rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-32961 HiCOS’ client-side citizen digital certificate - Stack Buffer Overflow
HICOS’ client-side citizen digital certificate component has a stack-based buffer overflow vulnerability when reading IC card due to insufficient parameter length validation for token information. An unauthenticated physical attacker can exploit this vulnerability to execute arbitrary code, manipulate system data or terminate service.
Problem types: cwe_id: CWE-787
description: CWE-787 Out-of-bounds Write
Affected products: vendor: HINET
product: HiCOS’ client-side citizen digital certificate
vendor: HINET
product: HiCOS’ client-side citizen digital certificate
vendor: HINET
product: HiCOS’ client-side citizen digital certificate
CVSS v3.1: attackComplexity: LOW
attackVector: PHYSICAL
availabilityImpact: HIGH
baseScore: 6.8
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2022-07-20T02:03:13.812Z
CVE-2022-32962 HiCOS’ client-side citizen digital certificate - Double Free
HiCOS’ client-side citizen certificate component has a double free vulnerability. An unauthenticated physical attacker can exploit this vulnerability to corrupt memory and execute arbitrary code, manipulate system data or terminate service.
Problem types: cwe_id: CWE-415
description: CWE-415 Double Free
Affected products: vendor: HINET
product: HiCOS’ client-side citizen digital certificate
vendor: HINET
product: HiCOS’ client-side citizen digital certificate
vendor: HINET
product: HiCOS’ client-side citizen digital certificate
CVSS v3.1: attackComplexity: LOW
attackVector: PHYSICAL
availabilityImpact: HIGH
baseScore: 6.8
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2022-07-20T02:03:43.658Z
CVE-2022-32963 ITPison OMICARD EDM - Path Traversal-1
OMICARD EDM’s mail file relay function has a path traversal vulnerability. An unauthenticated remote attacker can exploit this vulnerability to by-pass authentication and access arbitrary system files.
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: ITPison
product: OMICARD EDM
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2022-08-04T09:15:25.734Z
CVE-2022-32964 ITPison OMICARD EDM - SQL Injection
OMICARD EDM’s API function has insufficient validation for user input. An unauthenticated remote attacker can inject arbitrary SQL commands to access, modify, delete database or disrupt service.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: ITPison
product: OMICARD EDM
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2022-08-04T09:15:27.394Z
CVE-2022-32965 ITPison OMICARD EDM - Use of Hard-coded Credentials
OMICARD EDM has a hard-coded machine key. An unauthenticated remote attacker can use the machine key to send serialized payload to the server to execute arbitrary code, manipulate system data and disrupt service.
Problem types: cwe_id: CWE-798
description: CWE-798 Use of Hard-coded Credentials
Affected products: vendor: ITPison
product: OMICARD EDM
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2022-08-04T09:15:28.816Z
CVE-2022-32966 Realtek RTL8111FP-CG - Missing Authorization
RTL8168FP-CG Dash remote management function has missing authorization. An unauthenticated attacker within the adjacent network can connect to DASH service port to disrupt service.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: Realtek
product: RTL8111FP-CG
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector: ADJACENT_NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
Published: 2022-11-29T03:30:26.503Z
CVE-2022-32967 Realtek RTL8111EP-CG/RTL8111FP-CG - Use of Hard-coded Credentials
RTL8111EP-CG/RTL8111FP-CG DASH function has hard-coded password. An unauthenticated physical attacker can use the hard-coded default password during system reboot triggered by other user, to acquire partial system information such as serial number and server information.
Problem types: cwe_id: CWE-798
description: CWE-798 Use of Hard-coded Credentials
Affected products: vendor: Realtek
product: RTL8111EP-CG
vendor: Realtek
product: RTL8111FP-CG
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
attackVector: PHYSICAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: NONE
baseScore: 2.1
baseSeverity: LOW
Published: 2022-11-29T03:30:27.572Z
CVE-2022-32969 
MetaMask before 10.11.3 might allow an attacker to access a user's secret recovery phrase because an input field is used for a BIP39 mnemonic, and Firefox and Chromium save such fields to disk in order to support the Restore Session feature, aka the Demonic issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-29T14:37:46.000Z
CVE-2022-32970 WordPress Themify Portfolio Post Plugin <= 1.2.4 is vulnerable to Cross Site Scripting (XSS)
Auth. (editor+) Stored Cross-Site Scripting (XSS) vulnerability in Themify Themify Portfolio Post plugin <= 1.2.4 versions.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Themify
product: Themify Portfolio Post
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.1
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: Muhammad Daffa (Patchstack Alliance)
Published: 2023-05-10T08:56:39.069Z
CVE-2022-32971 
Improper authentication in the Intel(R) SUR software before version 2.4.8902 may allow a privileged user to potentially enable escalation of privilege via network access.
