deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-3568
Published: 2023-02-10
Description: The ImageMagick Engine plugin for WordPress is vulnerable to deserialization of untrusted input via the 'cli_path' parameter in versions up to, and including 1.7.5. This makes it possible for unauthenticated users to call files using a PHAR wrapper, granted they can trick a site administrator into performing an action such as clicking on a link, that will deserialize and call arbitrary PHP Objects that can be used to perform a variety of malicious actions granted a POP chain is also present. It also requires that the attacker is successful in uploading a file with the serialized payload.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502, CWE-352
References: https://github.com/orangelabweb/imagemagick-engine/blob/1.7.4/imagemagick-engine.php#L529; https://github.com/orangelabweb/imagemagick-engine/blob/v.1.7.2/imagemagick-engine.php#L529; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2801283%40imagemagick-engine&new=2801283%40imagemagick-engine&sfp_email=&sfph_mail=
CVE: CVE-2023-0771
Published: 2023-02-10
Description: SQL Injection in GitHub repository ampache/ampache prior to 5.5.7,develop.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/ampache/ampache/commit/c456e66ef6fd8d11390181a40c66910ae01fbf4c; https://huntr.dev/bounties/2493f350-271b-4c38-9e1d-c8fa189c5ce1; https://github.com/ampache/ampache/commit/c456e66ef6fd8d11390181a40c66910ae01fbf4c
CVE: CVE-2022-45699
Published: 2023-02-10
Description: Command injection in the administration interface in APSystems ECU-R version 5203 allows a remote unauthenticated attacker to execute arbitrary commands as root using the timezone parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-94
References: https://github.com/0xst4n/APSystems-ECU-R-RCE-Timezone; https://web.archive.org/web/[PII_REDACTED]5954/https://github.com/0xst4n/APSystems-ECU-R-RCE-Timezone; https://www.youtube.com/watch?v=YNeeaDPJOBY
CVE: CVE-2023-23286
Published: 2023-02-10
Description: Cross Site Scripting (XSS) vulnerability in Provide server 14.4 allows attackers to execute arbitrary code through the server-log via username field from the login form.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://packetstormsecurity.com/files/171734/Provide-Server-14.4-XSS-Cross-Site-Request-Forgery-Code-Execution.html; https://f20.be/cves/provide-server-v-14-4; https://www.provideserver.se/
CVE: CVE-2022-43501
Published: 2023-02-10
Description: KASAGO TCP/IP stack provided by Zuken Elmic generates ISNs(Initial Sequence Number) for TCP connections from an insufficiently random source. An attacker may be able to determine the ISN of the current or future TCP connections and either hijack existing ones or spoof future ones.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-330, CWE-330
References: https://jvn.jp/en/vu/JVNVU99551468/; https://www.elwsc.co.jp/news/6352; https://jvn.jp/en/vu/JVNVU99551468/
CVE: CVE-2023-22369
Published: 2023-02-10
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2023-25011. Reason: This candidate is a duplicate of CVE-2023-25011. Notes: All CVE users should reference CVE-2023-25011 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2023-22832
Published: 2023-02-10
Description: The ExtractCCDAAttributes Processor in Apache NiFi 1.2.0 through 1.19.1 does not restrict XML External Entity references.

Flow configurations that include the ExtractCCDAAttributes Processor are vulnerable to malicious XML documents that contain Document Type Declarations with XML External Entity references.

The resolution disables Document Type Declarations and disallows XML External Entity resolution in the ExtractCCDAAttributes Processor.


CVSS Score: 7.5 (HIGH)
CWE: CWE-611, CWE-611
References: https://lists.apache.org/thread/b51qs6y7b7r58vovddkv6wc16g2xbl3w; https://nifi.apache.org/security.html#CVE-2023-22832; https://lists.apache.org/thread/b51qs6y7b7r58vovddkv6wc16g2xbl3w
CVE: CVE-2022-34452
Published: 2023-02-10
Description: 
PowerPath Management Appliance with versions 3.3, 3.2*, 3.1 & 3.0* contains sensitive information disclosure vulnerability. An Authenticated admin user can able to exploit the issue and view sensitive information stored in the logs.


