deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-30148
Published: 2022-06-15
Description: Windows Desired State Configuration (DSC) Information Disclosure Vulnerability
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-532
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30148; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-30148
CVE: CVE-2022-30149
Published: 2022-06-15
Description: Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability
CVSS Score: 7.5 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30149; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-30149
CVE: CVE-2022-30150
Published: 2022-06-15
Description: Windows Defender Remote Credential Guard Elevation of Privilege Vulnerability
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30150; http://packetstormsecurity.com/files/167697/Windows-Defender-Remote-Credential-Guard-Authentication-Relay-Privilege-Escalation.html; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-30150
CVE: CVE-2022-30151
Published: 2022-06-15
Description: Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
CVSS Score: 7.0 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30151; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-30151
CVE: CVE-2022-30152
Published: 2022-06-15
Description: Windows Network Address Translation (NAT) Denial of Service Vulnerability
CVSS Score: 7.5 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30152; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-30152
CVE: CVE-2022-30153
Published: 2022-06-15
Description: Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30153; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-30153
CVE: CVE-2022-30154
Published: 2022-06-15
Description: Microsoft File Server Shadow Copy Agent Service (RVSS) Elevation of Privilege Vulnerability
CVSS Score: 5.3 (MEDIUM)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30154; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-30154
CVE: CVE-2022-30155
Published: 2022-06-15
Description: Windows Kernel Denial of Service Vulnerability
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-193
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30155; http://packetstormsecurity.com/files/167755/Windows-Kernel-nt-MiRelocateImage-Invalid-Read.html; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-30155
CVE: CVE-2022-30157
Published: 2022-06-15
Description: Microsoft SharePoint Server Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30157; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-30157
CVE: CVE-2022-30158
Published: 2022-06-15
Description: Microsoft SharePoint Server Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30158; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-30158
CVE: CVE-2022-30159
Published: 2022-06-15
Description: Microsoft Office Information Disclosure Vulnerability
CVSS Score: 5.5 (MEDIUM)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30159; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-30159
CVE: CVE-2022-30160
Published: 2022-06-15
Description: Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30160; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-30160
CVE: CVE-2022-30161
Published: 2022-06-15
Description: Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30161; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-30161
CVE: CVE-2022-30162
Published: 2022-06-15
Description: Windows Kernel Information Disclosure Vulnerability
CVSS Score: 5.5 (MEDIUM)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30162; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-30162
CVE: CVE-2022-30163
Published: 2022-06-15
Description: Windows Hyper-V Remote Code Execution Vulnerability
CVSS Score: 8.5 (HIGH)
CWE: CWE-362
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30163; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-30163
CVE: CVE-2022-30164
Published: 2022-06-15
Description: Kerberos AppContainer Security Feature Bypass Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30164; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-30164
CVE: CVE-2022-30165
Published: 2022-06-15
Description: Windows Kerberos Elevation of Privilege Vulnerability
CVSS Score: 8.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30165; http://packetstormsecurity.com/files/167711/Windows-Kerberos-Redirected-Logon-Buffer-Privilege-Escalation.html; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-30165
CVE: CVE-2022-30166
Published: 2022-06-15
Description: Local Security Authority Subsystem Service Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30166; http://packetstormsecurity.com/files/167754/Windows-LSA-Service-LsapGetClientInfo-Impersonation-Level-Check-Privilege-Escalation.html; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-30166
CVE: CVE-2022-30167
Published: 2022-06-15
Description: AV1 Video Extension Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30167; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-30167
CVE: CVE-2022-30168
Published: 2022-06-15
Description: Microsoft Photos App Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30168; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-30168
CVE: CVE-2022-30171
Published: 2022-06-15
Description: Microsoft Office Information Disclosure Vulnerability
CVSS Score: 5.5 (MEDIUM)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30171; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-30171
CVE: CVE-2022-30172
Published: 2022-06-15
Description: Microsoft Office Information Disclosure Vulnerability
CVSS Score: 5.5 (MEDIUM)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30172; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-30172
CVE: CVE-2022-30173
Published: 2022-06-15
Description: Microsoft Excel Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30173; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-30173
CVE: CVE-2022-30174
Published: 2022-06-15
Description: Microsoft Office Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30174; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-30174
CVE: CVE-2022-30177
Published: 2022-06-15
Description: Azure RTOS GUIX Studio Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30177; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-30177
