rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-38974 WordPress WPML Multilingual CMS premium plugin <= 4.5.10 - Broken Access Control vulnerability
Broken Access Control vulnerability in WPML Multilingual CMS premium plugin <= 4.5.10 on WordPress allows users with subscriber or higher user roles to change the status of the translation jobs.
Problem types: cwe_id: CWE-264
description: CWE-264 Permissions, Privileges, and Access Controls
Affected products: vendor: OnTheGoSystems Ltd.
product: WPML Multilingual CMS (WordPress plugin)
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: Vulnerability discovered by Dave Jong (Patchstack)
Published: 2022-11-18T18:13:32.875Z
CVE-2022-38975 
DOM-based cross-site scripting vulnerability in EC-CUBE 4 series (EC-CUBE 4.0.0 to 4.1.2) allows a remote attacker to inject an arbitrary script by having an administrative user of the product to visit a specially crafted page.
Problem types: description: Cross-site scripting
Affected products: vendor: EC-CUBE CO.,LTD.
product: EC-CUBE 4 series
Published: 2022-09-27T01:55:16.000Z
CVE-2022-38977 
The HwAirlink module has a heap overflow vulnerability.Successful exploitation of this vulnerability may cause out-of-bounds writes, resulting in modification of sensitive data.
Problem types: description: Heap overflow vulnerability
Affected products: vendor: Huawei
product: HarmonyOS
Published: 2022-10-14T00:00:00.000Z
CVE-2022-38978 
The secure OS module has configuration defects. Successful exploitation of this vulnerability may affect data confidentiality.
Problem types: description: Configuration defects
Affected products: vendor: Huawei
product: HarmonyOS
vendor: Huawei
product: EMUI
vendor: Huawei
product: Magic UI
Published: 2022-09-16T17:56:37.000Z
CVE-2022-38979 
The secure OS module has configuration defects. Successful exploitation of this vulnerability may affect data confidentiality.
Problem types: description: Configuration defects
Affected products: vendor: Huawei
product: HarmonyOS
vendor: Huawei
product: EMUI
vendor: Huawei
product: Magic UI
Published: 2022-09-16T17:56:43.000Z
CVE-2022-38980 
The HwAirlink module has a heap overflow vulnerability in processing data packets of the proprietary protocol.Successful exploitation of this vulnerability may allow attackers to obtain process control permissions.
Problem types: description: Heap overflow vulnerability
Affected products: vendor: Huawei
product: HarmonyOS
Published: 2022-10-14T00:00:00.000Z
CVE-2022-38981 
The HwAirlink module has an out-of-bounds read vulnerability.Successful exploitation of this vulnerability may cause information leakage.
Problem types: description: Out-of-bounds read vulnerability
Affected products: vendor: Huawei
product: HarmonyOS
Published: 2022-10-14T00:00:00.000Z
CVE-2022-38982 
The fingerprint module has service logic errors.Successful exploitation of this vulnerability will cause the phone lock to be cracked.
Problem types: description: Service logic error vulnerability
Affected products: vendor: Huawei
product: HarmonyOS
Published: 2022-10-14T00:00:00.000Z
CVE-2022-38983 
The BT Hfp Client module has a Use-After-Free (UAF) vulnerability.Successful exploitation of this vulnerability may result in arbitrary code execution.
Problem types: description: UAF vulnerability
Affected products: vendor: Huawei
product: HarmonyOS
vendor: Huawei
product: EMUI
Published: 2022-10-14T00:00:00.000Z
CVE-2022-38984 
The HIPP module has a vulnerability of not verifying the data transferred in the kernel space.Successful exploitation of this vulnerability will cause out-of-bounds read, which affects data confidentiality.
Problem types: description: Out-of-bounds read vulnerability
Affected products: vendor: Huawei
