deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-26392
Published: 2023-04-12
Description: Adobe Substance 3D Stager version 2.0.1 (and earlier) is affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://helpx.adobe.com/security/products/substance3d_stager/apsb23-26.html; https://helpx.adobe.com/security/products/substance3d_stager/apsb23-26.html
CVE: CVE-2023-26393
Published: 2023-04-12
Description: Adobe Substance 3D Stager version 2.0.1 (and earlier) is affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/substance3d_stager/apsb23-26.html; https://helpx.adobe.com/security/products/substance3d_stager/apsb23-26.html
CVE: CVE-2023-26394
Published: 2023-04-12
Description: Adobe Substance 3D Stager version 2.0.1 (and earlier) is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: https://helpx.adobe.com/security/products/substance3d_stager/apsb23-26.html; https://helpx.adobe.com/security/products/substance3d_stager/apsb23-26.html
CVE: CVE-2023-26402
Published: 2023-04-12
Description: Adobe Substance 3D Stager version 2.0.1 (and earlier) is affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/substance3d_stager/apsb23-26.html; https://helpx.adobe.com/security/products/substance3d_stager/apsb23-26.html
CVE: CVE-2023-26403
Published: 2023-04-12
Description: Adobe Substance 3D Stager version 2.0.1 (and earlier) is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/substance3d_stager/apsb23-26.html; https://helpx.adobe.com/security/products/substance3d_stager/apsb23-26.html
CVE: CVE-2023-22620
Published: 2023-04-12
Description: An issue was discovered in SecurePoint UTM before 12.2.5.1. The firewall's endpoint at /spcgi.cgi allows sessionid information disclosure via an invalid authentication attempt. This can afterwards be used to bypass the device's authentication and get access to the administrative interface.
CVSS Score: 7.5 (HIGH)
CWE: CWE-863, CWE-863
References: http://packetstormsecurity.com/files/171924/SecurePoint-UTM-12.x-Session-ID-Leak.html; http://seclists.org/fulldisclosure/2023/Apr/7; https://github.com/MrTuxracer/advisories/blob/master/CVEs/CVE-2023-22620.txt
CVE: CVE-2023-22897
Published: 2023-04-12
Description: An issue was discovered in SecurePoint UTM before 12.2.5.1. The firewall's endpoint at /spcgi.cgi allows information disclosure of memory contents to be achieved by an authenticated user. Essentially, uninitialized data can be retrieved via an approach in which a sessionid is obtained but not used.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-908, CWE-908
References: http://packetstormsecurity.com/files/171928/SecurePoint-UTM-12.x-Memory-Leak.html; http://seclists.org/fulldisclosure/2023/Apr/8; https://github.com/MrTuxracer/advisories/blob/master/CVEs/CVE-2023-22897.txt
CVE: CVE-2023-2014
Published: 2023-04-13
Description: Cross-site Scripting (XSS) - Generic in GitHub repository microweber/microweber prior to 1.3.3.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/microweber/microweber/commit/1a9b904722b35b00653c6ae72dca[PII_REDACTED]b3; https://huntr.dev/bounties/a77bf7ed-6b61-452e-b5ee-e20017e28d1a; https://github.com/microweber/microweber/commit/1a9b904722b35b00653c6ae72dca[PII_REDACTED]b3
CVE: CVE-2023-25954
Published: 2023-04-13
Description: KYOCERA Mobile Print' v3.2.0.230119 and earlier, 'UTAX/TA MobilePrint' v3.2.0.230119 and earlier, and 'Olivetti Mobile Print' v3.2.0.230119 and earlier are vulnerable to improper intent handling. When a malicious app is installed on the victim user's Android device, the app may send an intent and direct the affected app to download malicious files or apps to the device without notification.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-668, CWE-668
References: https://jvn.jp/en/vu/JVNVU98434809/; https://play.google.com/store/apps/details?id=com.kyocera.kyoprint; https://play.google.com/store/apps/details?id=com.kyocera.kyoprintolivetti
CVE: CVE-2022-25678
Published: 2023-04-13
Description: Memory correction in modem due to buffer overwrite during coap connection
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120, CWE-787
References: https://www.qualcomm.com/company/product-security/bulletins/april-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/april-2023-bulletin
