deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-25749
Published: 2023-05-24
Description: Windows workloads can run as ContainerAdministrator even when those workloads set the runAsNonRoot option to true.
CVSS Score: 7.8 (HIGH)
CWE: CWE-284
References: https://groups.google.com/g/kubernetes-security-announce/c/qqTZgulISzA; https://groups.google.com/g/kubernetes-security-announce/c/qqTZgulISzA
CVE: CVE-2022-47446
Published: 2023-05-24
Description: Cross-Site Request Forgery (CSRF) vulnerability in Viadat Creations Store Locator for WordPress with Google Maps – LotsOfLocales plugin <= 3.98.7 versions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/store-locator/wordpress-store-locator-for-wordpress-with-google-maps-lotsoflocales-plugin-3-98-7-cross-site-request-forgery-csrf?_s_id=cve; https://patchstack.com/database/vulnerability/store-locator/wordpress-store-locator-for-wordpress-with-google-maps-lotsoflocales-plugin-3-98-7-cross-site-request-forgery-csrf?_s_id=cve
CVE: CVE-2022-47447
Published: 2023-05-24
Description: Cross-Site Request Forgery (CSRF) vulnerability in Mathieu Chartier WordPress WP-Advanced-Search plugin <= 3.3.8 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/wp-advanced-search/wordpress-wp-advanced-search-plugin-3-3-8-cross-site-request-forgery-csrf?_s_id=cve; https://patchstack.com/database/vulnerability/wp-advanced-search/wordpress-wp-advanced-search-plugin-3-3-8-cross-site-request-forgery-csrf?_s_id=cve
CVE: CVE-2022-47448
Published: 2023-05-24
Description: Cross-Site Request Forgery (CSRF) vulnerability in dev.Xiligroup.Com - MS plugin <= 1.12.03 versions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://patchstack.com/database/vulnerability/xili-tidy-tags/wordpress-xili-tidy-tags-plugin-1-12-03-cross-site-request-forgery-csrf?_s_id=cve; https://patchstack.com/database/vulnerability/xili-tidy-tags/wordpress-xili-tidy-tags-plugin-1-12-03-cross-site-request-forgery-csrf?_s_id=cve
CVE: CVE-2023-1174
Published: 2023-05-24
Description: This vulnerability exposes a network port in minikube running on macOS with Docker driver that could enable unexpected remote access to the minikube container.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-266
References: https://groups.google.com/g/kubernetes-security-announce/c/2ZkJFMDTKbM; https://groups.google.com/g/kubernetes-security-announce/c/2ZkJFMDTKbM
CVE: CVE-2023-1944
Published: 2023-05-24
Description: This vulnerability enables ssh access to minikube container using a default password.
CVSS Score: 8.4 (HIGH)
CWE: CWE-259, CWE-798
References: https://github.com/kubernetes/minikube; https://github.com/kubernetes/minikube
CVE: CVE-2023-25028
Published: 2023-05-24
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in chuyencode CC Custom Taxonomy plugin <= 1.0.1 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/cc-custom-taxonmy/wordpress-cc-custom-taxonomy-plugin-1-0-1-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/cc-custom-taxonmy/wordpress-cc-custom-taxonomy-plugin-1-0-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-33949
Published: 2023-05-24
Description: In Liferay Portal 7.3.0 and earlier, and Liferay DXP 7.2 and earlier the default configuration does not require users to verify their email address, which allows remote attackers to create accounts using fake email addresses or email addresses which they don't control. The portal property `company.security.strangers.verify` should be set to true.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-1188, CWE-1188
References: https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33949; https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33949
CVE: CVE-2023-33950
Published: 2023-05-24
Description: Pattern Redirects in Liferay Portal 7.4.3.48 through 7.4.3.76, and Liferay DXP 7.4 update 48 through 76 allows regular expressions that are vulnerable to ReDoS attacks to be used as patterns, which allows remote attackers to consume an excessive amount of server resources via crafted request URLs.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-1333, CWE-1333
References: https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33950; https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33950
CVE: CVE-2023-2870
Published: 2023-05-24
Description: A vulnerability was found in EnTech Monitor Asset Manager 2.9. It has been declared as problematic. Affected by this vulnerability is the function 0x80002014 of the component IoControlCode Handler. The manipulation leads to denial of service. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The identifier VDB-229849 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.3 (LOW)
