deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-28008
Published: 2022-04-21
Description: Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \admin\attendance_delete.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/bug_c/README.md; https://github.com/k0xx11/bug_report/blob/main/bug_c/README.md
CVE: CVE-2022-28009
Published: 2022-04-21
Description: Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \admin\attendance_delete.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/bug_d/README.mde; https://github.com/k0xx11/bug_report/blob/main/bug_d/README.mde
CVE: CVE-2022-28010
Published: 2022-04-21
Description: Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \admin\overtime_delete.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/bug_e/README.md; https://github.com/k0xx11/bug_report/blob/main/bug_e/README.md
CVE: CVE-2022-28011
Published: 2022-04-21
Description: Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \admin\schedule_delete.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/bug_f/README.md; https://github.com/k0xx11/bug_report/blob/main/bug_f/README.md
CVE: CVE-2022-28012
Published: 2022-04-21
Description: Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \admin\position_delete.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/bug_g/README.md; https://github.com/k0xx11/bug_report/blob/main/bug_g/README.md
CVE: CVE-2022-28013
Published: 2022-04-21
Description: Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \admin\schedule_employee_edit.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/bug_h/README.md; https://github.com/k0xx11/bug_report/blob/main/bug_h/README.md
CVE: CVE-2022-28014
Published: 2022-04-21
Description: Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \admin\attendance_edit.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/bug_i/README.md; https://github.com/k0xx11/bug_report/blob/main/bug_i/README.md
CVE: CVE-2022-28015
Published: 2022-04-21
Description: Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \admin\cashadvance_edit.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/bug_j/README.md; https://github.com/k0xx11/bug_report/blob/main/bug_j/README.md
CVE: CVE-2022-28016
Published: 2022-04-21
Description: Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \admin\deduction_edit.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/bug_k/README.md; https://github.com/k0xx11/bug_report/blob/main/bug_k/README.md
CVE: CVE-2022-28017
Published: 2022-04-21
Description: Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \admin\overtime_edit.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/bug_l/README.md; https://github.com/k0xx11/bug_report/blob/main/bug_l/README.md
CVE: CVE-2022-28018
Published: 2022-04-21
Description: Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \admin\schedule_edit.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/bug_m/README.md; https://github.com/k0xx11/bug_report/blob/main/bug_m/README.md
CVE: CVE-2022-28019
Published: 2022-04-21
Description: Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \admin\employee_edit.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/bug_n/README.md; https://github.com/k0xx11/bug_report/blob/main/bug_n/README.md
CVE: CVE-2022-28020
Published: 2022-04-21
Description: Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \admin\position_edit.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/bug_o/README.md; https://github.com/k0xx11/bug_report/blob/main/bug_o/README.md
CVE: CVE-2022-28021
Published: 2022-04-21
Description: Purchase Order Management System v1.0 was discovered to contain a remote code execution (RCE) vulnerability via /purchase_order/admin/?page=user.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/purchase-order-management-system/RCE-1.md; https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/purchase-order-management-system/RCE-1.md
CVE: CVE-2022-28022
Published: 2022-04-21
Description: Purchase Order Management System v1.0 was discovered to contain a SQL injection vulnerability via /purchase_order/classes/Master.php?f=delete_item.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/purchase-order-management-system/SQLi-1.md; https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/purchase-order-management-system/SQLi-1.md
CVE: CVE-2022-28023
Published: 2022-04-21
Description: Purchase Order Management System v1.0 was discovered to contain a SQL injection vulnerability via /purchase_order/classes/Master.php?f=delete_supplier.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/purchase-order-management-system/SQLi-2.md; https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/purchase-order-management-system/SQLi-2.md
CVE: CVE-2022-28024
Published: 2022-04-21
Description: Student Grading System v1.0 was discovered to contain a SQL injection vulnerability via /student-grading-system/rms.php?page=grade.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/Student-Grading-System/SQLi-1.md; https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/Student-Grading-System/SQLi-1.md
CVE: CVE-2022-28025
Published: 2022-04-21
Description: Student Grading System v1.0 was discovered to contain a SQL injection vulnerability via /student-grading-system/rms.php?page=school_year.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/Student-Grading-System/SQLi-2.md; https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/Student-Grading-System/SQLi-2.md
CVE: CVE-2022-28026
Published: 2022-04-21