CVE: CVE-2022-25726
Published: 2023-04-13
Description: Information disclosure in modem data due to array out of bound access while handling the incoming DNS response packet
CVSS Score: 8.2 (HIGH)
CWE: CWE-126, CWE-125
References: https://www.qualcomm.com/company/product-security/bulletins/april-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/april-2023-bulletin
CVE: CVE-2022-25730
Published: 2023-04-13
Description: Information disclosure in modem due to improper check of IP type while processing DNS server query
CVSS Score: 8.2 (HIGH)
CWE: CWE-126, CWE-125
References: https://www.qualcomm.com/company/product-security/bulletins/april-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/april-2023-bulletin
CVE: CVE-2022-25731
Published: 2023-04-13
Description: Information disclosure in modem due to buffer over-read while processing packets from DNS server
CVSS Score: 7.5 (HIGH)
CWE: CWE-131, CWE-125
References: https://www.qualcomm.com/company/product-security/bulletins/april-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/april-2023-bulletin
CVE: CVE-2022-25737
Published: 2023-04-13
Description: Information disclosure in modem due to missing NULL check  while reading packets received from local network
CVSS Score: 7.5 (HIGH)
CWE: CWE-457, CWE-908
References: https://www.qualcomm.com/company/product-security/bulletins/april-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/april-2023-bulletin
CVE: CVE-2022-25739
Published: 2023-04-13
Description: Denial of service in modem due to missing null check while processing the ipv6 packet received during ECM call
CVSS Score: 7.5 (HIGH)
CWE: CWE-476, CWE-476
References: https://www.qualcomm.com/company/product-security/bulletins/april-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/april-2023-bulletin
CVE: CVE-2022-25740
Published: 2023-04-13
Description: Memory corruption in modem due to buffer overwrite while building an IPv6 multicast address based on the MAC address of the iface
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120, CWE-787
References: https://www.qualcomm.com/company/product-security/bulletins/april-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/april-2023-bulletin
CVE: CVE-2022-25745
Published: 2023-04-13
Description: Memory corruption in modem due to improper input validation while handling the incoming CoAP message
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-670, CWE-670
References: https://www.qualcomm.com/company/product-security/bulletins/april-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/april-2023-bulletin
CVE: CVE-2022-25747
Published: 2023-04-13
Description: Information disclosure in modem due to improper input validation during parsing of upcoming CoAP message
CVSS Score: 8.2 (HIGH)
CWE: CWE-126, CWE-125
References: https://www.qualcomm.com/company/product-security/bulletins/april-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/april-2023-bulletin
CVE: CVE-2022-33211
Published: 2023-04-13
Description: memory corruption in modem due to improper check while calculating size of serialized CoAP message
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20, CWE-131
References: https://www.qualcomm.com/company/product-security/bulletins/april-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/april-2023-bulletin
CVE: CVE-2022-33222
Published: 2023-04-13
Description: Information disclosure due to buffer over-read while parsing DNS response packets in Modem.
CVSS Score: 8.2 (HIGH)
CWE: CWE-126, CWE-125
References: https://www.qualcomm.com/company/product-security/bulletins/april-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/april-2023-bulletin
CVE: CVE-2022-33223
Published: 2023-04-13
Description: Transient DOS in Modem due to null pointer dereference while processing the incoming packet with http chunked encoding.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476, CWE-476
References: https://www.qualcomm.com/company/product-security/bulletins/april-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/april-2023-bulletin
CVE: CVE-2022-33228
Published: 2023-04-13
Description: Information disclosure sue to buffer over-read in modem while processing ipv6 packet with hop-by-hop or destination option in header.
