deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-2209
Published: 2023-04-21
Description: A vulnerability, which was classified as critical, was found in Campcodes Coffee Shop POS System 1.0. Affected is an unknown function of the file /admin/sales/view_details.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-226974 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/Coffee%20Shop%20POS%20System/Coffee%20Shop%20POS%20System%20-%20vuln%201.pdf; https://vuldb.com/?ctiid.226974; https://vuldb.com/?id.226974
CVE: CVE-2023-2210
Published: 2023-04-21
Description: A vulnerability has been found in Campcodes Coffee Shop POS System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/categories/view_category.php. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-226975.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/Coffee%20Shop%20POS%20System/Coffee%20Shop%20POS%20System%20-%20vuln%202.pdf; https://vuldb.com/?ctiid.226975; https://vuldb.com/?id.226975
CVE: CVE-2023-2211
Published: 2023-04-21
Description: A vulnerability was found in Campcodes Coffee Shop POS System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/categories/manage_category.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-226976.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/Coffee%20Shop%20POS%20System/Coffee%20Shop%20POS%20System%20-%20vuln%203.pdf; https://vuldb.com/?ctiid.226976; https://vuldb.com/?id.226976
CVE: CVE-2023-2212
Published: 2023-04-21
Description: A vulnerability was found in Campcodes Coffee Shop POS System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/products/view_product.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-226977 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/Coffee%20Shop%20POS%20System/Coffee%20Shop%20POS%20System%20-%20vuln%204.pdf; https://vuldb.com/?ctiid.226977; https://vuldb.com/?id.226977
CVE: CVE-2023-2213
Published: 2023-04-21
Description: A vulnerability was found in Campcodes Coffee Shop POS System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin/products/manage_product.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-226978 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/Coffee%20Shop%20POS%20System/Coffee%20Shop%20POS%20System%20-%20vuln%205.pdf; https://vuldb.com/?ctiid.226978; https://vuldb.com/?id.226978
CVE: CVE-2023-2214
Published: 2023-04-21
Description: A vulnerability was found in Campcodes Coffee Shop POS System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /admin/sales/manage_sale.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-226979.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/Coffee%20Shop%20POS%20System/Coffee%20Shop%20POS%20System%20-%20vuln%206.pdf; https://vuldb.com/?ctiid.226979; https://vuldb.com/?id.226979
CVE: CVE-2023-2215
Published: 2023-04-21
Description: A vulnerability classified as critical has been found in Campcodes Coffee Shop POS System 1.0. Affected is an unknown function of the file /admin/user/manage_user.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-226980.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/Coffee%20Shop%20POS%20System/Coffee%20Shop%20POS%20System%20-%20vuln%207.pdf; https://vuldb.com/?ctiid.226980; https://vuldb.com/?id.226980
CVE: CVE-2023-2216
Published: 2023-04-21
Description: A vulnerability classified as problematic was found in Campcodes Coffee Shop POS System 1.0. Affected by this vulnerability is an unknown functionality of the file /classes/Users.php. The manipulation of the argument firstname leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-226981 was assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/E1CHO/cve_hub/blob/main/Coffee%20Shop%20POS%20System/Coffee%20Shop%20POS%20System%20-%20vuln%208.pdf; https://vuldb.com/?ctiid.226981; https://vuldb.com/?id.226981