CWE: CWE-404
References: https://drive.google.com/file/d/1ehTYhcdeTiB4rQ38n5FqhQZgVqcvvPE_/view?usp=sharing; https://github.com/zeze-zeze/WindowsKernelVuln/blob/master/CVE-2023-2870; https://vuldb.com/?ctiid.229849
CVE: CVE-2023-2871
Published: 2023-05-24
Description: A vulnerability was found in FabulaTech USB for Remote Desktop 6.1.0.0. It has been rated as problematic. Affected by this issue is the function 0x220448/0x220420/0x22040c/0x220408 of the component IoControlCode Handler. The manipulation leads to null pointer dereference. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. VDB-229850 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.3 (LOW)
CWE: CWE-476
References: https://drive.google.com/file/d/1Y8e5f0AjddrozLv155r9cNhkXwwwZbYE/view?usp=sharing; https://github.com/zeze-zeze/WindowsKernelVuln/blob/master/CVE-2023-2871; https://vuldb.com/?ctiid.229850
CVE: CVE-2023-2872
Published: 2023-05-24
Description: A vulnerability classified as problematic has been found in FlexiHub 5.5.14691.0. This affects the function 0x220088 in the library fusbhub.sys of the component IoControlCode Handler. The manipulation leads to null pointer dereference. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-229851. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://drive.google.com/file/d/1h-7fnmb31bkEW4FoLNDlneftDqS4TQHT/view?usp=sharing; https://github.com/zeze-zeze/WindowsKernelVuln/blob/master/CVE-2023-2872; https://vuldb.com/?ctiid.229851
CVE: CVE-2023-2873
Published: 2023-05-24
Description: A vulnerability classified as critical was found in Twister Antivirus 8. This vulnerability affects the function 0x804f2143/0x804f217f/0x804f214b/0x80800043 in the library filppd.sys of the component IoControlCode Handler. The manipulation leads to memory corruption. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-229852. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-119, CWE-787
References: https://drive.google.com/file/d/1ABRMxr6Ek02P_WAXjyYLGQ4sHYMVQTka/view?usp=sharing; https://github.com/zeze-zeze/WindowsKernelVuln/blob/master/CVE-2023-2873; https://vuldb.com/?ctiid.229852
CVE: CVE-2023-33980
Published: 2023-05-24
Description: Bramble Synchronisation Protocol (BSP) in Briar before 1.4.22 allows attackers to cause a denial of service (repeated application crashes) via a series of long messages to a contact.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://briarproject.org/news/2023-three-security-issues-found-and-fixed/; https://ethz.ch/content/dam/ethz/special-interest/infk/inst-infsec/appliedcrypto/education/theses/report_YuanmingSong.pdf; https://briarproject.org/news/2023-three-security-issues-found-and-fixed/
CVE: CVE-2023-33981
Published: 2023-05-24
Description: Briar before 1.4.22 allows attackers to spoof other users' messages in a blog, forum, or private group, but each spoofed message would need to be an exact duplicate of a legitimate message displayed alongside the spoofed one.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-354, CWE-354
References: https://briarproject.org/news/2023-three-security-issues-found-and-fixed/; https://ethz.ch/content/dam/ethz/special-interest/infk/inst-infsec/appliedcrypto/education/theses/report_YuanmingSong.pdf; https://briarproject.org/news/2023-three-security-issues-found-and-fixed/
CVE: CVE-2023-33982
Published: 2023-05-24
Description: Bramble Handshake Protocol (BHP) in Briar before 1.5.3 is not forward secure: eavesdroppers can decrypt network traffic between two accounts if they later compromise both accounts. NOTE: the eavesdropping is typically impractical because BHP runs over an encrypted session that uses the Tor hidden service protocol.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-326, CWE-326
References: https://briarproject.org/news/2023-three-security-issues-found-and-fixed/; https://ethz.ch/content/dam/ethz/special-interest/infk/inst-infsec/appliedcrypto/education/theses/report_YuanmingSong.pdf; https://briarproject.org/news/2023-three-security-issues-found-and-fixed/
CVE: CVE-2023-33983
Published: 2023-05-24
Description: The Introduction Client in Briar through 1.5.3 does not implement out-of-band verification for the public keys of introducees. An introducer can launch man-in-the-middle attacks against later private communication between two introduced parties.