CVSS Score: 2.7 (LOW)
CWE: CWE-598, CWE-668
References: https://www.dell.com/support/kbdoc/en-us/000205404/dsa-2022-283-powerpath-management-appliance-security-update-for-multiple-security-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000205404/dsa-2022-283-powerpath-management-appliance-security-update-for-multiple-security-vulnerabilities
CVE: CVE-2022-34454
Published: 2023-02-10
Description: Dell PowerScale OneFS, versions 8.2.x-9.3.x, contain a heap-based buffer overflow. A local privileged malicious user could potentially exploit this vulnerability, leading to system takeover. This impacts compliance mode clusters.


CVSS Score: 6.7 (MEDIUM)
CWE: CWE-122, CWE-787
References: https://www.dell.com/support/kbdoc/en-us/000205618/dsa-2022-271; https://www.dell.com/support/kbdoc/en-us/000205618/dsa-2022-271
CVE: CVE-2022-24410
Published: 2023-02-10
Description: 
Dell BIOS contains an information exposure vulnerability. An unauthenticated local attacker with physical access to the system and knowledge of the system configuration could potentially exploit this vulnerability to read system information via debug interfaces.


CVSS Score: 6.8 (MEDIUM)
CWE: CWE-200, CWE-312
References: https://www.dell.com/support/kbdoc/en-us/000205719/dsa-2022-325; https://www.dell.com/support/kbdoc/en-us/000205719/dsa-2022-325
CVE: CVE-2018-7935
Published: 2023-02-10
Description: 
There is a vulnerability in 21.328.01.00.00 version of the E5573Cs-322. Remote attackers could exploit this vulnerability to make the network where the E5573Cs-322 is running temporarily unavailable.


CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20
References: https://www.huawei.com/en/psirt/security-notices/huawei-sn-20230210-01-dos-en; https://www.huawei.com/en/psirt/security-notices/huawei-sn-20230210-01-dos-en
CVE: CVE-2023-0774
Published: 2023-02-10
Description: A vulnerability has been found in SourceCodester Medical Certificate Generator App 1.0 and classified as critical. This vulnerability affects unknown code of the file action.php. The manipulation of the argument lastname leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-220558 is the identifier assigned to this vulnerability.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://vuldb.com/?ctiid.220558; https://vuldb.com/?id.220558; https://www.youtube.com/watch?v=s3oK5jebx_I
CVE: CVE-2023-23698
Published: 2023-02-10
Description: 
Dell Command | Update, Dell Update, and Alienware Update versions before 4.6.0 and 4.7.1 contain Insecure Operation on Windows Junction in the installer component. A local malicious user may potentially exploit this vulnerability leading to arbitrary file delete.


CVSS Score: 5.5 (MEDIUM)
CWE: CWE-1386
References: https://www.dell.com/support/kbdoc/en-us/000208038/dsa-2023-031; https://www.dell.com/support/kbdoc/en-us/000208038/dsa-2023-031
CVE: CVE-2023-24569
Published: 2023-02-10
Description: 
Dell Alienware Command Center versions 5.5.37.0 and prior contain an Improper Input validation vulnerability. A local authenticated malicious user could potentially send malicious input to a named pipe in order to elevate privileges on the system.


CVSS Score: 7.8 (HIGH)
CWE: CWE-20, CWE-20
References: https://www.dell.com/support/kbdoc/en-us/000208327/dsa-2023-044; https://www.dell.com/support/kbdoc/en-us/000208327/dsa-2023-044
CVE: CVE-2023-24573
Published: 2023-02-10
Description: 
Dell Command | Monitor versions prior to 10.9 contain an arbitrary folder delete vulnerability during uninstallation. A locally authenticated malicious user may potentially exploit this vulnerability leading to arbitrary folder deletion.