Problem types: description: escalation of privilege
Affected products: vendor: n/a
product: Intel(R) SUR software
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 3.1
baseSeverity: LOW
vectorString: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:L
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: HIGH
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: LOW
availabilityImpact: LOW
Published: 2023-02-16T20:00:14.395Z
CVE-2022-32972 
Infoblox BloxOne Endpoint for Windows through 2.2.7 allows DLL injection that can result in local privilege escalation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-17T00:00:00.000Z
CVE-2022-32973 
An authenticated attacker could create an audit file that bypasses PowerShell cmdlet checks and executes commands with administrator privileges.
Problem types: description: Command Injection
Affected products: vendor: n/a
product: Nessus
Published: 2022-06-21T14:23:30.000Z
CVE-2022-32974 
An authenticated attacker could read arbitrary files from the underlying operating system of the scanner using a custom crafted compliance audit file without providing any valid SSH credentials.
Problem types: description: Arbitrary File Read
Affected products: vendor: n/a
product: Nessus
Published: 2022-06-21T14:23:31.000Z
CVE-2022-32978 
There is an assertion failure in SingleComponentLSScan::ParseMCU in singlecomponentlsscan.cpp in libjpeg before 1.64 via an empty JPEG-LS scan.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-10T14:49:06.000Z
CVE-2022-32981 
An issue was discovered in the Linux kernel through 5.18.3 on powerpc 32-bit platforms. There is a buffer overflow in ptrace PEEKUSER and POKEUSER (aka PEEKUSR and POKEUSR) when accessing floating point registers.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-10T19:42:34.000Z
CVE-2022-32983 
Knot Resolver through 5.5.1 may allow DNS cache poisoning when there is an attempt to limit forwarding actions by filters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-20T15:05:01.000Z
CVE-2022-32984 
BTCPay Server 1.3.0 through 1.5.3 allows a remote attacker to obtain sensitive information when a public Point of Sale app is exposed. The sensitive information, found in the HTML source code, includes the xpub of the store. Also, if the store isn't using the internal lightning node, the credentials of a lightning node are exposed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-01-31T00:00:00.000Z
CVE-2022-32985 
libnx_apl.so on Nexans FTTO GigaSwitch before 6.02N and 7.x before 7.02 implements a Backdoor Account for SSH logins on port 50200 or 50201.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-17T22:48:58.000Z
CVE-2022-32987 
Multiple cross-site scripting (XSS) vulnerabilities in /bsms/?page=manage_account of Simple Bakery Shop Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Username or Full Name fields.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-23T18:38:33.000Z
CVE-2022-32988 
Cross Site Scripting (XSS) vulnerability in router Asus DSL-N14U-B1 1.1.2.3_805 via the "*list" parameters (e.g. filter_lwlist, keyword_rulelist, etc) in every ".asp" page containing a list of stored strings. The following asp files are affected: (1) cgi-bin/APP_Installation.asp, (2) cgi-bin/Advanced_ACL_Content.asp, (3) cgi-bin/Advanced_ADSL_Content.asp, (4) cgi-bin/Advanced_ASUSDDNS_Content.asp, (5) cgi-bin/Advanced_AiDisk_ftp.asp, (6) cgi-bin/Advanced_AiDisk_samba.asp, (7) cgi-bin/Advanced_DSL_Content.asp, (8) cgi-bin/Advanced_Firewall_Content.asp, (9) cgi-bin/Advanced_FirmwareUpgrade_Content.asp, (10) cgi-bin/Advanced_GWStaticRoute_Content.asp, (11) cgi-bin/Advanced_IPTV_Content.asp, (12) cgi-bin/Advanced_IPv6_Content.asp, (13) cgi-bin/Advanced_KeywordFilter_Content.asp, (14) cgi-bin/Advanced_LAN_Content.asp, (15) cgi-bin/Advanced_Modem_Content.asp, (16) cgi-bin/Advanced_PortTrigger_Content.asp, (17) cgi-bin/Advanced_QOSUserPrio_Content.asp, (18) cgi-bin/Advanced_QOSUserRules_Content.asp, (19) cgi-bin/Advanced_SettingBackup_Content.asp, (20) cgi-bin/Advanced_System_Content.asp, (21) cgi-bin/Advanced_URLFilter_Content.asp, (22) cgi-bin/Advanced_VPN_PPTP.asp, (23) cgi-bin/Advanced_VirtualServer_Content.asp, (24) cgi-bin/Advanced_WANPort_Content.asp, (25) cgi-bin/Advanced_WAdvanced_Content.asp, (26) cgi-bin/Advanced_WMode_Content.asp, (27) cgi-bin/Advanced_WWPS_Content.asp, (28) cgi-bin/Advanced_Wireless_Content.asp, (29) cgi-bin/Bandwidth_Limiter.asp, (30) cgi-bin/Guest_network.asp, (31) cgi-bin/Main_AccessLog_Content.asp, (32) cgi-bin/Main_AdslStatus_Content.asp, (33) cgi-bin/Main_Spectrum_Content.asp, (34) cgi-bin/Main_WebHistory_Content.