CVE: CVE-2023-2217
Published: 2023-04-21
Description: A vulnerability, which was classified as critical, was found in SourceCodester Task Reminder System 1.0. This affects an unknown part of the file /admin/reminders/manage_reminder.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-226983.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/Task%20Reminder%20System/Task%20Reminder%20System%20-%20vuln%202.pdf; https://vuldb.com/?ctiid.226983; https://vuldb.com/?id.226983
CVE: CVE-2023-2218
Published: 2023-04-21
Description: A vulnerability has been found in SourceCodester Task Reminder System 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/user/manage_user.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-226984.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/Task%20Reminder%20System/Task%20Reminder%20System%20-%20vuln%203.pdf; https://vuldb.com/?ctiid.226984; https://vuldb.com/?id.226984
CVE: CVE-2023-2219
Published: 2023-04-21
Description: A vulnerability was found in SourceCodester Task Reminder System 1.0 and classified as problematic. This issue affects some unknown processing of the file /classes/Users.php. The manipulation of the argument id leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-226985 was assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/E1CHO/cve_hub/blob/main/Task%20Reminder%20System/Task%20Reminder%20System%20-%20vuln%204.pdf; https://vuldb.com/?ctiid.226985; https://vuldb.com/?id.226985
CVE: CVE-2021-33589
Published: 2023-04-21
Description: Ribose RNP before 0.15.1 does not implement a required step in a cryptographic algorithm, resulting in weaker encryption than on the tin of the algorithm.
CVSS Score: 7.5 (HIGH)
CWE: CWE-522, CWE-522
References: https://open.ribose.com/advisories/ra-2021-05-30/#CVE-2021-33589; https://www.ribose.com/feedback/security; https://open.ribose.com/advisories/ra-2021-05-30/#CVE-2021-33589
CVE: CVE-2023-26100
Published: 2023-04-21
Description: In Progress Flowmon before 12.2.0, an application endpoint failed to sanitize user-supplied input. A threat actor could leverage a reflected XSS vulnerability to execute arbitrary code within the context of a Flowmon user's web browser.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://support.kemptechnologies.com/hc/en-us/articles/[PII_REDACTED]837; https://www.flowmon.com/en; https://support.kemptechnologies.com/hc/en-us/articles/[PII_REDACTED]837
CVE: CVE-2023-26101
Published: 2023-04-21
Description: In Progress Flowmon Packet Investigator before 12.1.0, a Flowmon user with access to Flowmon Packet Investigator could leverage a path-traversal vulnerability to retrieve files on the Flowmon appliance's local filesystem.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://support.kemptechnologies.com/hc/en-us/articles/[PII_REDACTED]789; https://www.flowmon.com/en; https://support.kemptechnologies.com/hc/en-us/articles/[PII_REDACTED]789
CVE: CVE-2023-2220
Published: 2023-04-21
Description: A vulnerability was found in Dream Technology mica up to 3.0.5. It has been classified as problematic. Affected is an unknown function of the component Form Object Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. VDB-226986 is the identifier assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://gitee.com/596392912/mica/issues/I6TGJD; https://vuldb.com/?ctiid.226986; https://vuldb.com/?id.226986
CVE: CVE-2023-2226
Published: 2023-04-21
Description: Due to insufficient validation in the PE and OLE parsers in Rapid7's Velociraptor versions earlier than 0.6.8 allows attacker to crash Velociraptor during parsing of maliciously malformed files. 

