rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-33049 
Online Railway Reservation System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /orrs/admin/?page=user/manage_user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-21T13:15:32.000Z
CVE-2022-33055 
Online Railway Reservation System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /orrs/admin/trains/manage_train.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-21T13:21:54.000Z
CVE-2022-33056 
Online Railway Reservation System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /orrs/admin/schedules/manage_schedule.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-21T13:21:55.000Z
CVE-2022-33057 
Online Railway Reservation System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f=delete_reservation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-29T17:05:06.000Z
CVE-2022-33058 
Online Railway Reservation System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f=delete_message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-29T17:05:07.000Z
CVE-2022-33059 
Online Railway Reservation System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f=delete_train.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-29T17:05:08.000Z
CVE-2022-33060 
Online Railway Reservation System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f=delete_schedule.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-29T17:18:13.000Z
CVE-2022-33061 
Online Railway Reservation System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f=delete_service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-29T17:18:13.000Z
CVE-2022-33064 
An off-by-one error in function wav_read_header in src/wav.c in Libsndfile 1.1.0, results in a write out of bound, which allows an attacker to execute arbitrary code, Denial of Service or other unspecified impacts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-07-18T00:00:00.000Z
CVE-2022-33065 
Multiple signed integers overflow in function au_read_header in src/au.c and in functions mat4_open and mat4_read_header in src/mat4.c in Libsndfile, allows an attacker to cause Denial of Service or other unspecified impacts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-07-18T00:00:00.000Z
CVE-2022-33067 
Lrzip v0.651 was discovered to contain multiple invalid arithmetic shifts via the functions get_magic in lrzip.c and Predictor::init in libzpaq/libzpaq.cpp. These vulnerabilities allow attackers to cause a Denial of Service via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-22T13:24:41.000Z
CVE-2022-33068 
An integer overflow in the component hb-ot-shape-fallback.cc of Harfbuzz v4.3.0 allows attackers to cause a Denial of Service (DoS) via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-22T13:24:42.000Z
CVE-2022-33069 
Ethereum Solidity v0.8.14 contains an assertion failure via SMTEncoder::indexOrMemberAssignment() at SMTEncoder.cpp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-22T13:24:43.000Z
CVE-2022-33070 
Protobuf-c v1.4.0 was discovered to contain an invalid arithmetic shift via the function parse_tag_and_wiretype in protobuf-c/protobuf-c.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-22T13:24:44.000Z
CVE-2022-33075 
A stored cross-site scripting (XSS) vulnerability in the Add Classification function of Zoo Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-05T17:33:42.000Z
CVE-2022-33077 
An access control issue in nopcommerce v4.50.2 allows attackers to arbitrarily modify any customer's address via the addressedit endpoint.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-10-19T00:00:00.000Z
CVE-2022-33082 
An issue in the AST parser (ast/compile.go) of Open Policy Agent v0.10.2 allows attackers to cause a Denial of Service (DoS) via a crafted input.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-30T21:50:11.000Z
CVE-2022-33085 
ESPCMS P8 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the fetch_filename function at \espcms_public\espcms_templates\ESPCMS_Templates.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-30T22:12:31.000Z
CVE-2022-33087 
A stack overflow in the function DM_ In fillobjbystr() of TP-Link Archer C50&A5(US)_V5_200407 allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-30T22:27:55.000Z
CVE-2022-33092 
74cmsSE v3.5.1 was discovered to contain a SQL injection vulnerability via the keyword parameter at /home/job/index.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-22T18:42:09.000Z
CVE-2022-33093 
74cmsSE v3.5.1 was discovered to contain a SQL injection vulnerability via the key parameter at /freelance/resume_list.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-22T18:42:09.000Z
CVE-2022-33094 
74cmsSE v3.5.1 was discovered to contain a SQL injection vulnerability via the keyword parameter at /home/job/map.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-22T18:42:10.000Z
CVE-2022-33095 
74cmsSE v3.5.1 was discovered to contain a SQL injection vulnerability via the keyword parameter at /home/jobfairol/resumelist.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-22T18:42:13.000Z
CVE-2022-33096 
74cmsSE v3.5.1 was discovered to contain a SQL injection vulnerability via the keyword parameter at /home/resume/index.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-22T18:42:13.000Z
CVE-2022-33097 
74cmsSE v3.5.1 was discovered to contain a SQL injection vulnerability via the keyword parameter at /home/campus/campus_job.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-22T18:42:14.000Z
CVE-2022-33098 
Magnolia CMS v6.2.19 was discovered to contain a cross-site scripting (XSS) vulnerability via the Edit Contact function. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-07T18:58:53.000Z
CVE-2022-33099 
An issue in the component luaG_runerror of Lua v5.4.4 and below leads to a heap-buffer overflow when a recursive error occurs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-01T11:26:38.000Z
CVE-2022-33103 
Das U-Boot from v2020.10 to v2022.07-rc3 was discovered to contain an out-of-bounds write via the function sqfs_readdir().
