deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-2859
Published: 2022-09-26
Description: Use after free in Chrome OS Shell in Google Chrome prior to 104.0.5112.101 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via specific UI interactions.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop_16.html; https://crbug.com/1338412; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4NMJURTG5RO3TGD7ZMIQ6Z4ZZ3SAVYE/
CVE: CVE-2022-2860
Published: 2022-09-26
Description: Insufficient policy enforcement in Cookies in Google Chrome prior to 104.0.5112.101 allowed a remote attacker to bypass cookie prefix restrictions via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
References: https://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop_16.html; https://crbug.com/1345193; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4NMJURTG5RO3TGD7ZMIQ6Z4ZZ3SAVYE/
CVE: CVE-2022-2861
Published: 2022-09-26
Description: Inappropriate implementation in Extensions API in Google Chrome prior to 104.0.5112.101 allowed an attacker who convinced a user to install a malicious extension to inject arbitrary scripts into WebUI via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop_16.html; https://crbug.com/1346236; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4NMJURTG5RO3TGD7ZMIQ6Z4ZZ3SAVYE/
CVE: CVE-2022-2998
Published: 2022-09-26
Description: Use after free in Browser Creation in Google Chrome prior to 104.0.5112.101 allowed a remote attacker who had convinced a user to engage in a specific UI interaction to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop_16.html; https://crbug.com/1329794; https://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop_16.html
CVE: CVE-2022-3038
Published: 2022-09-26
Description: Use after free in Network Service in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: http://packetstormsecurity.com/files/168596/Google-Chrome-103.0.5060.53-network-URLLoader-NotifyCompleted-Heap-Use-After-Free.html; https://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop_30.html; https://crbug.com/1340253
CVE: CVE-2022-3039
Published: 2022-09-26
Description: Use after free in WebSQL in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop_30.html; https://crbug.com/1343348; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4NMJURTG5RO3TGD7ZMIQ6Z4ZZ3SAVYE/
CVE: CVE-2022-3040
Published: 2022-09-26
Description: Use after free in Layout in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop_30.html; https://crbug.com/1341539; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4NMJURTG5RO3TGD7ZMIQ6Z4ZZ3SAVYE/
CVE: CVE-2022-3041
Published: 2022-09-26
Description: Use after free in WebSQL in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop_30.html; https://crbug.com/1345947; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4NMJURTG5RO3TGD7ZMIQ6Z4ZZ3SAVYE/
CVE: CVE-2022-3042
Published: 2022-09-26
Description: Use after free in PhoneHub in Google Chrome on Chrome OS prior to 105.0.5195.52 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-362, CWE-362
References: https://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop_30.html; https://crbug.com/1338553; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4NMJURTG5RO3TGD7ZMIQ6Z4ZZ3SAVYE/
CVE: CVE-2022-3043
Published: 2022-09-26
Description: Heap buffer overflow in Screen Capture in Google Chrome on Chrome OS prior to 105.0.5195.52 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop_30.html; https://crbug.com/1336979; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4NMJURTG5RO3TGD7ZMIQ6Z4ZZ3SAVYE/
CVE: CVE-2022-3044
Published: 2022-09-26
Description: Inappropriate implementation in Site Isolation in Google Chrome prior to 105.0.5195.52 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-693
References: https://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop_30.html; https://crbug.com/1051198; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4NMJURTG5RO3TGD7ZMIQ6Z4ZZ3SAVYE/
CVE: CVE-2022-3045
Published: 2022-09-26
Description: Insufficient validation of untrusted input in V8 in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop_30.html; https://crbug.com/1339648; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4NMJURTG5RO3TGD7ZMIQ6Z4ZZ3SAVYE/
CVE: CVE-2022-3046
Published: 2022-09-26
Description: Use after free in Browser Tag in Google Chrome prior to 105.0.5195.52 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop_30.html; https://crbug.com/1346245; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4NMJURTG5RO3TGD7ZMIQ6Z4ZZ3SAVYE/
CVE: CVE-2022-3047
Published: 2022-09-26
Description: Insufficient policy enforcement in Extensions API in Google Chrome prior to 105.0.5195.52 allowed an attacker who convinced a user to install a malicious extension to bypass downloads policy via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-602
