score: 7.3 (HIGH)
CWE: CWE-269
References: http://seclists.org/fulldisclosure/2017/Feb/13; https://vuldb.com/?id.96807; http://seclists.org/fulldisclosure/2017/Feb/13
CVE: CVE-2017-20112
Published: 2022-06-29
Description: A vulnerability has been found in IVPN Client 2.6.6120.33863 and classified as critical. Affected by this vulnerability is an unknown functionality. The manipulation of the argument --up cmd leads to improper privilege management. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. Upgrading to version 2.6.2 is able to address this issue. It is recommended to upgrade the affected component.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: http://seclists.org/fulldisclosure/2017/Feb/14; https://github.com/kacperszurek/exploits/blob/master/IVPN/ivpn_privilege_escalation.py; https://vuldb.com/?id.96655
CVE: CVE-2021-40642
Published: 2022-06-29
Description: Textpattern CMS v4.8.7 and older vulnerability exists through Sensitive Cookie in HTTPS Session Without 'Secure' Attribute via textpattern/lib/txplib_misc.php. The secure flag is not set for txp_login session cookie in the application. If the secure flag is not set, then the cookie will be transmitted in clear-text if the user visits any HTTP URLs within the cookie's scope. An attacker may be able to induce this event by feeding a user suitable links, either directly or via another web site.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-311
References: https://github.com/textpattern/textpattern/commit/211fab0093999f59b0b61682aa988ac7d8337aa9; https://www.huntr.dev/bounties/aadbe434-a376-443b-876f-2a1cbab7847b/; https://github.com/textpattern/textpattern/commit/211fab0093999f59b0b61682aa988ac7d8337aa9
CVE: CVE-2022-33021
Published: 2022-06-29
Description: CVA6 commit 909d85a accesses invalid memory when reading the value of MHPMCOUNTER30.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://github.com/openhwgroup/cva6/issues/884; https://github.com/openhwgroup/cva6/issues/884
CVE: CVE-2022-33023
Published: 2022-06-29
Description: CVA6 commit 909d85a gives incorrect permission to use special multiplication units when the format of instructions is wrong.
CVSS Score: 7.5 (HIGH)
CWE: CWE-276
References: https://github.com/openhwgroup/cva6/issues/885; https://github.com/openhwgroup/cva6/issues/885
CVE: CVE-2022-33107
Published: 2022-06-29
Description: ThinkPHP v6.0.12 was discovered to contain a deserialization vulnerability via the component vendor\league\flysystem-cached-adapter\src\Storage\AbstractCache.php. This vulnerability allows attackers to execute arbitrary code via a crafted payload.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://github.com/top-think/framework/issues/2717; https://github.com/top-think/framework/issues/2717
CVE: CVE-2022-33035
Published: 2022-06-29
Description: XLPD v7.0.0094 and below contains an unquoted service path vulnerability which allows local users to launch processes with elevated privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://github.com/ycdxsb/Vuln/blob/main/Xlpd-Unquoted-Service-Path/XLpd-Unquoted-Service-Path.md; https://www.netsarang.com/en/xlpd-update-history/; https://github.com/ycdxsb/Vuln/blob/main/Xlpd-Unquoted-Service-Path/XLpd-Unquoted-Service-Path.md
CVE: CVE-2022-33036
Published: 2022-06-29
Description: A binary hijack in Embarcadero Dev-CPP v6.3 allows attackers to execute arbitrary code via a crafted .exe file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://github.com/ycdxsb/Vuln/blob/main/Embarcadero-Dev-Cpp-CreateProcessW-Misuse-Binary-Hijack/Embarcadero-Dev-Cpp-CreateProcessW-Misuse-Binary-Hijack.md; https://github.com/ycdxsb/Vuln/blob/main/Embarcadero-Dev-Cpp-CreateProcessW-Misuse-Binary-Hijack/Embarcadero-Dev-Cpp-CreateProcessW-Misuse-Binary-Hijack.md
CVE: CVE-2022-33037
Published: 2022-06-29
Description: A binary hijack in Orwell-Dev-Cpp v5.11 allows attackers to execute arbitrary code via a crafted .exe file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://github.com/ycdxsb/Vuln/blob/main/Orwell-Dev-Cpp-CreateProcessA-Misuse-Binary-Hijack/Orwell-Dev-Cpp-CreateProcessA-Misuse-Binary-Hijack.md; https://github.com/ycdxsb/Vuln/blob/main/Orwell-Dev-Cpp-CreateProcessA-Misuse-Binary-Hijack/Orwell-Dev-Cpp-CreateProcessA-Misuse-Binary-Hijack.md
CVE: CVE-2022-34043
Published: 2022-06-29
Description: Incorrect permissions for the folder C:\ProgramData\NoMachine\var\uninstall of Nomachine v7.9.2 allows attackers to perform a DLL hijacking attack and execute arbitrary code.
