deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-43521
Published: 2022-04-08
Description: A Buffer Overflow vulnerability exists in zlog 1.2.15 via zlog_conf_build_with_file in src/zlog/src/conf.c.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://github.com/HardySimpson/zlog; https://github.com/HardySimpson/zlog/issues/206; https://github.com/HardySimpson/zlog
CVE: CVE-2022-22339
Published: 2022-04-08
Description: IBM Planning Analytics 2.0 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 219736.
CVSS Score: 7.3 (HIGH)
CWE: CWE-918
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/219736; https://www.ibm.com/support/pages/node/6565099; https://exchange.xforce.ibmcloud.com/vulnerabilities/219736
CVE: CVE-2022-27047
Published: 2022-04-08
Description: mogu_blog_cms 5.2 suffers from upload arbitrary files without any limitation.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://github.com/moxi624/mogu_blog_v2/issues/62; https://github.com/moxi624/mogu_blog_v2/issues/62
CVE: CVE-2022-27145
Published: 2022-04-08
Description: GPAC mp4box 1.1.0-DEV-rev1727-g8be34973d-master has a stack-overflow vulnerability in function gf_isom_get_sample_for_movie_time of mp4box.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://github.com/gpac/gpac/issues/2108; https://www.debian.org/security/2023/dsa-5411; https://github.com/gpac/gpac/issues/2108
CVE: CVE-2022-27146
Published: 2022-04-08
Description: GPAC mp4box 1.1.0-DEV-rev1759-geb2d1e6dd-has a heap-buffer-overflow vulnerability in function gf_isom_apple_enum_tag.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://github.com/gpac/gpac/issues/2120; https://github.com/gpac/gpac/issues/2120
CVE: CVE-2022-27147
Published: 2022-04-08
Description: GPAC mp4box 1.1.0-DEV-rev1727-g8be34973d-master has a use-after-free vulnerability in function gf_node_get_attribute_by_tag.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416
References: https://github.com/gpac/gpac/issues/2109; https://www.debian.org/security/2023/dsa-5411; https://github.com/gpac/gpac/issues/2109
CVE: CVE-2022-27148
Published: 2022-04-08
Description: GPAC mp4box 1.1.0-DEV-rev1663-g881c6a94a-master is vulnerable to Integer Overflow.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-190
References: https://github.com/gpac/gpac/issues/2067; https://github.com/gpac/gpac/issues/2067
CVE: CVE-2021-43515
Published: 2022-04-08
Description: CSV Injection (aka Excel Macro Injection or Formula Injection) exists in creating new timesheet in Kimai. By filling the Description field with malicious payload, it will be mistreated while exporting to a CSV file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-1236
References: https://github.com/kevinpapst/kimai2/commit/dad1b8b772947f1596175add1b4f33b791705507#diff-6774f5865dbaf8bc6c55b75bd92e6f9950ebe7834aa2efd828a19fd637e667cf; https://github.com/kevinpapst/kimai2/commit/dad1b8b772947f1596175add1b4f33b791705507#diff-6774f5865dbaf8bc6c55b75bd92e6f9950ebe7834aa2efd828a19fd637e667cf
CVE: CVE-2021-43517
Published: 2022-04-08
Description: FOSCAM Camera FI9805E with firmware V4.02.R12.00[PII_REDACTED]2[PII_REDACTED]0 contains a backdoor that opens Telnet port when special command is sent on port 9530.
CVSS Score: 9.8 (CRITICAL)
References: https://habr.com/ru/post/486856/; https://habr.com/ru/post/486856/
CVE: CVE-2021-43503
Published: 2022-04-08
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2022-1283
Published: 2022-04-08
Description: NULL Pointer Dereference in r_bin_ne_get_entrypoints function in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability allows attackers to cause a denial of service (application crash).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/radareorg/radare2/commit/18d1d064bf599a255d55f09fca3104776fc34a67; https://huntr.dev/bounties/bfeb8fb8-644d-4587-80d4-cb704c404013; https://github.com/radareorg/radare2/commit/18d1d064bf599a255d55f09fca3104776fc34a67
CVE: CVE-2022-27152
Published: 2022-04-08
Description: Roku devices running RokuOS v9.4.0 build 4200 or earlier that uses a Realtek WiFi chip is vulnerable to Arbitrary file modification.
CVSS Score: 5.7 (MEDIUM)
References: https://github.com/llamasoft/RootMyRoku; https://support.roku.com/article/[PII_REDACTED]879; https://github.com/llamasoft/RootMyRoku
CVE: CVE-2021-43498
Published: 2022-04-08
Description: An Access Control vulnerability exists in ATutor 2.2.4 in password_reminder.php when the g, id, h, form_password_hidden, and form_change HTTP POST parameters are set.
