deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-26035
Published: 2023-02-25
Description: ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33 and 1.37.33 are vulnerable to Unauthenticated Remote Code Execution via Missing Authorization. There are no permissions check on the snapshot action, which expects an id to fetch an existing monitor but can be passed an object to create a new one instead. TriggerOn ends up calling shell_exec using the supplied Id. This issue is fixed in This issue is fixed in versions 1.36.33 and 1.37.33.
CVSS Score: 7.2 (HIGH)
CWE: CWE-862, CWE-862
References: http://packetstormsecurity.com/files/175675/ZoneMinder-Snapshots-Command-Injection.html; https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-72rg-h4vf-29gr; http://packetstormsecurity.com/files/175675/ZoneMinder-Snapshots-Command-Injection.html
CVE: CVE-2023-26036
Published: 2023-02-25
Description: ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33 and 1.37.33 contain a Local File Inclusion (Untrusted Search Path) vulnerability via /web/index.php. By controlling $view, any local file ending in .php can be executed. This is supposed to be mitigated by calling detaintPath, however dentaintPath does not properly sandbox the path. This can be exploited by constructing paths like "..././", which get replaced by "../". This issue is patched in versions 1.36.33 and 1.37.33.
CVSS Score: 8.1 (HIGH)
CWE: CWE-426, CWE-426
References: https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-h5m9-6jjc-cgmw; https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-h5m9-6jjc-cgmw
CVE: CVE-2023-26037
Published: 2023-02-25
Description: ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33 and 1.37.33 contain an SQL Injection. The minTime and maxTime request parameters are not properly validated and could be used execute arbitrary SQL. This issue is fixed in versions 1.36.33 and 1.37.33.
CVSS Score: 8.9 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-65jp-2hj3-3733; https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-65jp-2hj3-3733
CVE: CVE-2023-26038
Published: 2023-02-25
Description: ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33 and 1.37.33 contain a Local File Inclusion (Untrusted Search Path) vulnerability via web/ajax/modal.php, where an arbitrary php file path can be passed in the request and loaded. This issue is patched in versions 1.36.33 and 1.37.33.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-426, CWE-426
References: https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-wrx3-r8c4-r24w; https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-wrx3-r8c4-r24w
CVE: CVE-2023-26039
Published: 2023-02-25
Description: ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33 and 1.37.33 contain an OS Command Injection via daemonControl() in (/web/api/app/Controller/HostController.php). Any authenticated user can construct an api command to execute any shell command as the web user. This issue is patched in versions 1.36.33 and 1.37.33.
CVSS Score: 7.1 (HIGH)
CWE: CWE-78, CWE-78
References: https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-44q8-h2pw-cc9g; https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-44q8-h2pw-cc9g
CVE: CVE-2023-26544
Published: 2023-02-25
Description: In the Linux kernel 6.0.8, there is a use-after-free in run_unpack in fs/ntfs3/run.c, related to a difference between NTFS sector size and media sector size.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://bugzilla.suse.com/show_bug.cgi?id=1208697; https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=887bfc546097fbe8071dac13b2fef73b77920899; https://lkml.org/lkml/2023/2/20/128
CVE: CVE-2023-26545
Published: 2023-02-25
Description: In the Linux kernel before 6.1.13, there is a double free in net/mpls/af_mpls.c upon an allocation failure (for registering the sysctl table under a new location) during the renaming of a device.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-415, CWE-415
References: https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.13; https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=fda6c89fe3d9aca073495a664e1d5aea28cd4377; https://github.com/torvalds/linux/commit/fda6c89fe3d9aca073495a664e1d5aea28cd4377
CVE: CVE-2023-26103
Published: 2023-02-25
Description: Versions of the package deno before 1.31.0 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the upgradeWebSocket function, which contains regexes in the form of /s*,s*/, used for splitting the Connection/Upgrade header. A specially crafted Connection/Upgrade header can be used to significantly slow down a web socket server.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-1333, CWE-1333, CWE-1333
References: https://github.com/denoland/deno/blob/2b247be517d789a37e532849e2e40b724af0918f/ext/http/01_http.js%23L395-L409; https://github.com/denoland/deno/commit/cf06a7c7e672880e1b38598fe445e2c50b4a9d06; https://github.com/denoland/deno/pull/17722