CVSS Score: 4.7 (MEDIUM)
CWE: CWE-264
References: https://www.dell.com/support/kbdoc/en-us/000207973/dsa-2023-033; https://www.dell.com/support/kbdoc/en-us/000207973/dsa-2023-033
CVE: CVE-2015-10077
Published: 2023-02-10
Description: A vulnerability was found in webbuilders-group silverstripe-kapost-bridge 0.3.3. It has been declared as critical. Affected by this vulnerability is the function index/getPreview of the file code/control/KapostService.php. The manipulation leads to sql injection. The attack can be launched remotely. Upgrading to version 0.4.0 is able to address this issue. The patch is named 2e14b0fd0ea35034f90890f364b130fb4645ff35. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-220471.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/webbuilders-group/silverstripe-kapost-bridge/commit/2e14b0fd0ea35034f90890f364b130fb4645ff35; https://github.com/webbuilders-group/silverstripe-kapost-bridge/releases/tag/0.4.0; https://vuldb.com/?ctiid.220471
CVE: CVE-2022-4903
Published: 2023-02-10
Description: A vulnerability was found in CodenameOne 7.0.70. It has been classified as problematic. Affected is an unknown function. The manipulation leads to use of implicit intent for sensitive communication. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. Upgrading to version 7.0.71 is able to address this issue. The patch is identified as dad49c9ef26a598619fc48d2697151a02987d478. It is recommended to upgrade the affected component. VDB-220470 is the identifier assigned to this vulnerability.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-927, CWE-668
References: https://github.com/codenameone/CodenameOne/commit/dad49c9ef26a598619fc48d2697151a02987d478; https://github.com/codenameone/CodenameOne/issues/3583; https://github.com/codenameone/CodenameOne/releases/tag/7.0.71
CVE: CVE-2023-24343
Published: 2023-02-10
Description: D-Link N300 WI-FI Router DIR-605L v2.13B01 was discovered to contain a stack overflow via the curTime parameter at /goform/formSchedule.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-121, CWE-787
References: https://github.com/[PII_REDACTED]/Vuls/tree/main/D-Link/DIR-605L/curTime_Vuls/01; https://www.dlink.com/en/security-bulletin/; https://github.com/[PII_REDACTED]/Vuls/tree/main/D-Link/DIR-605L/curTime_Vuls/01
CVE: CVE-2023-24344
Published: 2023-02-10
Description: D-Link N300 WI-FI Router DIR-605L v2.13B01 was discovered to contain a stack overflow via the webpage parameter at /goform/formWlanGuestSetup.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-121, CWE-787
References: https://github.com/[PII_REDACTED]/Vuls/tree/main/D-Link/DIR-605L/webpage_Vuls/01; https://www.dlink.com/en/security-bulletin/; https://github.com/[PII_REDACTED]/Vuls/tree/main/D-Link/DIR-605L/webpage_Vuls/01
CVE: CVE-2023-24345
Published: 2023-02-10
Description: D-Link N300 WI-FI Router DIR-605L v2.13B01 was discovered to contain a stack overflow via the curTime parameter at /goform/formSetWanDhcpplus.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-121, CWE-787
References: https://github.com/[PII_REDACTED]/Vuls/tree/main/D-Link/DIR-605L/curTime_Vuls/03; https://www.dlink.com/en/security-bulletin/; https://github.com/[PII_REDACTED]/Vuls/tree/main/D-Link/DIR-605L/curTime_Vuls/03
CVE: CVE-2023-24346
Published: 2023-02-10
Description: D-Link N300 WI-FI Router DIR-605L v2.13B01 was discovered to contain a stack overflow via the wan_connected parameter at /goform/formEasySetupWizard3.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-121, CWE-787
References: https://github.com/[PII_REDACTED]/Vuls/tree/main/D-Link/DIR-605L/02; https://www.dlink.com/en/security-bulletin/; https://github.com/[PII_REDACTED]/Vuls/tree/main/D-Link/DIR-605L/02
CVE: CVE-2023-24347
Published: 2023-02-10
