rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-0790 
Use after free in Cast UI in Google Chrome prior to 99.0.4844.51 allowed a remote attacker who convinced a user to engage in specific user interaction to potentially perform a sandbox escape via a crafted HTML page.
Problem types: description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2022-04-05T00:25:36.000Z
CVE-2022-0791 
Use after free in Omnibox in Google Chrome prior to 99.0.4844.51 allowed a remote attacker who convinced a user to engage in specific user interactions to potentially exploit heap corruption via user interactions.
Problem types: description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2022-04-05T00:25:38.000Z
CVE-2022-0792 
Out of bounds read in ANGLE in Google Chrome prior to 99.0.4844.51 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Problem types: description: Out of bounds read
Affected products: vendor: Google
product: Chrome
Published: 2022-04-05T00:25:39.000Z
CVE-2022-0793 
Use after free in Cast in Google Chrome prior to 99.0.4844.51 allowed an attacker who convinced a user to install a malicious extension and engage in specific user interaction to potentially exploit heap corruption via a crafted Chrome Extension.
Problem types: description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2022-04-05T00:25:40.000Z
CVE-2022-0794 
Use after free in WebShare in Google Chrome prior to 99.0.4844.51 allowed a remote attacker who convinced a user to engage in specific user interaction to potentially exploit heap corruption via a crafted HTML page.
Problem types: description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2022-04-05T00:25:42.000Z
CVE-2022-0795 
Type confusion in Blink Layout in Google Chrome prior to 99.0.4844.51 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Problem types: description: Type Confusion
Affected products: vendor: Google
product: Chrome
Published: 2022-04-05T00:25:43.000Z
CVE-2022-0796 
Use after free in Media in Google Chrome prior to 99.0.4844.51 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Problem types: description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2022-04-05T00:25:45.000Z
CVE-2022-0797 
Out of bounds memory access in Mojo in Google Chrome prior to 99.0.4844.51 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page.
Problem types: description: Out of bounds memory access
Affected products: vendor: Google
product: Chrome
Published: 2022-04-05T00:25:46.000Z
CVE-2022-0798 
Use after free in MediaStream in Google Chrome prior to 99.0.4844.51 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension.
Problem types: description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2022-04-05T00:25:47.000Z
CVE-2022-0799 
Insufficient policy enforcement in Installer in Google Chrome on Windows prior to 99.0.4844.51 allowed a remote attacker to perform local privilege escalation via a crafted offline installer file.
Problem types: description: Insufficient policy enforcement
Affected products: vendor: Google
product: Chrome
Published: 2022-04-05T00:25:49.000Z
CVE-2022-0800 
Heap buffer overflow in Cast UI in Google Chrome prior to 99.0.4844.51 allowed a remote attacker who convinced a user to engage in specific user interaction to potentially exploit heap corruption via a crafted HTML page.
Problem types: description: Heap buffer overflow
Affected products: vendor: Google
product: Chrome
Published: 2022-04-05T00:25:50.000Z
CVE-2022-0801 
Inappropriate implementation in HTML parser in Google Chrome prior to 99.0.4844.51 allowed a remote attacker to bypass XSS preventions via a crafted HTML page. (Chrome security severity: Medium)
Problem types: description: Inappropriate implementation
Affected products: vendor: Google
product: Chrome
Published: 2023-01-02T00:00:00.000Z
CVE-2022-0802 
Inappropriate implementation in Full screen mode in Google Chrome on Android prior to 99.0.4844.51 allowed a remote attacker to hide the contents of the Omnibox (URL bar) via a crafted HTML page.
Problem types: description: Inappropriate implementation
Affected products: vendor: Google
product: Chrome
Published: 2022-04-05T00:25:52.000Z
CVE-2022-0803 
Inappropriate implementation in Permissions in Google Chrome prior to 99.0.4844.51 allowed a remote attacker to tamper with the contents of the Omnibox (URL bar) via a crafted HTML page.
Problem types: description: Inappropriate implementation
Affected products: vendor: Google
product: Chrome
Published: 2022-04-05T00:25:53.000Z
CVE-2022-0804 
Inappropriate implementation in Full screen mode in Google Chrome on Android prior to 99.0.4844.51 allowed a remote attacker to hide the contents of the Omnibox (URL bar) via a crafted HTML page.
Problem types: description: Inappropriate implementation
Affected products: vendor: Google
product: Chrome
Published: 2022-04-05T00:25:55.000Z
CVE-2022-0805 
Use after free in Browser Switcher in Google Chrome prior to 99.0.4844.51 allowed a remote attacker who convinced a user to engage in specific user interaction to potentially exploit heap corruption via user interaction.
Problem types: description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2022-04-05T00:25:56.000Z
CVE-2022-0806 
Data leak in Canvas in Google Chrome prior to 99.0.4844.51 allowed a remote attacker who convinced a user to engage in screen sharing to potentially leak cross-origin data via a crafted HTML page.
Problem types: description: Data leak
Affected products: vendor: Google
product: Chrome
Published: 2022-04-05T00:25:57.000Z
CVE-2022-0807 
Inappropriate implementation in Autofill in Google Chrome prior to 99.0.4844.51 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.
