rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-1247 
An issue found in linux-kernel that leads to a race condition in rose_connect(). The rose driver uses rose_neigh->use to represent how many objects are using the rose_neigh. When a user wants to delete a rose_route via rose_ioctl(), the rose driver calls rose_del_node() and removes neighbours only if their “count” and “use” are zero.
Problem types: cwe_id: CWE-362
description: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition').
Affected products: vendor: n/a
product: Kernel
Published: 2022-08-31T15:32:59.000Z
CVE-2022-1248 SAP Information System POST Request add_admin.php improper authentication
A vulnerability was found in SAP Information System 1.0 which has been rated as critical. Affected by this issue is the file /SAP_Information_System/controllers/add_admin.php. An unauthenticated attacker is able to create a new admin account for the web application with a simple POST request. Exploit details were disclosed.
Problem types: cwe_id: CWE-287
description: CWE-287 Improper Authentication
Affected products: vendor: unspecified
product: SAP Information System
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.3
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
version: 3.1
Published: 2022-04-06T03:10:10.000Z
CVE-2022-1249 
A NULL pointer dereference flaw was found in pesign's cms_set_pw_data() function of the cms_common.c file. The function fails to handle the NULL pwdata invocation from daemon.c, which leads to an explicit NULL dereference and crash on all attempts to daemonize pesign.
Problem types: cwe_id: CWE-476
description: CWE-476
Affected products: vendor: n/a
product: pesign
Published: 2022-04-29T15:43:10.000Z
CVE-2022-1250 LifterLMS PayPal < 1.4.0 - Reflected Cross-Site Scripting
The LifterLMS PayPal WordPress plugin before 1.4.0 does not sanitise and escape some parameters from the payment confirmation page before outputting them back in the page, leading to a Reflected Cross-Site Scripting issue
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: LifterLMS Paypal
Credits: lang: en
value: Brandon James Roldan
Published: 2022-05-02T16:05:50.000Z
CVE-2022-1251 Ask Me < 6.8.4 - CSRF in Edit Profile
The Ask me WordPress theme before 6.8.4 does not perform nonce checks when processing POST requests to the Edit Profile page, allowing an attacker to trick a user to change their profile information by sending a crafted request.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: Ask me
Credits: lang: en
value: WPScan team
Published: 2022-08-22T14:57:20.000Z
CVE-2022-1252 Use of a Broken or Risky Cryptographic Algorithm in gnuboard/gnuboard5
Use of a Broken or Risky Cryptographic Algorithm in GitHub repository gnuboard/gnuboard5 prior to and including 5.5.5. A vulnerability in gnuboard v5.5.5 and below uses weak encryption algorithms leading to sensitive information exposure. This allows an attacker to derive the email address of any user, including when the 'Let others see my information.' box is ticked off. Or to send emails to any email address, with full control of its contents
Problem types: cwe_id: CWE-327
description: CWE-327 Use of a Broken or Risky Cryptographic Algorithm
Affected products: vendor: gnuboard
product: gnuboard/gnuboard5
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 8.2
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
version: 3.1
Published: 2022-04-11T10:15:14.000Z
CVE-2022-1253 Heap-based Buffer Overflow in strukturag/libde265
Heap-based Buffer Overflow in GitHub repository strukturag/libde265 prior to and including 1.0.8. The fix is established in commit 8e89fe0e175d2870c39486fdd09250b230ec10b8 but does not yet belong to an official release.
Problem types: cwe_id: CWE-122
description: CWE-122 Heap-based Buffer Overflow
Affected products: vendor: strukturag
product: strukturag/libde265
Published: 2022-04-06T00:00:00.000Z
CVE-2022-1254 SWG URL redirection vulnerability
A URL redirection vulnerability in Skyhigh SWG in main releases 10.x prior to 10.2.9, 9.x prior to 9.2.20, 8.x prior to 8.2.27, and 7.x prior to 7.8.2.31, and controlled release 11.x prior to 11.1.3 allows a remote attacker to redirect a user to a malicious website controlled by the attacker. This is possible because SWG incorrectly creates a HTTP redirect response when a user clicks a carefully constructed URL. Following the redirect response, the new request is still filtered by the SWG policy.