Description: Student Grading System v1.0 was discovered to contain a SQL injection vulnerability via /student-grading-system/rms.php?page=student_p&id=.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/Student-Grading-System/SQLi-3.md; https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/Student-Grading-System/SQLi-3.md
CVE: CVE-2022-28028
Published: 2022-04-21
Description: Simple Real Estate Portal System v1.0 was discovered to contain a SQL injection vulnerability via /reps/classes/Master.php?f=delete_amenity.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/Simple-Real-Estate-Portal-System/SQLi-1.md; https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/Simple-Real-Estate-Portal-System/SQLi-1.md
CVE: CVE-2022-28029
Published: 2022-04-21
Description: Simple Real Estate Portal System v1.0 was discovered to contain a SQL injection vulnerability via /reps/classes/Master.php?f=delete_type.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/Simple-Real-Estate-Portal-System/SQLi-2.md; https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/Simple-Real-Estate-Portal-System/SQLi-2.md
CVE: CVE-2022-28030
Published: 2022-04-21
Description: Simple Real Estate Portal System v1.0 was discovered to contain a SQL injection vulnerability via /reps/classes/Master.php?f=delete_estate.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/Simple-Real-Estate-Portal-System/SQLi-3.md; https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/Simple-Real-Estate-Portal-System/SQLi-3.md
CVE: CVE-2022-28410
Published: 2022-04-21
Description: Simple Real Estate Portal System v1.0 was discovered to contain a SQL injection vulnerability via /reps/classes/Users.php?f=delete_agent.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/Simple-Real-Estate-Portal-System/SQLi-4.md; https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/Simple-Real-Estate-Portal-System/SQLi-4.md
CVE: CVE-2022-28411
Published: 2022-04-21
Description: Simple Real Estate Portal System v1.0 was discovered to contain a SQL injection vulnerability via /reps/admin/?page=agents/manage_agent.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/Simple-Real-Estate-Portal-System/SQLi-5.md; https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/Simple-Real-Estate-Portal-System/SQLi-5.md
CVE: CVE-2022-28412
Published: 2022-04-21
Description: Car Driving School Managment System v1.0 was discovered to contain a SQL injection vulnerability via /cdsms/classes/Master.php?f=delete_package.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/car-driving-school-management-system/SQLi-1.md; https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/car-driving-school-management-system/SQLi-1.md
CVE: CVE-2022-28413
Published: 2022-04-21
Description: Car Driving School Management System v1.0 was discovered to contain a SQL injection vulnerability via /cdsms/classes/Master.php?f=delete_enrollment.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/car-driving-school-management-system/SQLi-2.md; https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/car-driving-school-management-system/SQLi-2.md
CVE: CVE-2022-28414
Published: 2022-04-21
Description: Home Owners Collection Management System v1.0 was discovered to contain a SQL injection vulnerability via /hocms/classes/Master.php?f=delete_member.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/Home-Owners-Collection-Management/SQLi-1.md; https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/Home-Owners-Collection-Management/SQLi-1.md
CVE: CVE-2022-28415
Published: 2022-04-21
Description: Home Owners Collection Management System v1.0 was discovered to contain a SQL injection vulnerability via /hocms/classes/Master.php?f=delete_collection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/Home-Owners-Collection-Management/SQLi-2.md; https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/Home-Owners-Collection-Management/SQLi-2.md
CVE: CVE-2022-28416
Published: 2022-04-21
Description: Home Owners Collection Management System v1.0 was discovered to contain a SQL injection vulnerability via /hocms/classes/Master.php?f=delete_phase.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/Home-Owners-Collection-Management/SQLi-3.md; https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/Home-Owners-Collection-Management/SQLi-3.md
CVE: CVE-2022-28417
Published: 2022-04-21
Description: Home Owners Collection Management System v1.0 was discovered to contain a SQL injection vulnerability via /hocms/classes/Master.php?f=delete_phase.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/Home-Owners-Collection-Management/SQLi-4.md; https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/Home-Owners-Collection-Management/SQLi-4.md
CVE: CVE-2022-28420
Published: 2022-04-21
Description: Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via BabyCare/admin.php?id=theme&setid=.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/janobe/baby-care-system/SQLi-1.md; https://github.com/k0xx11/bug_report/blob/main/vendors/janobe/baby-care-system/SQLi-1.md
CVE: CVE-2022-28421
Published: 2022-04-21
Description: Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin.php?id=posts&action=display&value=1&postid=.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/janobe/baby-care-system/SQLi-2.md; https://github.com/k0xx11/bug_report/blob/main/vendors/janobe/baby-care-system/SQLi-2.md
CVE: CVE-2022-28422
Published: 2022-04-21