References: https://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop_30.html; https://crbug.com/1342586; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4NMJURTG5RO3TGD7ZMIQ6Z4ZZ3SAVYE/
CVE: CVE-2022-3048
Published: 2022-09-26
Description: Inappropriate implementation in Chrome OS lockscreen in Google Chrome on Chrome OS prior to 105.0.5195.52 allowed a local attacker to bypass lockscreen navigation restrictions via physical access to the device.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-863, CWE-863
References: https://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop_30.html; https://crbug.com/1303308; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4NMJURTG5RO3TGD7ZMIQ6Z4ZZ3SAVYE/
CVE: CVE-2022-3049
Published: 2022-09-26
Description: Use after free in SplitScreen in Google Chrome on Chrome OS, Lacros prior to 105.0.5195.52 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-362, CWE-362
References: https://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop_30.html; https://crbug.com/1316892; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4NMJURTG5RO3TGD7ZMIQ6Z4ZZ3SAVYE/
CVE: CVE-2022-3050
Published: 2022-09-26
Description: Heap buffer overflow in WebUI in Google Chrome on Chrome OS prior to 105.0.5195.52 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via crafted UI interactions.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop_30.html; https://crbug.com/1337132; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4NMJURTG5RO3TGD7ZMIQ6Z4ZZ3SAVYE/
CVE: CVE-2022-3051
Published: 2022-09-26
Description: Heap buffer overflow in Exosphere in Google Chrome on Chrome OS, Lacros prior to 105.0.5195.52 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via crafted UI interactions.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop_30.html; https://crbug.com/1345245; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4NMJURTG5RO3TGD7ZMIQ6Z4ZZ3SAVYE/
CVE: CVE-2022-3052
Published: 2022-09-26
Description: Heap buffer overflow in Window Manager in Google Chrome on Chrome OS, Lacros prior to 105.0.5195.52 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via crafted UI interactions.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop_30.html; https://crbug.com/1346154; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4NMJURTG5RO3TGD7ZMIQ6Z4ZZ3SAVYE/
CVE: CVE-2022-3053
Published: 2022-09-26
Description: Inappropriate implementation in Pointer Lock in Google Chrome on Mac prior to 105.0.5195.52 allowed a remote attacker to restrict user navigation via a crafted HTML page.
CVSS Score: 4.3 (MEDIUM)
References: https://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop_30.html; https://crbug.com/1267867; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4NMJURTG5RO3TGD7ZMIQ6Z4ZZ3SAVYE/
CVE: CVE-2022-3054
Published: 2022-09-26
Description: Insufficient policy enforcement in DevTools in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
References: https://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop_30.html; https://crbug.com/1290236; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4NMJURTG5RO3TGD7ZMIQ6Z4ZZ3SAVYE/
CVE: CVE-2022-3055
Published: 2022-09-26
Description: Use after free in Passwords in Google Chrome prior to 105.0.5195.52 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop_30.html; https://crbug.com/1351969; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4NMJURTG5RO3TGD7ZMIQ6Z4ZZ3SAVYE/
CVE: CVE-2022-3056
Published: 2022-09-26
Description: Insufficient policy enforcement in Content Security Policy in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to bypass content security policy via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-693
References: https://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop_30.html; https://crbug.com/1329460; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4NMJURTG5RO3TGD7ZMIQ6Z4ZZ3SAVYE/
CVE: CVE-2022-3057
Published: 2022-09-26
Description: Inappropriate implementation in iframe Sandbox in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop_30.html; https://crbug.com/1336904; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4NMJURTG5RO3TGD7ZMIQ6Z4ZZ3SAVYE/
CVE: CVE-2022-3058
Published: 2022-09-26
Description: Use after free in Sign-In Flow in Google Chrome prior to 105.0.5195.52 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via crafted UI interaction.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop_30.html; https://crbug.com/1337676; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4NMJURTG5RO3TGD7ZMIQ6Z4ZZ3SAVYE/
CVE: CVE-2022-3071
Published: 2022-09-26
Description: Use after free in Tab Strip in Google Chrome on Chrome OS, Lacros prior to 105.0.5195.52 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via crafted UI interaction.