CVSS Score: 7.5 (HIGH)
CWE: CWE-640
References: https://github.com/atutor/ATutor/blob/master/password_reminder.php; https://packetstormsecurity.com/files/157563/ATutor-LMS-2.2.4-Weak-Password-Reset-Hash.html; https://github.com/atutor/ATutor/blob/master/password_reminder.php
CVE: CVE-2022-1284
Published: 2022-04-08
Description: heap-use-after-free in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability is capable of inducing denial of service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416, CWE-416
References: https://github.com/radareorg/radare2/commit/64a82e284dddabaeb[PII_REDACTED]03b57dead32a6; https://huntr.dev/bounties/e98ad92c-3a64-48fb-84d4-d13afdbcbdd7; https://github.com/radareorg/radare2/commit/64a82e284dddabaeb[PII_REDACTED]03b57dead32a6
CVE: CVE-2022-24821
Published: 2022-04-08
Description: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Simple users can create global SSX/JSX without specific rights: in theory only users with Programming Rights should be allowed to create SSX or JSX that are executed everywhere on a wiki. But a bug allow anyone with edit rights to actually create those. This issue has been patched in XWiki 13.10-rc-1, 12.10.11 and 13.4.6. There's no easy workaround for this issue, administrators should upgrade their wiki.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-648
References: https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-ghcq-472w-vf4h; https://jira.xwiki.org/browse/XWIKI-19155; https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-ghcq-472w-vf4h
CVE: CVE-2021-36287
Published: 2022-04-08
Description: Dell VNX2 for file version 8.1.21.266 and earlier, contain an unauthenticated remote code execution vulnerability which may lead unauthenticated users to execute commands on the system.
CVSS Score: 7.3 (HIGH)
CWE: CWE-78, CWE-78
References: https://www.dell.com/support/kbdoc/en-us/000191155/dsa-2021-164-dell-vnx2-control-station-security-update-for-multiple-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000191155/dsa-2021-164-dell-vnx2-control-station-security-update-for-multiple-vulnerabilities
CVE: CVE-2021-36288
Published: 2022-04-08
Description: Dell VNX2 for File version 8.1.21.266 and earlier, contain a path traversal vulnerability which may lead unauthenticated users to read/write restricted files
CVSS Score: 8.6 (HIGH)
CWE: CWE-22, CWE-22
References: https://www.dell.com/support/kbdoc/en-us/000191155/dsa-2021-164-dell-vnx2-control-station-security-update-for-multiple-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000191155/dsa-2021-164-dell-vnx2-control-station-security-update-for-multiple-vulnerabilities
CVE: CVE-2021-36290
Published: 2022-04-08
Description: Dell VNX2 for File version 8.1.21.266 and earlier, contain a privilege escalation vulnerability. A local malicious admin may potentially exploit vulnerability and gain privileges.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-732, CWE-269
References: https://www.dell.com/support/kbdoc/en-us/000191155/dsa-2021-164-dell-vnx2-control-station-security-update-for-multiple-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000191155/dsa-2021-164-dell-vnx2-control-station-security-update-for-multiple-vulnerabilities
CVE: CVE-2021-36293
Published: 2022-04-08
Description: Dell VNX2 for File version 8.1.21.266 and earlier, contain a privilege escalation vulnerability. A local malicious admin may potentially exploit vulnerability and gain elevated privileges.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-78, CWE-269
References: https://www.dell.com/support/kbdoc/en-us/000191155/dsa-2021-164-dell-vnx2-control-station-security-update-for-multiple-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000191155/dsa-2021-164-dell-vnx2-control-station-security-update-for-multiple-vulnerabilities
CVE: CVE-2021-43009
Published: 2022-04-08
Description: A Cross Site Scripting (XSS) vulnerability exists in OpServices OpMon through 9.11 via the search parameter in the request URL.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/166619/Opmon-9.11-Cross-Site-Scripting.html; https://www.exploit-db.com/exploits/50857; http://packetstormsecurity.com/files/166619/Opmon-9.11-Cross-Site-Scripting.html
CVE: CVE-2022-22563
Published: 2022-04-08
Description: Dell EMC Powerscale OneFS 8.2.x - 9.2.x omit security-relevant information in /etc/master.passwd. A high-privileged user can exploit this vulnerability to not record information identifying the source of account information changes.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-223
References: https://www.dell.com/support/kbdoc/000196657; https://www.dell.com/support/kbdoc/en-an/000197991/dell-emc-powerscale-onefs-security-update-for-multiple-component-vulnerabilities; https://www.dell.com/support/kbdoc/000196657
CVE: CVE-2022-24428
Published: 2022-04-08
Description: Dell PowerScale OneFS, versions 8.2.x, 9.0.0.x, 9.1.0.x, 9.2.0.x, 9.2.1.x, and 9.3.0.x, contain an improper preservation of privileges. A remote filesystem user with a local account could potentially exploit this vulnerability, leading to an escalation of file privileges and information disclosure.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-281, CWE-281
