rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-1683 amtyThumb <= 4.2.0 - Subscriber+ SQLi
The amtyThumb WordPress plugin through 4.2.0 does not sanitise and escape a parameter before using it in a SQL statement via its shortcode, leading to an SQL injection and is exploitable by any authenticated user (and not just Author+ like the original advisory mention) due to the fact that they can execute shortcodes via an AJAX action
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: amtyThumb
Credits: lang: en
value: Daniel Krohmer (Fraunhofer IESE)
lang: en
value: Shi Chen (University of Kaiserslautern)
Published: 2022-06-06T08:51:16.000Z
CVE-2022-1684 Cube Slider <= 1.2 - Admin+ SQLi
The Cube Slider WordPress plugin through 1.2 does not sanitise and escape the idslider parameter before using it in various SQL queries, leading to SQL Injections exploitable by high privileged users such as admin
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: CUBE SLIDER
Credits: lang: en
value: Daniel Krohmer (Fraunhofer IESE)
lang: en
value: Shi Chen (University of Kaiserslautern)
Published: 2022-06-06T08:51:17.000Z
CVE-2022-1685 Five Minute Webshop <= 1.3.2 - Admin+ SQLi via orderby
The Five Minute Webshop WordPress plugin through 1.3.2 does not properly validate and sanitise the orderby parameter before using it in a SQL statement via the Manage Products admin page, leading to an SQL Injection
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: Five Minute Webshop
Credits: lang: en
value: Daniel Krohmer (Fraunhofer IESE)
lang: en
value: Shi Chen (University of Kaiserslautern)
Published: 2022-06-06T08:51:19.000Z
CVE-2022-1686 Five Minute Webshop <= 1.3.2 - Admin+ SQLi via id
The Five Minute Webshop WordPress plugin through 1.3.2 does not sanitise and escape the id parameter before using it in a SQL statement when editing a product via the admin dashboard, leading to an SQL Injection
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: Five Minute Webshop
Credits: lang: en
value: Daniel Krohmer (Fraunhofer IESE)
lang: en
value: Shi Chen (University of Kaiserslautern)
Published: 2022-06-06T08:51:20.000Z
CVE-2022-1687 Logo Slider <= 1.4.8 - Admin+ SQLi
The Logo Slider WordPress plugin through 1.4.8 does not sanitise and escape the lsp_slider_id parameter before using it in a SQL statement via the Manage Slider Images admin page, leading to an SQL Injection
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: Logo Slider
Credits: lang: en
value: Daniel Krohmer (Fraunhofer IESE)
lang: en
value: Shi Chen (University of Kaiserslautern)
Published: 2022-06-06T08:51:22.000Z
CVE-2022-1688 Note Press <= 0.1.10 - Admin+ SQLi via id
The Note Press WordPress plugin through 0.1.10 does not sanitise and escape the id parameter before using it in various SQL statement via the admin dashboard, leading to SQL Injections
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: Note Press
Credits: lang: en
value: Daniel Krohmer (Fraunhofer IESE)
lang: en
value: Shi Chen (University of Kaiserslautern)
Published: 2022-06-06T08:51:23.000Z
CVE-2022-1689 Note Press <= 0.1.10 - Admin+ SQLi via Update
The Note Press WordPress plugin through 0.1.10 does not sanitise and escape the Update parameter before using it in a SQL statement when updating a note via the admin dashboard, leading to an SQL injection
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: Note Press
Credits: lang: en
value: Daniel Krohmer (Fraunhofer IESE)
lang: en
value: Shi Chen (University of Kaiserslautern)
Published: 2022-06-06T08:51:24.000Z
CVE-2022-1690 Note Press <= 0.1.10 - Admin+ SQLi via Bulk Actions
The Note Press WordPress plugin through 0.1.10 does not sanitise and escape the ids from the bulk actions before using them in a SQL statement in an admin page, leading to an SQL injection
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: Note Press
Credits: lang: en
value: Daniel Krohmer (Fraunhofer IESE)
lang: en
value: Shi Chen (University of Kaiserslautern)
Published: 2022-06-06T08:51:26.000Z
CVE-2022-1691 Realty Workstation < 1.0.15 - Agent SQLi
