deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-4246
Published: 2022-12-01
Description: A vulnerability classified as problematic has been found in Kakao PotPlayer. This affects an unknown part of the component MID File Handler. The manipulation leads to denial of service. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-214623.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-404
References: https://seclists.org/fulldisclosure/2022/Nov/16; https://seclists.org/fulldisclosure/2022/Nov/att-16/potplayer_7z.bin; https://vuldb.com/?id.214623
CVE: CVE-2022-4247
Published: 2022-12-01
Description: A vulnerability classified as critical was found in Movie Ticket Booking System. This vulnerability affects unknown code of the file booking.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-214624.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-707
References: https://github.com/aman05382/movie_ticket_booking_system_php/issues/1; https://vuldb.com/?id.214624; https://github.com/aman05382/movie_ticket_booking_system_php/issues/1
CVE: CVE-2022-4248
Published: 2022-12-01
Description: A vulnerability, which was classified as critical, has been found in Movie Ticket Booking System. This issue affects some unknown processing of the file editBooking.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-214625 was assigned to this vulnerability.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-707
References: https://github.com/aman05382/movie_ticket_booking_system_php/issues/3; https://vuldb.com/?id.214625; https://github.com/aman05382/movie_ticket_booking_system_php/issues/3
CVE: CVE-2022-4249
Published: 2022-12-01
Description: A vulnerability, which was classified as problematic, was found in Movie Ticket Booking System. Affected is an unknown function of the component POST Request Handler. The manipulation of the argument ORDER_ID leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-214626 is the identifier assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-707, CWE-79
References: https://github.com/aman05382/movie_ticket_booking_system_php/issues/5; https://vuldb.com/?id.214626; https://github.com/aman05382/movie_ticket_booking_system_php/issues/5
CVE: CVE-2022-4250
Published: 2022-12-01
Description: A vulnerability has been found in Movie Ticket Booking System and classified as problematic. Affected by this vulnerability is an unknown functionality of the file booking.php. The manipulation of the argument id leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-214627.
CVSS Score: 3.5 (LOW)
CWE: CWE-707
References: https://github.com/aman05382/movie_ticket_booking_system_php/issues/2; https://vuldb.com/?id.214627; https://github.com/aman05382/movie_ticket_booking_system_php/issues/2
CVE: CVE-2022-4251
Published: 2022-12-01
Description: A vulnerability was found in Movie Ticket Booking System and classified as problematic. Affected by this issue is some unknown functionality of the file editBooking.php. The manipulation leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-214628.
CVSS Score: 2.4 (LOW)
CWE: CWE-707
References: https://github.com/aman05382/movie_ticket_booking_system_php/issues/4; https://vuldb.com/?id.214628; https://github.com/aman05382/movie_ticket_booking_system_php/issues/4
CVE: CVE-2022-4252
Published: 2022-12-01
Description: A vulnerability was found in SourceCodester Canteen Management System. It has been classified as problematic. This affects the function builtin_echo of the file categories.php. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-214629 was assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-707
References: https://blog.csdn.net/weixin_43864034/article/details/128127288; https://vuldb.com/?id.214629; https://blog.csdn.net/weixin_43864034/article/details/128127288
CVE: CVE-2022-4253
Published: 2022-12-01
Description: A vulnerability was found in SourceCodester Canteen Management System. It has been declared as problematic. This vulnerability affects the function builtin_echo of the file customer.php. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-214630 is the identifier assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-707
References: https://blog.csdn.net/weixin_43864034/article/details/128127516; https://vuldb.com/?id.214630; https://blog.csdn.net/weixin_43864034/article/details/128127516
CVE: CVE-2022-45050
Published: 2022-12-01
Description: A reflected XSS vulnerability has been found in Axiell Iguana CMS, allowing an attacker to execute code in a victim's browser. The title parameter on the twitter.php endpoint does not properly neutralise user input, resulting in the vulnerability.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://csirt.divd.nl/CVE-2022-45050/; https://csirt.divd.nl/DIVD-2022-00064/; https://csirt.divd.nl/CVE-2022-45050/
CVE: CVE-2022-4221
Published: 2022-12-01
Description: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Asus NAS-M25 allows an unauthenticated attacker to inject arbitrary OS commands via unsanitized cookie values.This issue affects NAS-M25: through 1.0.1.7.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://onekey.com/blog/security-advisory-asus-m25-nas-vulnerability/; https://onekey.com/blog/security-advisory-asus-m25-nas-vulnerability/
CVE: CVE-2022-1471
Published: 2022-12-01
Description: SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization. Deserializing yaml content provided by an attacker can lead to remote code execution. We recommend using SnakeYaml's SafeConsturctor when parsing untrusted content to restrict deserialization. We recommend upgrading to version 2.0 and beyond.