Description: D-Link N300 WI-FI Router DIR-605L v2.13B01 was discovered to contain a stack overflow via the webpage parameter at /goform/formSetWanDhcpplus.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-121, CWE-787
References: https://github.com/[PII_REDACTED]/Vuls/tree/main/D-Link/DIR-605L/webpage_Vuls/02; https://www.dlink.com/en/security-bulletin/; https://github.com/[PII_REDACTED]/Vuls/tree/main/D-Link/DIR-605L/webpage_Vuls/02
CVE: CVE-2023-24348
Published: 2023-02-10
Description: D-Link N300 WI-FI Router DIR-605L v2.13B01 was discovered to contain a stack overflow via the curTime parameter at /goform/formSetACLFilter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-121, CWE-787
References: https://github.com/[PII_REDACTED]/Vuls/tree/main/D-Link/DIR-605L/curTime_Vuls/02; https://www.dlink.com/en/security-bulletin/; https://github.com/[PII_REDACTED]/Vuls/tree/main/D-Link/DIR-605L/curTime_Vuls/02
CVE: CVE-2023-24349
Published: 2023-02-10
Description: D-Link N300 WI-FI Router DIR-605L v2.13B01 was discovered to contain a stack overflow via the curTime parameter at /goform/formSetRoute.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://github.com/[PII_REDACTED]/Vuls/tree/main/D-Link/DIR-605L/curTime_Vuls/04; https://www.dlink.com/en/security-bulletin/; https://github.com/[PII_REDACTED]/Vuls/tree/main/D-Link/DIR-605L/curTime_Vuls/04
CVE: CVE-2023-24350
Published: 2023-02-10
Description: D-Link N300 WI-FI Router DIR-605L v2.13B01 was discovered to contain a stack overflow via the config.smtp_email_subject parameter at /goform/formSetEmail.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://github.com/[PII_REDACTED]/Vuls/tree/main/D-Link/DIR-605L/03; https://www.dlink.com/en/security-bulletin/; https://github.com/[PII_REDACTED]/Vuls/tree/main/D-Link/DIR-605L/03
CVE: CVE-2023-24351
Published: 2023-02-10
Description: D-Link N300 WI-FI Router DIR-605L v2.13B01 was discovered to contain a stack overflow via the FILECODE parameter at /goform/formLogin.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://github.com/[PII_REDACTED]/Vuls/tree/main/D-Link/DIR-605L/01; https://www.dlink.com/en/security-bulletin/; https://github.com/[PII_REDACTED]/Vuls/tree/main/D-Link/DIR-605L/01
CVE: CVE-2023-24352
Published: 2023-02-10
Description: D-Link N300 WI-FI Router DIR-605L v2.13B01 was discovered to contain a stack overflow via the webpage parameter at /goform/formWPS.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://github.com/[PII_REDACTED]/Vuls/tree/main/D-Link/DIR-605L/webpage_Vuls/03; https://www.dlink.com/en/security-bulletin/; https://github.com/[PII_REDACTED]/Vuls/tree/main/D-Link/DIR-605L/webpage_Vuls/03
CVE: CVE-2023-24230
Published: 2023-02-10
Description: A stored cross-site scripting (XSS) vulnerability in the component /formwork/panel/dashboard of Formwork v1.12.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Page title parameter.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/getformwork/formwork/releases/tag/1.12.1; https://medium.com/%400x2bit/formwork-1-12-1-stored-xss-vulnerability-at-page-title-b6efba27891a; https://github.com/getformwork/formwork/releases/tag/1.12.1
CVE: CVE-2023-24231
Published: 2023-02-10
Description: A stored cross-site scripting (XSS) vulnerability in the component /php-inventory-management-system/categories.php of Inventory Management System v1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Categories Name parameter.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/stemword/php-inventory-management-system; https://medium.com/%400x2bit/inventory-management-system-multiple-stored-xss-vulnerability-b296365065b; https://github.com/stemword/php-inventory-management-system
CVE: CVE-2023-24232
Published: 2023-02-10
