rainbutterfly/cve_corpus huggingface dataset:
CVE-2015-0996 
Schneider Electric InduSoft Web Studio before 7.1.3.4 SP3 Patch 4 and InTouch Machine Edition 2014 before 7.1.3.4 SP3 Patch 4 rely on a hardcoded cleartext password to control read access to Project files and Project Configuration files, which makes it easier for local users to obtain sensitive information by discovering this password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-29T10:00:00.000Z
CVE-2015-0997 
Schneider Electric InduSoft Web Studio before 7.1.3.4 SP3 Patch 4 and InTouch Machine Edition 2014 before 7.1.3.4 SP3 Patch 4 provide an HMI user interface that lists all valid usernames, which makes it easier for remote attackers to obtain access via a brute-force password-guessing attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-29T10:00:00.000Z
CVE-2015-0998 
Schneider Electric InduSoft Web Studio before 7.1.3.4 SP3 Patch 4 and InTouch Machine Edition 2014 before 7.1.3.4 SP3 Patch 4 transmit cleartext credentials, which allows remote attackers to obtain sensitive information by sniffing the network.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-29T10:00:00.000Z
CVE-2015-0999 
Schneider Electric InduSoft Web Studio before 7.1.3.4 SP3 Patch 4 and InTouch Machine Edition 2014 before 7.1.3.4 SP3 Patch 4 store cleartext OPC User credentials in a configuration file, which allows local users to obtain sensitive information by reading this file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-29T10:00:00.000Z
CVE-2015-1000000 
Remote file upload vulnerability in mailcwp v1.99 wordpress plugin
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-10-06T14:00:00.000Z
CVE-2015-1000001 
Remote file upload vulnerability in fast-image-adder v1.1 Wordpress plugin
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-10-06T14:00:00.000Z
CVE-2015-1000002 
Open Proxy in filedownload v1.4 wordpress plugin
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-10-06T14:00:00.000Z
CVE-2015-1000003 
Blind SQL Injection in filedownload v1.4 wordpress plugin
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-10-06T14:00:00.000Z
CVE-2015-1000004 
XSS in filedownload v1.4 wordpress plugin
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-10-06T14:00:00.000Z
CVE-2015-1000005 
Remote file download vulnerability in candidate-application-form v1.0 wordpress plugin
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-10-06T14:00:00.000Z
CVE-2015-1000006 
Remote file download vulnerability in recent-backups v0.7 wordpress plugin
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-10-06T14:00:00.000Z
CVE-2015-1000007 
Remote file download vulnerability in wptf-image-gallery v1.03
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-10-06T14:00:00.000Z
CVE-2015-1000008 
Path Disclosure Vulnerability in wordpress plugin MP3-jPlayer v2.3.2
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-10-06T14:00:00.000Z
CVE-2015-1000009 
Open proxy in Wordpress plugin google-adsense-and-hotel-booking v1.05
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-10-06T14:00:00.000Z
CVE-2015-1000010 
Remote file download in simple-image-manipulator v1.0 wordpress plugin
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-10-06T14:00:00.000Z
CVE-2015-1000011 
Blind SQL Injection in wordpress plugin dukapress v2.5.9
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-10-06T14:00:00.000Z
CVE-2015-1000012 
Local File Inclusion Vulnerability in mypixs v0.3 wordpress plugin
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-10-06T14:00:00.000Z
CVE-2015-1000013 
Remote file upload vulnerability in wordpress plugin csv2wpec-coupon v1.1
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-10-06T14:00:00.000Z
CVE-2015-10001 WP-Stats < 2.5.2 - CSRF to Stored Cross-Site Scripting (XSS)
The WP-Stats WordPress plugin before 2.52 does not have CSRF check when saving its settings, and did not escape some of them when outputting them, allowing attacker to make logged in high privilege users change them and set Cross-Site Scripting payloads
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: WP-Stats
Credits: lang: en
value: Sebastian Wolfgang Kraemer
Published: 2021-11-01T08:45:47.000Z
CVE-2015-10002 Kiddoware Kids Place Home Button Protection denial of service
A vulnerability classified as problematic has been found in Kiddoware Kids Place. This affects the Home Button Protection. A repeated pressing of the button causes a local denial of service. It is recommended to upgrade the affected component.
Problem types: cwe_id: CWE-404
description: CWE-404 Denial of Service
Affected products: vendor: Kiddoware
product: Kids Place
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Noah Ruef/Marc Ruef
Published: 2022-03-28T18:00:15.000Z
CVE-2015-10003 FileZilla Server PORT confused deputy
A vulnerability, which was classified as problematic, was found in FileZilla Server up to 0.9.50. This affects an unknown part of the component PORT Handler. The manipulation leads to unintended intermediary. It is possible to initiate the attack remotely. Upgrading to version 0.9.51 is able to address this issue. It is recommended to upgrade the affected component.