product: HarmonyOS
vendor: Huawei
product: EMUI
Published: 2022-10-14T00:00:00.000Z
CVE-2022-38985 
The facial recognition module has a vulnerability in input validation.Successful exploitation of this vulnerability may affect data confidentiality.
Problem types: description: Input verification vulnerability
Affected products: vendor: Huawei
product: HarmonyOS
vendor: Huawei
product: EMUI
Published: 2022-10-14T00:00:00.000Z
CVE-2022-38986 
The HIPP module has a vulnerability of bypassing the check of the data transferred in the kernel space.Successful exploitation of this vulnerability may cause out-of-bounds access to the HIPP module and page table tampering, affecting device confidentiality and availability.
Problem types: description: Out-of-bounds access vulnerability
Affected products: vendor: Huawei
product: HarmonyOS
vendor: Huawei
product: EMUI
Published: 2022-10-14T00:00:00.000Z
CVE-2022-38987 
The secure OS module has configuration defects. Successful exploitation of this vulnerability may affect system availability.
Problem types: description: Configuration defects
Affected products: vendor: Huawei
product: HarmonyOS
vendor: Huawei
product: EMUI
Published: 2022-09-16T17:55:59.000Z
CVE-2022-38988 
The secure OS module has configuration defects. Successful exploitation of this vulnerability may affect data confidentiality.
Problem types: description: Configuration defects
Affected products: vendor: Huawei
product: HarmonyOS
vendor: Huawei
product: EMUI
Published: 2022-09-16T17:56:28.000Z
CVE-2022-38989 
The secure OS module has configuration defects. Successful exploitation of this vulnerability may affect system availability.
Problem types: description: Configuration defects
Affected products: vendor: Huawei
product: HarmonyOS
vendor: Huawei
product: EMUI
Published: 2022-09-16T17:56:33.000Z
CVE-2022-38990 
The secure OS module has configuration defects. Successful exploitation of this vulnerability may affect system availability.
Problem types: description: Configuration defects
Affected products: vendor: Huawei
product: HarmonyOS
vendor: Huawei
product: EMUI
Published: 2022-09-16T17:55:50.000Z
CVE-2022-38991 
The secure OS module has configuration defects. Successful exploitation of this vulnerability may affect data confidentiality.
Problem types: description: Configuration defects
Affected products: vendor: Huawei
product: HarmonyOS
vendor: Huawei
product: EMUI
Published: 2022-09-16T17:56:49.000Z
CVE-2022-38992 
The secure OS module has configuration defects. Successful exploitation of this vulnerability may affect data confidentiality.
Problem types: description: Configuration defects
Affected products: vendor: Huawei
product: HarmonyOS
vendor: Huawei
product: EMUI
Published: 2022-09-16T17:56:55.000Z
CVE-2022-38993 
The secure OS module has configuration defects. Successful exploitation of this vulnerability may affect system availability.
Problem types: description: Configuration defects
Affected products: vendor: Huawei
product: HarmonyOS
vendor: Huawei
product: EMUI
Published: 2022-09-16T17:55:53.000Z
CVE-2022-38994 
The secure OS module has configuration defects. Successful exploitation of this vulnerability may affect data confidentiality.
Problem types: description: Configuration defects
Affected products: vendor: Huawei
product: HarmonyOS
vendor: Huawei
product: EMUI
Published: 2022-09-16T17:56:57.000Z
CVE-2022-38995 
The secure OS module has configuration defects. Successful exploitation of this vulnerability may affect system availability.
Problem types: description: Configuration defects
Affected products: vendor: Huawei
product: HarmonyOS
vendor: Huawei
product: EMUI
Published: 2022-09-16T17:57:00.000Z
CVE-2022-38996 