CVSS Score: 8.3 (HIGH)
CWE: CWE-20, CWE-502
References: http://packetstormsecurity.com/files/175095/PyTorch-Model-Server-Registration-Deserialization-Remote-Code-Execution.html; http://www.openwall.com/lists/oss-security/2023/11/19/1; https://bitbucket.org/snakeyaml/snakeyaml/issues/561/cve-2022-1471-vulnerability-in#comment-64581479
CVE: CVE-2022-3270
Published: 2022-12-01
Description: In multiple products by Festo a remote unauthenticated attacker could use functions of an undocumented  protocol which could lead to a complete loss of confidentiality, integrity and availability.

CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1059
References: https://cert.vde.com/en/advisories/VDE-2022-041/; https://cert.vde.com/en/advisories/VDE-2022-041/
CVE: CVE-2022-28607
Published: 2022-12-01
Description: An issue was discovered in asith-eranga ISIC tour booking through version published on Feb 13th 2018, allows attackers to gain sensitive information via the action parameter to /system/user/modules/mod_users/controller.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://github.com/killmonday/isic.lk-RCE; https://github.com/killmonday/isic.lk-RCE
CVE: CVE-2022-30528
Published: 2022-12-01
Description: SQL Injection vulnerability in asith-eranga ISIC tour booking through version published on Feb 13th 2018, allows attackers to execute arbitrary commands via the username parameter to /system/user/modules/mod_users/controller.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/asith-eranga/isic; https://github.com/killmonday/isic.lk-RCE; https://github.com/asith-eranga/isic
CVE: CVE-2022-37016
Published: 2022-12-01
Description: Symantec Endpoint Protection (Windows) agent may be susceptible to a Privilege Escalation vulnerability, which is a type of issue whereby an attacker may attempt to compromise the software application to gain elevated access to resources that are normally protected from an application or user.
CVSS Score: 9.8 (CRITICAL)
References: https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/21014; https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/21014
CVE: CVE-2022-37017
Published: 2022-12-01
Description: Symantec Endpoint Protection (Windows) agent, prior to 14.3 RU6/14.3 RU5 Patch 1, may be susceptible to a Security Control Bypass vulnerability, which is a type of issue that can potentially allow a threat actor to circumvent existing security controls. This CVE applies narrowly to the Client User Interface Password protection and Policy Import/Export Password protection, if it has been enabled.
CVSS Score: 7.5 (HIGH)
References: https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/21014; https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/21014
CVE: CVE-2022-4257
Published: 2022-12-01
Description: A vulnerability was found in C-DATA Web Management System. It has been rated as critical. This issue affects some unknown processing of the file cgi-bin/jumpto.php of the component GET Parameter Handler. The manipulation of the argument hostname leads to argument injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-214631.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-707, CWE-78
References: https://github.com/siriuswhiter/VulnHub/blob/main/C-Data/rce1.md; https://vuldb.com/?id.214631; https://github.com/siriuswhiter/VulnHub/blob/main/C-Data/rce1.md
CVE: CVE-2022-29837
Published: 2022-12-01
Description: A path traversal vulnerability was addressed in Western Digital My Cloud Home, My Cloud Home Duo and SanDisk ibi which could allow an attacker to initiate installation of custom ZIP packages and overwrite system files. This could potentially lead to a code execution.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://www.westerndigital.com/support/product-security/wdc-22018-western-digital-my-cloud-home-my-cloud-home-duo-and-sandisk-ibi-firmware-version-8-12-0-178; https://www.westerndigital.com/support/product-security/wdc-22018-western-digital-my-cloud-home-my-cloud-home-duo-and-sandisk-ibi-firmware-version-8-12-0-178
CVE: CVE-2022-2969
Published: 2022-12-01
Description: Delta Industrial Automation DIALink versions prior to v1.5.0.0 Beta 4 uses an external input to construct a pathname intended to identify a file or directory located underneath a restricted parent directory. However, the software does not properly neutralize special elements within the pathname, which can cause the pathname to resolve to a location outside of the restricted directory.