Problem types: cwe_id: CWE-601
description: CWE-601: URL Redirection to Untrusted Site
Affected products: vendor: McAfee,LLC
product: Secure Web Gateway
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.1
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Published: 2022-04-20T13:00:17.000Z
CVE-2022-1255 Import and export users and customers < 1.19.2.1 - Admin+ Stored Cross-Site Scripting
The Import and export users and customers WordPress plugin before 1.19.2.1 does not sanitise and escaped imported CSV data, which could allow high privilege users to import malicious javascript code and lead to Stored Cross-Site Scripting issues
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Import and export users and customers
Credits: lang: en
value: 0x23.so
Published: 2022-05-02T16:05:52.000Z
CVE-2022-1256 Improper Privilege Management in McAfee Agent for Windows
A local privilege escalation vulnerability in MA for Windows prior to 5.7.6 allows a local low privileged user to gain system privileges through running the repair functionality. Temporary file actions were performed on the local user's %TEMP% directory with System privileges through manipulation of symbolic links.
Problem types: cwe_id: CWE-269
description: CWE-269: Improper Privilege Management
Affected products: vendor: McAfee,LLC
product: McAfee Agent for Windows
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2022-04-14T13:45:17.000Z
CVE-2022-1257 Improper Verification of Cryptographic Signature by McAfee Agent
Insecure storage of sensitive information vulnerability in MA for Linux, macOS, and Windows prior to 5.7.6 allows a local user to gain access to sensitive information through storage in ma.db. The sensitive information has been moved to encrypted database files.
Problem types: cwe_id: CWE-922
description: CWE-922: Insecure Storage of Sensitive Information
Affected products: vendor: McAfee,LLC
product: McAfee Agent
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 6.1
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
version: 3.1
Published: 2022-04-14T13:50:18.000Z
CVE-2022-1258 SQL injection vulnerability in McAfee Agent's ePO extension
A blind SQL injection vulnerability in the ePolicy Orchestrator (ePO) extension of MA prior to 5.7.6 can be exploited by an authenticated administrator on ePO to perform arbitrary SQL queries in the back-end database, potentially leading to command execution on the server.
Problem types: cwe_id: CWE-89
description: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: McAfee,LLC
product: McAfee Agent ePO extension
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.4
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
version: 3.1
Published: 2022-04-14T13:50:12.000Z
CVE-2022-1259 
A flaw was found in Undertow. A potential security issue in flow control handling by the browser over HTTP/2 may cause overhead or a denial of service in the server. This flaw exists because of an incomplete fix for CVE-2021-3629.
Problem types: cwe_id: CWE-400
description: CWE-400 - Uncontrolled Resource Consumption.
Affected products: vendor: n/a
product: undertow
Published: 2022-08-31T00:00:00.000Z
CVE-2022-1261 Matrikon OPC Server Improper Access Control
Matrikon, a subsidary of Honeywell Matrikon OPC Server (all versions) is vulnerable to a condition where a low privileged user allowed to connect to the OPC server to use the functions of the IPersisFile to execute operating system processes with system-level privileges.
Problem types: cwe_id: CWE-284
description: CWE-284 Improper Access Control
Affected products: vendor: Matrikon, a subsidiary of Honeywell
product: Matrikon OPC Server
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.8
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:N
version: 3.1
Published: 2022-05-26T16:35:55.833Z
CVE-2022-1262 
A command injection vulnerability in the protest binary allows an attacker with access to the remote command line interface to execute arbitrary commands as root.