References: https://www.dell.com/support/kbdoc/en-us/000197991/dell-emc-powerscale-onefs-security-update-for-multiple-component-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000197991/dell-emc-powerscale-onefs-security-update-for-multiple-component-vulnerabilities
CVE: CVE-2022-24819
Published: 2022-04-08
Description: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A guest user without the right to view pages of the wiki can still list documents related to users of the wiki. The problem has been patched in XWiki versions 12.10.11, 13.4.4, and 13.9-rc-1. There is no known workaround for this problem.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-359
References: https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-97jg-43c9-q6pf; https://jira.xwiki.org/browse/XWIKI-18850; https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-97jg-43c9-q6pf
CVE: CVE-2022-24820
Published: 2022-04-08
Description: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A guest user without the right to view pages of the wiki can still list documents by rendering some velocity documents. The problem has been patched in XWiki versions 12.10.11, 13.4.4, and 13.9-rc-1. There is no known workaround for this problem.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-359, CWE-306
References: https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-qpp2-2mcp-2wm5; https://jira.xwiki.org/browse/XWIKI-16544; https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-qpp2-2mcp-2wm5
CVE: CVE-2022-26851
Published: 2022-04-08
Description: Dell PowerScale OneFS, 8.2.2-9.3.x, contains a predictable file name from observable state vulnerability. An unprivileged network attacker could potentially exploit this vulnerability, leading to data loss.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-330, CWE-330
References: https://www.dell.com/support/kbdoc/en-us/000197991/dell-emc-powerscale-onefs-security-update-for-multiple-component-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000197991/dell-emc-powerscale-onefs-security-update-for-multiple-component-vulnerabilities
CVE: CVE-2022-26852
Published: 2022-04-08
Description: Dell PowerScale OneFS, versions 8.2.x-9.3.x, contain a predictable seed in pseudo-random number generator. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to an account compromise.
CVSS Score: 8.1 (HIGH)
CWE: CWE-337, CWE-335
References: https://www.dell.com/support/kbdoc/en-us/000197991/dell-emc-powerscale-onefs-security-update-for-multiple-component-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000197991/dell-emc-powerscale-onefs-security-update-for-multiple-component-vulnerabilities
CVE: CVE-2022-26854
Published: 2022-04-08
Description: Dell PowerScale OneFS, versions 8.2.x-9.2.x, contain risky cryptographic algorithms. A remote unprivileged malicious attacker could potentially exploit this vulnerability, leading to full system access
CVSS Score: 8.1 (HIGH)
CWE: CWE-327, CWE-327
References: https://www.dell.com/support/kbdoc/en-us/000197991/dell-emc-powerscale-onefs-security-update-for-multiple-component-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000197991/dell-emc-powerscale-onefs-security-update-for-multiple-component-vulnerabilities
CVE: CVE-2022-26855
Published: 2022-04-08
Description: Dell PowerScale OneFS, versions 8.2.x-9.3.0.x, contains an incorrect default permissions vulnerability. A local malicious user could potentially exploit this vulnerability, leading to a denial of service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-276, CWE-276
References: https://www.dell.com/support/kbdoc/en-us/000197991/dell-emc-powerscale-onefs-security-update-for-multiple-component-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000197991/dell-emc-powerscale-onefs-security-update-for-multiple-component-vulnerabilities
CVE: CVE-2021-43149
Published: 2022-04-08
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2022-26180
Published: 2022-04-08
Description: qdPM 9.2 allows Cross-Site Request Forgery (CSRF) via the index.php/myAccount/update URI.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://packetstormsecurity.com/files/166630/qdPM-9.2-Cross-Site-Request-Forgery.html; https://www.exploit-db.com/exploits/50854; http://packetstormsecurity.com/files/166630/qdPM-9.2-Cross-Site-Request-Forgery.html
CVE: CVE-2022-26588
Published: 2022-04-08
Description: A Cross-Site Request Forgery (CSRF) in IceHrm 31.0.0.OS allows attackers to delete arbitrary users or achieve account takeover via the app/service.php URI.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: http://packetstormsecurity.com/files/166627/ICEHRM-31.0.0.0S-Cross-Site-Request-Forgery.html; https://medium.com/%40devansh3008/csrf-in-icehrm-31-0-0-0s-in-delete-user-endpoint-86a39ecf253f; http://packetstormsecurity.com/files/166627/ICEHRM-31.0.0.0S-Cross-Site-Request-Forgery.html
CVE: CVE-2022-27883
Published: 2022-04-09
Description: A link following vulnerability in Trend Micro Antivirus for Mac 11.5 could allow an attacker to create a specially-crafted file as a symlink that can lead to privilege escalation. Please note that an attacker must at least have low-level privileges on the system to attempt to exploit this vulnerability.