CVE: CVE-2023-26104
Published: 2023-02-25
Description: All versions of the package lite-web-server are vulnerable to Denial of Service (DoS) when an attacker sends an HTTP request and includes control characters that the decodeURI() function is unable to parse.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-400, CWE-400
References: https://gist.github.com/lirantal/637520812da06fffb91dd86d02ff6bde; https://github.com/chasyumen/lite-web-server/blob/main/src/WebServer.js%23L274; https://security.snyk.io/vuln/SNYK-JS-LITEWEBSERVER-3153703
CVE: CVE-2022-2024
Published: 2023-02-25
Description: OS Command Injection in GitHub repository gogs/gogs prior to 0.12.11.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/gogs/gogs/commit/15d0d6a94be0098a8227b6b95bdf2daed105ec41; https://huntr.dev/bounties/18cf9256-23ab-4098-a769-85f8da130f97; https://github.com/gogs/gogs/commit/15d0d6a94be0098a8227b6b95bdf2daed105ec41
CVE: CVE-2023-1035
Published: 2023-02-25
Description: A vulnerability was found in SourceCodester Clinics Patient Management System 1.0. It has been classified as critical. Affected is an unknown function of the file update_user.php. The manipulation of the argument user_id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-221784.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/clinics%20patient%20management%20system/clinics-patient-management-system%20vlun2.pdf; https://vuldb.com/?ctiid.221784; https://vuldb.com/?id.221784
CVE: CVE-2023-26550
Published: 2023-02-25
Description: A SQL injection vulnerability in BMC Control-M before 9.0.20.214 allows attackers to execute arbitrary SQL commands via the memname JSON field.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://www.synacktiv.com/sites/default/files/2023-02/Synacktiv-ControlM-Multiple-Vulnerabilities.pdf; https://www.synacktiv.com/sites/default/files/2023-02/Synacktiv-ControlM-Multiple-Vulnerabilities.pdf
CVE: CVE-2022-48362
Published: 2023-02-25
Description: Zoho ManageEngine Desktop Central and Desktop Central MSP before 10.1.2137.2 allow directory traversal via computerName to AgentLogUploadServlet. A remote, authenticated attacker could upload arbitrary code that would be executed when Desktop Central is restarted. (The attacker could authenticate by exploiting CVE-2021-44515.)
CVSS Score: 8.8 (HIGH)
CWE: CWE-22, CWE-22
References: https://srcincite.io/blog/2022/01/20/zohowned-a-critical-authentication-bypass-on-zoho-manageengine-desktop-central.html; https://www.manageengine.com/products/desktop-central/cve-2022-48362.html; https://srcincite.io/blog/2022/01/20/zohowned-a-critical-authentication-bypass-on-zoho-manageengine-desktop-central.html
CVE: CVE-2023-26091
Published: 2023-02-26
Description: The frp_form_answers (aka Forms Export) extension before 3.1.2, and 4.x before 4.0.2, for TYPO3 allows XSS via saved emails.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://typo3.org/help/security-advisories; https://typo3.org/security/advisory/typo3-ext-sa-2023-002; https://typo3.org/help/security-advisories
CVE: CVE-2021-3329
Published: 2023-02-26
Description: Lack of proper validation in HCI Host stack initialization can cause a crash of the bluetooth stack
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-703, CWE-665
References: https://zephyrprojectsec.atlassian.net/browse/ZEPSEC-117; https://zephyrprojectsec.atlassian.net/browse/ZEPSEC-117
CVE: CVE-2019-25105
Published: 2023-02-26
Description: A vulnerability, which was classified as problematic, was found in dro.pm. This affects an unknown part of the file web/fileman.php. The manipulation of the argument secret/key leads to cross site scripting. It is possible to initiate the attack remotely. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The patch is named fa73c3a42bc5c246a1b8f815699ea241aef154bb. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-221763.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-79
References: https://github.com/lgommans/dro.pm/commit/fa73c3a42bc5c246a1b8f815699ea241aef154bb; https://vuldb.com/?ctiid.221763; https://vuldb.com/?id.221763
CVE: CVE-2023-1036
Published: 2023-02-26
Description: A vulnerability was found in SourceCodester Dental Clinic Appointment Reservation System 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file /APR/signup.php of the component POST Parameter Handler. The manipulation of the argument firstname leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-221794 is the identifier assigned to this vulnerability.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://github.com/nightcloudos/bug_report/blob/main/vendors/jkev/Dental%20Clinic%20Appointment%20Reservation%20System/XSS-1.md; https://vuldb.com/?ctiid.221794; https://vuldb.com/?id.221794
