rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-4279 SourceCodester Human Resource Management System employeeview.php cross site scripting
A vulnerability classified as problematic has been found in SourceCodester Human Resource Management System 1.0. Affected is an unknown function of the file /hrm/employeeview.php. The manipulation of the argument search leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-214776.
Problem types: cwe_id: CWE-707
description: CWE-707 Improper Neutralization -> CWE-74 Injection -> CWE-79 Cross Site Scripting
Affected products: vendor: SourceCodester
product: Human Resource Management System
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: LOW
availabilityImpact: NONE
baseScore: 3.5
baseSeverity: LOW
Published: 2022-12-03T00:00:00.000Z
CVE-2022-4280 Dot Tech Smart Campus System findUser information disclosure
A vulnerability, which was classified as problematic, has been found in Dot Tech Smart Campus System. Affected by this issue is some unknown functionality of the file /services/Card/findUser. The manipulation leads to information disclosure. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-214778 is the identifier assigned to this vulnerability.
Problem types: cwe_id: CWE-266
description: CWE-266 Incorrect Privilege Assignment -> CWE-284 Improper Access Controls -> CWE-200 Information Disclosure
Affected products: vendor: Dot Tech
product: Smart Campus System
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
Published: 2022-12-03T00:00:00.000Z
CVE-2022-4281 Facepay camera.php authorization
A vulnerability has been found in Facepay 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /face-recognition-php/facepay-master/camera.php. The manipulation of the argument userId leads to authorization bypass. The attack can be launched remotely. The identifier VDB-214789 was assigned to this vulnerability.
Problem types: cwe_id: CWE-266
description: CWE-266 Incorrect Privilege Assignment -> CWE-285 Improper Authorization -> CWE-639 Authorization Bypass
Affected products: vendor: unspecified
product: Facepay
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: LOW
baseScore: 6.3
baseSeverity: MEDIUM
Published: 2022-12-05T00:00:00.000Z
CVE-2022-4282 SpringBootCMS Template Management injection
A vulnerability was found in SpringBootCMS and classified as critical. Affected by this issue is some unknown functionality of the component Template Management. The manipulation leads to injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-214790 is the identifier assigned to this vulnerability.
Problem types: cwe_id: CWE-707
description: CWE-707 Improper Neutralization -> CWE-74 Injection
Affected products: vendor: unspecified
product: SpringBootCMS
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: LOW
baseScore: 4.7
baseSeverity: MEDIUM
Published: 2022-12-05T00:00:00.000Z
CVE-2022-4283 
A vulnerability was found in X.Org. This security flaw occurs because the XkbCopyNames function left a dangling pointer to freed memory, resulting in out-of-bounds memory access on subsequent XkbGetKbdByName requests.. This issue can lead to local privileges elevation on systems where the X server is running privileged and remote code execution for ssh X forwarding sessions.
Problem types: description: use-after-free
Affected products: vendor: n/a
product: xorg-x11-server
Published: 2022-12-14T00:00:00.000Z
CVE-2022-4285 
An illegal memory access flaw was found in the binutils package. Parsing an ELF file containing corrupt symbol version information may result in a denial of service. This issue is the result of an incomplete fix for CVE-2020-16599.
Problem types: cwe_id: CWE-476
description: CWE-476
Affected products: vendor: n/a
product: binutils
Published: 2023-01-27T00:00:00.000Z
CVE-2022-4286 Reflected Cross-Site Scripting Vulnerabilities in Automation Runtime

A reflected cross-site scripting (XSS) vulnerability exists in System Diagnostics Manager of B&R Automation Runtime versions >=3.00 and <=C4.93 that enables a remote attacker to execute arbitrary JavaScript in the context of the users browser session.


Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: B&R Industrial Automation
product: B&R Automation Runtime
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.1
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Published: 2023-02-14T14:25:37.538Z
CVE-2022-4287 
Authentication bypass in local application lock feature in Devolutions Remote Desktop Manager  2022.3.26 and earlier on Windows allows malicious user to access the application.