CVSS Score: 7.3 (HIGH)
CWE: CWE-59
References: https://helpcenter.trendmicro.com/en-us/article/tmka-10978; https://www.zerodayinitiative.com/advisories/ZDI-22-546/; https://helpcenter.trendmicro.com/en-us/article/tmka-10978
CVE: CVE-2022-26877
Published: 2022-04-09
Description: Asana Desktop before 1.6.0 allows remote attackers to exfiltrate local files if they can trick the Asana desktop app into loading a malicious web page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-552
References: https://asana.com; https://forum.asana.com/t/asana-desktop-app-security-update/160477; https://asana.com
CVE: CVE-2022-27149
Published: 2022-04-09
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2022-28363
Published: 2022-04-09
Description: Reprise License Manager 14.2 is affected by a reflected cross-site scripting vulnerability (XSS) in the /goform/login_process username parameter via GET. No authentication is required.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/166647/Reprise-License-Manager-14.2-Cross-Site-Scripting-Information-Disclosure.html; https://seclists.org/fulldisclosure/2022/Apr/1; https://www.reprisesoftware.com/products/software-license-management.php
CVE: CVE-2022-28364
Published: 2022-04-09
Description: Reprise License Manager 14.2 is affected by a reflected cross-site scripting vulnerability (XSS) in the /goform/rlmswitchr_process file parameter via GET. Authentication is required.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/166647/Reprise-License-Manager-14.2-Cross-Site-Scripting-Information-Disclosure.html; https://seclists.org/fulldisclosure/2022/Apr/1; https://www.reprisesoftware.com/products/software-license-management.php
CVE: CVE-2022-28365
Published: 2022-04-09
Description: Reprise License Manager 14.2 is affected by an Information Disclosure vulnerability via a GET request to /goforms/rlminfo. No authentication is required. The information disclosed is associated with software versions, process IDs, network configuration, hostname(s), system architecture, and file/directory details.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-425
References: http://packetstormsecurity.com/files/166647/Reprise-License-Manager-14.2-Cross-Site-Scripting-Information-Disclosure.html; https://seclists.org/fulldisclosure/2022/Apr/1; https://www.reprisesoftware.com/RELEASE_NOTES
CVE: CVE-2022-1287
Published: 2022-04-09
Description: A vulnerability classified as critical was found in School Club Application System 1.0. This vulnerability affects a request to the file /scas/classes/Users.php?f=save_user. The manipulation with a POST request leads to privilege escalation. The attack can be initiated remotely and does not require authentication. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-99, CWE-74
References: https://vuldb.com/?id.196750; https://vuldb.com/?id.196750
CVE: CVE-2022-1288
Published: 2022-04-09
Description: A vulnerability, which was classified as problematic, has been found in School Club Application System 1.0. This issue affects access to /scas/admin/. The manipulation of the parameter page with the input %22%3E%3Cimg%20src=x%20onerror=alert(1)%3E leads to a reflected cross site scripting. The attack may be initiated remotely and does not require any form of authentication. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://vuldb.com/?id.196751; https://vuldb.com/?id.196751
CVE: CVE-2022-1276
Published: 2022-04-10
Description: Out-of-bounds Read in mrb_get_args in GitHub repository mruby/mruby prior to 3.2. Possible arbitrary code execution if being exploited.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125
References: https://github.com/mruby/mruby/commit/c8c083cb750606b2da81582cd8e43b442bb143e6; https://huntr.dev/bounties/6ea041d1-e2aa-472c-bf3e-da5fa8726c25; https://github.com/mruby/mruby/commit/c8c083cb750606b2da81582cd8e43b442bb143e6
CVE: CVE-2022-1286
Published: 2022-04-10
Description: heap-buffer-overflow in mrb_vm_exec in mruby/mruby in GitHub repository mruby/mruby prior to 3.2. Possible arbitrary code execution if being exploited.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-122, CWE-787