CVE: CVE-2023-1037
Published: 2023-02-26
Description: A vulnerability was found in SourceCodester Dental Clinic Appointment Reservation System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /APR/login.php of the component POST Parameter Handler. The manipulation of the argument username leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-221795.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://github.com/nightcloudos/bug_report/blob/main/vendors/jkev/Dental%20Clinic%20Appointment%20Reservation%20System/SQLi-1.md; https://vuldb.com/?ctiid.221795; https://vuldb.com/?id.221795
CVE: CVE-2023-1038
Published: 2023-02-26
Description: A vulnerability classified as critical has been found in SourceCodester Online Reviewer Management System 1.0. Affected is an unknown function of the file /reviewer_0/admins/assessments/pretest/questions-view.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-221796.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/believeti/bug_report/blob/main/vendors/janobe/Online%20Reviewer%20Management%20System/SQLi-1.md; https://vuldb.com/?ctiid.221796; https://vuldb.com/?id.221796
CVE: CVE-2023-1039
Published: 2023-02-26
Description: A vulnerability classified as critical was found in SourceCodester Class and Exam Timetabling System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/index3.php of the component POST Parameter Handler. The manipulation of the argument password leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-221797 was assigned to this vulnerability.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://github.com/anquanclub/bug_report/blob/main/vendors/Cherylda%20Jardeliza%20Ohiman/Class%20and%20Exam%20Timetabling%20System/SQLi-1.md; https://vuldb.com/?ctiid.221797; https://vuldb.com/?id.221797
CVE: CVE-2023-1040
Published: 2023-02-26
Description: A vulnerability, which was classified as critical, has been found in SourceCodester Online Graduate Tracer System 1.0. Affected by this issue is some unknown functionality of the file tracking/admin/add_acc.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-221798 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://blog.csdn.net/weixin_43864034/article/details/129228718; https://vuldb.com/?ctiid.221798; https://vuldb.com/?id.221798
CVE: CVE-2023-1041
Published: 2023-02-26
Description: A vulnerability, which was classified as problematic, was found in SourceCodester Simple Responsive Tourism Website 1.0. This affects an unknown part of the file /tourism/rate_review.php. The manipulation of the argument id with the input 1"><script>alert(1111)</script> leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-221799.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/verylazycat/bug_report/blob/main/vendors/oretnom23/Simple%20Responsive%20Tourism%20Website/XSS-1.md; https://vuldb.com/?ctiid.221799; https://vuldb.com/?id.221799
CVE: CVE-2023-1042
Published: 2023-02-26
Description: A vulnerability has been found in SourceCodester Online Pet Shop We App 1.0 and classified as problematic. This vulnerability affects unknown code of the file /pet_shop/admin/orders/update_status.php. The manipulation of the argument oid with the input 1"><script>alert(1111)</script> leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-221800.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/hujianjie123/bug_report/blob/main/vendors/oretnom23/Online%20Pet%20Shop%20We%20App/XSS-1.md; https://vuldb.com/?ctiid.221800; https://vuldb.com/?id.221800
CVE: CVE-2023-1043
Published: 2023-02-26
Description: A vulnerability was found in MuYuCMS 2.2. It has been classified as problematic. Affected is an unknown function of the file /editor/index.php. The manipulation of the argument dir_path leads to relative path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-221802 is the identifier assigned to this vulnerability.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-23, CWE-22
References: https://github.com/MuYuCMS/MuYuCMS/issues/4; https://vuldb.com/?ctiid.221802; https://vuldb.com/?id.221802
CVE: CVE-2023-1044
Published: 2023-02-26
Description: A vulnerability was found in MuYuCMS 2.2. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /editor/index.php. The manipulation of the argument file_path leads to relative path traversal. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-221803.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-23, CWE-22
References: https://github.com/MuYuCMS/MuYuCMS/issues/5; https://vuldb.com/?ctiid.221803; https://vuldb.com/?id.221803
CVE: CVE-2023-1045
Published: 2023-02-26
Description: A vulnerability was found in MuYuCMS 2.2. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /admin.php/accessory/filesdel.html. The manipulation of the argument filedelur leads to relative path traversal. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-221804.
