deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-29368
Published: 2022-05-12
Description: Moddable commit before 135aa9a4a6a9b49b60aa730ebc3bcc6247d75c45 was discovered to contain an out-of-bounds read via the function fxUint8Getter at /moddable/xs/sources/xsDataView.c.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125
References: https://github.com/Moddable-OpenSource/moddable/commit/135aa9a4a6a9b49b60aa730ebc3bcc6247d75c45; https://github.com/Moddable-OpenSource/moddable/issues/896; https://github.com/Moddable-OpenSource/moddable/commit/135aa9a4a6a9b49b60aa730ebc3bcc6247d75c45
CVE: CVE-2022-29369
Published: 2022-05-12
Description: Nginx NJS v0.7.2 was discovered to contain a segmentation violation via njs_lvlhsh_bucket_find at njs_lvlhsh.c.
CVSS Score: 7.5 (HIGH)
CWE: CWE-754
References: https://github.com/nginx/njs/commit/222d6fdcf0c6485ec8e175f3a7b70d650c234b4e; https://github.com/nginx/njs/issues/467; https://github.com/nginx/njs/commit/222d6fdcf0c6485ec8e175f3a7b70d650c234b4e
CVE: CVE-2020-22984
Published: 2022-05-12
Description: Cross-Site Scripting (XSS) vulnerability in MicroStrategy Web SDK 10.11 and earlier, allows remote unauthenticated attackers to execute arbitrary code via key parameter to the getGoogleExtraConfig task.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://microstrategy.com; http://www.yourcompany.com:8080/MicroStrategy/servlet/taskProc; https://medium.com/%40win3zz/simple-story-of-some-complicated-xss-on-facebook-8a9c0d80969d
CVE: CVE-2020-22985
Published: 2022-05-12
Description: Cross-Site Scripting (XSS) vulnerability in MicroStrategy Web SDK 10.11 and earlier, allows remote unauthenticated attackers to execute arbitrary code via the key parameter to the getESRIExtraConfig task.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://microstrategy.com; http://www.yourcompany.com:8080/MicroStrategy/servlet/taskProc; https://medium.com/%40win3zz/simple-story-of-some-complicated-xss-on-facebook-8a9c0d80969d
CVE: CVE-2020-22986
Published: 2022-05-12
Description: Cross-Site Scripting (XSS) vulnerability in MicroStrategy Web SDK 10.11 and earlier, allows remote unauthenticated attackers to execute arbitrary code via the searchString parameter to the wikiScrapper task.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://microstrategy.com; http://www.yourcompany.com:8080/MicroStrategy/servlet/taskProc; https://medium.com/%40win3zz/simple-story-of-some-complicated-xss-on-facebook-8a9c0d80969d
CVE: CVE-2020-22987
Published: 2022-05-12
Description: Cross-Site Scripting (XSS) vulnerability in MicroStrategy Web SDK 10.11 and earlier, allows remote unauthenticated attackers to execute arbitrary code via the fileToUpload parameter to the uploadFile task.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://microstrategy.com; http://www.yourcompany.com:8080/MicroStrategy/servlet/taskProc; https://medium.com/%40win3zz/simple-story-of-some-complicated-xss-on-facebook-8a9c0d80969d
CVE: CVE-2021-27478
Published: 2022-05-12
Description: A specifically crafted packet sent by an attacker to EIPStackGroup OpENer EtherNet/IP commits and versions prior to Feb 10, 2021 may cause a denial-of-service condition.
CVSS Score: 8.2 (HIGH)
CWE: CWE-681, CWE-681
References: https://github.com/EIPStackGroup/OpENer; https://www.cisa.gov/uscert/ics/advisories/icsa-21-105-02; https://github.com/EIPStackGroup/OpENer
CVE: CVE-2021-27482
Published: 2022-05-12
Description: A specifically crafted packet sent by an attacker to EIPStackGroup OpENer EtherNet/IP commits and versions prior to Feb 10, 2021 may allow the attacker to read arbitrary data.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://github.com/EIPStackGroup/OpENer; https://www.cisa.gov/uscert/ics/advisories/icsa-21-105-02; https://github.com/EIPStackGroup/OpENer
CVE: CVE-2021-27498
Published: 2022-05-12
Description: A specifically crafted packet sent by an attacker to EIPStackGroup OpENer EtherNet/IP commits and versions prior to Feb 10, 2021 may result in a denial-of-service condition.