CVSS Score: 7.4 (HIGH)
CWE: CWE-862, CWE-862
References: https://ethz.ch/content/dam/ethz/special-interest/infk/inst-infsec/appliedcrypto/education/theses/report_YuanmingSong.pdf; https://ethz.ch/content/dam/ethz/special-interest/infk/inst-infsec/appliedcrypto/education/theses/report_YuanmingSong.pdf
CVE: CVE-2023-2868
Published: 2023-05-24
Description: A remote command injection vulnerability exists in the Barracuda Email Security Gateway (appliance form factor only) product effecting versions 5.1.3.001-9.2.0.006. The vulnerability arises out of a failure to comprehensively sanitize the processing of .tar file (tape archives). The vulnerability stems from incomplete input validation of a user-supplied .tar file as it pertains to the names of the files contained within the archive. As a consequence, a remote attacker can specifically format these file names in a particular manner that will result in remotely executing a system command through Perl's qx operator with the privileges of the Email Security Gateway product. This issue was fixed as part of BNSF-36456 patch. This patch was automatically applied to all customer appliances.
CVSS Score: 9.4 (CRITICAL)
CWE: CWE-20, CWE-77
References: https://status.barracuda.com/incidents/34kx82j5n4q9; https://www.barracuda.com/company/legal/esg-vulnerability; https://status.barracuda.com/incidents/34kx82j5n4q9
CVE: CVE-2023-2874
Published: 2023-05-24
Description: A vulnerability, which was classified as problematic, has been found in Twister Antivirus 8. This issue affects the function 0x804f2158/0x804f2154/0x804f2150/0x804f215c/0x804f2160/0x80800040/0x804f214c/0x804f2148/0x804f2144/0x801120e4/0x804f213c/0x804f2140 in the library filppd.sys of the component IoControlCode Handler. The manipulation leads to denial of service. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The identifier VDB-229853 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-404
References: https://drive.google.com/file/d/1hcj4tdRveydUv84J5IEQFmjF1XxUvxGy/view?usp=sharing; https://github.com/zeze-zeze/WindowsKernelVuln/blob/master/CVE-2023-2874; https://vuldb.com/?ctiid.229853
CVE: CVE-2023-2875
Published: 2023-05-24
Description: A vulnerability, which was classified as problematic, was found in eScan Antivirus 22.0.1400.2443. Affected is the function 0x22E008u in the library PROCOBSRVESX.SYS of the component IoControlCode Handler. The manipulation leads to null pointer dereference. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. VDB-229854 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://drive.google.com/file/d/1fvlP0d9HmApjWhYDjgsdco7g7FPsbn0V/view?usp=sharing; https://github.com/zeze-zeze/WindowsKernelVuln/blob/master/CVE-2023-2875; https://vuldb.com/?ctiid.229854
CVE: CVE-2022-42225
Published: 2023-05-24
Description: Jumpserver 2.10.0 <= version <= 2.26.0 contains multiple stored XSS vulnerabilities because of improper filtering of user input, which can execute any javascript under admin's permission.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://gist.github.com/bybit-sec/eb750c1d906c89e97092b[PII_REDACTED]8; https://github.com/jumpserver/lina/blob/v2.10.0/src/views/settings/SystemMessageSubscription/SelectDialog.vue#L43; https://github.com/jumpserver/lina/blob/v2.11.0/src/layout/components/NavHeader/SiteMessages.vue#L40
CVE: CVE-2023-25598
Published: 2023-05-24
Description: A vulnerability in the conferencing component of Mitel MiVoice Connect through 19.3 SP2 and 20.x, 21.x, and 22.x through 22.24.1500.0 could allow an unauthenticated attacker to conduct a reflected cross-site scripting (XSS) attack due to insufficient validation for the home.php page. A successful exploit could allow an attacker to execute arbitrary scripts.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.mitel.com/support/security-advisories; https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-23-0003; https://www.mitel.com/support/security-advisories
CVE: CVE-2023-31457
Published: 2023-05-24
Description: A vulnerability in the Headquarters server component of Mitel MiVoice Connect versions 19.3 SP2 (22.24.1500.0) and earlier could allow an unauthenticated attacker with internal network access to execute arbitrary scripts due to improper access control.