CVE: CVE-2022-30178
Published: 2022-06-15
Description: Azure RTOS GUIX Studio Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30178; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-30178
CVE: CVE-2022-30179
Published: 2022-06-15
Description: Azure RTOS GUIX Studio Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30179; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-30179
CVE: CVE-2022-30180
Published: 2022-06-15
Description: Azure RTOS GUIX Studio Information Disclosure Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30180; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-30180
CVE: CVE-2022-30184
Published: 2022-06-15
Description: .NET and Visual Studio Information Disclosure Vulnerability
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30184; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DMP34G53EA2DBTBLFOAQCDZRRENE2EA2/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XWNH4AC3LFVX35MDRX5OBZDGD2AMH66K/
CVE: CVE-2022-30188
Published: 2022-06-15
Description: HEVC Video Extensions Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30188; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-30188
CVE: CVE-2022-30189
Published: 2022-06-15
Description: Windows Autopilot Device Management and Enrollment Client Spoofing Vulnerability
CVSS Score: 6.5 (MEDIUM)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30189; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-30189
CVE: CVE-2022-30193
Published: 2022-06-15
Description: AV1 Video Extension Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30193; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-30193
CVE: CVE-2022-31071
Published: 2022-06-15
Description: Octopoller is a micro gem for polling and retrying. Version 0.2.0 of the octopoller gem was published containing world-writeable files. Specifically, the gem was packed with files having their permissions set to `-rw-rw-rw-` (i.e. 0666) instead of `rw-r--r--` (i.e. 0644). This means everyone who is not the owner (Group and Public) with access to the instance where this release had been installed could modify the world-writable files from this gem. This issue is patched in Octopoller 0.3.0. Two workarounds are available. Users can use the previous version of the gem, v0.1.0. Alternatively, users can modify the file permissions manually until they are able to upgrade to the latest version.
CVSS Score: 2.5 (LOW)
CWE: CWE-276
References: https://github.com/octokit/octopoller.rb/commit/abed2b8d05abe2cc3eb6bdfb34e53d465e7c7874; https://github.com/octokit/octopoller.rb/security/advisories/GHSA-26qj-cr27-r5c4; https://github.com/octokit/octopoller.rb/commit/abed2b8d05abe2cc3eb6bdfb34e53d465e7c7874
CVE: CVE-2022-31072
Published: 2022-06-15
Description: Octokit is a Ruby toolkit for the GitHub API. Versions 4.23.0 and 4.24.0 of the octokit gem were published containing world-writeable files. Specifically, the gem was packed with files having their permissions set to `-rw-rw-rw-` (i.e. 0666) instead of `rw-r--r--` (i.e. 0644). This means everyone who is not the owner (Group and Public) with access to the instance where this release had been installed could modify the world-writable files from this gem. This issue is patched in Octokit 4.25.0. Two workarounds are available. Users can use the previous version of the gem, v4.22.0. Alternatively, users can modify the file permissions manually until they are able to upgrade to the latest version.
CVSS Score: 2.5 (LOW)
CWE: CWE-276
References: https://github.com/octokit/octokit.rb/commit/1c8edecc9cf23d1ceb959d91a416a69f55ce7d55; https://github.com/octokit/octokit.rb/security/advisories/GHSA-g28x-pgr3-qqx6; https://github.com/octokit/octokit.rb/commit/1c8edecc9cf23d1ceb959d91a416a69f55ce7d55
CVE: CVE-2022-30533
Published: 2022-06-16
Description: Cross-site scripting vulnerability in Modern Events Calendar Lite versions prior to 6.3.0 allows remote an authenticated attacker to inject an arbitrary script via unspecified vectors.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://jvn.jp/en/jp/JVN04155116/index.html; https://webnus.net/modern-events-calendar/lite/; https://jvn.jp/en/jp/JVN04155116/index.html
CVE: CVE-2022-30538
Published: 2022-06-16
Description: Out-of-bounds write vulnerability exists in the simulator module contained in the graphic editor 'V-SFT' versions prior to v6.1.6.0, which may allow an attacker to obtain information and/or execute arbitrary code by having a user to open a specially crafted image file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://jvn.jp/en/vu/JVNVU99188133/index.html; https://monitouch.fujielectric.com/site/download-e/09vsft6_inf/Search.php; https://jvn.jp/en/vu/JVNVU99188133/index.html
CVE: CVE-2022-30546
Published: 2022-06-16
Description: Out-of-bounds read vulnerability exists in the simulator module contained in the graphic editor 'V-SFT' versions prior to v6.1.6.0, which may allow an attacker to obtain information and/or execute arbitrary code by having a user to open a specially crafted image file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://jvn.jp/en/vu/JVNVU99188133/index.html; https://monitouch.fujielectric.com/site/download-e/09vsft6_inf/Search.php; https://jvn.jp/en/vu/JVNVU99188133/index.html
CVE: CVE-2022-30549
Published: 2022-06-16
Description: Out-of-bounds read vulnerability exists in V-Server v4.0.11.0 and earlier and V-Server Lite v4.0.13.0 and earlier, which may allow an attacker to obtain information and/or execute arbitrary code by having a user to open a specially crafted image file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://jvn.jp/en/vu/JVNVU93134398/index.html; https://monitouch.fujielectric.com/site/download-e/09vsft6_inf/Search.php; https://monitouch.fujielectric.com/site/download-eu/03tellus_inf/index.php
CVE: CVE-2022-31625
Published: 2022-06-16
Description: In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when using Postgres database extension, supplying invalid parameters to the parametrized query may lead to PHP attempting to free memory using uninitialized data as pointers. This could lead to RCE vulnerability or denial of service.