Problem types: description: Command Injection
Affected products: vendor: n/a
product: D-Link Routers
Published: 2022-04-11T19:38:13.000Z
CVE-2022-1263 
A NULL pointer dereference issue was found in KVM when releasing a vCPU with dirty ring support enabled. This flaw allows an unprivileged local attacker on the host to issue specific ioctl calls, causing a kernel oops condition that results in a denial of service.
Problem types: cwe_id: CWE-476
description: CWE-476 - NULL Pointer Dereference.
Affected products: vendor: n/a
product: Kernel:KVM
Published: 2022-08-31T15:33:00.000Z
CVE-2022-1264 Inductive Automation Ignition
The affected product may allow an attacker with access to the Ignition web configuration to run arbitrary code.
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: Inductive Automation
product: Ignition
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.8
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N
version: 3.1
Credits: lang: en
value: Mashav Sapir of Claroty reported this vulnerability to CISA
Published: 2022-07-20T15:34:59.675Z
CVE-2022-1265 BulletProof Security < 6.1 - Admin+ Stored Cross-Site Scripting
The BulletProof Security WordPress plugin before 6.1 does not sanitize and escape some of its CAPTCHA settings, which could allow high-privileged users to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: BulletProof Security
Credits: lang: en
value: Fayçal CHENA
Published: 2022-05-16T14:30:43.000Z
CVE-2022-1266 Post Grid, Slider & Carousel Ultimate < 1.5.0 - Admin+ Stored XSS
The Post Grid, Slider & Carousel Ultimate WordPress plugin before 1.5.0 does not sanitise and escape the Header Title, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Post Grid, Slider & Carousel Ultimate
Credits: lang: en
value: Fayçal CHENA
Published: 2022-06-20T10:25:48.000Z
CVE-2022-1267 BMI BMR Calculator <= 1.3 - Reflected Cross-Site Scripting
The BMI BMR Calculator WordPress plugin through 1.3 does not sanitise and escape arbitrary POST data before outputting it back in the response, leading to a Reflected Cross-Site Scripting
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: BMI BMR Calculator
Credits: lang: en
value: p7e4
Published: 2022-05-16T14:30:45.000Z
CVE-2022-1268 Donate Extra <= 2.02 - Reflected Cross-Site Scripting
The Donate Extra WordPress plugin through 2.02 does not sanitise and escape a parameter before outputting it back in the response, leading to a Reflected cross-Site Scripting
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Donate Extra
Credits: lang: en
value: p7e4
Published: 2022-05-23T07:15:31.000Z
CVE-2022-1269 Fast Flow < 1.2.12 - Reflected Cross-Site Scripting
The Fast Flow WordPress plugin before 1.2.12 does not sanitise and escape the page parameter before outputting back in an attribute in an admin dashboard, leading to a Reflected Cross-Site Scripting
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Fast Flow
Credits: lang: en
value: p7e4
Published: 2022-05-02T16:05:53.000Z
CVE-2022-1270 
In GraphicsMagick, a heap buffer overflow was found when parsing MIFF.
Problem types: cwe_id: CWE-119
description: CWE-119
Affected products: vendor: n/a
product: GraphicsMagick
Published: 2022-09-28T00:00:00.000Z
CVE-2022-1271 
An arbitrary file write vulnerability was found in GNU gzip's zgrep utility. When zgrep is applied on the attacker's chosen file name (for example, a crafted file name), this can overwrite an attacker's content to an arbitrary attacker-selected file. This flaw occurs due to insufficient validation when processing filenames with two or more newlines where selected content and the target file names are embedded in crafted multi-line file names. This flaw allows a remote, low privileged attacker to force zgrep to write arbitrary files on the system.