CVSS Score: 9.8 (CRITICAL)
References: https://www.mitel.com/support/security-advisories; https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-23-0004; https://www.mitel.com/support/security-advisories
CVE: CVE-2023-31459
Published: 2023-05-24
Description: A vulnerability in the Connect Mobility Router component of Mitel MiVoice Connect versions 9.6.2208.101 and earlier could allow an unauthenticated attacker with internal network access to authenticate with administrative privileges, because the initial installation does not enforce a password change. A successful exploit could allow an attacker to make arbitrary configuration changes and execute arbitrary commands.
CVSS Score: 8.8 (HIGH)
CWE: CWE-640, CWE-640
References: https://www.mitel.com/support/security-advisories; https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-23-0006; https://www.mitel.com/support/security-advisories
CVE: CVE-2023-31460
Published: 2023-05-24
Description: A vulnerability in the Connect Mobility Router component of MiVoice Connect versions 9.6.2208.101 and earlier could allow an authenticated attacker with internal network access to conduct a command injection attack due to insufficient restriction on URL parameters.
CVSS Score: 7.2 (HIGH)
CWE: CWE-77, CWE-77
References: https://www.mitel.com/support/security-advisories; https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-23-0007; https://www.mitel.com/support/security-advisories
CVE: CVE-2023-31595
Published: 2023-05-24
Description: IC Realtime ICIP-P2012T 2.420 is vulnerable to Incorrect Access Control via unauthenticated port access.
CVSS Score: 7.5 (HIGH)
References: http://ic.com; https://github.com/Yozarseef95/CVE-2023-31595; http://ic.com
CVE: CVE-2023-33785
Published: 2023-05-24
Description: A stored cross-site scripting (XSS) vulnerability in the Create Rack Roles (/dcim/rack-roles/) function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/anhdq201/netbox/issues/8; https://github.com/anhdq201/netbox/issues/8
CVE: CVE-2023-33786
Published: 2023-05-24
Description: A stored cross-site scripting (XSS) vulnerability in the Create Circuit Types (/circuits/circuit-types/) function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/anhdq201/netbox/issues/2; https://github.com/anhdq201/netbox/issues/2
CVE: CVE-2023-33787
Published: 2023-05-24
Description: A stored cross-site scripting (XSS) vulnerability in the Create Tenant Groups (/tenancy/tenant-groups/) function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/anhdq201/netbox/issues/6; https://github.com/anhdq201/netbox/issues/6
CVE: CVE-2023-33788
Published: 2023-05-24
Description: A stored cross-site scripting (XSS) vulnerability in the Create Providers (/circuits/providers/) function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/anhdq201/netbox/issues/3; https://github.com/anhdq201/netbox/issues/3
CVE: CVE-2023-33789
Published: 2023-05-24
Description: A stored cross-site scripting (XSS) vulnerability in the Create Contact Groups (/tenancy/contact-groups/) function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/anhdq201/netbox/issues/7; https://github.com/anhdq201/netbox/issues/7
CVE: CVE-2023-33790
Published: 2023-05-24
Description: A stored cross-site scripting (XSS) vulnerability in the Create Locations (/dcim/locations/) function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/anhdq201/netbox/issues/9; https://github.com/anhdq201/netbox/issues/9
CVE: CVE-2023-33791
Published: 2023-05-24