CVSS Score: 7.5 (HIGH)
CWE: CWE-617
References: https://github.com/EIPStackGroup/OpENer; https://www.cisa.gov/uscert/ics/advisories/icsa-21-105-02; https://github.com/EIPStackGroup/OpENer
CVE: CVE-2021-27500
Published: 2022-05-12
Description: A specifically crafted packet sent by an attacker to EIPStackGroup OpENer EtherNet/IP commits and versions prior to Feb 10, 2021 may result in a denial-of-service condition.
CVSS Score: 7.5 (HIGH)
CWE: CWE-617
References: https://github.com/EIPStackGroup/OpENer; https://www.cisa.gov/uscert/ics/advisories/icsa-21-105-02; https://github.com/EIPStackGroup/OpENer
CVE: CVE-2022-22796
Published: 2022-05-12
Description: Sysaid – Sysaid System Takeover - An attacker can bypass the authentication process by accessing to: /wmiwizard.jsp, Then to: /ConcurrentLogin.jsp, then click on the login button, and it will redirect you to /home.jsp without any authentication.
CVSS Score: 7.0 (HIGH)
CWE: CWE-287
References: https://www.gov.il/en/departments/faq/cve_advisories; https://www.gov.il/en/departments/faq/cve_advisories
CVE: CVE-2022-22797
Published: 2022-05-12
Description: Sysaid – sysaid Open Redirect - An Attacker can change the redirect link at the parameter "redirectURL" from"GET" request from the url location: /CommunitySSORedirect.jsp?redirectURL=https://google.com. Unvalidated redirects and forwards are possible when a web application accepts untrusted input that could cause the web application to redirect the request to a URL contained within untrusted input. By modifying untrusted URL input to a malicious site, an attacker may successfully launch a phishing scam and steal user credentials.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-601, CWE-601
References: https://www.gov.il/en/departments/faq/cve_advisories; https://www.gov.il/en/departments/faq/cve_advisories
CVE: CVE-2022-22798
Published: 2022-05-12
Description: Sysaid – Pro Plus Edition, SysAid Help Desk Broken Access Control v20.4.74 b10, v22.1.20 b62, v22.1.30 b49 - An attacker needs to log in as a guest after that the system redirects him to the service portal or EndUserPortal.JSP, then he needs to change the path in the URL to /ConcurrentLogin%2ejsp after that he will receive an error message with a login button, by clicking on it, he will connect to the system dashboard. The attacker can receive sensitive data like server details, usernames, workstations, etc. He can also perform actions such as uploading files, deleting calls from the system.
CVSS Score: 6.8 (MEDIUM)
References: https://www.gov.il/en/departments/faq/cve_advisories; https://www.gov.il/en/departments/faq/cve_advisories
CVE: CVE-2022-22970
Published: 2022-05-12
Description: In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, applications that handle file uploads are vulnerable to DoS attack if they rely on data binding to set a MultipartFile or javax.servlet.Part to a field in a model object.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-770, CWE-770
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://tanzu.vmware.com/security/cve-2022-22970; https://www.oracle.com/security-alerts/cpujul2022.html
CVE: CVE-2022-22971
Published: 2022-05-12
Description: In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, application with a STOMP over WebSocket endpoint is vulnerable to a denial of service attack by an authenticated user.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-770, CWE-770
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://tanzu.vmware.com/security/cve-2022-22971; https://www.oracle.com/security-alerts/cpujul2022.html
CVE: CVE-2022-23139
Published: 2022-05-12
Description: ZTE's ZXMP M721 product has a permission and access control vulnerability. Since the folder permission viewed by sftp is 666, which is inconsistent with the actual permission. It’s easy for?users to?ignore the modification?of?the file permission configuration, so that low-authority accounts could actually obtain higher operating permissions on key files.