Problem types: cwe_id: CWE-179
description: CWE-179 - Incorrect Behavior Order: Early Validation, CWE-1173 Improper Use of Validation Framework
Affected products: vendor: n/a
product: gzip, xz-utils
Published: 2022-08-31T15:33:00.000Z
CVE-2022-1273 Import WP < 2.4.6 - Admin+ Arbitrary File Upload to RCE
The Import WP WordPress plugin before 2.4.6 does not validate the imported file in some cases, allowing high privilege users such as admin to upload arbitrary files (such as PHP), leading to RCE
Problem types: cwe_id: CWE-434
description: CWE-434 Unrestricted Upload of File with Dangerous Type
Affected products: vendor: Unknown
product: Import WP – Import and Export WordPress data to XML or CSV files
Credits: lang: en
value: ericfrank900528
Published: 2022-05-02T16:05:55.000Z
CVE-2022-1274 
A flaw was found in Keycloak in the execute-actions-email endpoint. This issue allows arbitrary HTML to be injected into emails sent to Keycloak users and can be misused to perform phishing or other attacks against users.
Problem types: cwe_id: CWE-80
description: CWE-80
Affected products: vendor: n/a
product: keycloak
Published: 2023-03-29T00:00:00.000Z
CVE-2022-1275 BannerMan <= 0.2.4 - Multiple Admin+ Stored Cross-Site Scripting
The BannerMan WordPress plugin through 0.2.4 does not sanitize or escape its settings, which could allow high-privileged users to perform Cross-Site Scripting attacks when the unfiltered_html is disallowed (such as in multisite)
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: BannerMan
Credits: lang: en
value: Fayçal CHENA
Published: 2022-05-30T08:35:40.000Z
CVE-2022-1276 Out-of-bounds Read in mrb_get_args  in mruby/mruby
Out-of-bounds Read in mrb_get_args in GitHub repository mruby/mruby prior to 3.2. Possible arbitrary code execution if being exploited.
Problem types: cwe_id: CWE-125
description: CWE-125 Out-of-bounds Read
Affected products: vendor: mruby
product: mruby/mruby
Published: 2022-04-10T09:35:10.000Z
CVE-2022-1277 SQL Injection in Inavitas Solar Log
Inavitas Solar Log product has an unauthenticated SQL Injection vulnerability.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Inavitas
product: Inavitas Solar Log
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: LOW
baseSeverity: CRITICAL
baseScore: 9.4
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
Credits: lang: en
value: Ismail ERKEK
Published: 2022-07-29T12:45:19.527Z
CVE-2022-1278 
A flaw was found in WildFly, where an attacker can see deployment names, endpoints, and any other data the trace payload may contain.
Problem types: cwe_id: CWE-1188
description: CWE-1188
Affected products: vendor: n/a
product: WildFly
Published: 2022-09-13T13:38:02.000Z
CVE-2022-1279 Insecure EBICS messages encryption implementation in ebics-java/ebics-java-client could allow an adjacent attacker to decrypt EBICS payloads
A vulnerability in the encryption implementation of EBICS messages in the open source librairy ebics-java/ebics-java-client allows an attacker sniffing network traffic to decrypt EBICS payloads. This issue affects: ebics-java/ebics-java-client versions prior to 1.2.
Problem types: cwe_id: CWE-325
description: CWE-325 Missing Required Cryptographic Step
Affected products: vendor: ebics-java
product: ebics-java-client
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Lars Meijers, Netcetera
Published: 2022-04-14T07:40:09.000Z
CVE-2022-1280 
A use-after-free vulnerability was found in drm_lease_held in drivers/gpu/drm/drm_lease.c in the Linux kernel due to a race problem. This flaw allows a local user privilege attacker to cause a denial of service (DoS) or a kernel information leak.