CVSS Score: 7.3 (HIGH)
CWE: CWE-732
References: https://github.com/ycdxsb/Vuln/tree/main/Nomachine-Incorrect-Folder-Permission; https://github.com/ycdxsb/Vuln/tree/main/Nomachine-Incorrect-Folder-Permission
CVE: CVE-2020-26877
Published: 2022-06-29
Description: ApiFest OAuth 2.0 Server 0.3.1 does not validate the redirect URI in accordance with RFC 6749 and is susceptible to an open redirector attack. Specifically, it directly sends an authorization code to the redirect URI submitted with the authorization request, without checking whether the redirect URI is registered by the client who initiated the request. This allows an attacker to craft a request with a manipulated redirect URI (redirect_uri parameter), which is under the attacker's control, and consequently obtain the leaked authorization code when the server redirects the client to the manipulated redirect URI with an authorization code. NOTE: this is similar to CVE-2019-3778.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: http://www.apifest.org/index.html; https://github.com/apifest/apifest-oauth20; https://tools.ietf.org/html/rfc6749#section-3.1.2.3
CVE: CVE-2022-32969
Published: 2022-06-29
Description: MetaMask before 10.11.3 might allow an attacker to access a user's secret recovery phrase because an input field is used for a BIP39 mnemonic, and Firefox and Chromium save such fields to disk in order to support the Restore Session feature, aka the Demonic issue.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-281
References: https://github.com/MetaMask/metamask-extension/compare/v10.11.2...v10.11.3; https://halborn.com/disclosures/demonic-vulnerability/; https://halborn.com/halborn-discovers-critical-vulnerability-affecting-crypto-wallet-browser-extensions/
CVE: CVE-2021-39074
Published: 2022-06-29
Description: IBM Security Guardium 11.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/215583; https://www.ibm.com/support/pages/node/6598759; https://exchange.xforce.ibmcloud.com/vulnerabilities/215583
CVE: CVE-2022-2252
Published: 2022-06-29
Description: Open Redirect in GitHub repository microweber/microweber prior to 1.2.19.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://github.com/microweber/microweber/commit/187e949daf7dea6f10b80da70988f0f86444eeff; https://huntr.dev/bounties/4d394bcc-a000-4f96-8cd2-8c565e1347e8; https://github.com/microweber/microweber/commit/187e949daf7dea6f10b80da70988f0f86444eeff
CVE: CVE-2017-20113
Published: 2022-06-29
Description: A vulnerability, which was classified as problematic, was found in TrueConf Server 4.3.7. This affects an unknown part. The manipulation leads to basic cross site scripting (Stored). It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-80, CWE-79
References: https://vuldb.com/?id.96627; https://www.exploit-db.com/exploits/41184/; https://vuldb.com/?id.96627
CVE: CVE-2017-20114
Published: 2022-06-29
Description: A vulnerability has been found in TrueConf Server 4.3.7 and classified as problematic. This vulnerability affects unknown code of the file /admin/conferences/get-all-status/. The manipulation of the argument keys[] leads to basic cross site scripting (Reflected). The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-80, CWE-79
References: https://vuldb.com/?id.96628; https://www.exploit-db.com/exploits/41184/; https://vuldb.com/?id.96628
CVE: CVE-2017-20115
Published: 2022-06-29
Description: A vulnerability was found in TrueConf Server 4.3.7 and classified as problematic. This issue affects some unknown processing of the file /admin/conferences/list/. The manipulation of the argument sort leads to basic cross site scripting (Reflected). The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-80, CWE-79
References: https://vuldb.com/?id.96629; https://www.exploit-db.com/exploits/41184/; https://vuldb.com/?id.96629
CVE: CVE-2017-20116
Published: 2022-06-29
Description: A vulnerability was found in TrueConf Server 4.3.7. It has been classified as problematic. Affected is an unknown function of the file /admin/group/list/. The manipulation of the argument checked_group_id leads to basic cross site scripting (Reflected). It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-80, CWE-79
References: https://vuldb.com/?id.96630; https://www.exploit-db.com/exploits/41184/; https://vuldb.com/?id.96630
CVE: CVE-2017-20117
Published: 2022-06-29
Description: A vulnerability was found in TrueConf Server 4.3.7. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/group. The manipulation leads to basic cross site scripting (DOM). The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-80, CWE-79
References: https://vuldb.com/?id.96631; https://www.exploit-db.com/exploits/41184/; https://vuldb.com/?id.96631
CVE: CVE-2017-20118
Published: 2022-06-29
Description: A vulnerability was found in TrueConf Server 4.3.7. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /admin/conferences/list/. The manipulation of the argument domxss leads to basic cross site scripting (DOM). The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-80, CWE-79
References: https://vuldb.com/?id.96632; https://www.exploit-db.com/exploits/41184/; https://vuldb.com/?id.96632
CVE: CVE-2017-20119
Published: 2022-06-29
Description: A vulnerability classified as problematic has been found in TrueConf Server 4.3.7. This affects an unknown part of the file /admin/general/change-lang. The manipulation of the argument redirect_url leads to open redirect. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-601, CWE-601
References: https://vuldb.com/?id.96633; https://www.exploit-db.com/exploits/41184/; https://vuldb.com/?id.96633
CVE: CVE-2017-20120
Published: 2022-06-29
Description: A vulnerability classified as problematic was found in TrueConf Server 4.3.7. This vulnerability affects unknown code of the file /admin/service/stop/. The manipulation leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://vuldb.com/?id.96634; https://www.exploit-db.com/exploits/41184/; https://vuldb.com/?id.96634
CVE: CVE-2022-30192
Published: 2022-06-29
Description: Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
CVSS Score: 8.3 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30192; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-30192; https://security.gentoo.org/glsa/202208-25
CVE: CVE-2022-33042
Published: 2022-06-29
Description: Online Railway Reservation System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/inquiries/view_details.php.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/736335151/bug_report/blob/main/vendors/oretnom23/online-railway-reservation-system/SQLi-1.md; https://github.com/736335151/bug_report/blob/main/vendors/oretnom23/online-railway-reservation-system/SQLi-1.md
CVE: CVE-2022-33638
Published: 2022-06-29
Description: Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
CVSS Score: 8.3 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-33638; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-33638; https://security.gentoo.org/glsa/202208-25
CVE: CVE-2022-33639
Published: 2022-06-29
Description: Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
CVSS Score: 8.3 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-33639; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-33639; https://security.gentoo.org/glsa/202208-25