Description: A stored cross-site scripting (XSS) vulnerability in the component /php-inventory-management-system/product.php of Inventory Management System v1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Product Name parameter.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/stemword/php-inventory-management-system; https://medium.com/%400x2bit/inventory-management-system-multiple-stored-xss-vulnerability-b296365065b; https://github.com/stemword/php-inventory-management-system
CVE: CVE-2023-24233
Published: 2023-02-10
Description: A stored cross-site scripting (XSS) vulnerability in the component /php-inventory-management-system/orders.php?o=add of Inventory Management System v1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Client Name parameter.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/stemword/php-inventory-management-system; https://medium.com/%400x2bit/inventory-management-system-multiple-stored-xss-vulnerability-b296365065b; https://github.com/stemword/php-inventory-management-system
CVE: CVE-2023-24234
Published: 2023-02-10
Description: A stored cross-site scripting (XSS) vulnerability in the component php-inventory-management-system/brand.php of Inventory Management System v1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Brand Name parameter.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/stemword/php-inventory-management-system; https://medium.com/%400x2bit/inventory-management-system-multiple-stored-xss-vulnerability-b296365065b; https://github.com/stemword/php-inventory-management-system
CVE: CVE-2022-46649
Published: 2023-02-10
Description: Acemanager in ALEOS before version 4.16 allows a user with valid credentials to manipulate the IP logging operation to execute arbitrary shell commands on the device.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://source.sierrawireless.com/resources/security-bulletins/sierra-wireless-technical-bulletin---swi-psa-2023-001/; https://www.cisa.gov/uscert/ics/advisories/icsa-23-026-04; https://www.otorio.com/blog/airlink-acemanager-vulnerabilities/
CVE: CVE-2022-46650
Published: 2023-02-10
Description: Acemanager in ALEOS before version 4.16 allows a user with valid credentials to reconfigure the device to expose the ACEManager credentials on the pre-login status page.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-200, CWE-200
References: https://source.sierrawireless.com/resources/security-bulletins/sierra-wireless-technical-bulletin---swi-psa-2023-001/; https://www.cisa.gov/uscert/ics/advisories/icsa-23-026-04; https://www.otorio.com/blog/airlink-acemanager-vulnerabilities/
CVE: CVE-2022-45766
Published: 2023-02-10
Description: Hardcoded credentials in Global Facilities Management Software (GFMS) Version 3 software distributed by Key Systems Management permits remote attackers to impact availability, confidentiality, accessibility and dependability of electronic key boxes.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-798, CWE-787
References: https://www.girlslearncyber.com/post/the-key-to-keeping-keys-safe; https://www.girlslearncyber.com/post/the-key-to-keeping-keys-safe
CVE: CVE-2023-0777
Published: 2023-02-10
Description: Authentication Bypass by Primary Weakness in GitHub repository modoboa/modoboa prior to 2.0.4.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-305
References: http://packetstormsecurity.com/files/171744/modoboa-2.0.4-Admin-Takeover.html; https://github.com/modoboa/modoboa/commit/47d17ac6643f[PII_REDACTED]73956a26e4be0a4806; https://huntr.dev/bounties/a17e7a9f-0fee-4130-a522-5a0466fc17c7
CVE: CVE-2022-33934
Published: 2023-02-10
Description: 
Dell PowerScale OneFS, versions 8.2.x through 9.4.x contain multiple stored cross-site scripting vulnerabilities. A remote authenticated malicious user with high privileges may potentially exploit these vulnerabilities to store malicious HTML or JavaScript code through multiple affected fields.