CVSS Score: 8.1 (HIGH)
CWE: CWE-590, CWE-824, CWE-763
References: https://bugs.php.net/bug.php?id=81720; https://lists.debian.org/debian-lts-announce/2022/12/msg00030.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3T4MMEEZYYAEHPQMZDFN44PHORJWJFZQ/
CVE: CVE-2022-31626
Published: 2022-06-16
Description: In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when pdo_mysql extension with mysqlnd driver, if the third party is allowed to supply host to connect to and the password for the connection, password of excessive length can trigger a buffer overflow in PHP, which can lead to a remote code execution vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-120
References: https://bugs.php.net/bug.php?id=81719; https://lists.debian.org/debian-lts-announce/2022/12/msg00030.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3T4MMEEZYYAEHPQMZDFN44PHORJWJFZQ/
CVE: CVE-2017-20051
Published: 2022-06-16
Description: A vulnerability was found in InnoSetup Installer. It has been declared as problematic. Affected by this vulnerability is an unknown functionality. The manipulation leads to uncontrolled search path. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-427, CWE-427
References: http://seclists.org/fulldisclosure/2017/Mar/8; https://vuldb.com/?id.97837; http://seclists.org/fulldisclosure/2017/Mar/8
CVE: CVE-2017-20052
Published: 2022-06-16
Description: A vulnerability classified as problematic was found in Python 2.7.13. This vulnerability affects unknown code of the component pgAdmin4. The manipulation leads to uncontrolled search path. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-427, CWE-427
References: http://seclists.org/fulldisclosure/2017/Feb/92; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://vuldb.com/?id.97822
CVE: CVE-2021-41402
Published: 2022-06-16
Description: flatCore-CMS v2.0.8 has a code execution vulnerability, which could let a remote malicious user execute arbitrary PHP code.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: https://github.com/flatCore/flatCore-CMS/issues/59; https://github.com/flatCore/flatCore-CMS/issues/59
CVE: CVE-2021-41411
Published: 2022-06-16
Description: drools <=7.59.x is affected by an XML External Entity (XXE) vulnerability in KieModuleMarshaller.java. The Validator class is not used correctly, resulting in the XXE injection vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-611
References: https://github.com/kiegroup/drools/pull/3808; https://github.com/kiegroup/drools/pull/3808
CVE: CVE-2021-41458
Published: 2022-06-16
Description: In GPAC MP4Box v1.1.0, there is a stack buffer overflow at src/utils/error.c:1769 which leads to a denial of service vulnerability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://github.com/gpac/gpac/issues/1910; https://github.com/gpac/gpac/issues/1910
CVE: CVE-2022-2098
Published: 2022-06-16
Description: Weak Password Requirements in GitHub repository kromitgmbh/titra prior to 0.78.1.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-521
References: https://github.com/kromitgmbh/titra/commit/7f09078a2ab88c35f2375c5f67bd0336c0e6c7a1; https://huntr.dev/bounties/a5d6c854-e158-49e9-bf40-bddc93dda7e6; https://github.com/kromitgmbh/titra/commit/7f09078a2ab88c35f2375c5f67bd0336c0e6c7a1
CVE: CVE-2021-41654
Published: 2022-06-16
Description: SQL injection vulnerabilities exist in Wuzhicms v4.1.0 which allows attackers to execute arbitrary SQL commands via the $keyValue parameter in /coreframe/app/pay/admin/index.php
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/wuzhicms/wuzhicms/issues/198; https://github.com/wuzhicms/wuzhicms/issues/198
CVE: CVE-2017-20053
Published: 2022-06-16
Description: A vulnerability was found in XYZScripts Contact Form Manager Plugin. It has been declared as problematic. Affected by this vulnerability is an unknown functionality. The manipulation leads to cross-site request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-352
References: http://seclists.org/fulldisclosure/2017/Feb/99; https://sumofpwn.nl/advisory/2016/cross_site_request_forgery___cross_site_scripting_in_contact_form_manager_wordpress_plugin.html; https://vuldb.com/?id.97387
CVE: CVE-2017-20054
Published: 2022-06-16
Description: A vulnerability was found in XYZScripts Contact Form Manager Plugin. It has been rated as problematic. Affected by this issue is some unknown functionality. The manipulation leads to basic cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-80, CWE-79
References: http://seclists.org/fulldisclosure/2017/Feb/99; https://sumofpwn.nl/advisory/2016/cross_site_request_forgery___cross_site_scripting_in_contact_form_manager_wordpress_plugin.html; https://vuldb.com/?id.97388
CVE: CVE-2017-20055
Published: 2022-06-16
Description: A vulnerability classified as problematic has been found in BestWebSoft Contact Form Plugin 4.0.0. This affects an unknown part. The manipulation leads to basic cross site scripting (Stored). It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.0.2 is able to address this issue. It is recommended to upgrade the affected component.