Problem types: description: n/a
Affected products: vendor: Devolutions
product: Remote Desktop Manager
default_status: unaffected
Published: 2022-12-20T14:16:09.540Z
CVE-2022-4289 
An issue has been discovered in GitLab affecting all versions starting from 15.3 before 15.7.8, versions of 15.8 before 15.8.4, and version 15.9 before 15.9.2. Google IAP details in Prometheus integration were not hidden, could be leaked from instance, group, or project settings to other users.
Problem types: description: Information exposure in GitLab
Affected products: vendor: GitLab
product: GitLab
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
baseScore: 6.4
baseSeverity: MEDIUM
Credits: lang: en
value: Thanks [joaxcar](https://hackerone.com/joaxcar) for reporting this vulnerability through our HackerOne bug bounty program
Published: 2023-03-09T00:00:00.000Z
CVE-2022-4290 Cyr to Lat <= 3.5 - Authenticated SQL Injection
The Cyr to Lat plugin for WordPress is vulnerable to authenticated SQL Injection via the 'ctl_sanitize_title' function in versions up to, and including, 3.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This potentially allows authenticated users with the ability to add or modify terms or tags to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. A partial patch became available in version 3.6 and the issue was fully patched in version 3.7.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: ivijanstefan
product: Cyr to Lat Enhanced
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
baseScore: 8.8
baseSeverity: HIGH
Credits: lang: en
value: Ramuel Gall
Published: 2023-10-20T07:29:31.288Z
CVE-2022-4291 Aswjsflt.dll in Avast Antivirus windows caused a crash of the Mozilla Firefox browser due to heap corruption
The aswjsflt.dll library from Avast Antivirus windows contained a potentially exploitable heap corruption vulnerability that could enable an attacker to bypass the sandbox of the application it was loaded into, if applicable. This issue was fixed in version 18.0.1478 of the Script Shield Component.

Problem types: cwe_id: CWE-119
description: CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
Affected products: vendor: NortonLifelock
product: Avast Antivirus
default_status: affected
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 7.7
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L
version: 3.1
Published: 2022-12-07T23:45:04.707Z
CVE-2022-4292 Use After Free in vim/vim
Use After Free in GitHub repository vim/vim prior to 9.0.0882.
Problem types: cwe_id: CWE-416
description: CWE-416 Use After Free
Affected products: vendor: vim
product: vim/vim
Published: 2022-12-05T00:00:00.000Z
CVE-2022-4293 Floating Point Comparison with Incorrect Operator in vim/vim
Floating Point Comparison with Incorrect Operator in GitHub repository vim/vim prior to 9.0.0804.
Problem types: cwe_id: CWE-1077
description: CWE-1077 Floating Point Comparison with Incorrect Operator
Affected products: vendor: vim
product: vim/vim
Published: 2022-12-05T00:00:00.000Z
CVE-2022-4294 Norton, Avira, Avast and AVG Antivirus for Windows Privilege Escalation
Norton, Avira, Avast and AVG Antivirus for Windows may be susceptible to a Privilege Escalation vulnerability, which is a type of issue whereby an attacker may attempt to compromise the software application to gain elevated access to resources that are normally protected from an application or user.