CVSS Score: 8.8 (HIGH)
CWE: CWE-362, CWE-362
References: https://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop_30.html; https://crbug.com/1333995; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4NMJURTG5RO3TGD7ZMIQ6Z4ZZ3SAVYE/
CVE: CVE-2022-3075
Published: 2022-09-26
Description: Insufficient data validation in Mojo in Google Chrome prior to 105.0.5195.102 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-20
References: https://chromereleases.googleblog.com/2022/09/stable-channel-update-for-desktop.html; https://crbug.com/1358134; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4NMJURTG5RO3TGD7ZMIQ6Z4ZZ3SAVYE/
CVE: CVE-2022-3195
Published: 2022-09-26
Description: Out of bounds write in Storage in Google Chrome prior to 105.0.5195.125 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://chromereleases.googleblog.com/2022/09/stable-channel-update-for-desktop_14.html; https://crbug.com/1358381; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4NMJURTG5RO3TGD7ZMIQ6Z4ZZ3SAVYE/
CVE: CVE-2022-3196
Published: 2022-09-26
Description: Use after free in PDF in Google Chrome prior to 105.0.5195.125 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://chromereleases.googleblog.com/2022/09/stable-channel-update-for-desktop_14.html; https://crbug.com/1358090; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4NMJURTG5RO3TGD7ZMIQ6Z4ZZ3SAVYE/
CVE: CVE-2022-3197
Published: 2022-09-26
Description: Use after free in PDF in Google Chrome prior to 105.0.5195.125 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://chromereleases.googleblog.com/2022/09/stable-channel-update-for-desktop_14.html; https://crbug.com/1358075; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4NMJURTG5RO3TGD7ZMIQ6Z4ZZ3SAVYE/
CVE: CVE-2022-3198
Published: 2022-09-26
Description: Use after free in PDF in Google Chrome prior to 105.0.5195.125 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://chromereleases.googleblog.com/2022/09/stable-channel-update-for-desktop_14.html; https://crbug.com/1355682; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4NMJURTG5RO3TGD7ZMIQ6Z4ZZ3SAVYE/
CVE: CVE-2022-3199
Published: 2022-09-26
Description: Use after free in Frames in Google Chrome prior to 105.0.5195.125 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: http://packetstormsecurity.com/files/170012/Chrome-blink-LocalFrameView-PerformLayout-Use-After-Free.html; https://chromereleases.googleblog.com/2022/09/stable-channel-update-for-desktop_14.html; https://crbug.com/1355237
CVE: CVE-2022-3200
Published: 2022-09-26
Description: Heap buffer overflow in Internals in Google Chrome prior to 105.0.5195.125 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://chromereleases.googleblog.com/2022/09/stable-channel-update-for-desktop_14.html; https://crbug.com/1355103; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4NMJURTG5RO3TGD7ZMIQ6Z4ZZ3SAVYE/
CVE: CVE-2022-3201
Published: 2022-09-26
Description: Insufficient validation of untrusted input in DevTools in Google Chrome on Chrome OS prior to 105.0.5195.125 allowed an attacker who convinced a user to install a malicious extension to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-20
References: https://chromereleases.googleblog.com/2022/09/stable-channel-update-for-desktop_14.html; https://crbug.com/1343104; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4NMJURTG5RO3TGD7ZMIQ6Z4ZZ3SAVYE/
CVE: CVE-2022-40043
Published: 2022-09-26
Description: Centreon v20.10.18 was discovered to contain a SQL injection vulnerability via the esc_name (Escalation Name) parameter at Configuration/Notifications/Escalations.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/centreon/centreon/releases; https://www.hakaioffensivesecurity.com/centreon-sqli-and-xss-vulnerability/; https://github.com/centreon/centreon/releases
CVE: CVE-2022-40044
Published: 2022-09-26
Description: Centreon v20.10.18 was discovered to contain a cross-site scripting (XSS) vulnerability via the esc_name (Escalation Name) parameter at Configuration/Notifications/Escalations. This vulnerability allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/centreon/centreon/releases; https://www.hakaioffensivesecurity.com/centreon-sqli-and-xss-vulnerability/; https://github.com/centreon/centreon/releases
CVE: CVE-2022-40784
Published: 2022-09-26
Description: Unlimited strcpy on user input when setting a locale file leads to stack buffer overflow in mIPC camera firmware 5.3.[PII_REDACTED].