Description: Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin/posts.php&action=edit.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/janobe/baby-care-system/SQLi-3.md; https://github.com/k0xx11/bug_report/blob/main/vendors/janobe/baby-care-system/SQLi-3.md
CVE: CVE-2022-28423
Published: 2022-04-21
Description: Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin/posts.php&action=delete.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/janobe/baby-care-system/SQLi-4.md; https://github.com/k0xx11/bug_report/blob/main/vendors/janobe/baby-care-system/SQLi-4.md
CVE: CVE-2022-28424
Published: 2022-04-21
Description: Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin/posts.php&find=.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/janobe/baby-care-system/SQLi-5.md; https://github.com/k0xx11/bug_report/blob/main/vendors/janobe/baby-care-system/SQLi-5.md
CVE: CVE-2022-28425
Published: 2022-04-21
Description: Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin/pagerole.php&action=display&value=1&roleid=.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/janobe/baby-care-system/SQLi-6.md; https://github.com/k0xx11/bug_report/blob/main/vendors/janobe/baby-care-system/SQLi-6.md
CVE: CVE-2022-28426
Published: 2022-04-21
Description: Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin/pagerole.php&action=edit&roleid=.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/janobe/baby-care-system/SQLi-7.md; https://github.com/k0xx11/bug_report/blob/main/vendors/janobe/baby-care-system/SQLi-7.md
CVE: CVE-2022-28427
Published: 2022-04-21
Description: Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin/inbox.php&action=read&msgid=.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/janobe/baby-care-system/SQLi-9.md; https://github.com/k0xx11/bug_report/blob/main/vendors/janobe/baby-care-system/SQLi-9.md
CVE: CVE-2022-28429
Published: 2022-04-21
Description: Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin/inbox.php&action=delete&msgid=.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/janobe/baby-care-system/SQLi-10.md; https://github.com/k0xx11/bug_report/blob/main/vendors/janobe/baby-care-system/SQLi-10.md
CVE: CVE-2022-28431
Published: 2022-04-21
Description: Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin/siteoptions.php&social=remove&sid=2.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/janobe/baby-care-system/SQLi-12.md; https://github.com/k0xx11/bug_report/blob/main/vendors/janobe/baby-care-system/SQLi-12.md
CVE: CVE-2022-28432
Published: 2022-04-21
Description: Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin.php?id=siteoptions&social=display&value=0&sid=2.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/janobe/baby-care-system/SQLi-13.md; https://github.com/k0xx11/bug_report/blob/main/vendors/janobe/baby-care-system/SQLi-13.md
CVE: CVE-2022-28433
Published: 2022-04-21
Description: Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin/uesrs.php&action=display&value=Show&userid=.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/janobe/baby-care-system/SQLi-16.md; https://github.com/k0xx11/bug_report/blob/main/vendors/janobe/baby-care-system/SQLi-16.md
CVE: CVE-2022-28434
Published: 2022-04-21
Description: Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin.php?id=siteoptions&social=edit&sid=2.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/k0xx11; https://github.com/k0xx11
CVE: CVE-2022-28435
Published: 2022-04-21
Description: Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin/siteoptions.php&action=displaygoal&value=1&roleid=1.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/janobe/baby-care-system/SQLi-15.md; https://github.com/k0xx11/bug_report/blob/main/vendors/janobe/baby-care-system/SQLi-15.md
CVE: CVE-2022-28436
Published: 2022-04-21
Description: Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin/uesrs.php&action=display&value=Hide&userid=.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/janobe/baby-care-system/SQLi-17.md; https://github.com/k0xx11/bug_report/blob/main/vendors/janobe/baby-care-system/SQLi-17.md
CVE: CVE-2022-28437
Published: 2022-04-21
Description: Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin/uesrs.php&action=type&userrole=Admin&userid=3.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/janobe/baby-care-system/SQLi-18.md; https://github.com/k0xx11/bug_report/blob/main/vendors/janobe/baby-care-system/SQLi-18.md
CVE: CVE-2022-28438
Published: 2022-04-21
Description: Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin/uesrs.php&action=type&userrole=User&userid=.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/janobe/baby-care-system/SQLi-20.md; https://github.com/k0xx11/bug_report/blob/main/vendors/janobe/baby-care-system/SQLi-20.md
CVE: CVE-2022-28439
Published: 2022-04-21
Description: Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin/uesrs.php&&action=delete&userid=4.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/janobe/baby-care-system/SQLi-19.md; https://github.com/k0xx11/bug_report/blob/main/vendors/janobe/baby-care-system/SQLi-19.md
CVE: CVE-2022-28440
Published: 2022-04-21
Description: An arbitrary file upload vulnerability in UCMS v1.6 allows attackers to execute arbitrary code via a crafted PHP file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://github.com/k0xx11/bug_report/blob/main/UCMS-1.6/UCMS-RCE1.md; https://github.com/k0xx11/bug_report/blob/main/UCMS-1.6/UCMS-RCE1.md
CVE: CVE-2022-28443
Published: 2022-04-21
Description: UCMS v1.6 was discovered to contain an arbitrary file deletion vulnerability.
