deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-35393
Published: 2022-07-12
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none
CVE: CVE-2022-35394
Published: 2022-07-12
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none
CVE: CVE-2022-35395
Published: 2022-07-12
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none
CVE: CVE-2022-35396
Published: 2022-07-12
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none
CVE: CVE-2022-35397
Published: 2022-07-12
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none
CVE: CVE-2022-35398
Published: 2022-07-12
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none
CVE: CVE-2022-35399
Published: 2022-07-12
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none
CVE: CVE-2022-35648
Published: 2022-07-12
Description: Nautilus treadmills T616 S/N 100672PRO21140001 through 100672PRO21171980 and T618 S/N 100647PRO21130111 through 100647PRO21183960 with software before 2022-06-09 allow physically proximate attackers to cause a denial of service (fall) by connecting the power cord to a 120V circuit (which may lead to self-starting at an inopportune time).
CVSS Score: 2.6 (LOW)
References: https://cwe.mitre.org/data/definitions/372.html; https://download.nautilus.com/pdf/NLS.T616-T618.cpsc.safety.notice.EN.pdf; https://www.cpsc.gov/Recalls/2022/Nautilus-Recalls-Treadmills-Due-to-Fall-Hazard
CVE: CVE-2022-25303
Published: 2022-07-12
Description: The package whoogle-search before 0.7.2 are vulnerable to Cross-site Scripting (XSS) via the query string parameter q. In the case where it does not contain the http string, it is used to build the error_message that is then rendered in the error.html template, using the [flask.render_template](https://flask.palletsprojects.com/en/2.1.x/api/flask.render_template) function. However, the error_message is rendered using the [| safe filter](https://jinja.palletsprojects.com/en/3.1.x/templates/working-with-automatic-escaping), meaning the user input is not escaped.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/benbusby/whoogle-search/blob/6d362ca5c7a00d2f691a2512461c5dfbfc01cbb3/app/routes.py%23L448; https://github.com/benbusby/whoogle-search/commit/abc30d7da3b5c67be7ce84d4699f327442d44606; https://snyk.io/vuln/SNYK-PYTHON-WHOOGLESEARCH-2803306
CVE: CVE-2022-2262
Published: 2022-07-12
Description: A vulnerability has been found in Online Hotel Booking System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file edit_all_room.php of the component Room Handler. The manipulation of the argument id with the input 2828%27%20AND%20(SELECT%203766%20FROM%20(SELECT(SLEEP(5)))BmIK)%20AND%20%27YLPl%27=%27YLPl leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://github.com/Xor-Gerke/webray.com.cn/blob/main/cve/Online%20Hotel%20Booking%20System/Online%20Hotel%20Booking%20System%20edit_all_room.php%20id%20SQL%20inject.md; https://vuldb.com/?id.202981; https://github.com/Xor-Gerke/webray.com.cn/blob/main/cve/Online%20Hotel%20Booking%20System/Online%20Hotel%20Booking%20System%20edit_all_room.php%20id%20SQL%20inject.md
CVE: CVE-2022-2263
Published: 2022-07-12
Description: A vulnerability was found in Online Hotel Booking System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file edit_room_cat.php of the component Room Handler. The manipulation of the argument roomname leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://github.com/Xor-Gerke/webray.com.cn/blob/main/cve/Online%20Hotel%20Booking%20System/Online%20Hotel%20Booking%20System%20edit_room_cat.php%20id%20SQL%20inject.md; https://vuldb.com/?id.202982; https://github.com/Xor-Gerke/webray.com.cn/blob/main/cve/Online%20Hotel%20Booking%20System/Online%20Hotel%20Booking%20System%20edit_room_cat.php%20id%20SQL%20inject.md
CVE: CVE-2022-2291
Published: 2022-07-12
Description: A vulnerability was found in SourceCodester Hotel Management System 2.0. It has been rated as problematic. This issue affects some unknown processing of the file /ci_hms/search of the component Search. The manipulation of the argument search with the input "><script>alert("XSS")</script> leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/CyberThoth/CVE/blob/a203e5c7b3ac88a5a0bc7200324f2b24716e8fc2/CVE/Hotel%20Management%20system/Cross%20Site%20Scripting%28Refelected%29/POC.md; https://vuldb.com/?id.203165; https://github.com/CyberThoth/CVE/blob/a203e5c7b3ac88a5a0bc7200324f2b24716e8fc2/CVE/Hotel%20Management%20system/Cross%20Site%20Scripting%28Refelected%29/POC.md
CVE: CVE-2022-2292
Published: 2022-07-12