CVSS Score: 8.2 (HIGH)
CWE: CWE-126, CWE-125
References: https://www.qualcomm.com/company/product-security/bulletins/april-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/april-2023-bulletin
CVE: CVE-2022-33231
Published: 2023-04-13
Description: Memory corruption due to double free in core while initializing the encryption key.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-415, CWE-415
References: https://www.qualcomm.com/company/product-security/bulletins/april-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/april-2023-bulletin
CVE: CVE-2022-33258
Published: 2023-04-13
Description: Information disclosure due to buffer over-read in modem while reading configuration parameters.
CVSS Score: 8.2 (HIGH)
CWE: CWE-126, CWE-125
References: https://www.qualcomm.com/company/product-security/bulletins/april-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/april-2023-bulletin
CVE: CVE-2022-33259
Published: 2023-04-13
Description: Memory corruption due to buffer copy without checking the size of input in modem while decoding raw SMS received.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120, CWE-120
References: https://www.qualcomm.com/company/product-security/bulletins/april-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/april-2023-bulletin
CVE: CVE-2022-33269
Published: 2023-04-13
Description: Memory corruption due to integer overflow or wraparound in Core while DDR memory assignment.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-190, CWE-190
References: https://www.qualcomm.com/company/product-security/bulletins/april-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/april-2023-bulletin
CVE: CVE-2022-33270
Published: 2023-04-13
Description: Transient DOS due to time-of-check time-of-use race condition in Modem while processing RRC Reconfiguration message.
CVSS Score: 7.5 (HIGH)
CWE: CWE-367, CWE-367
References: https://www.qualcomm.com/company/product-security/bulletins/april-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/april-2023-bulletin
CVE: CVE-2022-33282
Published: 2023-04-13
Description: Memory corruption in Automotive Multimedia due to integer overflow to buffer overflow during IOCTL calls in video playback.
CVSS Score: 8.4 (HIGH)
CWE: CWE-680, CWE-190
References: https://www.qualcomm.com/company/product-security/bulletins/april-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/april-2023-bulletin
CVE: CVE-2022-33287
Published: 2023-04-13
Description: Information disclosure in Modem due to buffer over-read while getting length of Unfragmented headers in an IPv6 packet.
CVSS Score: 8.2 (HIGH)
CWE: CWE-126, CWE-125
References: https://www.qualcomm.com/company/product-security/bulletins/april-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/april-2023-bulletin
CVE: CVE-2022-33288
Published: 2023-04-13
Description: Memory corruption due to buffer copy without checking the size of input in Core while sending SCM command to get write protection information.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-120, CWE-120
References: https://www.qualcomm.com/company/product-security/bulletins/april-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/april-2023-bulletin
CVE: CVE-2022-33289
Published: 2023-04-13
Description: Memory corruption occurs in Modem due to improper validation of array index when malformed APDU is sent from card.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-129, CWE-129
References: https://www.qualcomm.com/company/product-security/bulletins/april-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/april-2023-bulletin
CVE: CVE-2022-33291
Published: 2023-04-13
Description: Information disclosure in Modem due to buffer over-read while receiving a IP header with malformed length.
CVSS Score: 8.2 (HIGH)
CWE: CWE-126, CWE-125
References: https://www.qualcomm.com/company/product-security/bulletins/april-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/april-2023-bulletin
CVE: CVE-2022-33294
Published: 2023-04-13
Description: Transient DOS in Modem due to NULL pointer dereference while receiving response of lwm2m registration/update/bootstrap request message.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476, CWE-476
References: https://www.qualcomm.com/company/product-security/bulletins/april-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/april-2023-bulletin
CVE: CVE-2022-33295
Published: 2023-04-13
Description: Information disclosure in Modem due to buffer over-read while parsing the wms message received given the buffer and its length.