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-01T11:36:55.000Z
CVE-2022-33105 
Redis v7.0 was discovered to contain a memory leak via the component streamGetEdgeID.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-22T13:13:56.000Z
CVE-2022-33106 
WiJungle NGFW Version U250 was discovered to be vulnerable to No Rate Limit attack, allowing the attacker to brute force the admin password leading to Account Take Over.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-10-12T00:00:00.000Z
CVE-2022-33107 
ThinkPHP v6.0.12 was discovered to contain a deserialization vulnerability via the component vendor\league\flysystem-cached-adapter\src\Storage\AbstractCache.php. This vulnerability allows attackers to execute arbitrary code via a crafted payload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-29T11:38:41.000Z
CVE-2022-33108 
XPDF v4.04 was discovered to contain a stack overflow vulnerability via the Object::Copy class of object.cc files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-28T16:59:18.000Z
CVE-2022-33113 
Jfinal CMS v5.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the keyword text field under the publish blog module.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-23T12:44:59.000Z
CVE-2022-33114 
Jfinal CMS v5.1.0 was discovered to contain a SQL injection vulnerability via the attrVal parameter at /jfinal_cms/system/dict/list.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-23T12:45:00.000Z
CVE-2022-33116 
An issue in the jmpath variable in /modules/mindmap/index.php of GUnet Open eClass Platform (aka openeclass) v3.12.4 and below allows attackers to read arbitrary files via a directory traversal.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-27T20:42:01.000Z
CVE-2022-33119 
NUUO Network Video Recorder NVRsolo v03.06.02 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via login.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-21T13:00:39.000Z
CVE-2022-33121 
A Cross-Site Request Forgery (CSRF) in MiniCMS v1.11 allows attackers to arbitrarily delete local .dat files via clicking on a malicious link.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-24T20:59:07.000Z
CVE-2022-33122 
A stored cross-site scripting (XSS) vulnerability in eyoucms v1.5.6 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the URL field under the login page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-24T20:59:08.000Z
CVE-2022-33124 
AIOHTTP 3.8.1 can report a "ValueError: Invalid IPv6 URL" outcome, which can lead to a Denial of Service (DoS). NOTE: multiple third parties dispute this issue because there is no example of a context in which denial of service would occur, and many common contexts have exception handing in the calling application
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-22T19:44:19.000Z
CVE-2022-33127 
The function that calls the diff tool in Diffy 3.4.1 does not properly handle double quotes in a filename when run in a windows environment. This allows attackers to execute arbitrary commands via a crafted string.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-22T19:31:51.000Z
CVE-2022-33128 
RG-EG series gateway EG350 EG_RGOS 11.1(6) was discovered to contain a SQL injection vulnerability via the function get_alarmAction at /alarm_pi/alarmService.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-25T01:13:59.000Z
CVE-2022-33137 
A vulnerability has been identified in SIMATIC MV540 H (All versions < V3.3), SIMATIC MV540 S (All versions < V3.3), SIMATIC MV550 H (All versions < V3.3), SIMATIC MV550 S (All versions < V3.3), SIMATIC MV560 U (All versions < V3.3), SIMATIC MV560 X (All versions < V3.3). The web session management of affected devices does not invalidate session ids in certain logout scenarios. This could allow an authenticated remote attacker to hijack other users' sessions.