The Realty Workstation WordPress plugin before 1.0.15 does not sanitise and escape the trans_edit parameter before using it in a SQL statement when an agent edit a transaction, leading to an SQL injection
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: Realty Workstation
Credits: lang: en
value: Daniel Krohmer (Fraunhofer IESE)
lang: en
value: Shi Chen (University of Kaiserslautern)
Published: 2022-06-06T08:51:27.000Z
CVE-2022-1692 CP Image Store with Slideshow < 1.0.68 - Unauthenticated SQLi
The CP Image Store with Slideshow WordPress plugin before 1.0.68 does not sanitise and escape the ordering_by query parameter before using it in a SQL statement in pages where the [codepeople-image-store] is embed, allowing unauthenticated users to perform an SQL injection attack
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: CP Image Store with Slideshow
Credits: lang: en
value: Daniel Krohmer (Fraunhofer IESE)
lang: en
value: Shi Chen (University of Kaiserslautern)
Published: 2022-06-06T08:51:29.000Z
CVE-2022-1694 Useful Banner Manager <= 1.6.1 - Modify banners via CSRF
The Useful Banner Manager WordPress plugin through 1.6.1 does not perform CSRF checks on POST requests to its admin page, allowing an attacker to trick a logged in admin to add, modify or delete banners from the plugin by submitting a form.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: Useful Banner Manager
Credits: lang: en
value: Daniel Ruf
Published: 2022-06-13T12:42:25.000Z
CVE-2022-1695 WP Simple Adsense Insertion < 2.1 - Inject ads and javascript via CSRF
The WP Simple Adsense Insertion WordPress plugin before 2.1 does not perform CSRF checks on updates to its admin page, allowing an attacker to trick a logged in user to manipulate ads and inject arbitrary javascript via submitting a form.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: WP Simple Adsense Insertion
Credits: lang: en
value: Daniel Ruf
Published: 2022-06-06T08:51:30.000Z
CVE-2022-1697 
Okta Active Directory Agent versions 3.8.0 through 3.11.0 installed the Okta AD Agent Update Service using an unquoted path. Note: To remediate this vulnerability, you must uninstall Okta Active Directory Agent and reinstall Okta Active Directory Agent 3.12.0 or greater per the documentation.
Problem types: description: Unquoted Search Path or Element
Affected products: vendor: Okta
product: Okta Active Directory Agent
Published: 2022-09-06T17:18:50.000Z
CVE-2022-1698 Allowing long password leads to denial of service in causefx/organizr
Allowing long password leads to denial of service in GitHub repository causefx/organizr prior to 2.1.2000. This vulnerability can be abused by doing a DDoS attack for which genuine users will not able to access resources/applications.
Problem types: cwe_id: CWE-191
description: CWE-191 Integer Underflow (Wrap or Wraparound)
Affected products: vendor: causefx
product: causefx/organizr
Published: 2022-05-12T15:20:15.000Z
CVE-2022-1699 Uncontrolled Resource Consumption in causefx/organizr
Uncontrolled Resource Consumption in GitHub repository causefx/organizr prior to 2.1.2000. This vulnerability can be abused by doing a DDoS attack for which genuine users will not able to access resources/applications.
Problem types: cwe_id: CWE-190
description: CWE-190 Integer Overflow or Wraparound
Affected products: vendor: causefx
product: causefx/organizr
Published: 2022-05-12T15:20:10.000Z
CVE-2022-1700 
Improper Restriction of XML External Entity Reference ('XXE') vulnerability in the Policy Engine of Forcepoint Data Loss Prevention (DLP), which is also leveraged by Forcepoint One Endpoint (F1E), Web Security Content Gateway, Email Security with DLP enabled, and Cloud Security Gateway prior to June 20, 2022. The XML parser in the Policy Engine was found to be improperly configured to support external entities and external DTD (Document Type Definitions), which can lead to an XXE attack. This issue affects: Forcepoint Data Loss Prevention (DLP) versions prior to 8.8.2. Forcepoint One Endpoint (F1E) with Policy Engine versions prior to 8.8.2. Forcepoint Web Security Content Gateway versions prior to 8.5.5. Forcepoint Email Security with DLP enabled versions prior to 8.5.5. Forcepoint Cloud Security Gateway prior to June 20, 2022.