CVSS Score: 3.8 (LOW)
CWE: CWE-23, CWE-22
References: https://github.com/MuYuCMS/MuYuCMS/issues/6; https://vuldb.com/?ctiid.221804; https://vuldb.com/?id.221804
CVE: CVE-2023-1046
Published: 2023-02-26
Description: A vulnerability classified as critical has been found in MuYuCMS 2.2. This affects an unknown part of the file /admin.php/update/getFile.html. The manipulation of the argument url leads to server-side request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-221805 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-918
References: https://github.com/MuYuCMS/MuYuCMS/issues/7; https://vuldb.com/?ctiid.221805; https://vuldb.com/?id.221805
CVE: CVE-2023-1047
Published: 2023-02-26
Description: A vulnerability classified as critical was found in TechPowerUp RealTemp 3.7.0.0. This vulnerability affects unknown code in the library WinRing0x64.sys. The manipulation leads to improper initialization. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. VDB-221806 is the identifier assigned to this vulnerability.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-665
References: https://github.com/zeze-zeze/WindowsKernelVuln/tree/master/CVE-2023-1047; https://vuldb.com/?ctiid.221806; https://vuldb.com/?id.221806
CVE: CVE-2023-1048
Published: 2023-02-26
Description: A vulnerability, which was classified as critical, has been found in TechPowerUp Ryzen DRAM Calculator 1.2.0.5. This issue affects some unknown processing in the library WinRing0x64.sys. The manipulation leads to improper initialization. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-221807.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-665
References: https://github.com/zeze-zeze/WindowsKernelVuln/tree/master/CVE-2023-1048; https://vuldb.com/?ctiid.221807; https://vuldb.com/?id.221807
CVE: CVE-2023-26602
Published: 2023-02-26
Description: ASUS ASMB8 iKVM firmware through 1.14.51 allows remote attackers to execute arbitrary code by using SNMP to create extensions, as demonstrated by snmpset for NET-SNMP-EXTEND-MIB with /bin/sh for command execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: http://packetstormsecurity.com/files/171137/ASUS-ASMB8-iKVM-1.14.51-SNMP-Remote-Root.html; http://seclists.org/fulldisclosure/2023/Feb/15; https://nwsec.de/NWSSA-002-2023.txt
CVE: CVE-2022-48363
Published: 2023-02-26
Description: In MPD before 0.23.8, as used on Automotive Grade Linux and other platforms, the PipeWire output plugin mishandles a Drain call in certain situations involving truncated files. Eventually there is an assertion failure in libmpdclient because libqtappfw passes in a NULL pointer.