CVSS Score: 8.8 (HIGH)
CWE: CWE-863
References: https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1024444; https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1024444
CVE: CVE-2022-23165
Published: 2022-05-12
Description: Sysaid – Sysaid 14.2.0 Reflected Cross-Site Scripting (XSS) - The parameter "helpPageName" used by the page "/help/treecontent.jsp" suffers from a Reflected Cross-Site Scripting vulnerability. For an attacker to exploit this Cross-Site Scripting vulnerability, it's necessary for the affected product to expose the Offline Help Pages. An attacker may gain access to sensitive information or execute client-side code in the browser session of the victim user. Furthermore, an attacker would require the victim to open a malicious link. An attacker may exploit this vulnerability in order to perform phishing attacks. The attacker can receive sensitive data like server details, usernames, workstations, etc. He can also perform actions such as uploading files, deleting calls from the system
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.gov.il/en/departments/faq/cve_advisories; https://www.gov.il/en/departments/faq/cve_advisories
CVE: CVE-2022-23166
Published: 2022-05-12
Description: Sysaid – Sysaid Local File Inclusion (LFI) – An unauthenticated attacker can access to the system by accessing to "/lib/tinymce/examples/index.html" path. in the "Insert/Edit Embedded Media" window Choose Type : iFrame and File/URL : [here is the LFI] Solution: Update to 22.2.20 cloud version, or to 22.1.64 on premise version.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-22
References: https://www.gov.il/en/departments/faq/cve_advisories; https://www.gov.il/en/departments/faq/cve_advisories
CVE: CVE-2022-23742
Published: 2022-05-12
Description: Check Point Endpoint Security Client for Windows versions earlier than E86.40 copy files for forensics reports from a directory with low privileges. An attacker can replace those files with malicious or linked content, such as exploiting CVE-2020-0896 on unpatched systems or using symbolic links.
CVSS Score: 7.8 (HIGH)
CWE: CWE-65, CWE-59
References: https://supportcontent.checkpoint.com/solutions?id=sk178665%2C; https://supportcontent.checkpoint.com/solutions?id=sk179132; https://supportcontent.checkpoint.com/solutions?id=sk178665%2C
CVE: CVE-2021-27768
Published: 2022-05-12
Description: Using the ability to perform a Man-in-the-Middle (MITM) attack, which indicates a lack of hostname verification, sensitive account information was able to be intercepted. In this specific scenario, the application's network traffic was intercepted using a proxy server set up in 'transparent' mode while a certificate with an invalid hostname was active. The Android application was found to have hostname verification issues during the server setup and login flows; however, the application did not process requests post-login.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-300, CWE-295
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0097753; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0097753
CVE: CVE-2021-27769
Published: 2022-05-12
Description: Information leakage occurs when a website reveals information that could aid an attacker to further exploit the system. This information may or may not be sensitive and does not automatically mean a breach is likely to occur. Overall, any information that could be used for an attack should be limited whenever possible.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-472
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0097430; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0097430
CVE: CVE-2021-27770
Published: 2022-05-12
Description: The vulnerability was discovered within the “FaviconService”. The service takes a base64-encoded URL which is then requested by the webserver. We assume this service is used by the “meetings”-function where users can specify an external URL where the online meeting will take place.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-472
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0097430; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0097430
CVE: CVE-2021-27771
Published: 2022-05-12
Description: User SID can be modified resulting in an Arbitrary File Upload or deletion of directories causing a Denial of Service. When interacting in a normal matter with the Sametime chat application, users hold a cookie containing their session ID (SID). This value is also used when sending chat messages, receiving notifications and/or transferring files.
CVSS Score: 8.2 (HIGH)
CWE: CWE-22, CWE-434, CWE-434
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0097430; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0097430
CVE: CVE-2021-27772
Published: 2022-05-12
Description: Users are able to read group conversations without actively taking part in them. Next to one to one conversations, users are able to start group conversations with multiple users. It was found possible to obtain the contents of these group conversations without being part of it. This could lead to information leakage where confidential information discussed in private groups is read by other users without the users knowledge.
CVSS Score: 7.1 (HIGH)
CWE: CWE-285
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0097430; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0097430
CVE: CVE-2021-27773
Published: 2022-05-12
Description: This vulnerability allows users to execute a clickjacking attack in the meeting's chat.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-451, CWE-1021
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0097430; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0097430
CVE: CVE-2021-27777
Published: 2022-05-12
Description: XML External Entity (XXE) injection vulnerabilities occur when poorly configured XML parsers process user supplied input without sufficient validation. Attackers can exploit this vulnerability to manipulate XML content and inject malicious external entity references.