Problem types: cwe_id: CWE-441
description: CWE-441 Unintended Intermediary
Affected products: vendor: FileZilla
product: Server
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: Amit Klein
Published: 2022-07-17T06:35:12.000Z
CVE-2015-10004 Timing side-channel in github.com/robbert229/jwt
Token validation methods are susceptible to a timing side-channel during HMAC comparison. With a large enough number of requests over a low latency connection, an attacker may use this to determine the expected HMAC.
Problem types: description: CWE 208: Information Exposure Through Timing Discrepancy
Affected products: vendor: github.com/robbert229/jwt
product: github.com/robbert229/jwt
default_status: unaffected
Published: 2022-12-27T21:13:11.967Z
CVE-2015-10005 markdown-it html_re.js redos
A vulnerability was found in markdown-it up to 2.x. It has been classified as problematic. Affected is an unknown function of the file lib/common/html_re.js. The manipulation leads to inefficient regular expression complexity. Upgrading to version 3.0.0 is able to address this issue. The name of the patch is 89c8620157d6e38f9872811620d25138fc9d1b0d. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-216852.
Problem types: cwe_id: CWE-1333
description: CWE-1333 Inefficient Regular Expression Complexity
Affected products: vendor: n/a
product: markdown-it
CVSS v3.1: version: 3.1
baseScore: 3.5
vectorString: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
baseSeverity: LOW
Published: 2022-12-27T08:05:38.793Z
CVE-2015-10006 admont28 Ingnovarq insertarSliderAjax.php cross site scripting
A vulnerability, which was classified as problematic, has been found in admont28 Ingnovarq. Affected by this issue is some unknown functionality of the file app/controller/insertarSliderAjax.php. The manipulation of the argument imagetitle leads to cross site scripting. The attack may be launched remotely. The name of the patch is 9d18a39944d79dfedacd754a742df38f99d3c0e2. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-217172.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross Site Scripting
Affected products: vendor: admont28
product: Ingnovarq
CVSS v3.1: version: 3.1
baseScore: 3.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
baseSeverity: LOW
Credits: lang: en
value: VulDB GitHub Commit Analyzer
Published: 2023-01-01T16:36:45.875Z
CVE-2015-10007 82Flex WEIPDCRM cross site scripting
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in 82Flex WEIPDCRM and classified as problematic. Affected by this issue is some unknown functionality. The manipulation leads to cross site scripting. The attack may be launched remotely. The name of the patch is 43bad79392332fa39e31b95268e76fbda9fec3a4. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-217184. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross Site Scripting
Affected products: vendor: 82Flex
product: WEIPDCRM
CVSS v3.1: version: 3.1
baseScore: 3.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
baseSeverity: LOW
Credits: lang: en
value: VulDB GitHub Commit Analyzer
Published: 2023-01-02T10:32:12.484Z
CVE-2015-10008 82Flex WEIPDCRM sql injection
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in 82Flex WEIPDCRM. It has been classified as critical. This affects an unknown part. The manipulation leads to sql injection. It is possible to initiate the attack remotely. The identifier of the patch is 43bad79392332fa39e31b95268e76fbda9fec3a4. It is recommended to apply a patch to fix this issue. The identifier VDB-217185 was assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: 82Flex
product: WEIPDCRM
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: VulDB GitHub Commit Analyzer
Published: 2023-01-02T10:33:17.872Z
CVE-2015-10009 nterchange code_caller_controller.php getContent code injection
A vulnerability was found in nterchange up to 4.1.0. It has been rated as critical. This issue affects the function getContent of the file app/controllers/code_caller_controller.php. The manipulation of the argument q with the input %5C%27%29;phpinfo%28%29;/* leads to code injection. The exploit has been disclosed to the public and may be used. Upgrading to version 4.1.1 is able to address this issue. The patch is named fba7d89176fba8fe289edd58835fe45080797d99. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-217187.
Problem types: cwe_id: CWE-94
description: CWE-94 Code Injection
Affected products: vendor: n/a
product: nterchange
CVSS v3.1: version: 3.1
baseScore: 5.5
vectorString: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: VulDB GitHub Commit Analyzer
Published: 2023-01-02T15:37:56.480Z
CVE-2015-10010 OpenDNS OpenResolve API endpoints.py get cross site scripting
A vulnerability was found in OpenDNS OpenResolve. It has been rated as problematic. Affected by this issue is the function get of the file resolverapi/endpoints.py of the component API. The manipulation leads to cross site scripting. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The name of the patch is c680170d5583cd9342fe1af43001fe8b2b8004dd. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-217196.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross Site Scripting
Affected products: vendor: OpenDNS
product: OpenResolve
CVSS v3.1: version: 3.1
baseScore: 3.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
baseSeverity: LOW
Credits: lang: en
value: VulDB GitHub Commit Analyzer
Published: 2023-01-02T20:55:47.826Z
CVE-2015-10011 OpenDNS OpenResolve endpoints.py neutralization for logs
A vulnerability classified as problematic has been found in OpenDNS OpenResolve. This affects an unknown part of the file resolverapi/endpoints.py. The manipulation leads to improper output neutralization for logs. The identifier of the patch is 9eba6ba5abd89d0e36a008921eb307fcef8c5311. It is recommended to apply a patch to fix this issue. The identifier VDB-217197 was assigned to this vulnerability.