Problem types: cwe_id: CWE-416
description: CWE-416
Affected products: vendor: n/a
product: kernel
Published: 2022-04-13T17:05:51.000Z
CVE-2022-1281 Photo Gallery < 1.6.3 - Unauthenticated SQL Injection
The Photo Gallery WordPress plugin through 1.6.3 does not properly escape the $_POST['filter_tag'] parameter, which is appended to an SQL query, making SQL Injection attacks possible.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: Photo Gallery by 10Web – Mobile-Friendly Image Gallery
Credits: lang: en
value: JrXnm
Published: 2022-05-02T16:05:57.000Z
CVE-2022-1282 Photo Gallery < 1.6.3 - Reflected Cross-Site Scripting
The Photo Gallery by 10Web WordPress plugin before 1.6.3 does not properly sanitize the $_GET['image_url'] variable, which is reflected back to the users when executing the editimage_bwg AJAX action.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Photo Gallery by 10Web – Mobile-Friendly Image Gallery
Credits: lang: en
value: JrXnm
Published: 2022-05-02T16:05:58.000Z
CVE-2022-1283 NULL Pointer Dereference in r_bin_ne_get_entrypoints function in radareorg/radare2
NULL Pointer Dereference in r_bin_ne_get_entrypoints function in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability allows attackers to cause a denial of service (application crash).
Problem types: cwe_id: CWE-476
description: CWE-476 NULL Pointer Dereference
Affected products: vendor: radareorg
product: radareorg/radare2
Published: 2022-04-08T17:55:10.000Z
CVE-2022-1284 heap-use-after-free in radareorg/radare2
heap-use-after-free in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability is capable of inducing denial of service.
Problem types: cwe_id: CWE-416
description: CWE-416 Use After Free
Affected products: vendor: radareorg
product: radareorg/radare2
Published: 2022-04-08T18:45:14.000Z
CVE-2022-1285 Server-Side Request Forgery (SSRF) in gogs/gogs
Server-Side Request Forgery (SSRF) in GitHub repository gogs/gogs prior to 0.12.8.
Problem types: cwe_id: CWE-918
description: CWE-918 Server-Side Request Forgery (SSRF)
Affected products: vendor: gogs
product: gogs/gogs
Published: 2022-06-01T05:55:10.000Z
CVE-2022-1286 heap-buffer-overflow in mrb_vm_exec in mruby/mruby in mruby/mruby
heap-buffer-overflow in mrb_vm_exec in mruby/mruby in GitHub repository mruby/mruby prior to 3.2. Possible arbitrary code execution if being exploited.
Problem types: cwe_id: CWE-122
description: CWE-122 Heap-based Buffer Overflow
Affected products: vendor: mruby
product: mruby/mruby
Published: 2022-04-10T10:40:09.000Z
CVE-2022-1287 School Club Application System resource injection
A vulnerability classified as critical was found in School Club Application System 1.0. This vulnerability affects a request to the file /scas/classes/Users.php?f=save_user. The manipulation with a POST request leads to privilege escalation. The attack can be initiated remotely and does not require authentication. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-99
description: CWE-99 Improper Control of Resource Identifiers
Affected products: vendor: unspecified
product: School Club Application System
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
version: 3.1
Published: 2022-04-09T20:10:12.000Z
CVE-2022-1288 School Club Application System cross site scripting
A vulnerability, which was classified as problematic, has been found in School Club Application System 1.0. This issue affects access to /scas/admin/. The manipulation of the parameter page with the input %22%3E%3Cimg%20src=x%20onerror=alert(1)%3E leads to a reflected cross site scripting. The attack may be initiated remotely and does not require any form of authentication. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross Site Scripting
Affected products: vendor: unspecified
product: School Club Application System
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
version: 3.1
Published: 2022-04-09T20:10:13.000Z
CVE-2022-1289 tildearrow Furnace Incomplete Fix CVE-2022-1211 denial of service
A denial of service vulnerability was found in tildearrow Furnace. It has been classified as problematic. This is due to an incomplete fix of CVE-2022-1211. It is possible to initiate the attack remotely but it requires user interaction. The issue got fixed with the patch 0eb02422d5161767e9983bdaa5c429762d3477ce.
Problem types: cwe_id: CWE-404
description: CWE-404 Denial of Service
Affected products: vendor: tildearrow
product: Furnace
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
version: 3.1
Published: 2022-04-10T15:15:15.000Z