CVSS Score: 7.5 (HIGH)
CWE: CWE-91, CWE-611
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0097124; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0097124
CVE: CVE-2022-27134
Published: 2022-05-13
Description: EOSIO batdappboomx v327c04cf has an Access-control vulnerability in the `transfer` function of the smart contract which allows remote attackers to win the cryptocurrency without paying ticket fee via the `std::string memo` parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-863
References: https://github.com/Kenun99/CVE-batdappboomx; https://github.com/Kenun99/CVE-batdappboomx
CVE: CVE-2022-29218
Published: 2022-05-13
Description: RubyGems is a package registry used to supply software for the Ruby language ecosystem. An ordering mistake in the code that accepts gem uploads allowed some gems (with platforms ending in numbers, like `arm64-darwin-21`) to be temporarily replaced in the CDN cache by a malicious package. The bug has been patched, and is believed to have never been exploited, based on an extensive review of logs and existing gems by rubygems. The easiest way to ensure that an application has not been exploited by this vulnerability is to verify all downloaded .gems checksums match the checksum recorded in the RubyGems.org database. RubyGems.org has been patched and is no longer vulnerable to this issue.
CVSS Score: 7.7 (HIGH)
CWE: CWE-269, CWE-290, CWE-863
References: https://github.com/rubygems/rubygems.org/security/advisories/GHSA-2jmx-8mh8-pm8w; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://github.com/rubygems/rubygems.org/security/advisories/GHSA-2jmx-8mh8-pm8w
CVE: CVE-2022-25762
Published: 2022-05-13
Description: If a web application sends a WebSocket message concurrently with the WebSocket connection closing when running on Apache Tomcat 8.5.0 to 8.5.75 or Apache Tomcat 9.0.0.M1 to 9.0.20, it is possible that the application will continue to use the socket after it has been closed. The error handling triggered in this case could cause the a pooled object to be placed in the pool twice. This could result in subsequent connections using the same object concurrently which could result in data being returned to the wrong use and/or other errors.
CVSS Score: 8.6 (HIGH)
CWE: CWE-404, CWE-404
References: https://lists.apache.org/thread/6ckmjfb1k61dyzkto9vm2k5jvt4o7w7c; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.oracle.com/security-alerts/cpujul2022.html
CVE: CVE-2021-42967
Published: 2022-05-13
Description: Unrestricted file upload in /novel-admin/src/main/java/com/java2nb/common/controller/FileController.java in novel-plus all versions allows allows an attacker to upload malicious JSP files.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://github.com/201206030/novel-plus/issues/62; https://github.com/201206030/novel-plus/issues/62
CVE: CVE-2021-42969
Published: 2022-05-13
Description: Certain Anaconda3 2021.05 are affected by OS command injection. When a user installs Anaconda, an attacker can create a new file and write something in usercustomize.py. When the user opens the terminal or activates Anaconda, the command will be executed.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://yuaneuro.cn/anaconda/anaconda_command_execution.docx; https://yuaneuro.cn/anaconda/anaconda_command_execution.docx
CVE: CVE-2020-22983
Published: 2022-05-13
Description: A Server-Side Request Forgery (SSRF) vulnerability exists in MicroStrategy Web SDK 11.1 and earlier, allows remote unauthenticated attackers to conduct a server-side request forgery (SSRF) attack via the srcURL parameter to the shortURL task.