Problem types: cwe_id: CWE-269
description: CWE-269 Improper Privilege Management
Affected products: vendor: NortonLifelock (GenDigital)
product: Norton Antivirus Windows Eraser Engine
default_status: unaffected
vendor: NortonLifelock (GenDigital)
product: Avira Security 
default_status: unaffected
vendor: NortonLifelock (GenDigital)
product: Avast Antivirus
default_status: unaffected
vendor: NortonLifelock (GenDigital)
product: AVG Antivirus
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
version: 3.1
Published: 2023-01-10T09:14:47.102Z
CVE-2022-4295 Show All Comments < 7.0.1 - Reflected XSS
The Show All Comments WordPress plugin before 7.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against a logged in high privilege users such as admin.
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Show All Comments
default_status: unaffected
Credits: lang: en
value: cydave
lang: en
value: WPScan
Published: 2023-01-16T15:38:09.605Z
CVE-2022-4296 TP-Link TL-WR740N ARP resource consumption
A vulnerability classified as problematic has been found in TP-Link TL-WR740N. Affected is an unknown function of the component ARP Handler. The manipulation leads to resource consumption. The attack needs to be done within the local network. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-214812.
Problem types: cwe_id: CWE-404
description: CWE-404 Denial of Service -> CWE-400 Resource Consumption
Affected products: vendor: TP-Link
product: TL-WR740N
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector: ADJACENT_NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
Published: 2022-12-06T00:00:00.000Z
CVE-2022-4297 WP AutoComplete Search <= 1.0.4 - Unauthenticated SQLi
The WP AutoComplete Search WordPress plugin through 1.0.4 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX available to unauthenticated users, leading to an unauthenticated SQL injection
Problem types: description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: WP AutoComplete Search
default_status: affected
Credits: lang: en
value: cydave
lang: en
value: WPScan
Published: 2023-01-02T21:49:08.397Z
CVE-2022-4298 Wholesale Market < 2.2.1 - Unauthenticated Arbitrary File Download
The Wholesale Market WordPress plugin before 2.2.1 does not have authorisation check, as well as does not validate user input used to generate system path, allowing unauthenticated attackers to download arbitrary file from the server.
Problem types: description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: Unknown
product: Wholesale Market
default_status: unaffected
Credits: lang: en
value: cydave
lang: en
value: WPScan
Published: 2023-01-02T21:49:31.907Z
CVE-2022-4299 Metricool < 1.18 - Admin+ Stored XSS
The Metricool WordPress plugin before 1.18 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Metricool
default_status: unaffected
Credits: lang: en
value: qerogram(at Kakao Style Corp.)
lang: en
value: WPScan
Published: 2023-01-16T15:38:12.110Z
CVE-2022-4300 FastCMS Template edit injection
A vulnerability was found in FastCMS. It has been rated as critical. This issue affects some unknown processing of the file /template/edit of the component Template Handler. The manipulation leads to injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-214901 was assigned to this vulnerability.
Problem types: cwe_id: CWE-707
description: CWE-707 Improper Neutralization -> CWE-74 Injection
Affected products: vendor: unspecified
product: FastCMS
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: LOW
baseScore: 6.3
baseSeverity: MEDIUM
Published: 2022-12-06T00:00:00.000Z
CVE-2022-4301 Sunshine Photo Cart < 2.9.15 - Reflected XSS
The Sunshine Photo Cart WordPress plugin before 2.9.15 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting.
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Sunshine Photo Cart
default_status: unaffected
Credits: lang: en
value: cydave
lang: en
value: WPScan
Published: 2023-01-09T22:13:37.475Z
CVE-2022-4302 White Label CMS < 2.5 - Admin+ PHP Object Injection
The White Label CMS WordPress plugin before 2.5 unserializes user input provided via the settings, which could allow high-privilege users such as admin to perform PHP Object Injection when a suitable gadget is present.
Problem types: description: CWE-502 Deserialization of Untrusted Data
Affected products: vendor: Unknown
product: White Label CMS
default_status: unaffected
Credits: lang: en
value: thinhnguyen1337
lang: en
value: WPScan
Published: 2023-01-02T21:49:18.707Z
CVE-2022-4303 WP Limit Login Attempts <= 2.6.4 - IP Spoofing
The WP Limit Login Attempts WordPress plugin through 2.6.4 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDR, which makes it possible to bypass IP-based restrictions on login forms.
Problem types: description: CWE-290 Authentication Bypass by Spoofing
Affected products: vendor: Unknown
product: WP Limit Login Attempts
default_status: affected
Credits: lang: en
value: Daniel Ruf
lang: en
value: WPScan
Published: 2023-01-23T14:31:49.652Z
CVE-2022-4304 Timing Oracle in RSA Decryption
A timing based side channel exists in the OpenSSL RSA Decryption implementation
which could be sufficient to recover a plaintext across a network in a
Bleichenbacher style attack. To achieve a successful decryption an attacker
would have to be able to send a very large number of trial messages for
decryption. The vulnerability affects all RSA padding modes: PKCS#1 v1.5,
RSA-OEAP and RSASVE.