The secure OS module has configuration defects. Successful exploitation of this vulnerability may affect system availability.
Problem types: description: Configuration defects
Affected products: vendor: Huawei
product: HarmonyOS
vendor: Huawei
product: EMUI
Published: 2022-09-16T17:57:04.000Z
CVE-2022-38997 
The secure OS module has configuration defects. Successful exploitation of this vulnerability may affect data confidentiality.
Problem types: description: Configuration defects
Affected products: vendor: Huawei
product: HarmonyOS
vendor: Huawei
product: EMUI
vendor: Huawei
product: Magic UI
Published: 2022-09-16T17:57:08.000Z
CVE-2022-38998 
The HISP module has a vulnerability of not verifying the data transferred in the kernel space.Successful exploitation of this vulnerability will cause out-of-bounds read, which affects data confidentiality.
Problem types: description: Out-of-bounds read vulnerability
Affected products: vendor: Huawei
product: HarmonyOS
vendor: Huawei
product: EMUI
Published: 2022-10-14T00:00:00.000Z
CVE-2022-38999 
The AOD module has the improper update of reference count vulnerability. Successful exploitation of this vulnerability may affect data integrity, confidentiality, and availability.
Problem types: description: Improper update of reference count vulnerability
Affected products: vendor: Huawei
product: HarmonyOS
vendor: Huawei
product: EMUI
Published: 2022-09-16T17:57:38.000Z
CVE-2022-39000 
The iAware module has a vulnerability in managing malicious apps.Successful exploitation of this vulnerability will cause malicious apps to automatically start upon system startup.
Problem types: description: Malicious app control vulnerability
Affected products: vendor: Huawei
product: HarmonyOS
vendor: Huawei
product: EMUI
vendor: Huawei
product: Magic UI
Published: 2022-09-16T17:55:46.000Z
CVE-2022-39001 
The number identification module has a path traversal vulnerability. Successful exploitation of this vulnerability may cause data disclosure.
Problem types: description: Path traversal vulnerability
Affected products: vendor: Huawei
product: HarmonyOS
vendor: Huawei
product: EMUI
vendor: Huawei
product: Magic UI
Published: 2022-09-16T17:57:48.000Z
CVE-2022-39002 
Double free vulnerability in the storage module. Successful exploitation of this vulnerability will cause the memory to be freed twice.
Problem types: description: Double free vulnerability
Affected products: vendor: n/a
product: HarmonyOS;EMUI;Magic UI
Published: 2022-09-16T00:00:00.000Z
CVE-2022-39003 
Buffer overflow vulnerability in the video framework. Successful exploitation of this vulnerability will affect the confidentiality and integrity of trusted components.
Problem types: description: Buffer overflow vulnerability
Affected products: vendor: Huawei
product: EMUI
vendor: Huawei
product: Magic UI
Published: 2022-09-16T17:58:06.000Z
CVE-2022-39004 
The MPTCP module has the memory leak vulnerability. Successful exploitation of this vulnerability can cause memory leaks.
Problem types: description: Memory leak vulnerability
Affected products: vendor: Huawei
product: HarmonyOS
vendor: Huawei
product: EMUI
vendor: Huawei
product: Magic UI
Published: 2022-09-16T17:56:03.000Z
CVE-2022-39005 
The MPTCP module has the memory leak vulnerability. Successful exploitation of this vulnerability can cause memory leaks.
Problem types: description: Memory leak vulnerability
Affected products: vendor: Huawei
product: HarmonyOS
vendor: Huawei
product: EMUI
vendor: Huawei
product: Magic UI
Published: 2022-09-16T17:56:07.000Z
CVE-2022-39006 
The MPTCP module has the race condition vulnerability. Successful exploitation of this vulnerability may cause the device to restart.
Problem types: description: Race condition vulnerability