asp, (35) cgi-bin/ParentalControl.asp, (36) cgi-bin/QIS_wizard.asp, (37) cgi-bin/QoS_EZQoS.asp, (38) cgi-bin/aidisk.asp, (39) cgi-bin/aidisk/Aidisk-1.asp, (40) cgi-bin/aidisk/Aidisk-2.asp, (41) cgi-bin/aidisk/Aidisk-3.asp, (42) cgi-bin/aidisk/Aidisk-4.asp, (43) cgi-bin/blocking.asp, (44) cgi-bin/cloud_main.asp, (45) cgi-bin/cloud_router_sync.asp, (46) cgi-bin/cloud_settings.asp, (47) cgi-bin/cloud_sync.asp, (48) cgi-bin/device-map/DSL_dashboard.asp, (49) cgi-bin/device-map/clients.asp, (50) cgi-bin/device-map/disk.asp, (51) cgi-bin/device-map/internet.asp, (52) cgi-bin/error_page.asp, (53) cgi-bin/index.asp, (54) cgi-bin/index2.asp, (55) cgi-bin/qis/QIS_PTM_manual_setting.asp, (56) cgi-bin/qis/QIS_admin_pass.asp, (57) cgi-bin/qis/QIS_annex_setting.asp, (58) cgi-bin/qis/QIS_bridge_cfg_tmp.asp, (59) cgi-bin/qis/QIS_detect.asp, (60) cgi-bin/qis/QIS_finish.asp, (61) cgi-bin/qis/QIS_ipoa_cfg_tmp.asp, (62) cgi-bin/qis/QIS_manual_setting.asp, (63) cgi-bin/qis/QIS_mer_cfg.asp, (64) cgi-bin/qis/QIS_mer_cfg_tmp.asp, (65) cgi-bin/qis/QIS_ppp_cfg.asp, (66) cgi-bin/qis/QIS_ppp_cfg_tmp.asp, (67) cgi-bin/qis/QIS_wireless.asp, (68) cgi-bin/query_wan_status.asp, (69) cgi-bin/query_wan_status2.asp, and (70) cgi-bin/start_apply.asp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-30T23:09:50.000Z
CVE-2022-32990 
An issue in gimp_layer_invalidate_boundary of GNOME GIMP 2.10.30 allows attackers to trigger an unhandled exception via a crafted XCF file, causing a Denial of Service (DoS).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-24T13:17:13.000Z
CVE-2022-32991 
Web Based Quiz System v1.0 was discovered to contain a SQL injection vulnerability via the eid parameter at welcome.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-15T16:21:08.000Z
CVE-2022-32992 
Online Tours And Travels Management System v1.0 was discovered to contain a SQL injection vulnerability via the tname parameter at /admin/operations/tax.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-15T16:22:29.000Z
CVE-2022-32993 
TOTOLINK A7000R V4.1cu.4134 was discovered to contain an access control issue via /cgi-bin/ExportSettings.sh.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-29T20:12:05.000Z
CVE-2022-32994 
Halo CMS v1.5.3 was discovered to contain an arbitrary file upload vulnerability via the component /api/admin/attachments/upload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-27T22:15:38.000Z
CVE-2022-32995 
Halo CMS v1.5.3 was discovered to contain a Server-Side Request Forgery (SSRF) via the template remote download function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-27T22:15:39.000Z
CVE-2022-32996 
The django-navbar-client package of v0.9.50 to v1.0.1 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well as escalate privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-24T20:39:38.000Z
CVE-2022-32997 
The RootInteractive package in PyPI v0.0.5 to v0.0.19b0 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well as escalate privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-24T20:39:39.000Z
CVE-2022-32998 
The cryptoasset-data-downloader package in PyPI v1.0.0 to v1.0.1 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well as escalate privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-24T20:39:40.000Z
CVE-2022-32999 
The cloudlabeling package in PyPI v0.0.1 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well as escalate privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-24T20:39:40.000Z
CVE-2022-33000 
The ML-Scanner package in PyPI v0.1.0 to v0.1.5 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well as escalate privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-24T20:39:41.000Z
CVE-2022-33001 
The AAmiles package in PyPI v0.1.0 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well as escalate privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-24T20:39:41.000Z
CVE-2022-33002 
The KGExplore package in PyPI v0.1.1 to v0.1.2 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well as escalate privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-24T20:39:45.000Z
CVE-2022-33003 
The watools package in PyPI v0.0.1 to v0.0.8 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well as escalate privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-24T20:39:45.000Z
CVE-2022-33004 
The Beginner package in PyPI v0.0.2 to v0.0.4 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well as escalate privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-24T20:39:46.000Z
CVE-2022-33005 