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://hackmd.io/%40_zOX-PXQQFmCETA_RZIgow/BkOhIU1oc; https://hackmd.io/%40_zOX-PXQQFmCETA_RZIgow/BkOhIU1oc; https://hackmd.io/@_zOX-PXQQFmCETA_RZIgow/BkOhIU1oc
CVE: CVE-2022-22058
Published: 2022-09-26
Description: Memory corruption due to use after free issue in kernel while processing ION handles in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
CVSS Score: 8.4 (HIGH)
CWE: CWE-416, CWE-416
References: https://www.qualcomm.com/company/product-security/bulletins/july-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/july-2022-bulletin
CVE: CVE-2022-3272
Published: 2022-09-26
Description: Improper Handling of Length Parameter Inconsistency in GitHub repository ikus060/rdiffweb prior to 2.4.8.
CVSS Score: 7.5 (HIGH)
CWE: CWE-130
References: https://github.com/ikus060/rdiffweb/commit/667657c6fe2b336c90be37f37fb92f65df4feee3; https://huntr.dev/bounties/733678b9-daa1-4d6a-875a-382fa09a6e38; https://github.com/ikus060/rdiffweb/commit/667657c6fe2b336c90be37f37fb92f65df4feee3
CVE: CVE-2022-30003
Published: 2022-09-26
Description: Sourcecodester Online Market Place Site 1.0 is vulnerable to Cross Site Scripting (XSS), allowing attackers to register as a Seller then create new products containing XSS payloads in the 'Product Title' and 'Short Description' fields.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://packetstormsecurity.com/files/168250/omps10-xss.txt; https://www.sourcecodester.com/php/15273/online-market-place-site-phpoop-free-source-code.html; https://packetstormsecurity.com/files/168250/omps10-xss.txt
CVE: CVE-2022-3290
Published: 2022-09-26
Description: Improper Handling of Length Parameter Inconsistency in GitHub repository ikus060/rdiffweb prior to 2.4.8.
CVSS Score: 7.5 (HIGH)
CWE: CWE-130
References: https://github.com/ikus060/rdiffweb/commit/667657c6fe2b336c90be37f37fb92f65df4feee3; https://huntr.dev/bounties/d8b8519d-96a5-484c-8141-624c54290bf5; https://github.com/ikus060/rdiffweb/commit/667657c6fe2b336c90be37f37fb92f65df4feee3
CVE: CVE-2022-30004
Published: 2022-09-26
Description: Sourcecodester Online Market Place Site v1.0 suffers from an unauthenticated blind SQL Injection Vulnerability allowing remote attackers to dump the SQL database via time-based SQL injection..
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://packetstormsecurity.com/files/168249/Online-Market-Place-Site-1.0-SQL-Injection.html; https://www.sourcecodester.com/php/15273/online-market-place-site-phpoop-free-source-code.html; https://packetstormsecurity.com/files/168249/Online-Market-Place-Site-1.0-SQL-Injection.html
CVE: CVE-2022-40050
Published: 2022-09-26
Description: ZFile v4.1.1 was discovered to contain an arbitrary file upload vulnerability via the component /file/upload/1.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434, CWE-434
References: https://github.com/achiove/repdosenotexist/blob/main/request4cve.pdf; https://github.com/achiove/repdosenotexist/blob/main/request4cve.pdf
CVE: CVE-2022-40097
Published: 2022-09-26
Description: Online Tours & Travels Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/update_currency.php.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/WYB-signal/Bug_report/blob/main/vendors/mayuri_k/online-tours-travels-management-system/SQLi-1.md; https://github.com/WYB-signal/Bug_report/blob/main/vendors/mayuri_k/online-tours-travels-management-system/SQLi-1.md
CVE: CVE-2022-40098
Published: 2022-09-26
Description: Online Tours & Travels Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/update_expense.php.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/WYB-signal/Bug_report/blob/main/vendors/mayuri_k/online-tours-travels-management-system/SQLi-2.md; https://github.com/WYB-signal/Bug_report/blob/main/vendors/mayuri_k/online-tours-travels-management-system/SQLi-2.md