Problem types: cwe_id: CWE-611
description: CWE-611 Improper Restriction of XML External Entity Reference ('XXE')
Affected products: vendor: Forcepoint
product: Data Loss Prevention (DLP)
vendor: Forcepoint
product: One Endpoint (F1E) with Policy Engine
vendor: Forcepoint
product: Web Security Content Gateway
vendor: Forcepoint
product: Email Security with DLP enabled
vendor: Forcepoint
product: Cloud Security Gateway
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Forcepoint would like to thank Kaushik Joshi and Keval Shah from iAppSecure Solutions Pvt Ltd. for discovering and working with us to responsibly disclose this vulnerability.
Published: 2022-09-12T18:07:05.000Z
CVE-2022-1701 
SonicWall SMA1000 series firmware 12.4.0, 12.4.1-02965 and earlier versions uses a shared and hard-coded encryption key to store data.
Problem types: cwe_id: CWE-321
description: CWE-321: Use of Hard-coded Cryptographic Key
Affected products: vendor: SonicWall
product: SonicWall SMA1000
Published: 2022-05-13T19:40:14.000Z
CVE-2022-1702 
SonicWall SMA1000 series firmware 12.4.0, 12.4.1-02965 and earlier versions accept a user-controlled input that specifies a link to an external site and uses that link in a redirect which leads to Open redirection vulnerability.
Problem types: cwe_id: CWE-601
description: CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
Affected products: vendor: SonicWall
product: SonicWall SMA1000
Published: 2022-05-13T19:40:15.000Z
CVE-2022-1703 
Improper neutralization of special elements in the SonicWall SSL-VPN SMA100 series management interface allows a remote authenticated attacker to inject OS Commands which potentially leads to remote command execution vulnerability or denial of service (DoS) attack.
Problem types: cwe_id: CWE-78
description: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: SonicWall
product: SMA100
Published: 2022-06-03T21:10:10.000Z
CVE-2022-1704 Inductive Automation Ignition
Due to an XML external entity reference, the software parses XML in the backup/restore functionality without XML security flags, which may lead to a XXE attack while restoring the backup.
Problem types: cwe_id: CWE-611
description: CWE-611 Improper Restriction of XML External Entity Reference ('XXE')
Affected products: vendor: Inductive Automation
product: Ignition
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.6
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L
version: 3.1
Credits: lang: en
value: Keval Shah reported this vulnerability to CISA
Published: 2022-08-05T15:25:19.220Z
CVE-2022-1705 Improper sanitization of Transfer-Encoding headers in net/http
Acceptance of some invalid Transfer-Encoding headers in the HTTP/1 client in net/http before Go 1.17.12 and Go 1.18.4 allows HTTP request smuggling if combined with an intermediate server that also improperly fails to reject the header as invalid.
Problem types: description: CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
Affected products: vendor: Go standard library
product: net/http
default_status: unaffected
Credits: lang: en
value: Zeyu Zhang (https://www.zeyu2001.com/)
Published: 2022-08-09T20:16:57.000Z
CVE-2022-1706 
A vulnerability was found in Ignition where ignition configs are accessible from unprivileged containers in VMs running on VMware products. This issue is only relevant in user environments where the Ignition config contains secrets. The highest threat from this vulnerability is to data confidentiality. Possible workaround is to not put secrets in the Ignition config.
Problem types: cwe_id: CWE-863
description: CWE-863 - Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: n/a
product: coreos/ignition
Published: 2022-05-17T00:00:00.000Z
CVE-2022-1707 Google Tag Manager for WordPress <= 1.15 - Reflected Cross-Site Scripting via Site Search
The Google Tag Manager for WordPress plugin for WordPress is vulnerable to reflected Cross-Site Scripting via the s parameter due to the site search populating into the data layer of sites with insufficient sanitization in versions up to an including 1.15. The affected file is ~/public/frontend.php and this could be exploited by unauthenticated attackers.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: duracelltomi
product: GTM4WP – A Google Tag Manager (GTM) plugin for WordPress
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
baseScore: 6.1
baseSeverity: MEDIUM
Credits: lang: en
value: Cory Buecker
lang: en
value: not_stoppable
Published: 2022-06-13T12:45:36.000Z
CVE-2022-1708 
A vulnerability was found in CRI-O that causes memory or disk space exhaustion on the node for anyone with access to the Kube API. The ExecSync request runs commands in a container and logs the output of the command. This output is then read by CRI-O after command execution, and it is read in a manner where the entire file corresponding to the output of the command is read in. Thus, if the output of the command is large it is possible to exhaust the memory or the disk space of the node when CRI-O reads the output of the command. The highest threat from this vulnerability is system availability.