CVSS Score: 8.2 (HIGH)
CWE: CWE-126, CWE-125
References: https://www.qualcomm.com/company/product-security/bulletins/april-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/april-2023-bulletin
CVE: CVE-2022-33296
Published: 2023-04-13
Description: Memory corruption due to integer overflow to buffer overflow in Modem while parsing Traffic Channel Neighbor List Update message.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-680, CWE-190
References: https://www.qualcomm.com/company/product-security/bulletins/april-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/april-2023-bulletin
CVE: CVE-2022-33297
Published: 2023-04-13
Description: Information disclosure due to buffer overread in Linux sensors
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-126, CWE-125
References: https://www.qualcomm.com/company/product-security/bulletins/april-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/april-2023-bulletin
CVE: CVE-2022-33298
Published: 2023-04-13
Description: Memory corruption due to use after free in Modem while modem initialization.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-416, CWE-416
References: https://www.qualcomm.com/company/product-security/bulletins/april-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/april-2023-bulletin
CVE: CVE-2022-33301
Published: 2023-04-13
Description: Memory corruption due to incorrect type conversion or cast in audio while using audio playback/capture when crafted address is sent from AGM IPC to AGM.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-704, CWE-704
References: https://www.qualcomm.com/company/product-security/bulletins/april-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/april-2023-bulletin
CVE: CVE-2022-33302
Published: 2023-04-13
Description: Memory corruption due to improper validation of array index in User Identity Module when APN TLV length is greater than command length.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-129, CWE-129
References: https://www.qualcomm.com/company/product-security/bulletins/april-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/april-2023-bulletin
CVE: CVE-2022-40503
Published: 2023-04-13
Description: Information disclosure due to buffer over-read in Bluetooth Host while A2DP streaming.
CVSS Score: 8.2 (HIGH)
CWE: CWE-126, CWE-125
References: https://www.qualcomm.com/company/product-security/bulletins/april-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/april-2023-bulletin
CVE: CVE-2022-40532
Published: 2023-04-13
Description: Memory corruption due to integer overflow or wraparound in WLAN while sending WMI cmd from host to target.
CVSS Score: 8.4 (HIGH)
CWE: CWE-190, CWE-190
References: https://www.qualcomm.com/company/product-security/bulletins/april-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/april-2023-bulletin
CVE: CVE-2023-1842
Published: 2023-04-13
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none.
CVE: CVE-2023-20118
Published: 2023-04-13
Description: A vulnerability in the web-based management interface of Cisco Small Business Routers RV016, RV042, RV042G, RV082, RV320, and RV325 Routers could allow an authenticated, remote attacker to execute arbitrary commands on an affected device.
 This vulnerability is due to improper validation of user input within incoming HTTP packets. An attacker could exploit this vulnerability by sending a crafted HTTP request to the web-based management interface. A successful exploit could allow the attacker to gain root-level privileges and access unauthorized data. To exploit this vulnerability, an attacker would need to have valid administrative credentials on the affected device.
 Cisco has not and will not release software updates that address this vulnerability.   However, administrators may disable the affected feature as described in the Workarounds ["#workarounds"] section.
  {{value}} ["%7b%7bvalue%7d%7d"])}]]
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-77, CWE-77
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sbr042-multi-vuln-ej76Pke5; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sbr042-multi-vuln-ej76Pke5; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-20118
CVE: CVE-2023-21630
Published: 2023-04-13
Description: Memory Corruption in Multimedia Framework due to integer overflow when synx bind is called along with synx signal.
CVSS Score: 8.4 (HIGH)
CWE: CWE-191, CWE-190
References: https://www.qualcomm.com/company/product-security/bulletins/april-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/april-2023-bulletin
CVE: CVE-2022-45064
Published: 2023-04-13
Description: The SlingRequestDispatcher doesn't correctly implement the RequestDispatcher API resulting in a generic type of include-based cross-site scripting issues on the Apache Sling level. The vulnerability is exploitable by an attacker that is able to include a resource with specific content-type and control the include path (i.e. writing content). The impact of a successful attack is privilege escalation to administrative power.