Problem types: cwe_id: CWE-117
description: CWE-117 Improper Output Neutralization for Logs
Affected products: vendor: OpenDNS
product: OpenResolve
CVSS v3.1: version: 3.1
baseScore: 4.6
vectorString: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: VulDB GitHub Commit Analyzer
Published: 2023-01-02T21:00:29.616Z
CVE-2015-10012 sumocoders FrameworkUserBundle login.html.twig information exposure
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in sumocoders FrameworkUserBundle up to 1.3.x. It has been rated as problematic. Affected by this issue is some unknown functionality of the file Resources/views/Security/login.html.twig. The manipulation leads to information exposure through error message. Upgrading to version 1.4.0 is able to address this issue. The name of the patch is abe4993390ba9bd7821ab12678270556645f94c8. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-217268. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Problem types: cwe_id: CWE-209
description: CWE-209 Information Exposure Through Error Message
Affected products: vendor: sumocoders
product: FrameworkUserBundle
CVSS v3.1: version: 3.1
baseScore: 3.5
vectorString: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
baseSeverity: LOW
Credits: lang: en
value: VulDB GitHub Commit Analyzer
Published: 2023-01-03T08:27:38.769Z
CVE-2015-10013 WebDevStudios taxonomy-switcher Plugin taxonomy-switcher.php taxonomy_switcher_init cross site scripting
A vulnerability was found in WebDevStudios taxonomy-switcher Plugin up to 1.0.3 on WordPress. It has been classified as problematic. Affected is the function taxonomy_switcher_init of the file taxonomy-switcher.php. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 1.0.4 is able to address this issue. It is recommended to upgrade the affected component. VDB-217446 is the identifier assigned to this vulnerability.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross Site Scripting
Affected products: vendor: WebDevStudios
product: taxonomy-switcher Plugin
CVSS v3.1: version: 3.1
baseScore: 3.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
baseSeverity: LOW
Credits: lang: en
value: VulDB GitHub Commit Analyzer
Published: 2023-01-05T09:52:06.307Z
CVE-2015-10014 arekk uke finder.rb sql injection
A vulnerability classified as critical has been found in arekk uke. This affects an unknown part of the file lib/uke/finder.rb. The manipulation leads to sql injection. The identifier of the patch is 52fd3b2d0bc16227ef57b7b98a3658bb67c1833f. It is recommended to apply a patch to fix this issue. The identifier VDB-217485 was assigned to this vulnerability.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: arekk
product: uke
CVSS v3.1: version: 3.1
baseScore: 5.5
vectorString: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: VulDB GitHub Commit Analyzer
Published: 2023-01-05T13:06:31.182Z
CVE-2015-10015 glidernet ogn-live sql injection
A vulnerability, which was classified as critical, has been found in glidernet ogn-live. This issue affects some unknown processing. The manipulation leads to sql injection. The patch is named bc0f19965f760587645583b7624d66a260946e01. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217487.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: glidernet
product: ogn-live
CVSS v3.1: version: 3.1
baseScore: 5.5
vectorString: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: VulDB GitHub Commit Analyzer
Published: 2023-01-05T14:43:19.209Z
CVE-2015-10016 jeff-kelley opensim-utils regionscrits.php DatabaseForRegion sql injection
A vulnerability, which was classified as critical, has been found in jeff-kelley opensim-utils. Affected by this issue is the function DatabaseForRegion of the file regionscrits.php. The manipulation of the argument region leads to sql injection. The patch is identified as c29e5c729a833a29dbf5b1e505a0553fe154575e. It is recommended to apply a patch to fix this issue. VDB-217550 is the identifier assigned to this vulnerability.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: jeff-kelley
product: opensim-utils
CVSS v3.1: version: 3.1
baseScore: 5.5
vectorString: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: VulDB GitHub Commit Analyzer
Published: 2023-01-06T09:49:12.503Z
CVE-2015-10017 HPI-Information-Systems ProLOD sql injection
A vulnerability has been found in HPI-Information-Systems ProLOD and classified as critical. This vulnerability affects unknown code. The manipulation of the argument this leads to sql injection. The name of the patch is 3f710905458d49c77530bd3cbcd8960457566b73. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-217552.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: HPI-Information-Systems
product: ProLOD
CVSS v3.1: version: 3.1
baseScore: 5.5
vectorString: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: VulDB GitHub Commit Analyzer
Published: 2023-01-06T10:26:12.339Z
CVE-2015-10018 DBRisinajumi d2files D2filesController.php actionDownloadFile sql injection