Description: A vulnerability classified as problematic has been found in SourceCodester Hotel Management System 2.0. Affected is an unknown function of the file /ci_hms/massage_room/edit/1 of the component Room Edit Page. The manipulation of the argument massageroomDetails with the input "><script>alert("XSS")</script> leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-79
References: https://github.com/CyberThoth/CVE/blob/a203e5c7b3ac88a5a0bc7200324f2b24716e8fc2/CVE/Hotel%20Management%20system/Cross%20Site%20Scripting%28Stored%29/POC.md; https://vuldb.com/?id.203166; https://github.com/CyberThoth/CVE/blob/a203e5c7b3ac88a5a0bc7200324f2b24716e8fc2/CVE/Hotel%20Management%20system/Cross%20Site%20Scripting%28Stored%29/POC.md
CVE: CVE-2022-2293
Published: 2022-07-12
Description: A vulnerability classified as problematic was found in SourceCodester Simple Sales Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /ci_ssms/index.php/orders/create. The manipulation of the argument customer_name with the input <script>alert("XSS")</script> leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-79
References: https://github.com/CyberThoth/CVE/blob/a203e5c7b3ac88a5a0bc7200324f2b24716e8fc2/CVE/Simple%20Sales%20Management%20System/Cross%20Site%20Scripting%28Stored%29/POC.md; https://vuldb.com/?id.203167; https://github.com/CyberThoth/CVE/blob/a203e5c7b3ac88a5a0bc7200324f2b24716e8fc2/CVE/Simple%20Sales%20Management%20System/Cross%20Site%20Scripting%28Stored%29/POC.md
CVE: CVE-2022-2297
Published: 2022-07-12
Description: A vulnerability, which was classified as critical, was found in SourceCodester Clinics Patient Management System 2.0. Affected is an unknown function of the file /pms/update_user.php?user_id=1. The manipulation of the argument profile_picture with the input <?php phpinfo();?> leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-434, CWE-434
References: https://github.com/CyberThoth/CVE/blob/8c6b66919be1bd66a54c16cc27cbdd9793221d3e/CVE/Clinic%27s%20Patient%20Management%20System/Unrestricted%20file%20upload%20%28RCE%29/POC.md; https://vuldb.com/?id.203178; https://github.com/CyberThoth/CVE/blob/8c6b66919be1bd66a54c16cc27cbdd9793221d3e/CVE/Clinic%27s%20Patient%20Management%20System/Unrestricted%20file%20upload%20%28RCE%29/POC.md
CVE: CVE-2022-2298
Published: 2022-07-12
Description: A vulnerability has been found in SourceCodester Clinics Patient Management System 2.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /pms/index.php of the component Login Page. The manipulation of the argument user_name with the input admin' or '1'='1 leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/CyberThoth/CVE/blob/63e283e7d7dad3783237f15cdae2bb649bc1e198/CVE/Clinic%27s%20Patient%20Management%20System/SQLi/POC.md; https://vuldb.com/?id.203179; https://github.com/CyberThoth/CVE/blob/63e283e7d7dad3783237f15cdae2bb649bc1e198/CVE/Clinic%27s%20Patient%20Management%20System/SQLi/POC.md
CVE: CVE-2022-2363
Published: 2022-07-12
Description: A vulnerability, which was classified as problematic, has been found in SourceCodester Simple Parking Management System 1.0. Affected by this issue is some unknown functionality of the file /ci_spms/admin/search/searching/. The manipulation of the argument search with the input "><script>alert("XSS")</script> leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-79
References: https://github.com/CyberThoth/CVE/blob/eea3090b960da014312f7ad4b09aa58d23966d77/CVE/Simple%20Parking%20Management%20System/Cross%20Site%20Scripting%28Refelected%29/POC.md; https://vuldb.com/?id.203420; https://github.com/CyberThoth/CVE/blob/eea3090b960da014312f7ad4b09aa58d23966d77/CVE/Simple%20Parking%20Management%20System/Cross%20Site%20Scripting%28Refelected%29/POC.md
CVE: CVE-2022-2364
Published: 2022-07-12
Description: A vulnerability, which was classified as problematic, was found in SourceCodester Simple Parking Management System 1.0. This affects an unknown part of the file /ci_spms/admin/category. The manipulation of the argument vehicle_type with the input "><script>alert("XSS")</script> leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-79
References: https://github.com/CyberThoth/CVE/blob/eea3090b960da014312f7ad4b09aa58d23966d77/CVE/Simple%20Parking%20Management%20System/Cross%20Site%20Scripting%28Stored%29/POC.md; https://vuldb.com/?id.203421; https://github.com/CyberThoth/CVE/blob/eea3090b960da014312f7ad4b09aa58d23966d77/CVE/Simple%20Parking%20Management%20System/Cross%20Site%20Scripting%28Stored%29/POC.md
CVE: CVE-2020-4157
Published: 2022-07-12
Description: IBM QRadar Network Security 5.4.0 and 5.5.0 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM X-Force ID: 174337.