For this attack to succeed, the attacker needs to be able to introduce malicious files to the system at the same time that Velociraptor attempts to collect any artifacts that attempt to parse PE files, Authenticode signatures, or OLE files. After crashing, the Velociraptor service will restart and it will still be possible to collect other artifacts.


CVSS Score: 3.3 (LOW)
CWE: CWE-125, CWE-125
References: https://github.com/Velocidex/velociraptor; https://github.com/Velocidex/velociraptor
CVE: CVE-2023-2227
Published: 2023-04-21
Description: Improper Authorization in GitHub repository modoboa/modoboa prior to 2.1.0.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-285
References: https://github.com/modoboa/modoboa/commit/7bcd3f6eb264d4e3e01071c97c2bac51cdd6fe97; https://huntr.dev/bounties/351f9055-2008-4af0-b820-01ff66678bf3; https://github.com/modoboa/modoboa/commit/7bcd3f6eb264d4e3e01071c97c2bac51cdd6fe97
CVE: CVE-2023-2228
Published: 2023-04-21
Description: Cross-Site Request Forgery (CSRF) in GitHub repository modoboa/modoboa prior to 2.1.0.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: https://github.com/modoboa/modoboa/commit/5d886f3d06373d2c3292911bac0772bcd5102343; https://huntr.dev/bounties/619fb490-69ad-4a2a-b686-4c42a62404a9; https://github.com/modoboa/modoboa/commit/5d886f3d06373d2c3292911bac0772bcd5102343
CVE: CVE-2022-48150
Published: 2023-04-21
Description: Shopware v5.5.10 was discovered to contain a cross-site scripting (XSS) vulnerability via the recovery/install/ URI.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/sahilop123/-CVE-2022-48150; https://github.com/sahilop123/-CVE-2022-48150
CVE: CVE-2023-29575
Published: 2023-04-21
Description: Bento4 v1.6.0-639 was discovered to contain an out-of-memory bug in the mp42aac component.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-770, CWE-770
References: https://github.com/axiomatic-systems/Bento4/issues/842; https://github.com/z1r00/fuzz_vuln/blob/main/Bento4/mp42aac/readme.md; https://github.com/axiomatic-systems/Bento4/issues/842
CVE: CVE-2023-1998
Published: 2023-04-21
Description: The Linux kernel allows userspace processes to enable mitigations by calling prctl with PR_SET_SPECULATION_CTRL which disables the speculation feature as well as by using seccomp. We had noticed that on VMs of at least one major cloud provider, the kernel still left the victim process exposed to attacks in some cases even after enabling the spectre-BTI mitigation with prctl. The same behavior can be observed on a bare-metal machine when forcing the mitigation to IBRS on boot command line.