For example, in a TLS connection, RSA is commonly used by a client to send an
encrypted pre-master secret to the server. An attacker that had observed a
genuine connection between a client and a server could use this flaw to send
trial messages to the server and record the time taken to process them. After a
sufficiently large number of messages the attacker could recover the pre-master
secret used for the original connection and thus be able to decrypt the
application data sent over that connection.
Problem types: description: timing based side channel attack
Affected products: vendor: OpenSSL
product: OpenSSL
default_status: unaffected
Credits: lang: en
value: Hubert Kario from RedHat
lang: en
value: Dmitry Belyavsky from RedHat
lang: en
value: Hubert Kario from RedHat
Published: 2023-02-08T19:04:28.890Z
CVE-2022-4305 Login as User or Customer < 3.3 - Unauthenticated Privilege Escalation to Admin
The Login as User or Customer WordPress plugin before 3.3 lacks authorization checks to ensure that users are allowed to log in as another one, which could allow unauthenticated attackers to obtain a valid admin session.
Problem types: description: CWE-269 Improper Privilege Management
Affected products: vendor: Unknown
product: Login as User or Customer
default_status: unaffected
Credits: lang: en
value: David
lang: en
value: WPScan
Published: 2023-01-23T14:31:57.132Z
CVE-2022-4306 Panda Pods Repeater Field < 1.5.4 - Reflected XSS
The Panda Pods Repeater Field WordPress plugin before 1.5.4 does not sanitize and escapes a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against a user having at least Contributor permission.
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Panda Pods Repeater Field
default_status: unaffected
Credits: lang: en
value: cydave
lang: en
value: WPScan
Published: 2023-01-30T20:31:30.627Z
CVE-2022-4307 Pardakht Delkhah < 2.9.3 - Unauthenticated Stored XSS
The پلاگین پرداخت دلخواه WordPress plugin before 2.9.3 does not sanitise and escape some parameters, allowing unauthenticated attackers to send a request with XSS payloads, which will be triggered when a high privilege users such as admin visits a page from the plugin.
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: پلاگین پرداخت دلخواه
default_status: unaffected
Credits: lang: en
value: cydave
lang: en
value: WPScan
Published: 2023-01-23T14:31:29.119Z
CVE-2022-4308 Clear-text passwords in configuration files
Plaintext Storage of a Password vulnerability in Secomea GateManager (USB wizard) allows Authentication abuse on SiteManager, if the generated file is leaked.
Problem types: cwe_id: CWE-256
description: CWE-256 Plaintext Storage of a Password
Affected products: vendor: Secomea
product: GateManager
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: PHYSICAL
availabilityImpact: HIGH
baseScore: 6.1
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
version: 3.1
Published: 2023-04-19T11:56:32.348Z
CVE-2022-4309 Subscribe2 < 10.38 - User Deletion via CSRF
The Subscribe2 WordPress plugin before 10.38 does not have CSRF check when deleting users, which could allow attackers to make a logged in admin delete arbitrary users by knowing their email via a CSRF attack.
Problem types: description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: Subscribe2
default_status: unaffected
Credits: lang: en
value: WPScan
lang: en
value: WPScan
Published: 2023-01-16T15:38:10.531Z
CVE-2022-4310 Slimstat Analytics < 4.9.3 - Unauthenticated Stored XSS
The Slimstat Analytics WordPress plugin before 4.9.3 does not sanitise and escape the URI when logging requests, which could allow unauthenticated attackers to perform Stored Cross-Site Scripting attacks against logged in admin viewing the logs
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Slimstat Analytics
default_status: unaffected
Credits: lang: en
value: Bilal Chawich
lang: en
value: WPScan
Published: 2023-01-09T22:13:26.488Z
CVE-2022-4311 

An insertion of sensitive information into log file vulnerability exists in PcVue versions 15 through 15.2.2. This
could allow a user with access to the log files to discover connection strings of data sources configured for the
DbConnect, which could include credentials. Successful exploitation of this vulnerability could allow other users
unauthorized access to the underlying data sources.


Problem types: cwe_id: CWE-532
description: CWE-532 Insertion of Sensitive Information into Log File
Affected products: vendor: ARC Informatique
product: PcVue
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 4.7
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: ARC Informatique
Published: 2022-12-12T17:08:30.847Z
CVE-2022-4312 

A cleartext storage of sensitive information vulnerability exists in PcVue versions 8.10 through 15.2.3. This could
allow an unauthorized user with access the email and short messaging service (SMS) accounts configuration files
to discover the associated simple mail transfer protocol (SMTP) account credentials and the SIM card PIN code.
Successful exploitation of this vulnerability could allow an unauthorized user access to the underlying email
account and SIM card.


Problem types: cwe_id: CWE-312
description: CWE-312 Cleartext Storage of Sensitive Information
Affected products: vendor: ARC Informatique
product: PcVue
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 5.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: ARC Informatique
Published: 2022-12-12T17:10:22.202Z
CVE-2022-4313 
A vulnerability was reported where through modifying the scan variables, an authenticated user in Tenable products, that has Scan Policy Configuration roles, could manipulate audit policy variables to execute arbitrary commands on credentialed scan targets.
Problem types: description: Remote Code Execution
Affected products: vendor: n/a
product: Tenable.io, Tenable.sc and Nessus
Published: 2023-03-15T00:00:00.000Z
CVE-2022-4314 Improper Privilege Management in ikus060/rdiffweb
Improper Privilege Management in GitHub repository ikus060/rdiffweb prior to 2.5.2.
Problem types: cwe_id: CWE-269
description: CWE-269 Improper Privilege Management
Affected products: vendor: ikus060
product: ikus060/rdiffweb
Published: 2022-12-06T00:00:00.000Z