CVSS Score: 7.5 (HIGH)
CWE: CWE-798
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/174337; https://www.ibm.com/support/pages/node/6602931; https://exchange.xforce.ibmcloud.com/vulnerabilities/174337
CVE: CVE-2020-4159
Published: 2022-07-12
Description: IBM QRadar Network Security 5.4.0 and 5.5.0 discloses sensitive information to unauthorized users which could be used to mount further attacks against the system. IBM X-Force ID: 174339.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/174339; https://www.ibm.com/support/pages/node/6602933; https://exchange.xforce.ibmcloud.com/vulnerabilities/174339
CVE: CVE-2021-39041
Published: 2022-07-12
Description: IBM QRadar SIEM 7.3, 7.4, and 7.5 may be vulnerable to partial denial of service attack, resulting in some protocols not listening to specified ports. IBM X-Force ID: 214028.
CVSS Score: 5.3 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/214028; https://www.ibm.com/support/pages/node/6602749; https://exchange.xforce.ibmcloud.com/vulnerabilities/214028
CVE: CVE-2022-25875
Published: 2022-07-12
Description: The package svelte before 3.49.0 are vulnerable to Cross-site Scripting (XSS) due to improper input sanitization and to improper escape of attributes when using objects during SSR (Server-Side Rendering). Exploiting this vulnerability is possible via objects with a custom toString() function.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/sveltejs/svelte/commit/f8605d6acbf66976da9b4547f76e90e163899907; https://github.com/sveltejs/svelte/pull/7530%23issuecomment[PII_REDACTED]; https://snyk.io/vuln/SNYK-JS-SVELTE-2931080
CVE: CVE-2022-29900
Published: 2022-07-12
Description: Mis-trained branch predictions for return instructions may allow arbitrary speculative code execution under certain microarchitecture-dependent conditions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-212
References: https://lists.debian.org/debian-lts-announce/2022/09/msg00011.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MYI3OMJ7RIZNL3C6GUWNANNPEUUID6FM/; https://security.gentoo.org/glsa/202402-07
CVE: CVE-2022-29901
Published: 2022-07-12
Description: Intel microprocessor generations 6 to 8 are affected by a new Spectre variant that is able to bypass their retpoline mitigation in the kernel to leak arbitrary data. An attacker with unprivileged user access can hijack return instructions to achieve arbitrary speculative code execution under certain microarchitecture-dependent conditions.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-200, CWE-668
References: http://www.openwall.com/lists/oss-security/2022/07/12/2; http://www.openwall.com/lists/oss-security/2022/07/12/4; http://www.openwall.com/lists/oss-security/2022/07/12/5
CVE: CVE-2022-2385
Published: 2022-07-12
Description: A security issue was discovered in aws-iam-authenticator where an allow-listed IAM identity may be able to modify their username and escalate privileges.