Affected products: vendor: Huawei
product: HarmonyOS
vendor: Huawei
product: EMUI
vendor: Huawei
product: Magic UI
Published: 2022-09-16T17:55:56.000Z
CVE-2022-39007 
The location module has a vulnerability of bypassing permission verification.Successful exploitation of this vulnerability may cause privilege escalation.
Problem types: description: Permission verification bypass vulnerability
Affected products: vendor: Huawei
product: HarmonyOS
vendor: Huawei
product: EMUI
Published: 2022-09-16T17:57:45.000Z
CVE-2022-39008 
The NFC module has bundle serialization/deserialization vulnerabilities. Successful exploitation of this vulnerability may cause third-party apps to read and write files that are accessible only to system apps.
Problem types: description: Bundle serialization/deserialization mismatch vulnerability
Affected products: vendor: Huawei
product: HarmonyOS
vendor: Huawei
product: EMUI
Published: 2022-09-16T17:55:34.000Z
CVE-2022-39009 
The WLAN module has a vulnerability in permission verification. Successful exploitation of this vulnerability may cause third-party apps to affect WLAN functions.
Problem types: description: Permission verification vulnerability
Affected products: vendor: Huawei
product: HarmonyOS
vendor: Huawei
product: EMUI
Published: 2022-09-16T17:57:50.000Z
CVE-2022-39010 
The HwChrService module has a vulnerability in permission control. Successful exploitation of this vulnerability may cause disclosure of user network information.
Problem types: description: Permission control vulnerability
Affected products: vendor: Huawei
product: HarmonyOS
vendor: Huawei
product: EMUI
Published: 2022-09-16T17:57:54.000Z
CVE-2022-39011 
The HISP module has a vulnerability of bypassing the check of the data transferred in the kernel space.Successful exploitation of this vulnerability may cause unauthorized access to the HISP module.
Problem types: description: Unauthorized access vulnerability
Affected products: vendor: Huawei
product: HarmonyOS
vendor: Huawei
product: EMUI
Published: 2022-10-14T00:00:00.000Z
CVE-2022-39012 
Huawei Aslan Children's Watch has an improper input validation vulnerability. Successful exploitation may cause the watch's application service abnormal.
Problem types: description: Improper Input
Affected products: vendor: Huawei
product: Aslan-AL10
Published: 2022-12-28T00:00:00.000Z
CVE-2022-39013 
Under certain conditions an authenticated attacker can get access to OS credentials. Getting access to OS credentials enables the attacker to modify system data and make the system unavailable leading to high impact on confidentiality and low impact on integrity and availability of the application.
Problem types: cwe_id: CWE-200
description: CWE-200
Affected products: vendor: SAP SE
product: SAP BusinessObjects Business Intelligence Platform (Program Objects)
Published: 2022-10-11T00:00:00.000Z
CVE-2022-39014 
Under certain conditions SAP BusinessObjects Business Intelligence Platform Central Management Console (CMC) - version 430, allows an attacker to access certain unencrypted sensitive parameters which would otherwise be restricted.
Problem types: cwe_id: CWE-311
description: CWE-311
Affected products: vendor: SAP SE
product: SAP BusinessObjects Business Intelligence Platform (CMC)
Published: 2022-09-13T15:43:47.000Z
CVE-2022-39015 
Under certain conditions, BOE AdminTools/ BOE SDK allows an attacker to access information which would otherwise be restricted.
Problem types: cwe_id: CWE-668
description: CWE-668
Affected products: vendor: SAP SE
product: SAP BusinessObjects Business Intelligence Platform (AdminTools/Query Builder)
Published: 2022-10-11T00:00:00.000Z
CVE-2022-39016 Javascript injection in PDFtron in M-Files Hubshare