Problem types: cwe_id: CWE-613
description: CWE-613: Insufficient Session Expiration
Affected products: vendor: Siemens
product: SIMATIC MV540 H
vendor: Siemens
product: SIMATIC MV540 S
vendor: Siemens
product: SIMATIC MV550 H
vendor: Siemens
product: SIMATIC MV550 S
vendor: Siemens
product: SIMATIC MV560 U
vendor: Siemens
product: SIMATIC MV560 X
Published: 2022-07-12T10:06:44.000Z
CVE-2022-33138 
A vulnerability has been identified in SIMATIC MV540 H (All versions < V3.3), SIMATIC MV540 S (All versions < V3.3), SIMATIC MV550 H (All versions < V3.3), SIMATIC MV550 S (All versions < V3.3), SIMATIC MV560 U (All versions < V3.3), SIMATIC MV560 X (All versions < V3.3). Affected devices do not perform authentication for several web API endpoints. This could allow an unauthenticated remote attacker to read and download data from the device.
Problem types: cwe_id: CWE-306
description: CWE-306: Missing Authentication for Critical Function
Affected products: vendor: Siemens
product: SIMATIC MV540 H
vendor: Siemens
product: SIMATIC MV540 S
vendor: Siemens
product: SIMATIC MV550 H
vendor: Siemens
product: SIMATIC MV550 S
vendor: Siemens
product: SIMATIC MV560 U
vendor: Siemens
product: SIMATIC MV560 X
Published: 2022-07-12T10:06:46.000Z
CVE-2022-33139 
A vulnerability has been identified in Cerberus DMS (All versions), Desigo CC (All versions), Desigo CC Compact (All versions), SIMATIC WinCC OA V3.16 (All versions in default configuration), SIMATIC WinCC OA V3.17 (All versions in non-default configuration), SIMATIC WinCC OA V3.18 (All versions in non-default configuration). Affected applications use client-side only authentication, when neither server-side authentication (SSA) nor Kerberos authentication is enabled. In this configuration, attackers could impersonate other users or exploit the client-server protocol without being authenticated.
Problem types: cwe_id: CWE-603
description: CWE-603: Use of Client-Side Authentication
Affected products: vendor: Siemens
product: Cerberus DMS
vendor: Siemens
product: Desigo CC
vendor: Siemens
product: Desigo CC Compact
vendor: Siemens
product: SIMATIC WinCC OA V3.16
vendor: Siemens
product: SIMATIC WinCC OA V3.17
vendor: Siemens
product: SIMATIC WinCC OA V3.18
Published: 2022-06-21T00:00:00.000Z
CVE-2022-33140 Improper Neutralization of Command Elements in Shell User Group Provider
The optional ShellUserGroupProvider in Apache NiFi 1.10.0 to 1.16.2 and Apache NiFi Registry 0.6.0 to 1.16.2 does not neutralize arguments for group resolution commands, allowing injection of operating system commands on Linux and macOS platforms. The ShellUserGroupProvider is not included in the default configuration. Command injection requires ShellUserGroupProvider to be one of the enabled User Group Providers in the Authorizers configuration. Command injection also requires an authenticated user with elevated privileges. Apache NiFi requires an authenticated user with authorization to modify access policies in order to execute the command. Apache NiFi Registry requires an authenticated user with authorization to read user groups in order to execute the command. The resolution removes command formatting based on user-provided arguments.
Problem types: cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: Apache Software Foundation
product: Apache NiFi
vendor: Apache Software Foundation
product: Apache NiFi Registry
Published: 2022-06-15T14:25:15.000Z
CVE-2022-33142 WordPress Better Messages plugin <= 1.9.10.57 - Denial Of Service (DoS) vulnerability
Authenticated (subscriber+) Denial Of Service (DoS) vulnerability in WordPlus WordPress Better Messages plugin <= 1.9.10.57 at WordPress.
Problem types: description: Denial Of Service (DoS)
Affected products: vendor: WordPlus
product: Better Messages (WordPress plugin)
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.7
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: Vulnerability discovered by Dhakal Ananda (Patchstack Alliance)
Published: 2022-08-23T15:46:18.683Z
CVE-2022-33146 
Open redirect vulnerability in web2py versions prior to 2.22.5 allows a remote attacker to redirect a user to an arbitrary web site and conduct a phishing attack by having a user to access a specially crafted URL.