CVSS Score: 7.5 (HIGH)
CWE: CWE-617, CWE-617
References: https://gerrit.automotivelinux.org/gerrit/c/src/libqtappfw/+/28484; https://gerrit.automotivelinux.org/gerrit/c/src/libqtappfw/+/28485; https://gerrit.automotivelinux.org/gerrit/q/project:src%252Flibqtappfw+status:open
CVE: CVE-2023-26605
Published: 2023-02-26
Description: In the Linux kernel 6.0.8, there is a use-after-free in inode_cgwb_move_to_attached in fs/fs-writeback.c, related to __list_del_entry_valid.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=4e3c51f4e805291b057d12f5dda5aeb50a538dc4; https://lkml.org/lkml/2023/2/22/3; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2023-26606
Published: 2023-02-26
Description: In the Linux kernel 6.0.8, there is a use-after-free in ntfs_trim_fs in fs/ntfs3/bitmap.c.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=557d19675a470bb0a98beccec38c5dc3735c20fa; https://lkml.org/lkml/2023/2/20/860; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2023-26607
Published: 2023-02-26
Description: In the Linux kernel 6.0.8, there is an out-of-bounds read in ntfs_attr_find in fs/ntfs/attrib.c.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125, CWE-125
References: https://bugzilla.suse.com/show_bug.cgi?id=1208703; https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=36a4d82dddbbd421d2b8e79e1cab68c8126d5075; https://lkml.org/lkml/2023/2/21/1353
CVE: CVE-2023-26609
Published: 2023-02-27
Description: ABUS TVIP 20000-21150 devices allows remote attackers to execute arbitrary code via shell metacharacters in the /cgi-bin/mft/wireless_mft ap field.
CVSS Score: 7.2 (HIGH)
References: http://packetstormsecurity.com/files/171136/ABUS-Security-Camera-TVIP-20000-21150-LFI-Remote-Code-Execution.html; http://seclists.org/fulldisclosure/2023/Feb/16; https://nwsec.de/NWSSA-001-2023.txt
CVE: CVE-2023-26257
Published: 2023-02-27
Description: An issue was discovered in the Connected Vehicle Systems Alliance (COVESA; formerly GENIVI) dlt-daemon through 2.18.8. Dynamic memory is not released after it is allocated in dlt-control-common.c.
CVSS Score: 7.5 (HIGH)
CWE: CWE-401, CWE-401
References: https://github.com/COVESA/dlt-daemon/issues/440; https://github.com/COVESA/dlt-daemon/pull/441/commits/b6149e203f919c899fefc702a17fbb78bdec3700; https://lists.debian.org/debian-lts-announce/2024/06/msg00021.html
CVE: CVE-2022-31405
Published: 2023-02-27
Description: MV iDigital Clinic Enterprise (iDCE) 1.0 stores passwords in cleartext.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-312
References: https://github.com/ifmacedo/mconnect/blob/main/IDCE-ClearTextStorage; https://mv.com.br/pt/blog/microdata-integra-novo-modulo-cockpit-ao-ris-idce; https://www.linkedin.com/pulse/armazenamento-inseguro-idce-mv-iran-macedo
CVE: CVE-2023-22636
Published: 2023-02-27
Description: An unauthorized configuration download vulnerability in FortiWeb 6.3.6 through 6.3.21, 6.4.0 through 6.4.2 and 7.0.0 through 7.0.4 may allow a local attacker to access confidential configuration files via a crafted http request.
CVSS Score: 7.0 (HIGH)
CWE: CWE-285
References: https://fortiguard.com/psirt/FG-IR-22-460; https://fortiguard.com/psirt/FG-IR-22-460
CVE: CVE-2023-1053
Published: 2023-02-27
Description: A vulnerability was found in SourceCodester Music Gallery Site 1.0 and classified as critical. This issue affects some unknown processing of the file view_category.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The associated identifier of this vulnerability is VDB-221819.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-89
References: https://vuldb.com/?ctiid.221819; https://vuldb.com/?id.221819; https://vuldb.com/?ctiid.221819
CVE: CVE-2023-1054
Published: 2023-02-27
Description: A vulnerability was found in SourceCodester Music Gallery Site 1.0. It has been classified as critical. Affected is an unknown function of the file /admin/?page=user/manage. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The identifier of this vulnerability is VDB-221820.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-89
References: https://vuldb.com/?ctiid.221820; https://vuldb.com/?id.221820; https://vuldb.com/?ctiid.221820