Description: A stored cross-site scripting (XSS) vulnerability in the Create Provider Accounts (/circuits/provider-accounts/) function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/anhdq201/netbox/issues/4; https://github.com/anhdq201/netbox/issues/4
CVE: CVE-2023-33792
Published: 2023-05-24
Description: A stored cross-site scripting (XSS) vulnerability in the Create Site Groups (/dcim/site-groups/) function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/anhdq201/netbox/issues/10; https://github.com/anhdq201/netbox/issues/10
CVE: CVE-2023-33793
Published: 2023-05-24
Description: A stored cross-site scripting (XSS) vulnerability in the Create Power Panels (/dcim/power-panels/) function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/anhdq201/netbox/issues/1; https://github.com/anhdq201/netbox/issues/1
CVE: CVE-2023-33794
Published: 2023-05-24
Description: A stored cross-site scripting (XSS) vulnerability in the Create Tenants (/tenancy/tenants/) function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/anhdq201/netbox/issues/5; https://github.com/anhdq201/netbox/issues/5
CVE: CVE-2023-33795
Published: 2023-05-24
Description: A stored cross-site scripting (XSS) vulnerability in the Create Contact Roles (/tenancy/contact-roles/) function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/anhdq201/netbox/issues/15; https://github.com/anhdq201/netbox/issues/15
CVE: CVE-2023-33796
Published: 2023-05-24
Description: A vulnerability in Netbox v3.5.1 allows unauthenticated attackers to execute queries against the GraphQL database, granting them access to sensitive data stored in the database. NOTE: the vendor disputes this because the reporter's only query was for the schema of the API, which is public; queries for database objects would have been denied.
CVSS Score: 9.1 (CRITICAL)
References: https://github.com/anhdq201/netbox/issues/16; https://github.com/netbox-community/netbox/discussions/12729#discussioncomment-6008669; https://github.com/anhdq201/netbox/issues/16
CVE: CVE-2023-33797
Published: 2023-05-24
Description: A stored cross-site scripting (XSS) vulnerability in the Create Sites (/dcim/sites/) function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/anhdq201/netbox/issues/12; https://github.com/anhdq201/netbox/issues/12
CVE: CVE-2023-33798
Published: 2023-05-24
Description: A stored cross-site scripting (XSS) vulnerability in the Create Rack (/dcim/rack/) function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/anhdq201/netbox/issues/13; https://github.com/anhdq201/netbox/issues/13
CVE: CVE-2023-33799
Published: 2023-05-24
Description: A stored cross-site scripting (XSS) vulnerability in the Create Contacts (/tenancy/contacts/) function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/anhdq201/netbox/issues/14; https://github.com/anhdq201/netbox/issues/14
CVE: CVE-2023-33800
Published: 2023-05-24
Description: A stored cross-site scripting (XSS) vulnerability in the Create Regions (/dcim/regions/) function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/anhdq201/netbox/issues/11; https://github.com/anhdq201/netbox/issues/11
CVE: CVE-2022-30025
Published: 2023-05-24
Description: SQL injection in "/Framewrk/Home.jsp" file (POST method) in tCredence Analytics iDEAL Wealth and Funds - 1.0 iallows authenticated remote attackers to inject payload via "v" parameter.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://gist.github.com/fir3storm/c8a013d1231c22e[PII_REDACTED]9620afd; https://gist.github.com/fir3storm/c8a013d1231c22e[PII_REDACTED]9620afd