CVSS Score: 3.5 (LOW)
CWE: CWE-80, CWE-79
References: http://seclists.org/fulldisclosure/2017/Feb/100; https://sumofpwn.nl/advisory/2016/stored_cross_site_scripting_vulnerability_in_contact_form_wordpress_plugin.html; https://vuldb.com/?id.97389
CVE: CVE-2017-20056
Published: 2022-06-16
Description: A vulnerability was found in weblizar User Login Log Plugin 2.2.1. It has been classified as problematic. Affected is an unknown function. The manipulation leads to basic cross site scripting (Stored). It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-80, CWE-79
References: http://seclists.org/fulldisclosure/2017/Feb/98; https://sumofpwn.nl/advisory/2016/stored_cross_site_scripting_vulnerability_in_user_login_log_wordpress_plugin.html; https://vuldb.com/?id.97386
CVE: CVE-2022-31372
Published: 2022-06-16
Description: Wiris Mathtype v7.28.0 was discovered to contain a path traversal vulnerability in the resourceFile parameter. This vulnerability is exploited via a crafted request to the resource handler.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://github.com/wiris/moodle-filter_wiris/commit/037ce9c1d9b9642689a332b6ebee8eaf0a737576; https://github.com/wiris/moodle-filter_wiris/commit/037ce9c1d9b9642689a332b6ebee8eaf0a737576
CVE: CVE-2022-30023
Published: 2022-06-16
Description: Tenda ONT GPON AC1200 Dual band WiFi HG9 v1.0.1 is vulnerable to Command Injection via the Ping function.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: http://ont.com; http://tenda.com; https://github.com/Haniwa0x01/CVE-2022-30023
CVE: CVE-2022-31277
Published: 2022-06-16
Description: Xiaomi Lamp 1 v2.0.4_0066 was discovered to be vulnerable to replay attacks. This allows attackers to to bypass the expected access restrictions and gain control of the switch and other functions via a crafted POST request.
CVSS Score: 8.8 (HIGH)
CWE: CWE-294
References: https://github.com/skyedai910/Vuln/tree/master/xiaomi_lamp_1/replay_attack_0; https://github.com/skyedai910/Vuln/tree/master/xiaomi_lamp_1/replay_attack_0
CVE: CVE-2022-31300
Published: 2022-06-16
Description: A cross-site scripting vulnerability in the DM Section component of Haraj v3.7 allows attackers to execute arbitrary web scripts or HTML via a crafted POST request.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://angtech.org; https://angtech.org/product/view/3; https://github.com/bigzooooz/CVE-2022-31300
CVE: CVE-2022-31849
Published: 2022-06-16
Description: MERCURY MIPC451-4 1.0.22 Build 220105 Rel.55642n was discovered to contain a remote code execution (RCE) vulnerability which is exploitable via a crafted POST request.
CVSS Score: 8.8 (HIGH)
References: https://github.com/skyedai910/Vuln/tree/master/MERCURY_MIPC451-4/command_execution_0; https://github.com/skyedai910/Vuln/tree/master/MERCURY_MIPC451-4/command_execution_0
CVE: CVE-2022-31906
Published: 2022-06-16
Description: Online Fire Reporting System v1.0 is vulnerable to Cross Site Scripting (XSS) via /ofrs/classes/Master.php.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/mikeccltt/0525/blob/main/online-fire-reporting-system/xss.md; https://github.com/mikeccltt/0525/blob/main/online-fire-reporting-system/xss.md
CVE: CVE-2022-31908
Published: 2022-06-16
Description: Student Registration and Fee Payment System v1.0 is vulnerable to SQL Injection via /scms/student.php.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/mikeccltt/0525/blob/main/student-registration-and-fee-payment-system/sql.md; https://github.com/mikeccltt/0525/blob/main/student-registration-and-fee-payment-system/sql.md