CVSS Score: 7.7 (HIGH)
CWE: CWE-79, CWE-79
References: https://www.dell.com/support/kbdoc/en-us/000205618/dsa-2022-271; https://www.dell.com/support/kbdoc/en-us/000205618/dsa-2022-271
CVE: CVE-2022-34364
Published: 2023-02-10
Description: 


Dell BSAFE SSL-J, versions before 6.5 and version 7.0 contain a debug message revealing unnecessary information vulnerability. This may lead to disclosing sensitive information to a locally privileged user.

.








CVSS Score: 4.4 (MEDIUM)
CWE: CWE-1295, CWE-668
References: https://www.dell.com/support/kbdoc/en-us/000203275/dsa-2022-188-dell-bsafe-ssl-j-6-5-and-7-1-security-vulnerability; https://www.dell.com/support/kbdoc/en-us/000203275/dsa-2022-188-dell-bsafe-ssl-j-6-5-and-7-1-security-vulnerability
CVE: CVE-2022-34366
Published: 2023-02-10
Description: 
Dell SupportAssist for Home PCs (version 3.11.2 and prior) contain Overly Permissive Cross-domain Whitelist vulnerability. An authenticated non-admin user could potentially exploit the issue and obtain sensitive information.






CVSS Score: 6.5 (MEDIUM)
CWE: CWE-942, CWE-697
References: https://www.dell.com/support/kbdoc/000204114; https://www.dell.com/support/kbdoc/000204114
CVE: CVE-2022-34376
Published: 2023-02-10
Description: 


Dell PowerEdge BIOS and Dell Precision BIOS contain an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by manipulating an SMI to cause a denial of service during SMM.








CVSS Score: 3.9 (LOW)
CWE: CWE-119, CWE-119
References: https://www.dell.com/support/kbdoc/en-us/000206296/dsa-2022-204-dell-poweredge-improper-smm-communication-buffer-verification-vulnerability; https://www.dell.com/support/kbdoc/en-us/000206296/dsa-2022-204-dell-poweredge-improper-smm-communication-buffer-verification-vulnerability
CVE: CVE-2022-34377
Published: 2023-02-10
Description: 


Dell PowerEdge BIOS and Dell Precision BIOS contain an Improper SMM communication buffer verification vulnerability. A local malicious user with high Privileges may potentially exploit this vulnerability to perform arbitrary code execution or cause denial of service.








CVSS Score: 1.9 (LOW)
CWE: CWE-119, CWE-119
References: https://www.dell.com/support/kbdoc/en-us/000206296/dsa-2022-204-dell-poweredge-improper-smm-communication-buffer-verification-vulnerability; https://www.dell.com/support/kbdoc/en-us/000206296/dsa-2022-204-dell-poweredge-improper-smm-communication-buffer-verification-vulnerability
CVE: CVE-2022-44261
Published: 2023-02-10
Description: Avery Dennison Monarch Printer M9855 is vulnerable to Cross Site Scripting (XSS).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/IthacaLabs/AveryDennison/blob/main/AveryDennison_MonarchM9855_XSS/AveryDennison_MonarchM9855_XSS_CVE-2022-44261.txt; https://github.com/IthacaLabs/AveryDennison/tree/main/AveryDennison_MonarchM9855_XSS; https://github.com/IthacaLabs/AveryDennison/blob/main/AveryDennison_MonarchM9855_XSS/AveryDennison_MonarchM9855_XSS_CVE-2022-44261.txt
CVE: CVE-2023-23161
Published: 2023-02-10
Description: A reflected cross-site scripting (XSS) vulnerability in Art Gallery Management System Project v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the artname parameter under ART TYPE option in the navigation bar.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/171642/Art-Gallery-Management-System-Project-1.0-Cross-Site-Scripting.html; https://github.com/rahulpatwari/CVE/blob/main/CVE-2023-23161/CVE-2023-23161.txt; https://phpgurukul.com/art-gallery-management-system-using-php-and-mysql/
CVE: CVE-2023-23162
Published: 2023-02-10
Description: Art Gallery Management System Project v1.0 was discovered to contain a SQL injection vulnerability via the cid parameter at product.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://packetstormsecurity.com/files/171643/Art-Gallery-Management-System-Project-1.0-SQL-Injection.html; https://github.com/rahulpatwari/CVE/blob/main/CVE-2023-23162/CVE-2023-23162.txt; https://phpgurukul.com/art-gallery-management-system-using-php-and-mysql/