CVSS Score: 8.1 (HIGH)
CWE: CWE-20
References: https://github.com/kubernetes-sigs/aws-iam-authenticator/issues/472; https://groups.google.com/a/kubernetes.io/g/dev/c/EMxHpU-1ZYs; https://github.com/kubernetes-sigs/aws-iam-authenticator/issues/472
CVE: CVE-2022-24800
Published: 2022-07-12
Description: October/System is the system module for October CMS, a self-hosted CMS platform based on the Laravel PHP Framework. Prior to versions 1.0.476, 1.1.12, and 2.2.15, when the developer allows the user to specify their own filename in the `fromData` method, an unauthenticated user can perform remote code execution (RCE) by exploiting a race condition in the temporary storage directory. This vulnerability affects plugins that expose the `October\Rain\Database\Attach\File::fromData` as a public interface and does not affect vanilla installations of October CMS since this method is not exposed or used by the system internally or externally. The issue has been patched in Build 476 (v1.0.476), v1.1.12, and v2.2.15. Those who are unable to upgrade may apply with patch to their installation manually as a workaround.
CVSS Score: 8.1 (HIGH)
CWE: CWE-362
References: https://github.com/octobercms/library/commit/fe569f3babf3f593be2b1e0a4ae[PII_REDACTED]a83; https://github.com/octobercms/october/security/advisories/GHSA-8v7h-cpc2-r8jp; https://github.com/octobercms/library/commit/fe569f3babf3f593be2b1e0a4ae[PII_REDACTED]a83
CVE: CVE-2011-4916
Published: 2022-07-12
Description: Linux kernel through 3.1 allows local users to obtain sensitive keystroke information via access to /dev/pts/ and /dev/tty*.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200, CWE-200
References: https://lkml.org/lkml/2011/11/7/355; https://www.openwall.com/lists/oss-security/2011/12/28/3; https://lkml.org/lkml/2011/11/7/355
CVE: CVE-2022-1025
Published: 2022-07-12
Description: All unpatched versions of Argo CD starting with v1.0.0 are vulnerable to an improper access control bug, allowing a malicious user to potentially escalate their privileges to admin-level.
CVSS Score: 8.8 (HIGH)
CWE: CWE-284
References: https://github.com/argoproj/argo-cd/security/advisories/GHSA-2f5v-8r3f-8pww; https://github.com/argoproj/argo-cd/security/advisories/GHSA-2f5v-8r3f-8pww
CVE: CVE-2022-1737
Published: 2022-07-12
Description: Pyramid Solutions' affected products, the Developer and DLL kits for EtherNet/IP Adapter and EtherNet/IP Scanner, are vulnerable to an out-of-bounds write, which may allow an unauthorized attacker to send a specially crafted packet that may result in a denial-of-service condition.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-174-04; https://www.cisa.gov/uscert/ics/advisories/icsa-22-174-04
CVE: CVE-2022-22997
Published: 2022-07-12
Description: Addressed a remote code execution vulnerability by resolving a command injection vulnerability and closing an AWS S3 bucket that potentially allowed an attacker to execute unsigned code on My Cloud Home devices.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-78, CWE-78
References: https://www.westerndigital.com/support/product-security/wdc-22009-my-cloud-home-firmware-version-8-7-0-107; https://www.westerndigital.com/support/product-security/wdc-22009-my-cloud-home-firmware-version-8-7-0-107
CVE: CVE-2022-22998
Published: 2022-07-12
Description: Implemented protections on AWS credentials that were not properly protected.
CVSS Score: 8.0 (HIGH)
CWE: CWE-522, CWE-522
References: https://www.westerndigital.com/support/product-security/wdc-22009-my-cloud-home-firmware-version-8-7-0-107; https://www.westerndigital.com/support/product-security/wdc-22009-my-cloud-home-firmware-version-8-7-0-107
CVE: CVE-2022-28771
Published: 2022-07-12
Description: Due to missing authentication check, SAP Business one License service API - version 10.0 allows an unauthenticated attacker to send malicious http requests over the network. On successful exploitation, an attacker can break the whole application making it inaccessible.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306, CWE-306
References: https://launchpad.support.sap.com/#/notes/3157613; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3157613
CVE: CVE-2022-29187
Published: 2022-07-12
Description: Git is a distributed revision control system. Git prior to versions 2.37.1, 2.36.2, 2.35.4, 2.34.4, 2.33.4, 2.32.3, 2.31.4, and 2.30.5, is vulnerable to privilege escalation in all platforms. An unsuspecting user could still be affected by the issue reported in CVE-2022-24765, for example when navigating as root into a shared tmp directory that is owned by them, but where an attacker could create a git repository. Versions 2.37.1, 2.36.2, 2.35.4, 2.34.4, 2.33.4, 2.32.3, 2.31.4, and 2.30.5 contain a patch for this issue. The simplest way to avoid being affected by the exploit described in the example is to avoid running git as root (or an Administrator in Windows), and if needed to reduce its use to a minimum. While a generic workaround is not possible, a system could be hardened from the exploit described in the example by removing any such repository if it exists already and creating one as root to block any future attacks.
