rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-44790 
Interspire Email Marketer through 6.5.1 allows SQL Injection via the surveys module. An unauthenticated attacker could successfully perform an attack to extract potentially sensitive information from the database if the survey id exists.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-09T00:00:00.000Z
CVE-2022-44792 
handle_ipDefaultTTL in agent/mibgroup/ip-mib/ip_scalars.c in Net-SNMP 5.8 through 5.9.3 has a NULL Pointer Exception bug that can be used by a remote attacker (who has write access) to cause the instance to crash via a crafted UDP packet, resulting in Denial of Service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-07T00:00:00.000Z
CVE-2022-44793 
handle_ipv6IpForwarding in agent/mibgroup/ip-mib/ip_scalars.c in Net-SNMP 5.4.3 through 5.9.3 has a NULL Pointer Exception bug that can be used by a remote attacker to cause the instance to crash via a crafted UDP packet, resulting in Denial of Service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-07T00:00:00.000Z
CVE-2022-44794 
An issue was discovered in Object First Ootbi BETA build 1.0.7.712. Management protocol has a flow which allows a remote attacker to execute arbitrary Bash code with root privileges. The command that sets the hostname doesn't validate input parameters. As a result, arbitrary data goes directly to the Bash interpreter. An attacker would need credentials to exploit this vulnerability. This is fixed in Object First Ootbi BETA build 1.0.13.1611.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-07T00:00:00.000Z
CVE-2022-44795 
An issue was discovered in Object First Ootbi BETA build 1.0.7.712. A flaw was found in the Web Service, which could lead to local information disclosure. The command that creates the URL for the support bundle uses an insecure RNG. That can lead to prediction of the generated URL. As a result, an attacker can get access to system logs. An attacker would need credentials to exploit this vulnerability. This is fixed in Object First Ootbi BETA build 1.0.13.1611. Important note - This vulnerability is related to the Object First Ootbi BETA version, which is not released for production and therefore has no impact on the production environment. The production-ready Object First Ootbi version will have this vulnerability fixed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-07T00:00:00.000Z
CVE-2022-44796 
An issue was discovered in Object First Ootbi BETA build 1.0.7.712. The authorization service has a flow that allows getting access to the Web UI without knowing credentials. For signing, the JWT token uses a secret key that is generated through a function that doesn't produce cryptographically strong sequences. An attacker can predict these sequences and generate a JWT token. As a result, an attacker can get access to the Web UI. This is fixed in Object First Ootbi BETA build 1.0.13.1611.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-07T00:00:00.000Z
CVE-2022-44797 
btcd before 0.23.2, as used in Lightning Labs lnd before 0.15.2-beta and other Bitcoin-related products, mishandles witness size checking.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-07T00:00:00.000Z
CVE-2022-44801 
D-Link DIR-878 1.02B05 is vulnerable to Incorrect Access Control.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-22T00:00:00.000Z
CVE-2022-44804 
D-Link DIR-882 1.10B02 and1.20B06 is vulnerable to Buffer Overflow via the websRedirect function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-22T00:00:00.000Z
CVE-2022-44806 
D-Link DIR-882 1.10B02 and 1.20B06 is vulnerable to Buffer Overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-22T00:00:00.000Z
CVE-2022-44807 
D-Link DIR-882 1.10B02 and 1.20B06 is vulnerable to Buffer Overflow via webGetVarString.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-22T00:00:00.000Z
CVE-2022-44808 
A command injection vulnerability has been found on D-Link DIR-823G devices with firmware version 1.02B03 that allows an attacker to execute arbitrary operating system commands through well-designed /HNAP1 requests. Before the HNAP API function can process the request, the system function executes an untrusted command that triggers the vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-22T00:00:00.000Z
CVE-2022-44820 
Automotive Shop Management System v1.0 is vulnerable to SQL Injection via /asms/admin/?page=transactions/manage_transaction&id=.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-18T00:00:00.000Z
CVE-2022-44830 
Sourcecodester Event Registration App v1.0 was discovered to contain multiple CSV injection vulnerabilities via the First Name, Contact and Remarks fields. These vulnerabilities allow attackers to execute arbitrary code via a crafted excel file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-21T00:00:00.000Z
CVE-2022-44832 
D-Link DIR-3040 device with firmware 120B03 was discovered to contain a command injection vulnerability via the SetTriggerLEDBlink function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-14T00:00:00.000Z
CVE-2022-44838 
Automotive Shop Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /services/view_service.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-09T00:00:00.000Z
CVE-2022-44840 
Heap buffer overflow vulnerability in binutils readelf before 2.40 via function find_section_in_set in file readelf.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-22T00:00:00.000Z
CVE-2022-44843 
TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the port parameter in the setting/setOpenVpnClientCfg function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-25T00:00:00.000Z
CVE-2022-44844 
TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the pass parameter in the setting/setOpenVpnCfg function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-25T00:00:00.000Z
CVE-2022-44849 