This happened because when plain IBRS was enabled (not enhanced IBRS), the kernel had some logic that determined that STIBP was not needed. The IBRS bit implicitly protects against cross-thread branch target injection. However, with legacy IBRS, the IBRS bit was cleared on returning to userspace, due to performance reasons, which disabled the implicit STIBP and left userspace threads vulnerable to cross-thread branch target injection against which STIBP protects.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-1303, CWE-203
References: https://github.com/google/security-research/security/advisories/GHSA-mj4w-6495-6crx; https://github.com/torvalds/linux/commit/6921ed9049bc7457f66c1596c5b78aec0dae4a9d; https://kernel.dance/#6921ed9049bc7457f66c1596c5b78aec0dae4a9d
CVE: CVE-2023-26876
Published: 2023-04-21
Description: SQL injection vulnerability found in Piwigo v.13.5.0 and before allows a remote attacker to execute arbitrary code via the filter_user_id parameter to the admin.php?page=history&filter_image_id=&filter_user_id endpoint.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: http://packetstormsecurity.com/files/172059/Piwigo-13.5.0-SQL-Injection.html; http://seclists.org/fulldisclosure/2023/Apr/13; https://gist.github.com/rodnt/a190d14d1715890d8df19bad58b90693
CVE: CVE-2023-29905
Published: 2023-04-21
Description: H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via the UpdateSnat interface at /goform/aspForm.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://hackmd.io/%400dayResearch/H1IFt1Jgn; https://hackmd.io/%400dayResearch/H1IFt1Jgn
CVE: CVE-2023-29906
Published: 2023-04-21
Description: H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via the Edit_BasicSSID interface at /goform/aspForm.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://hackmd.io/%400dayResearch/rk1uu20Jh; https://hackmd.io/%400dayResearch/rk1uu20Jh
CVE: CVE-2023-29907
Published: 2023-04-21
Description: H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via the Edit_BasicSSID_5G interface at /goform/aspForm.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://hackmd.io/%400dayResearch/rk-6aRRyn; https://hackmd.io/%400dayResearch/rk-6aRRyn
CVE: CVE-2023-29908
Published: 2023-04-21
Description: H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via the SetMobileAPInfoById interface at /goform/aspForm.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://hackmd.io/%400dayResearch/Ski-S20J2; https://hackmd.io/%400dayResearch/Ski-S20J2
CVE: CVE-2023-29909
Published: 2023-04-21
Description: H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via the AddWlanMacList interface at /goform/aspForm.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://hackmd.io/%400dayResearch/r1FC0AAy2; https://hackmd.io/%400dayResearch/r1FC0AAy2
CVE: CVE-2023-29910
Published: 2023-04-21
Description: H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via the UpdateMacClone interface at /goform/aspForm.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://hackmd.io/%400dayResearch/S1aGs1Jl2; https://hackmd.io/%400dayResearch/S1aGs1Jl2
CVE: CVE-2023-29911
Published: 2023-04-21
Description: H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via the AddMacList interface at /goform/aspForm.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://hackmd.io/%400dayResearch/SyTaRoCJn; https://hackmd.io/%400dayResearch/SyTaRoCJn
CVE: CVE-2023-29912
Published: 2023-04-21
Description: H3C Magic R200 R200V100R004 was discovered to contain a stack overflow via the DelvsList interface at /goform/aspForm.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://hackmd.io/%400dayResearch/S1TusiR1n; https://hackmd.io/%400dayResearch/S1TusiR1n
CVE: CVE-2023-29913
Published: 2023-04-21
Description: H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via the SetAPWifiorLedInfoById interface at /goform/aspForm.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://hackmd.io/%400dayResearch/HyvnMn013; https://hackmd.io/%400dayResearch/HyvnMn013
CVE: CVE-2023-29914
Published: 2023-04-21
Description: H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via the DeltriggerList interface at /goform/aspForm.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://hackmd.io/%400dayResearch/H1Cn2sAk3; https://hackmd.io/%400dayResearch/H1Cn2sAk3
CVE: CVE-2023-29915
Published: 2023-04-21
Description: H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via CMD parameter at /goform/aspForm.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://hackmd.io/%400dayResearch/HJBc2lyl2; https://hackmd.io/%400dayResearch/HJBc2lyl2
CVE: CVE-2023-29916
Published: 2023-04-21
Description: H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via the UpdateWanParams interface at /goform/aspForm.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://hackmd.io/%400dayResearch/rkpbC1Jgh; https://hackmd.io/%400dayResearch/rkpbC1Jgh
CVE: CVE-2023-29917
Published: 2023-04-21
Description: H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via go parameter at /goform/aspForm.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://hackmd.io/%400dayResearch/rJJzEg1e3; https://hackmd.io/%400dayResearch/rJJzEg1e3
CVE: CVE-2023-2231
Published: 2023-04-21
Description: A vulnerability, which was classified as critical, was found in MAXTECH MAX-G866ac 0.4.1_TBRO_20160314. This affects an unknown part of the component Remote Management. The manipulation leads to missing authentication. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-227001 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://vuldb.com/?ctiid.227001; https://vuldb.com/?id.227001; https://youtu.be/fikdcK_xlS8
CVE: CVE-2023-2139
Published: 2023-04-21
Description: 
A reflected Cross-site Scripting (XSS) Vulnerability in DELMIA Apriso Release 2017 through Release 2022 allows an attacker to execute arbitrary script code.


CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.3ds.com/vulnerability/advisories; https://www.3ds.com/vulnerability/advisories
CVE: CVE-2023-2140
Published: 2023-04-21
Description: A Server-Side Request Forgery vulnerability in DELMIA Apriso Release  2017 through Release 2022 

could allow an unauthenticated attacker to issue requests to arbitrary hosts on behalf of the server running the DELMIA Apriso application.

CVSS Score: 7.5 (HIGH)
CWE: CWE-918, CWE-918
References: https://www.3ds.com/vulnerability/advisories; https://www.3ds.com/vulnerability/advisories
CVE: CVE-2023-2141
Published: 2023-04-21
Description: An unsafe .NET object deserialization in DELMIA Apriso Release 2017 through Release 2022 could lead to post-authentication remote code execution.