CVSS Score: 9.1 (CRITICAL)
References: https://github.com/k0xx11; https://github.com/k0xx11
CVE: CVE-2022-28444
Published: 2022-04-21
Description: UCMS v1.6 was discovered to contain an arbitrary file read vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://github.com/k0xx11/bug_report/blob/main/UCMS-1.6/Arbitrary-file-reading-1.md; https://github.com/k0xx11/bug_report/blob/main/UCMS-1.6/Arbitrary-file-reading-1.md
CVE: CVE-2022-28445
Published: 2022-04-21
Description: KiteCMS v1.1.1 was discovered to contain an arbitrary file read vulnerability via the background management module.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-552
References: https://github.com/k0xx11/bug_report/blob/main/kitecms/Arbitrary-file-reading-1.md; https://github.com/k0xx11/bug_report/blob/main/kitecms/Arbitrary-file-reading-1.md
CVE: CVE-2022-22558
Published: 2022-04-21
Description: Dell PowerEdge Server BIOS and Dell Precision Workstation 7910 and 7920 Rack BIOS contain an Improper SMM communication buffer verification vulnerability. A Local High Privileged attacker could potentially exploit this vulnerability leading to arbitrary writes or denial of service.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-119, CWE-119
References: https://www.dell.com/support/kbdoc/000197971; https://www.dell.com/support/kbdoc/000197971
CVE: CVE-2022-24423
Published: 2022-04-21
Description: Dell iDRAC8 versions prior to 2.83.83.83 contain a denial of service vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability to cause resource exhaustion in the webserver, resulting in a denial of service condition.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20, CWE-20
References: https://www.dell.com/support/kbdoc/en-us/000198064/dsa-2022-069; https://www.dell.com/support/kbdoc/en-us/000198064/dsa-2022-069
CVE: CVE-2022-24424
Published: 2022-04-21
Description: Dell EMC AppSync versions from 3.9 to 4.3 contain a path traversal vulnerability in AppSync server. A remote unauthenticated attacker may potentially exploit this vulnerability to gain unauthorized read access to the files stored on the server filesystem, with the privileges of the running web application.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://www.dell.com/support/kbdoc/000197433; https://www.dell.com/support/kbdoc/000197433
CVE: CVE-2022-26856
Published: 2022-04-21
Description: Dell EMC Repository Manager version 3.4.0 contains a plain-text password storage vulnerability. A local attacker could potentially exploit this vulnerability, leading to the disclosure of certain user credentials. The attacker may be able to use the exposed credentials to access the vulnerable application's database with privileges of the compromised account.
CVSS Score: 8.2 (HIGH)
CWE: CWE-522, CWE-522
References: https://www.dell.com/support/kbdoc/000197797; https://www.dell.com/support/kbdoc/000197797
CVE: CVE-2022-29280
Published: 2022-04-21
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2022-28366. Reason: This candidate is a reservation duplicate of CVE-2022-28366. Notes: All CVE users should reference CVE-2022-28366 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2022-28366
Published: 2022-04-21
Description: Certain Neko-related HTML parsers allow a denial of service via crafted Processing Instruction (PI) input that causes excessive heap memory consumption. In particular, this issue exists in HtmlUnit-Neko through 2.26, and is fixed in 2.27. This issue also exists in CyberNeko HTML through 1.9.22 (also affecting OWASP AntiSamy before 1.6.6), but 1.9.22 is the last version of CyberNeko HTML. NOTE: this may be related to CVE-2022-24839.
CVSS Score: 7.5 (HIGH)
References: https://github.com/nahsra/antisamy/releases/tag/v1.6.6; https://search.maven.org/artifact/net.sourceforge.htmlunit/neko-htmlunit; https://sourceforge.net/projects/htmlunit/files/htmlunit/2.27/