CVSS Score: 8.1 (HIGH)
CWE: CWE-918
References: http://microstrategy.com; http://www.yourcompany.com:8080/MicroStrategy/servlet/taskProc; https://medium.com/%40win3zz/how-i-made-31500-by-submitting-a-bug-to-facebook-d31bb046e204
CVE: CVE-2022-29383
Published: 2022-05-13
Description: NETGEAR ProSafe SSL VPN firmware FVS336Gv2 and FVS336Gv3 was discovered to contain a SQL injection vulnerability via USERDBDomains.Domainname at cgi-bin/platform.cgi.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/badboycxcc/Netgear-ssl-vpn-20211222; https://www.netgear.com/about/security/; https://github.com/badboycxcc/Netgear-ssl-vpn-20211222
CVE: CVE-2022-30370
Published: 2022-05-13
Description: Air Cargo Management System 1.0 is vulnerable to SQL Injection via /acms/classes/Master.php?f=delete_cargo_type.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/air-cargo-management-system/SQLi-1.md; https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/air-cargo-management-system/SQLi-1.md
CVE: CVE-2022-30371
Published: 2022-05-13
Description: Air Cargo Management System 1.0 is vulnerable to SQL Injection via /acms/admin/cargo_types/view_cargo_type.php?id=.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/air-cargo-management-system/SQLi-3.md; https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/air-cargo-management-system/SQLi-3.md
CVE: CVE-2022-30372
Published: 2022-05-13
Description: Air Cargo Management System 1.0 is vulnerable to SQL Injection via /acms/classes/Master.php?f=delete_cargo.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/air-cargo-management-system/SQLi-2.md; https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/air-cargo-management-system/SQLi-2.md
CVE: CVE-2022-30373
Published: 2022-05-13
Description: Air Cargo Management System 1.0 is vulnerable to SQL Injection via /acms/admin/cargo_types/manage_cargo_type.php?id=.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/air-cargo-management-system/SQLi-4.md; https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/air-cargo-management-system/SQLi-4.md
CVE: CVE-2022-30374
Published: 2022-05-13
Description: Air Cargo Management System 1.0 is vulnerable to SQL Injection via /acms/admin/?page=transactions/manage_transaction&id=.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/air-cargo-management-system/SQLi-5.md; https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/air-cargo-management-system/SQLi-5.md
CVE: CVE-2022-30489
Published: 2022-05-13
Description: WAVLINK WN535 G3 was discovered to contain a cross-site scripting (XSS) vulnerability via the hostname parameter at /cgi-bin/login.cgi.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/badboycxcc/XSS; https://github.com/badboycxcc/XSS
CVE: CVE-2022-29854
Published: 2022-05-13
Description: A vulnerability in Mitel 6900 Series IP (MiNet) phones excluding 6970, versions 1.8 (1.8.0.12) and earlier, could allow a unauthenticated attacker with physical access to the phone to gain root access due to insufficient access control for test functionality during system startup. A successful exploit could allow access to sensitive information and code execution.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-863
References: http://packetstormsecurity.com/files/167547/Mitel-6800-6900-Series-SIP-Phones-Backdoor-Access.html; http://seclists.org/fulldisclosure/2022/Jun/32; https://www.mitel.com/support/security-advisories
CVE: CVE-2022-30367
Published: 2022-05-13
Description: Air Cargo Management System v1.0 is vulnerable to file deletion via /acms/classes/Master.php?f=delete_img.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-276
References: https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/air-cargo-management-system/delet-file-1.md; https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/air-cargo-management-system/delet-file-1.md
CVE: CVE-2022-30375
Published: 2022-05-13
Description: Sourcecodester Simple Social Networking Site v1.0 is vulnerable to file deletion via /sns/classes/Master.php?f=delete_img.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-276
References: https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/simple-social-networking-site/delet-file-1.md; https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/simple-social-networking-site/delet-file-1.md
CVE: CVE-2022-30376
Published: 2022-05-13
Description: Sourcecodester Simple Social Networking Site v1.0 is vulnerable to SQL Injection via /sns/admin/members/view_member.php?id=.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/simple-social-networking-site/SQLi-1.md; https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/simple-social-networking-site/SQLi-1.md
CVE: CVE-2022-30378
Published: 2022-05-13
Description: Sourcecodester Simple Social Networking Site v1.0 is vulnerable to SQL Injection via /sns/admin/?page=posts/view_post&id=.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/simple-social-networking-site/SQLi-2.md; https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/simple-social-networking-site/SQLi-2.md
CVE: CVE-2022-30379
Published: 2022-05-13
Description: Sourcecodester Simple Social Networking Site v1.0 is vulnerable to SQL Injection via /sns/admin/?page=user/manage_user&id=.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/simple-social-networking-site/SQLi-3.md; https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/simple-social-networking-site/SQLi-3.md
CVE: CVE-2021-22275
Published: 2022-05-13
Description: Buffer Overflow vulnerability in B&R Automation Runtime webserver allows an unauthenticated network-based attacker to stop the cyclic program on the device and cause a denial of service.
CVSS Score: 8.6 (HIGH)
CWE: CWE-120, CWE-120
References: https://www.br-automation.com/downloads_br_productcatalogue/assets/[PII_REDACTED]64-en-original-1.0.pdf; https://www.br-automation.com/downloads_br_productcatalogue/assets/[PII_REDACTED]64-en-original-1.0.pdf