Problem types: cwe_id: CWE-400
description: CWE-400 - Uncontrolled Resource Consumption
Affected products: vendor: n/a
product: CRI-O
Published: 2022-06-07T17:43:56.000Z
CVE-2022-1709 Throws SPAM Away < 3.3.1 - Comment Deletion via CSRF
The Throws SPAM Away WordPress plugin before 3.3.1 does not have CSRF checks in place when deleting comments (either all, spam, or pending), allowing attackers to make a logged in admin delete comments via a CSRF attack
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: Throws SPAM Away
Credits: lang: en
value: Daniel Ruf
Published: 2022-06-06T08:51:32.000Z
CVE-2022-1710 Appointment Hour Booking < 1.3.56 - Admin+ Stored Cross-Site Scripting
The Appointment Hour Booking WordPress plugin before 1.3.56 does not sanitise and escape a settings of its Calendar fields, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Appointment Hour Booking – WordPress Booking Plugin
Credits: lang: en
value: Bruno Halltari
Published: 2022-06-13T12:42:28.000Z
CVE-2022-1711 Server-Side Request Forgery (SSRF) in jgraph/drawio
Server-Side Request Forgery (SSRF) in GitHub repository jgraph/drawio prior to 18.0.5.
Problem types: cwe_id: CWE-918
description: CWE-918 Server-Side Request Forgery (SSRF)
Affected products: vendor: jgraph
product: jgraph/drawio
Published: 2022-05-17T12:40:09.000Z
CVE-2022-1712 LiveSync for WordPress <= 1.0 - Arbitrary Settings Update via CSRF
The LiveSync for WordPress plugin through 1.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: LiveSync for WordPress
Credits: lang: en
value: Daniel Ruf
Published: 2022-06-06T08:51:33.000Z
CVE-2022-1713 SSRF on /proxy in jgraph/drawio
SSRF on /proxy in GitHub repository jgraph/drawio prior to 18.0.4. An attacker can make a request as the server and read its contents. This can lead to a leak of sensitive information.
Problem types: cwe_id: CWE-918
description: CWE-918 Server-Side Request Forgery (SSRF)
Affected products: vendor: jgraph
product: jgraph/drawio
Published: 2022-05-16T14:31:52.000Z
CVE-2022-1714 Out-of-bounds Read in radareorg/radare2
Out-of-bounds Read in GitHub repository radareorg/radare2 prior to 5.7.0. The bug causes the program reads data past the end of the intented buffer. Typically, this can allow attackers to read sensitive information from other memory locations or cause a crash.
Problem types: cwe_id: CWE-125
description: CWE-125 Out-of-bounds Read
Affected products: vendor: radareorg
product: radareorg/radare2
Published: 2022-05-13T00:00:00.000Z
CVE-2022-1715 Account Takeover in neorazorx/facturascripts
Account Takeover in GitHub repository neorazorx/facturascripts prior to 2022.07.
Problem types: cwe_id: CWE-1125
description: CWE-1125 Excessive Attack Surface
Affected products: vendor: neorazorx
product: neorazorx/facturascripts
Published: 2022-05-13T17:10:10.000Z
CVE-2022-1716 
Keep My Notes v1.80.147 allows an attacker with physical access to the victim's device to bypass the application's password/pin lock to access user data. This is possible due to lack of adequate security controls to prevent dynamic code manipulation.
Problem types: description: Improper Access Control
Affected products: vendor: n/a
product: Keep My Notes
Published: 2022-06-02T17:05:42.000Z
CVE-2022-1717 Custom Share Buttons with Floating Sidebar < 4.2 - Admin+ Stored XSS
The Custom Share Buttons with Floating Sidebar WordPress plugin before 4.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Custom Share Buttons with Floating Sidebar
Credits: lang: en
value: Asif Nawaz Minhas
Published: 2022-06-20T10:25:57.000Z
CVE-2022-1718 The trudesk application allows large characters to insert in the input field "Full Name" on the signup field which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request in polonel/trudesk
The trudesk application allows large characters to insert in the input field "Full Name" on the signup field which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request in GitHub repository polonel/trudesk prior to 1.2.2. This can lead to Denial of service.