CVSS Score: 7.8 (HIGH)
CWE: CWE-282, CWE-427, CWE-427
References: http://seclists.org/fulldisclosure/2022/Nov/1; http://www.openwall.com/lists/oss-security/2022/07/14/1; https://github.blog/2022-04-12-git-security-vulnerability-announced
CVE: CVE-2022-29619
Published: 2022-07-12
Description: Under certain conditions SAP BusinessObjects Business Intelligence Platform 4.x - versions 420,430 allows user Administrator to view, edit or modify rights of objects it doesn't own and which would otherwise be restricted.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-863
References: https://launchpad.support.sap.com/#/notes/3169239; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3169239
CVE: CVE-2022-2211
Published: 2022-07-12
Description: A vulnerability was found in libguestfs. This issue occurs while calculating the greatest possible number of matching keys in the get_keys() function. This flaw leads to a denial of service, either by mistake or malicious actor.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-120
References: https://access.redhat.com/security/cve/CVE-2022-2211; https://access.redhat.com/security/cve/CVE-2022-2211
CVE: CVE-2022-31012
Published: 2022-07-12
Description: Git for Windows is a fork of Git that contains Windows-specific patches. This vulnerability in versions prior to 2.37.1 lets Git for Windows' installer execute a binary into `C:\mingw64\bin\git.exe` by mistake. This only happens upon a fresh install, not when upgrading Git for Windows. A patch is included in version 2.37.1. Two workarounds are available. Create the `C:\mingw64` folder and remove read/write access from this folder, or disallow arbitrary authenticated users to create folders in `C:\`.
CVSS Score: 8.2 (HIGH)
CWE: CWE-426
References: https://github.com/git-for-windows/git/releases/tag/v2.37.1.windows.1; https://github.com/git-for-windows/git/security/advisories/GHSA-gjrj-fxvp-hjj2; https://github.com/git-for-windows/git/releases/tag/v2.37.1.windows.1
CVE: CVE-2022-31134
Published: 2022-07-12
Description: Zulip is an open-source team collaboration tool. Zulip Server versions 2.1.0 above have a user interface tool, accessible only to server owners and server administrators, which provides a way to download a "public data" export. While this export is only accessible to administrators, in many configurations server administrators are not expected to have access to private messages and private streams. However, the "public data" export which administrators could generate contained the attachment contents for all attachments, even those from private messages and streams. Zulip Server version 5.4 contains a patch for this issue.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-200, CWE-434
References: https://blog.zulip.com/2022/07/12/zulip-cloud-data-exports; https://blog.zulip.com/2022/07/12/zulip-server-5-4-security-release; https://github.com/zulip/zulip/security/advisories/GHSA-58pm-88xp-7x9m
CVE: CVE-2022-31591
Published: 2022-07-12
Description: SAP BusinessObjects BW Publisher Service - versions 420, 430, uses a search path that contains an unquoted element. A local attacker can gain elevated privileges by inserting an executable file in the path of the affected service
CVSS Score: 7.8 (HIGH)
CWE: CWE-428
References: https://launchpad.support.sap.com/#/notes/3167430; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3167430
CVE: CVE-2022-31592
Published: 2022-07-12
Description: The application SAP Enterprise Extension Defense Forces & Public Security - versions 605, 606, 616,617,618, 802, 803, 804, 805, 806, does not perform necessary authorization checks for an authenticated user over the network, resulting in escalation of privileges leading to a limited impact on confidentiality.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://launchpad.support.sap.com/#/notes/3196280; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3196280
CVE: CVE-2022-31593
Published: 2022-07-12
Description: SAP Business One client - version 10.0 allows an attacker with low privileges, to inject code that can be executed by the application. An attacker could thereby control the behavior of the application.
CVSS Score: 8.8 (HIGH)
CWE: CWE-74
References: https://launchpad.support.sap.com/#/notes/3191012; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3191012