References: https://github.com/mruby/mruby/commit/b1d0296a937fe278239bdfac840a3fd0e93b3ee9; https://huntr.dev/bounties/f918376e-b488-4113-963d-ffe8716e4189; https://github.com/mruby/mruby/commit/b1d0296a937fe278239bdfac840a3fd0e93b3ee9
CVE: CVE-2022-1289
Published: 2022-04-10
Description: A denial of service vulnerability was found in tildearrow Furnace. It has been classified as problematic. This is due to an incomplete fix of CVE-2022-1211. It is possible to initiate the attack remotely but it requires user interaction. The issue got fixed with the patch 0eb02422d5161767e9983bdaa5c429762d3477ce.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-404
References: https://github.com/tildearrow/furnace/commit/0eb02422d5161767e9983bdaa5c429762d3477ce; https://github.com/tildearrow/furnace/issues/325#issuecomment[PII_REDACTED]; https://vuldb.com/?id.196755
CVE: CVE-2022-1290
Published: 2022-04-10
Description: Stored XSS in "Name", "Group Name" & "Title" in GitHub repository polonel/trudesk prior to v1.2.0. This allows attackers to execute malicious scripts in the user's browser and it can lead to session hijacking, sensitive data exposure, and worse.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/polonel/trudesk/commit/4f48b3bb86ba66a[PII_REDACTED]065bb6437e864ec; https://huntr.dev/bounties/da6d03e6-053f-43b6-99a7-78c2e386e3ed; https://github.com/polonel/trudesk/commit/4f48b3bb86ba66a[PII_REDACTED]065bb6437e864ec
CVE: CVE-2022-1291
Published: 2022-04-10
Description: XSS vulnerability with default `onCellHtmlData` function in GitHub repository hhurz/tableexport.jquery.plugin prior to 1.25.0. Transmitting cookies to third-party servers. Sending data from secure sessions to third-party servers
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/hhurz/tableexport.jquery.plugin/commit/dcbaee23cf98328397a153e71556f75202988ec9; https://huntr.dev/bounties/49a14371-6058-47dd-9801-ec38a7459fc5; https://github.com/hhurz/tableexport.jquery.plugin/commit/dcbaee23cf98328397a153e71556f75202988ec9
CVE: CVE-2022-27125
Published: 2022-04-10
Description: zbzcms v1.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the neirong parameter at /php/ajax.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/wu610777031/My_CMSHunter/blob/main/zbzcms%20v1.0%20vulnerabilities.pdf; https://github.com/wu610777031/My_CMSHunter/blob/main/zbzcms%20v1.0%20vulnerabilities.pdf
CVE: CVE-2022-27126
Published: 2022-04-10
Description: zbzcms v1.0 was discovered to contain a SQL injection vulnerability via the art parameter at /include/make.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/wu610777031/My_CMSHunter/blob/main/zbzcms%20v1.0%20vulnerabilities.pdf; https://github.com/wu610777031/My_CMSHunter/blob/main/zbzcms%20v1.0%20vulnerabilities.pdf
CVE: CVE-2022-27127
Published: 2022-04-10
Description: zbzcms v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /php/ajax.php.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/wu610777031/My_CMSHunter/blob/main/zbzcms%20v1.0%20vulnerabilities.pdf; https://github.com/wu610777031/My_CMSHunter/blob/main/zbzcms%20v1.0%20vulnerabilities.pdf
CVE: CVE-2022-27128
Published: 2022-04-10
Description: An incorrect access control issue at /admin/run_ajax.php in zbzcms v1.0 allows attackers to arbitrarily add administrator accounts.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/wu610777031/My_CMSHunter/blob/main/zbzcms%20v1.0%20vulnerabilities.pdf; https://github.com/wu610777031/My_CMSHunter/blob/main/zbzcms%20v1.0%20vulnerabilities.pdf
CVE: CVE-2022-27129
Published: 2022-04-10
Description: An arbitrary file upload vulnerability at /admin/ajax.php in zbzcms v1.0 allows attackers to execute arbitrary code via a crafted PHP file.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://github.com/wu610777031/My_CMSHunter/blob/main/zbzcms%20v1.0%20vulnerabilities.pdf; https://github.com/wu610777031/My_CMSHunter/blob/main/zbzcms%20v1.0%20vulnerabilities.pdf
CVE: CVE-2022-27131
Published: 2022-04-10
Description: An arbitrary file upload vulnerability at /zbzedit/php/zbz.php in zbzcms v1.0 allows attackers to execute arbitrary code via a crafted PHP file.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://github.com/wu610777031/My_CMSHunter/blob/main/zbzcms%20v1.0%20vulnerabilities.pdf; https://github.com/wu610777031/My_CMSHunter/blob/main/zbzcms%20v1.0%20vulnerabilities.pdf