CVSS Score: 8.5 (HIGH)
CWE: CWE-502, CWE-502
References: https://www.3ds.com/vulnerability/advisories; https://www.3ds.com/vulnerability/advisories
CVE: CVE-2023-30798
Published: 2023-04-21
Description: There MultipartParser usage in Encode's Starlette python framework before versions 0.25.0 allows an unauthenticated and remote attacker to specify any number of form fields or files which can cause excessive memory usage resulting in denial of service of the HTTP service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-400
References: https://github.com/encode/starlette/commit/8c74c2c8dba7030154f8af18e016136bea1938fa; https://github.com/encode/starlette/security/advisories/GHSA-74m5-2c7w-9w3x; https://vulncheck.com/advisories/starlette-multipartparser-dos
CVE: CVE-2022-47930
Published: 2023-04-21
Description: An issue was discovered in IO FinNet tss-lib before 2.0.0. The parameter ssid for defining a session id is not used through the MPC implementation, which makes replaying and spoofing of messages easier. In particular, the Schnorr proof of knowledge implemented in sch.go does not utilize a session id, context, or random nonce in the generation of the challenge. This could allow a malicious user or an eavesdropper to replay a valid proof sent in the past.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-294, CWE-294
References: https://github.com/IoFinnet/tss-lib/releases/tag/v2.0.0; https://medium.com/%40iofinnet/security-disclosure-for-ecdsa-and-eddsa-threshold-signature-schemes-4e969af7155b; https://github.com/IoFinnet/tss-lib/releases/tag/v2.0.0
CVE: CVE-2023-26556
Published: 2023-04-21
Description: io.finnet tss-lib before 2.0.0 can leak a secret key via a timing side-channel attack because it relies on the scalar-multiplication implementation in Go crypto/elliptic, which is not constant time (there is an if statement in a loop). One leak is in ecdsa/keygen/round_2.go. (bnb-chain/tss-lib and thorchain/tss are also affected.)
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-203, CWE-203
References: https://github.com/IoFinnet/tss-lib/releases/tag/v2.0.0; https://github.com/bnb-chain/tss-lib/tree/v1.3.5; https://gitlab.com/thorchain/tss/tss-lib/-/tags/v0.1.3
CVE: CVE-2023-26557
Published: 2023-04-21
Description: io.finnet tss-lib before 2.0.0 can leak the lambda value of a private key via a timing side-channel attack because it relies on Go big.Int, which is not constant time for Cmp, modular exponentiation, or modular inverse. An example leak is in crypto/paillier/paillier.go. (bnb-chain/tss-lib and thorchain/tss are also affected.)
CVSS Score: 7.5 (HIGH)
CWE: CWE-203, CWE-203
References: https://github.com/IoFinnet/tss-lib/releases/tag/v2.0.0; https://github.com/bnb-chain/tss-lib/tree/v1.3.5; https://gitlab.com/thorchain/tss/tss-lib/-/tags/v0.1.3
CVE: CVE-2022-36963
Published: 2023-04-21
Description: The SolarWinds Platform was susceptible to the Command Injection Vulnerability. This vulnerability allows a remote adversary with a valid SolarWinds Platform admin account to execute arbitrary commands.


CVSS Score: 7.2 (HIGH)
CWE: CWE-94, CWE-94
References: https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2023-2_release_notes.htm; https://www.solarwinds.com/trust-center/security-advisories/cve-2022-36963; https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2023-2_release_notes.htm
CVE: CVE-2022-47505
Published: 2023-04-21
Description: The SolarWinds Platform was susceptible to the Local Privilege Escalation Vulnerability. This vulnerability allows a local adversary with a valid system user account to escalate local privileges.


CVSS Score: 7.8 (HIGH)
CWE: CWE-269, CWE-269
References: https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2023-2_release_notes.htm; https://www.solarwinds.com/trust-center/security-advisories/cve-2022-47505; https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2023-2_release_notes.htm