CVSS Score: 8.1 (HIGH)
CWE: CWE-22
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-307-03; https://www.cisa.gov/uscert/ics/advisories/icsa-22-307-03
CVE: CVE-2022-3226
Published: 2022-12-01
Description: An OS command injection vulnerability allows admins to execute code via SSL VPN configuration uploads in Sophos Firewall releases older than version 19.5 GA.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78, CWE-78
References: https://www.sophos.com/en-us/security-advisories/sophos-sa-20221201-sfos-19-5-0; https://www.sophos.com/en-us/security-advisories/sophos-sa-20221201-sfos-19-5-0
CVE: CVE-2022-3696
Published: 2022-12-01
Description: A post-auth code injection vulnerability allows admins to execute code in Webadmin of Sophos Firewall releases older than version 19.5 GA.
CVSS Score: 7.2 (HIGH)
CWE: CWE-94, CWE-94
References: https://www.sophos.com/en-us/security-advisories/sophos-sa-20221201-sfos-19-5-0; https://www.sophos.com/en-us/security-advisories/sophos-sa-20221201-sfos-19-5-0
CVE: CVE-2022-3709
Published: 2022-12-01
Description: A stored XSS vulnerability allows admin to super-admin privilege escalation in the Webadmin import group wizard of Sophos Firewall releases older than version 19.5 GA.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.sophos.com/en-us/security-advisories/sophos-sa-20221201-sfos-19-5-0; https://www.sophos.com/en-us/security-advisories/sophos-sa-20221201-sfos-19-5-0
CVE: CVE-2022-3710
Published: 2022-12-01
Description: A post-auth read-only SQL injection vulnerability allows API clients to read non-sensitive configuration database contents in the API controller of Sophos Firewall releases older than version 19.5 GA.
CVSS Score: 2.7 (LOW)
CWE: CWE-89, CWE-89
References: https://www.sophos.com/en-us/security-advisories/sophos-sa-20221201-sfos-19-5-0; https://www.sophos.com/en-us/security-advisories/sophos-sa-20221201-sfos-19-5-0
CVE: CVE-2022-3711
Published: 2022-12-01
Description: A post-auth read-only SQL injection vulnerability allows users to read non-sensitive configuration database contents in the User Portal of Sophos Firewall releases older than version 19.5 GA.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://www.sophos.com/en-us/security-advisories/sophos-sa-20221201-sfos-19-5-0; https://www.sophos.com/en-us/security-advisories/sophos-sa-20221201-sfos-19-5-0
CVE: CVE-2022-3713
Published: 2022-12-01
Description: A code injection vulnerability allows adjacent attackers to execute code in the Wifi controller of Sophos Firewall releases older than version 19.5 GA.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94, CWE-94
References: https://www.sophos.com/en-us/security-advisories/sophos-sa-20221201-sfos-19-5-0; https://www.sophos.com/en-us/security-advisories/sophos-sa-20221201-sfos-19-5-0
CVE: CVE-2022-41297
Published: 2022-12-01
Description: IBM Db2U 3.5, 4.0, and 4.5 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.  IBM X-Force ID:  237212.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/237212; https://www.ibm.com/support/pages/node/6843071; https://exchange.xforce.ibmcloud.com/vulnerabilities/237212
CVE: CVE-2022-43900
Published: 2022-12-01
Description: 
IBM WebSphere Automation for IBM Cloud Pak for Watson AIOps 1.4.2 could provide a weaker than expected security. A local attacker can create an outbound network connection to another system. IBM X-Force ID: 240827.


CVSS Score: 5.3 (MEDIUM)
CWE: CWE-287, CWE-287
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/240827; https://www.ibm.com/support/pages/node/6842605; https://exchange.xforce.ibmcloud.com/vulnerabilities/240827
CVE: CVE-2022-43901
Published: 2022-12-01
Description: 
IBM WebSphere Automation for IBM Cloud Pak for Watson AIOps 1.4.3 could disclose sensitive information. An authenticated local attacker could exploit this vulnerability to possibly gain information to other IBM WebSphere Automation for IBM Cloud Pak for Watson AIOps components. IBM X-Force ID: 240829.