Problem types: cwe_id: CWE-190
description: CWE-190 Integer Overflow or Wraparound
Affected products: vendor: polonel
product: polonel/trudesk
Published: 2022-05-16T14:32:17.000Z
CVE-2022-1719 Reflected XSS on ticket filter function in polonel/trudesk
Reflected XSS on ticket filter function in GitHub repository polonel/trudesk prior to 1.2.2. This vulnerability is capable of executing a malicious javascript code in web page
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: polonel
product: polonel/trudesk
Published: 2022-05-16T14:32:10.000Z
CVE-2022-1720 Buffer Over-read in function grab_file_name in vim/vim
Buffer Over-read in function grab_file_name in GitHub repository vim/vim prior to 8.2.4956. This vulnerability is capable of crashing the software, memory modification, and possible remote execution.
Problem types: cwe_id: CWE-126
description: CWE-126 Buffer Over-read
Affected products: vendor: vim
product: vim/vim
Published: 2022-05-16T00:00:00.000Z
CVE-2022-1721 Path Traversal in WellKnownServlet in jgraph/drawio
Path Traversal in WellKnownServlet in GitHub repository jgraph/drawio prior to 18.0.5. Read local files of the web application.
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: jgraph
product: jgraph/drawio
Published: 2022-05-16T14:31:26.000Z
CVE-2022-1722 SSRF in editor's proxy via IPv6 link-local address in jgraph/drawio
SSRF in editor's proxy via IPv6 link-local address in GitHub repository jgraph/drawio prior to 18.0.5. SSRF to internal link-local IPv6 addresses
Problem types: cwe_id: CWE-918
description: CWE-918 Server-Side Request Forgery (SSRF)
Affected products: vendor: jgraph
product: jgraph/drawio
Published: 2022-05-16T14:31:21.000Z
CVE-2022-1723 Server-Side Request Forgery (SSRF) in jgraph/drawio
Server-Side Request Forgery (SSRF) in GitHub repository jgraph/drawio prior to 18.0.6.
Problem types: cwe_id: CWE-918
description: CWE-918 Server-Side Request Forgery (SSRF)
Affected products: vendor: jgraph
product: jgraph/drawio
Published: 2022-05-17T08:35:10.000Z
CVE-2022-1724 Simple Membership < 4.1.1 - Reflected Cross-Site Scripting
The Simple Membership WordPress plugin before 4.1.1 does not properly sanitise and escape parameters before outputting them back in AJAX actions, leading to Reflected Cross-Site Scripting
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Simple Membership
Credits: lang: en
value: cydave
Published: 2022-06-13T12:42:31.000Z
CVE-2022-1725 NULL Pointer Dereference in vim/vim
NULL Pointer Dereference in GitHub repository vim/vim prior to 8.2.4959.
Problem types: cwe_id: CWE-476
description: CWE-476 NULL Pointer Dereference
Affected products: vendor: vim
product: vim/vim
Published: 2022-05-16T00:00:00.000Z
CVE-2022-1726 Bootstrap Tables XSS vulnerability with Table Export plug-in when exportOptions: htmlContent is true in wenzhixin/bootstrap-table
Bootstrap Tables XSS vulnerability with Table Export plug-in when exportOptions: htmlContent is true in GitHub repository wenzhixin/bootstrap-table prior to 1.20.2. Disclosing session cookies, disclosing secure session data, exfiltrating data to third-parties.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: wenzhixin
product: wenzhixin/bootstrap-table
Published: 2022-05-16T14:55:18.000Z
CVE-2022-1727 Improper Input Validation in jgraph/drawio
Improper Input Validation in GitHub repository jgraph/drawio prior to 18.0.6.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: jgraph
product: jgraph/drawio
Published: 2022-05-18T10:25:12.000Z
CVE-2022-1728 Allowing long password leads to denial of service in polonel/trudesk in polonel/trudesk
Allowing long password leads to denial of service in polonel/trudesk in GitHub repository polonel/trudesk prior to 1.2.2. This vulnerability can be abused by doing a DDoS attack for which genuine users will not able to access resources/applications.
Problem types: cwe_id: CWE-190
description: CWE-190 Integer Overflow or Wraparound
Affected products: vendor: polonel
product: polonel/trudesk
Published: 2022-05-16T14:55:13.000Z