A vulnerability has been found in DBRisinajumi d2files and classified as critical. Affected by this vulnerability is the function actionUpload/actionDownloadFile of the file controllers/D2filesController.php. The manipulation leads to sql injection. Upgrading to version 1.0.0 is able to address this issue. The identifier of the patch is b5767f2ec9d0f3cbfda7f13c84740e2179c90574. It is recommended to upgrade the affected component. The identifier VDB-217561 was assigned to this vulnerability.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: DBRisinajumi
product: d2files
CVSS v3.1: version: 3.1
baseScore: 5.5
vectorString: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: VulDB GitHub Commit Analyzer
Published: 2023-01-06T12:33:34.030Z
CVE-2015-10019 foxoverflow MySimplifiedSQL MySimplifiedSQL_Examples.php cross site scripting
A vulnerability, which was classified as problematic, has been found in foxoverflow MySimplifiedSQL. This issue affects some unknown processing of the file MySimplifiedSQL_Examples.php. The manipulation of the argument FirstName/LastName leads to cross site scripting. The attack may be initiated remotely. The patch is named 3b7481c72786f88041b7c2d83bb4f219f77f1293. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217595.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross Site Scripting
Affected products: vendor: foxoverflow
product: MySimplifiedSQL
CVSS v3.1: version: 3.1
baseScore: 3.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
baseSeverity: LOW
Credits: lang: en
value: VulDB GitHub Commit Analyzer
Published: 2023-01-07T08:48:03.997Z
CVE-2015-10020 ssn2013 cis450Project AddAppUser.java addUser sql injection
A vulnerability has been found in ssn2013 cis450Project and classified as critical. This vulnerability affects the function addUser of the file HeatMapServer/src/com/datformers/servlet/AddAppUser.java. The manipulation leads to sql injection. The name of the patch is 39b495011437a105c7670e17e071f99195b4922e. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-218380.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: ssn2013
product: cis450Project
CVSS v3.1: version: 3.1
baseScore: 5.5
vectorString: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: VulDB GitHub Commit Analyzer
Published: 2023-01-14T20:15:30.605Z
CVE-2015-10021 ritterim definely database.js cross site scripting
A vulnerability was found in ritterim definely. It has been classified as problematic. Affected is an unknown function of the file src/database.js. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The name of the patch is b31a022ba4d8d17148445a13ebb5a42ad593dbaa. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-217608.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross Site Scripting
Affected products: vendor: ritterim
product: definely
CVSS v3.1: version: 3.1
baseScore: 3.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
baseSeverity: LOW
Credits: lang: en
value: VulDB GitHub Commit Analyzer
Published: 2023-01-07T11:19:58.558Z
CVE-2015-10022 IISH nlgis2 custom_import.pl sql injection
A vulnerability was found in IISH nlgis2. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file scripts/etl/custom_import.pl. The manipulation leads to sql injection. The identifier of the patch is 8bdb6fcf7209584eaf1232437f0f53e735b2b34c. It is recommended to apply a patch to fix this issue. The identifier VDB-217609 was assigned to this vulnerability.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: IISH
product: nlgis2
CVSS v3.1: version: 3.1
baseScore: 5.5
vectorString: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: VulDB GitHub Commit Analyzer
Published: 2023-01-07T11:23:43.686Z
CVE-2015-10023 Fumon trello-octometric srv.go main sql injection
A vulnerability classified as critical has been found in Fumon trello-octometric. This affects the function main of the file metrics-ui/server/srv.go. The manipulation of the argument num leads to sql injection. The patch is named a1f1754933fbf21e2221fbc671c81a47de6a04ef. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217611.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Fumon
product: trello-octometric
CVSS v3.1: version: 3.1
baseScore: 5.5
vectorString: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: VulDB GitHub Commit Analyzer
Published: 2023-01-07T11:31:46.264Z
CVE-2015-10024 hoffie larasync file_storage.go path traversal
A vulnerability classified as critical was found in hoffie larasync. This vulnerability affects unknown code of the file repository/content/file_storage.go. The manipulation leads to path traversal. The name of the patch is 776bad422f4bd4930d09491711246bbeb1be9ba5. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-217612.
Problem types: cwe_id: CWE-22
description: CWE-22 Path Traversal
Affected products: vendor: hoffie
product: larasync
CVSS v3.1: version: 3.1
baseScore: 5.5
vectorString: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: VulDB GitHub Commit Analyzer
Published: 2023-01-07T12:39:47.568Z