Javascript injection in PDFtron in M-Files Hubshare before 3.3.10.9 allows authenticated attackers to perform an account takeover via a crafted PDF upload.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: M-Files
product: Hubshare
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 8.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L
version: 3.1
Published: 2022-10-31T20:06:26.219Z
CVE-2022-39017 XSS in all comments fields in M-Files Hubshare



Improper input validation and output encoding in all comments fields, in M-Files Hubshare before 3.3.10.9 allows authenticated attackers to introduce cross-site scripting attacks via specially crafted comments.


Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: M-Files
product: Hubshare
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 8.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L
version: 3.1
Published: 2022-10-31T20:07:26.779Z
CVE-2022-39018 Broken access controls on PDFtron data in M-Files Hubshare

Broken access controls on PDFtron data in M-Files Hubshare before 3.3.11.3 allows unauthenticated attackers to access restricted PDF files via a known URL.


Problem types: cwe_id: CWE-200
description: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
cwe_id: CWE-639
description: CWE-639 Authorization Bypass Through User-Controlled Key
cwe_id: CWE-287
description: CWE-287 Improper Authentication
Affected products: vendor: M-Files
product: Hubshare
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 8.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L
version: 3.1
Published: 2022-10-31T20:09:57.134Z
CVE-2022-39019 Broken access controls on PDFtron WebviewerUI in M-Files Hubshare

Broken access controls on PDFtron WebviewerUI in M-Files Hubshare before 3.3.11.3 allows unauthenticated attackers to upload malicious files to the application server.


Problem types: cwe_id: CWE-287
description: CWE-287 Improper Authentication
cwe_id: CWE-434
description: CWE-434 Unrestricted Upload of File with Dangerous Type
Affected products: vendor: M-Files
product: Hubshare
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
version: 3.1
Published: 2022-10-31T20:09:40.656Z
CVE-2022-39020 Cross-site scripting in Schoolbox version 21.0.2, by Schoolbox Pty Ltd

Multiple instances of XSS (stored and reflected) was found in the application. For example, features such as student assessment submission, file upload, news, ePortfolio and calendar event creation were found to be vulnerable to cross-site scripting.


Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Schoolbox Pty Ltd
product: Schoolbox
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.6
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L
version: 3.1
Published: 2022-10-31T20:06:12.157Z
CVE-2022-39021 e-Excellence Inc. U-Office Force - Open Redirect
U-Office Force login function has an Open Redirect vulnerability. An unauthenticated remote attacker can exploit this vulnerability to redirect user to arbitrary website.
Problem types: cwe_id: CWE-601
description: CWE-601 URL Redirection to Untrusted Site ('Open Redirect')
Affected products: vendor: e-Excellence Inc.
product: U-Office Force
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
baseScore: 6.1
baseSeverity: MEDIUM
Published: 2022-10-31T06:40:33.606Z
CVE-2022-39022 e-Excellence Inc. U-Office Force - Path Traversal
U-Office Force Download function has a path traversal vulnerability. A remote attacker with general user privilege can exploit this vulnerability to download arbitrary system file.
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: e-Excellence Inc.
product: U-Office Force
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
Published: 2022-10-31T06:40:34.591Z
CVE-2022-39023 e-Excellence Inc. U-Office Force - Path Traversal
U-Office Force Download function has a path traversal vulnerability. A remote attacker with general user privilege can exploit this vulnerability to download arbitrary system file.
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: e-Excellence Inc.
product: U-Office Force
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
Published: 2022-10-31T06:40:35.568Z
CVE-2022-39024 e-Excellence Inc. U-Office Force - Reflected XSS
U-Office Force Bulletin function has insufficient filtering for special characters. An unauthenticated remote attacker can exploit this vulnerability to inject JavaScript and perform XSS (Reflected Cross-Site Scripting) attack.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: e-Excellence Inc.
product: U-Office Force
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
baseScore: 6.1
baseSeverity: MEDIUM
Published: 2022-10-31T06:40:36.532Z
CVE-2022-39025 e-Excellence Inc. U-Office Force - Reflected XSS
U-Office Force PrintMessage function has insufficient filtering for special characters. An unauthenticated remote attacker can exploit this vulnerability to inject JavaScript and perform XSS (Reflected Cross-Site Scripting) attack.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: e-Excellence Inc.
product: U-Office Force
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
baseScore: 6.1
baseSeverity: MEDIUM
Published: 2022-10-31T06:40:37.605Z
CVE-2022-39026 e-Excellence Inc. U-Office Force - Stored XSS
U-Office Force UserDefault page has insufficient filtering for special characters in the HTTP header fields. A remote attacker with general user privilege can exploit this vulnerability to inject JavaScript and perform XSS (Stored Cross-Site Scripting) attack.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: e-Excellence Inc.
product: U-Office Force
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
Published: 2022-10-31T06:40:38.607Z