CVSS Score: 5.7 (MEDIUM)
CWE: CWE-200, CWE-668
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/240829; https://www.ibm.com/support/pages/node/6842605; https://exchange.xforce.ibmcloud.com/vulnerabilities/240829
CVE: CVE-2022-23737
Published: 2022-12-01
Description: An improper privilege management vulnerability was identified in GitHub Enterprise Server that allowed users with improper privileges to create or delete pages via the API. To exploit this vulnerability, an attacker would need to be added to an organization's repo with write permissions. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.7 and was fixed in versions 3.2.20, 3.3.15, 3.4.10, 3.5.7, and 3.6.3. This vulnerability was reported via the GitHub Bug Bounty program.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-269, CWE-269, CWE-269
References: https://docs.github.com/en/enterprise-server%403.2/admin/release-notes#3.2.20; https://docs.github.com/en/enterprise-server%403.3/admin/release-notes#3.3.15; https://docs.github.com/en/enterprise-server%403.4/admin/release-notes#3.4.10
CVE: CVE-2022-41968
Published: 2022-12-01
Description: Nextcloud Server is an open source personal cloud server. Prior to versions 23.0.10 and 24.0.5, calendar name lengths are not validated before writing to a database. As a result, an attacker can send unnecessary amounts of data against the database. Version 23.0.10 and 24.0.5 contain patches for the issue. No known workarounds are available.
CVSS Score: 3.5 (LOW)
CWE: CWE-400, CWE-1284
References: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-m92j-xxc8-hq3v; https://github.com/nextcloud/server/pull/33139; https://hackerone.com/reports/1596148
CVE: CVE-2022-41969
Published: 2022-12-01
Description: Nextcloud Server is an open source personal cloud server. Prior to versions 23.0.11, 24.0.7, and 25.0.0, there is no password length limit when creating a user as an administrator. An administrator can cause a limited DoS attack against their own server. Versions 23.0.11, 24.0.7, and 25.0.0 contain a fix for the issue. As a workaround, don't create user accounts with long passwords.
CVSS Score: 2.4 (LOW)
CWE: CWE-400, CWE-521
References: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-4gm7-j7wg-m4fx; https://github.com/nextcloud/server/pull/34500; https://hackerone.com/reports/1727424
CVE: CVE-2022-41970
Published: 2022-12-01
Description: Nextcloud Server is an open source personal cloud server. Prior to versions 24.0.7 and 25.0.1, disabled download shares still allow download through preview images. Images could be downloaded and previews of documents (first page) can be downloaded without being watermarked. Versions 24.0.7 and 25.0.1 contain a fix for this issue. No known workarounds are available.
CVSS Score: 2.6 (LOW)
CWE: CWE-284, CWE-863, CWE-863
References: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-9mh6-cph8-772c; https://github.com/nextcloud/server/pull/34788; https://hackerone.com/reports/1745766
CVE: CVE-2022-41971
Published: 2022-12-01
Description: Nextcould Talk android is a video and audio conferencing app for Nextcloud. Prior to versions 12.2.8, 13.0.10, 14.0.6, and 15.0.0, guests can continue to receive video streams from a call after being removed from a conversation. An attacker would be able to see videos on a call in a public conversation after being removed from that conversation, provided that they were removed while being in the call. Versions 12.2.8, 13.0.10, 14.0.6, and 15.0.0 contain patches for the issue. No known workarounds are available.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-200, CWE-359, CWE-668
References: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-wx6w-xpg9-6fv4; https://github.com/nextcloud/spreed/pull/7974; https://hackerone.com/reports/1706248
CVE: CVE-2022-42718
Published: 2022-12-01
Description: Incorrect default permissions in the installation folder for NI LabVIEW Command Line Interface (CLI) may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276, CWE-276
References: https://www.ni.com/en-us/support/documentation/supplemental/22/privilege-escalation-in-ni-labview-cli-.html; https://www.ni.com/en-us/support/documentation/supplemental/22/privilege-escalation-in-ni-labview-cli-.html
CVE: CVE-2022-35120
Published: 2022-12-01
Description: IXPdata EasyInstall 6.6.14725 contains an access control issue.