A Cross-Site Request Forgery (CSRF) in the Administrator List of MetInfo v7.7 allows attackers to arbitrarily add Super Administrator account.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-07T00:00:00.000Z
CVE-2022-44858 
Automotive Shop Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /asms/products/view_product.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-25T00:00:00.000Z
CVE-2022-44859 
Automotive Shop Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /asms/admin/products/manage_product.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-25T00:00:00.000Z
CVE-2022-44860 
Automotive Shop Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/transactions/update_status.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-25T00:00:00.000Z
CVE-2022-44870 
A reflected cross-site scripting (XSS) vulnerability in maccms10 v2022.1000.3032 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter under the AD Management module.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-01-06T00:00:00.000Z
CVE-2022-44874 
wasm3 commit 7890a2097569fde845881e0b352d813573e371f9 was discovered to contain a segmentation fault via the component op_CallIndirect at /m3_exec.h.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-13T00:00:00.000Z
CVE-2022-44875 
KioWare through 8.33 on Windows sets KioScriptingUrlACL.AclActions.AllowHigh for the about:blank origin, which allows attackers to obtain SYSTEM access via KioUtils.Execute in JavaScript code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-03-06T00:00:00.000Z
CVE-2022-44877 
login/index.php in CWP (aka Control Web Panel or CentOS Web Panel) 7 before 0.9.8.1147 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the login parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-01-05T00:00:00.000Z
CVE-2022-44897 
A cross-site scripting (XSS) vulnerability in ApolloTheme AP PageBuilder component through 2.4.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the show_number parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-01-31T00:00:00.000Z
CVE-2022-44898 
The MsIo64.sys component in Asus Aura Sync through v1.07.79 does not properly validate input to IOCTL 0x80102040, 0x80102044, 0x80102050, and 0x80102054, allowing attackers to trigger a memory corruption and cause a Denial of Service (DoS) or escalate privileges via crafted IOCTL requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-14T00:00:00.000Z
CVE-2022-44900 
A directory traversal vulnerability in the SevenZipFile.extractall() function of the python library py7zr v0.20.0 and earlier allows attackers to write arbitrary files via extracting a crafted 7z file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-06T00:00:00.000Z
CVE-2022-44910 
Binbloom 2.0 was discovered to contain a heap buffer overflow via the read_pointer function at /binbloom-master/src/helpers.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-14T00:00:00.000Z
CVE-2022-44928 
D-Link DVG-G5402SP GE_1.03 was discovered to contain a command injection vulnerability via the Maintenance function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-02T00:00:00.000Z
CVE-2022-44929 
An access control issue in D-Link DVG-G5402SP GE_1.03 allows unauthenticated attackers to escalate privileges via arbitrarily editing VoIP SIB profiles.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-02T00:00:00.000Z
CVE-2022-44930 
D-Link DHP-W310AV 3.10EU was discovered to contain a command injection vulnerability via the System Checks function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-02T00:00:00.000Z
CVE-2022-44931 
Tenda A18 v15.13.07.09 was discovered to contain a stack overflow via the security_5g parameter at /goform/WifiBasicSet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-08T00:00:00.000Z
CVE-2022-44932 
An access control issue in Tenda A18 v15.13.07.09 allows unauthenticated attackers to access the Telnet service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-08T00:00:00.000Z
CVE-2022-44937 
Bosscms v2.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the Add function under the Administrator List module.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-28T00:00:00.000Z
CVE-2022-44938 
Weak reset token generation in SeedDMS v6.0.20 and v5.1.7 allows attackers to execute a full account takeover via a brute force attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-08T00:00:00.000Z
CVE-2022-44939 
Efs Software Easy Chat Server Version 3.1 was discovered to contain a DLL hijacking vulnerability via the component TextShaping.dll. This vulnerability allows attackers to execute arbitrary code via a crafted DLL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-01-06T00:00:00.000Z
CVE-2022-44940 
Patchelf v0.9 was discovered to contain an out-of-bounds read via the function modifyRPath at src/patchelf.cc.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-19T00:00:00.000Z
CVE-2022-44942 
Casdoor before v1.126.1 was discovered to contain an arbitrary file deletion vulnerability via the uploadFile function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-07T00:00:00.000Z
CVE-2022-44944 
Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add Announcement function at /index.php?module=help_pages/pages&entities_id=24. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-02T00:00:00.000Z
CVE-2022-44945 
Rukovoditel v3.2.1 was discovered to contain a SQL injection vulnerability via the heading_field_id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-02T00:00:00.000Z
CVE-2022-44946 
Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add Page function at /index.php?module=help_pages/pages&entities_id=24. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-02T00:00:00.000Z
CVE-2022-44947 
Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Highlight Row feature at /index.php?module=entities/listing_types&entities_id=24. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Note field after clicking "Add".