Please update to Apache Sling Engine >= 2.14.0 and enable the "Check Content-Type overrides" configuration option.





CVSS Score: 8.0 (HIGH)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2023/04/18/6; https://lists.apache.org/thread/hhp611hltby3whk03vx2mv7cmy3vs0ok; http://www.openwall.com/lists/oss-security/2023/04/18/6
CVE: CVE-2022-44625
Published: 2023-04-13
Description: Auth. (admin+) Stored Cross-Site Scripting') vulnerability in Zephilou Cyklodev WP Notify plugin <= 1.2.1 versions.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/cyklodev-wp-notify/wordpress-cyklodev-wp-notify-plugin-1-2-1-auth-stored-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/cyklodev-wp-notify/wordpress-cyklodev-wp-notify-plugin-1-2-1-auth-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2022-45358
Published: 2023-04-13
Description: Auth. (subscriber+) Reflected Cross-Site Scripting (XSS) vulnerability in Silkalns Activello theme <= 1.4.4 versions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/activello/wordpress-activello-theme-1-4-4-auth-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/activello/wordpress-activello-theme-1-4-4-auth-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-2021
Published: 2023-04-13
Description: Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.3.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/nilsteampassnet/teampass/commit/77c541a0151841d1f4ceb0a84ca391e1b526d58d; https://huntr.dev/bounties/2e31082d-7aeb-46ff-84d6-9561758e3bf0; https://github.com/nilsteampassnet/teampass/commit/77c541a0151841d1f4ceb0a84ca391e1b526d58d
CVE: CVE-2023-27812
Published: 2023-04-13
Description: bloofox v0.5.2 was discovered to contain an arbitrary file deletion vulnerability via the delete_file() function.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-22
References: http://bloofox.com; https://github.com/jspring996; https://github.com/jspring996/PHPcodecms/issues/1
CVE: CVE-2023-29597
Published: 2023-04-13
Description: bloofox v0.5.2 was discovered to contain a SQL injection vulnerability via the component /index.php?mode=content&page=pages&action=edit&eid=1.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/jspring996/PHPcodecms/issues/2; https://github.com/jspring996/PHPcodecms/issues/2
CVE: CVE-2023-29598
Published: 2023-04-13
Description: lmxcms v1.4.1 was discovered to contain a SQL injection vulnerability via the setbook parameter at index.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/jspring996/PHPcodecms/issues/3; https://github.com/jspring996/PHPcodecms/issues/3
CVE: CVE-2023-30630
Published: 2023-04-13
Description: Dmidecode before 3.5 allows -dump-bin to overwrite a local file. This has security relevance because, for example, execution of Dmidecode via Sudo is plausible. NOTE: Some third parties have indicated the fix in 3.5 does not adequately address the vulnerability. The argument is that the proposed patch prevents dmidecode from writing to an existing file. However, there are multiple attack vectors that would not require overwriting an existing file that would provide the same level of unauthorized privilege escalation (e.g. creating a new file in /etc/cron.hourly).
CVSS Score: 7.1 (HIGH)
CWE: CWE-23
References: https://git.savannah.nongnu.org/cgit/dmidecode.git/commit/?id=6ca381c1247c81f74e1ca4e7706f70bdda72e6f2; https://git.savannah.nongnu.org/cgit/dmidecode.git/commit/?id=d8cfbc808f387e87091c25e7d5b8c2bb348bb206; https://github.com/adamreiser/dmiwrite
CVE: CVE-2023-27779
Published: 2023-04-13
Description: AM Presencia v3.7.3 was discovered to contain a SQL injection vulnerability via the user parameter in the login form.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: http://alo.com; https://amsystem.es/; https://docs.google.com/document/d/1kGzmc6AOCfRzJf9mDz4emkhQj84Y1XemmAMZjYK32-o/edit?usp=sharing