CVSS Score: 8.8 (HIGH)
CWE: CWE-312, CWE-312
References: https://la.rsbir.ch/CVE-2022-35120.pdf; https://la.rsbir.ch/CVE-2022-35120.pdf
CVE: CVE-2022-43333
Published: 2022-12-01
Description: Telenia Software s.r.l TVox before v22.0.17 was discovered to contain a remote code execution (RCE) vulnerability in the component action_export_control.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://www.swascan.com/it/security-advisory-telenia-software-tvox/; https://www.swascan.com/it/security-advisory-telenia-software-tvox/
CVE: CVE-2022-44211
Published: 2022-12-01
Description: In GL.iNet Goodcloud 1.1 Incorrect access control allows a remote attacker to access/change devices' settings.
CVSS Score: 7.4 (HIGH)
CWE: CWE-284
References: https://forum.gl-inet.com/t/security-advisories-vulnerabilities-and-cves-of-gl-inet-software/25518; https://forum.gl-inet.com/t/security-advisories-vulnerabilities-and-cves-of-gl-inet-software/25518
CVE: CVE-2022-44212
Published: 2022-12-01
Description: In GL.iNet Goodcloud 1.0, insecure design allows remote attacker to access devices' admin panel.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-284
References: https://forum.gl-inet.com/t/security-advisories-vulnerabilities-and-cves-of-gl-inet-software/25518/2; https://forum.gl-inet.com/t/security-advisories-vulnerabilities-and-cves-of-gl-inet-software/25518/2
CVE: CVE-2022-43325
Published: 2022-12-02
Description: An unauthenticated command injection vulnerability in the product license validation function of Telos Alliance Omnia MPX Node 1.3.* - 1.4.* allows attackers to execute arbitrary commands via a crafted payload injected into the license input.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://cyber-guy.gitbook.io/cyber-guys-blog/pocs/cve-2022-43325; https://cyber-guy.gitbook.io/cyber-guys-blog/pocs/cve-2022-43325
CVE: CVE-2022-44928
Published: 2022-12-02
Description: D-Link DVG-G5402SP GE_1.03 was discovered to contain a command injection vulnerability via the Maintenance function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://cyber-guy.gitbook.io/cyber-guys-blog/pocs/cve-2022-44928; https://cyber-guy.gitbook.io/cyber-guys-blog/pocs/cve-2022-44928
CVE: CVE-2022-44929
Published: 2022-12-02
Description: An access control issue in D-Link DVG-G5402SP GE_1.03 allows unauthenticated attackers to escalate privileges via arbitrarily editing VoIP SIB profiles.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-276
References: https://cyber-guy.gitbook.io/cyber-guys-blog/pocs/cve-2022-44929; https://cyber-guy.gitbook.io/cyber-guys-blog/pocs/cve-2022-44929
CVE: CVE-2022-44930
Published: 2022-12-02
Description: D-Link DHP-W310AV 3.10EU was discovered to contain a command injection vulnerability via the System Checks function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://cyber-guy.gitbook.io/cyber-guys-blog/pocs/cve-2022-44930; https://cyber-guy.gitbook.io/cyber-guys-blog/pocs/cve-2022-44930
CVE: CVE-2022-45562
Published: 2022-12-02
Description: Insecure permissions in Telos Alliance Omnia MPX Node v1.0.0 to v1.4.9 allow attackers to manipulate and access system settings with backdoor account low privilege, this can lead to change hardware settings and execute arbitrary commands in vulnerable system functions that is requires high privilege to access.
CVSS Score: 8.8 (HIGH)
CWE: CWE-276, CWE-276
References: https://cyber-guy.gitbook.io/cyber-guys-blog/pocs/cve-2022-45562; https://cyber-guy.gitbook.io/cyber-guys-blog/pocs/cve-2022-45562
CVE: CVE-2022-2807
Published: 2022-12-02
Description: SQL Injection vulnerability in Algan Software Prens Student Information System allows SQL Injection.This issue affects Prens Student Information System: before 2.1.11.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://www.usom.gov.tr/bildirim/tr-22-0708; https://www.usom.gov.tr/bildirim/tr-22-0708
CVE: CVE-2022-2808
Published: 2022-12-02
Description: Authorization Bypass Through User-Controlled Key vulnerability in Algan Software Prens Student Information System allows Object Relational Mapping Injection.This issue affects Prens Student Information System: before 2.1.11.
CVSS Score: 8.8 (HIGH)
CWE: CWE-639, CWE-639
References: https://www.usom.gov.tr/bildirim/tr-22-0708; https://www.usom.gov.tr/bildirim/tr-22-0708