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-02T00:00:00.000Z
CVE-2022-44948 
Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Entities Group feature at/index.php?module=entities/entities_groups. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field after clicking "Add".
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-02T00:00:00.000Z
CVE-2022-44949 
Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add New Field function at /index.php?module=entities/fields&entities_id=24. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Short Name field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-02T00:00:00.000Z
CVE-2022-44950 
Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add New Field function at /index.php?module=entities/fields&entities_id=24. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-02T00:00:00.000Z
CVE-2022-44951 
Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add New Form tab function at /index.php?module=entities/forms&entities_id=24. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-02T00:00:00.000Z
CVE-2022-44952 
Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in /index.php?module=configuration/application. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Copyright Text field after clicking "Add".
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-02T00:00:00.000Z
CVE-2022-44953 
webtareas 2.4p5 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /linkedcontent/listfiles.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field after clicking "Add".
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-02T00:00:00.000Z
CVE-2022-44954 
webtareas 2.4p5 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /contacts/listcontacts.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Last Name field after clicking "Add".
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-02T00:00:00.000Z
CVE-2022-44955 
webtareas 2.4p5 was discovered to contain a cross-site scripting (XSS) vulnerability in the Chat function. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Messages field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-02T00:00:00.000Z
CVE-2022-44956 
webtareas 2.4p5 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /projects/listprojects.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-02T00:00:00.000Z
CVE-2022-44957 
webtareas 2.4p5 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /clients/listclients.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-02T00:00:00.000Z
CVE-2022-44959 
webtareas 2.4p5 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /meetings/listmeetings.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-02T00:00:00.000Z
CVE-2022-44960 
webtareas 2.4p5 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /general/search.php?searchtype=simple. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Search field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-02T00:00:00.000Z
CVE-2022-44961 
webtareas 2.4p5 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /forums/editforum.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-02T00:00:00.000Z
CVE-2022-44962 
webtareas 2.4p5 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /calendar/viewcalendar.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Subject field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-02T00:00:00.000Z
CVE-2022-45003 
Gophish through 0.12.1 allows attackers to cause a Denial of Service (DoS) via a crafted payload involving autofocus.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-03-22T00:00:00.000Z
CVE-2022-45004 
Gophish through 0.12.1 was discovered to contain a cross-site scripting (XSS) vulnerability via a crafted landing page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-03-22T00:00:00.000Z
CVE-2022-45005 
IP-COM EW9 V15.11.0.14(9732) was discovered to contain a command injection vulnerability in the cmd_get_ping_output function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-13T00:00:00.000Z
CVE-2022-45008 
Online Leave Management System v1.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the component /leave_system/admin/?page=maintenance/department. This vulnerability allows attackers to execute arbitrary web scripts or HTML via crafted payload injected into the Name field under the Create New module.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-07T00:00:00.000Z
CVE-2022-45009 
Online Leave Management System v1.0 was discovered to contain an arbitrary file upload vulnerability at /leave_system/classes/SystemSettings.php?f=update_settings. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-07T00:00:00.000Z
CVE-2022-45010 
Simple Phone Book/Directory Web App v1.0 was discovered to contain a SQL injection vulnerability via the editid parameter at /PhoneBook/edit.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-07T00:00:00.000Z
CVE-2022-45012 
A cross-site scripting (XSS) vulnerability in the Modify Page module of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Source field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-21T00:00:00.000Z
CVE-2022-45013 
A cross-site scripting (XSS) vulnerability in the Show Advanced Option module of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Section Header field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-21T00:00:00.000Z
CVE-2022-45014 
A cross-site scripting (XSS) vulnerability in the Search Settings module of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Results Header field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-21T00:00:00.000Z
CVE-2022-45015 
A cross-site scripting (XSS) vulnerability in the Search Settings module of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Results Footer field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-21T00:00:00.000Z
CVE-2022-45016 
A cross-site scripting (XSS) vulnerability in the Search Settings module of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Footer field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-21T00:00:00.000Z
CVE-2022-45017 
A cross-site scripting (XSS) vulnerability in the Overview Page settings module of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Post Loop field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-21T00:00:00.000Z