Problem types: description: Open Redirect
Affected products: vendor: web2py
product: web2py
Published: 2022-06-27T00:20:17.000Z
CVE-2022-33147 
A sql injection vulnerability exists in the ObjectYPT functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to a SQL injection. An attacker can send an HTTP request to trigger this vulnerability.This vulnerability exists in the aVideoEncoder functionality which can be used to add new videos, allowing an attacker to inject SQL by manipulating the videoDownloadedLink or duration parameter.
Problem types: cwe_id: CWE-89
description: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: WWBN
product: AVideo
Published: 2022-08-22T18:29:10.678Z
CVE-2022-33148 
A sql injection vulnerability exists in the ObjectYPT functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to a SQL injection. An attacker can send an HTTP request to trigger this vulnerability.This vulnerability exists in the Live Schedules plugin, allowing an attacker to inject SQL by manipulating the title parameter.
Problem types: cwe_id: CWE-89
description: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: WWBN
product: AVideo
Published: 2022-08-22T18:29:35.981Z
CVE-2022-33149 
A sql injection vulnerability exists in the ObjectYPT functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to a SQL injection. An attacker can send an HTTP request to trigger this vulnerability.This vulnerability exists in the CloneSite plugin, allowing an attacker to inject SQL by manipulating the url parameter.
Problem types: cwe_id: CWE-89
description: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: WWBN
product: AVideo
Published: 2022-08-22T18:29:57.518Z
CVE-2022-33150 
An OS command injection vulnerability exists in the js_package install functionality of Robustel R1510 3.1.16. A specially-crafted network request can lead to arbitrary command execution. An attacker can send a sequence of requests to trigger this vulnerability.
Problem types: cwe_id: CWE-78
description: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: Robustel
product: R1510
Published: 2022-10-25T16:33:47.057Z
CVE-2022-33151 
Cross-site scripting vulnerability in the specific parameters of Cybozu Office 10.0.0 to 10.8.5 allows remote attackers to inject an arbitrary script via unspecified vectors.
Problem types: description: Cross-site scripting
Affected products: vendor: Cybozu, Inc.
product: Cybozu Office
Published: 2022-08-18T07:14:25.000Z
CVE-2022-33154 
The schema (aka Embedding schema.org vocabulary) extension before 1.13.1 and 2.x before 2.5.1 for TYPO3 allows XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-12T21:56:37.000Z
CVE-2022-33155 
The ameos_tarteaucitron (aka AMEOS - TarteAuCitron GDPR cookie banner and tracking management / French RGPD compatible) extension before 1.2.23 for TYPO3 allows XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-12T21:59:13.000Z
CVE-2022-33156 
The matomo_integration (aka Matomo Integration) extension before 1.3.2 for TYPO3 allows XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-12T22:45:07.000Z
CVE-2022-33157 
The libconnect extension before 7.0.8 and 8.x before 8.1.0 for TYPO3 allows XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-12T22:36:56.000Z
CVE-2022-33158 
Trend Micro VPN Proxy Pro version 5.2.1026 and below contains a vulnerability involving some overly permissive folders in a key directory which could allow a local attacker to obtain privilege escalation on an affected system.
Problem types: description: Incorrect Permission Assignment
Affected products: vendor: Trend Micro
product: Trend Micro VPN Proxy One Pro (Consumer)
Published: 2022-07-29T23:15:23.000Z
CVE-2022-33159 IBM Security Directory Suite VA information disclosure
IBM Security Directory Suite VA 8.0.1 through 8.0.1.19 stores user credentials in plain clear text which can be read by an authenticated user.  IBM X-Force ID:  228567.
Problem types: cwe_id: CWE-200
description: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: IBM
product: Security Directory Suite VA
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2023-06-15T01:43:19.811Z
CVE-2022-33160 IBM Security Directory Suite information disclosure
IBM Security Directory Suite 8.0.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.  IBM X-Force ID:  228568.
Problem types: cwe_id: CWE-757
description: CWE-757 Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade')
Affected products: vendor: IBM
product: Security Directory Suite
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 3.7
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Published: 2023-10-06T21:09:11.698Z
CVE-2022-33161 IBM Security Directory Server information disclosure
IBM Security Directory Server 6.4.0 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques.  X-Force ID:  228569.
Problem types: cwe_id: CWE-311
description: CWE-311 Missing Encryption of Sensitive Data
Affected products: vendor: IBM
product: Security Directory Server
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
version: 3.1
Published: 2023-10-14T14:14:04.692Z