A cross-site scripting (XSS) vulnerability in the System Settings/IOT Settings module of Delta Electronics DIAEnergie v1.08.00 allows attackers to execute arbitrary web scripts via a crafted payload injected into the Name text field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-27T20:56:27.000Z
CVE-2022-33007 
TRENDnet Wi-Fi routers TEW751DR v1.03 and TEW-752DRU v1.03 were discovered to contain a stack overflow via the function genacgi_main.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-27T21:37:27.000Z
CVE-2022-33009 
A stored cross-site scripting (XSS) vulnerability in LightCMS v1.3.11 allows attackers to execute arbitrary web scripts or HTML via uploading a crafted PDF file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-27T22:28:25.000Z
CVE-2022-33011 
Known v1.3.1+2020120201 was discovered to allow attackers to perform an account takeover via a host header injection attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-08T11:10:47.000Z
CVE-2022-33012 
Microweber v1.2.15 was discovered to allow attackers to perform an account takeover via a host header injection attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-22T00:00:00.000Z
CVE-2022-33021 
CVA6 commit 909d85a accesses invalid memory when reading the value of MHPMCOUNTER30.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-29T11:54:20.000Z
CVE-2022-33023 
CVA6 commit 909d85a gives incorrect permission to use special multiplication units when the format of instructions is wrong.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-29T11:54:21.000Z
CVE-2022-33024 
There is an Assertion `int decode_preR13_entities(BITCODE_RL, BITCODE_RL, unsigned int, BITCODE_RL, BITCODE_RL, Bit_Chain *, Dwg_Data *' failed at dwg2dxf: decode.c:5801 in libredwg v0.12.4.4608.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-22T13:33:29.000Z
CVE-2022-33025 
LibreDWG v0.12.4.4608 was discovered to contain a heap-use-after-free via the function decode_preR13_section at decode_r11.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-22T13:33:34.000Z
CVE-2022-33026 
LibreDWG v0.12.4.4608 was discovered to contain a heap buffer overflow via the function bit_calc_CRC at bits.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-22T13:33:30.000Z
CVE-2022-33027 
LibreDWG v0.12.4.4608 was discovered to contain a heap-use-after-free via the function dwg_add_handleref at dwg.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-22T13:33:32.000Z
CVE-2022-33028 
LibreDWG v0.12.4.4608 was discovered to contain a heap buffer overflow via the function dwg_add_object at decode.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-22T13:33:33.000Z
CVE-2022-33032 
LibreDWG v0.12.4.4608 was discovered to contain a heap-buffer-overflow via the function decode_preR13_section_hdr at decode_r11.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-22T13:33:36.000Z
CVE-2022-33033 
LibreDWG v0.12.4.4608 was discovered to contain a double-free via the function dwg_read_file at dwg.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-22T13:33:37.000Z
CVE-2022-33034 
LibreDWG v0.12.4.4608 was discovered to contain a stack overflow via the function copy_bytes at decode_r2007.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-22T13:33:38.000Z
CVE-2022-33035 
XLPD v7.0.0094 and below contains an unquoted service path vulnerability which allows local users to launch processes with elevated privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-29T12:25:23.000Z
CVE-2022-33036 
A binary hijack in Embarcadero Dev-CPP v6.3 allows attackers to execute arbitrary code via a crafted .exe file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-29T12:25:24.000Z
CVE-2022-33037 
A binary hijack in Orwell-Dev-Cpp v5.11 allows attackers to execute arbitrary code via a crafted .exe file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-29T12:25:32.000Z
CVE-2022-33042 
Online Railway Reservation System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/inquiries/view_details.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-29T16:52:05.000Z
CVE-2022-33043 
A cross-site scripting (XSS) vulnerability in the batch add function of Urtracker Premium v4.0.1.1477 allows attackers to execute arbitrary web scripts or HTML via a crafted excel file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-30T12:13:06.000Z
CVE-2022-33047 
OTFCC v0.10.4 was discovered to contain a heap buffer overflow after free via otfccbuild.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-06T18:17:52.000Z
CVE-2022-33048 
Online Railway Reservation System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /orrs/admin/reservations/view_details.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-21T13:15:31.000Z