Problem types: description: Inappropriate implementation
Affected products: vendor: Google
product: Chrome
Published: 2022-04-05T00:25:59.000Z
CVE-2022-0808 
Use after free in Chrome OS Shell in Google Chrome on Chrome OS prior to 99.0.4844.51 allowed a remote attacker who convinced a user to engage in a series of user interaction to potentially exploit heap corruption via user interactions.
Problem types: description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2022-04-05T00:26:00.000Z
CVE-2022-0809 
Out of bounds memory access in WebXR in Google Chrome prior to 99.0.4844.51 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Problem types: description: Out of bounds memory access
Affected products: vendor: Google
product: Chrome
Published: 2022-04-05T00:26:03.000Z
CVE-2022-0811 
A flaw was found in CRI-O in the way it set kernel options for a pod. This issue allows anyone with rights to deploy a pod on a Kubernetes cluster that uses the CRI-O runtime to achieve a container escape and arbitrary code execution as root on the cluster node, where the malicious pod was deployed.
Problem types: cwe_id: CWE-94
description: CWE-94
Affected products: vendor: n/a
product: CRI-O
Published: 2022-03-16T14:03:40.000Z
CVE-2022-0812 
An information leak flaw was found in NFS over RDMA in the net/sunrpc/xprtrdma/rpc_rdma.c in the Linux Kernel. This flaw allows an attacker with normal user privileges to leak kernel information.
Problem types: cwe_id: CWE-200
description: CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor.
Affected products: vendor: n/a
product: Kernel
Published: 2022-08-29T14:03:05.000Z
CVE-2022-0813 PhpMyAdmin exposure of sensitive information
PhpMyAdmin 5.1.1 and before allows an attacker to retrieve potentially sensitive information by creating invalid requests. This affects the lang parameter, the pma_parameter, and the cookie section.
Problem types: cwe_id: CWE-200
description: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: phpMyAdmin
product: phpMyAdmin
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
Credits: lang: en
value: Rafael Pedrero
Published: 2022-03-09T14:59:28.954Z
CVE-2022-0814 Ubigeo de Peru < 3.6.4 - Unauthenticated SQLi
The Ubigeo de Perú para Woocommerce WordPress plugin before 3.6.4 does not properly sanitise and escape some parameters before using them in SQL statements via various AJAX actions, some of which are available to unauthenticated users, leading to SQL Injections
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: Ubigeo de Perú para Woocommerce y WordPress
Credits: lang: en
value: cydave
Published: 2022-05-09T16:50:32.000Z
CVE-2022-0815 McAfee WebAdvisor - Extension Fingerprinting vulnerability
Improper access control vulnerability in McAfee WebAdvisor Chrome and Edge browser extensions up to 8.1.0.1895 allows a remote attacker to gain access to McAfee WebAdvisor settings and other details about the user’s system. This could lead to unexpected behaviors including; settings being changed, fingerprinting of the system leading to targeted scams, and not triggering the malicious software if McAfee software is detected.
Problem types: cwe_id: CWE-668
description: CWE-668: Exposure of Resource to Wrong Sphere
Affected products: vendor: McAfee
product: McAfee WebAdvisor
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
version: 3.1
Published: 2022-03-10T22:30:11.000Z
CVE-2022-0817 BadgeOS <= 3.7.0 - Unauthenticated SQLi
The BadgeOS WordPress plugin through 3.7.0 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action, leading to an SQL Injection exploitable by unauthenticated users
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: BadgeOS
Credits: lang: en
value: cydave
Published: 2022-05-09T16:50:34.000Z
CVE-2022-0818 Coupon Affiliates < 4.16.4.5 - Unauthenticated Stored XSS
The WooCommerce Affiliate Plugin WordPress plugin before 4.16.4.5 does not have authorization and CSRF checks on a specific action handler, as well as does not sanitize its settings, which enables an unauthenticated attacker to inject malicious XSS payloads into the settings page of the plugin.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: WooCommerce Affiliate Plugin – Coupon Affiliates
Credits: lang: en
value: cydave
Published: 2022-03-28T17:23:25.000Z
CVE-2022-0819 Code Injection in dolibarr/dolibarr
Code Injection in GitHub repository dolibarr/dolibarr prior to 15.0.1.
Problem types: cwe_id: CWE-94
description: CWE-94 Improper Control of Generation of Code
Affected products: vendor: dolibarr
product: dolibarr/dolibarr
Published: 2022-03-02T15:40:13.000Z
CVE-2022-0820 Cross-site Scripting (XSS) - Stored in orchardcms/orchardcore
Cross-site Scripting (XSS) - Stored in GitHub repository orchardcms/orchardcore prior to 1.3.0.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: orchardcms
product: orchardcms/orchardcore
Published: 2022-03-10T23:35:09.000Z
CVE-2022-0821 Improper Authorization in orchardcms/orchardcore
Improper Authorization in GitHub repository orchardcms/orchardcore prior to 1.3.0.
Problem types: cwe_id: CWE-285
description: CWE-285 Improper Authorization
Affected products: vendor: orchardcms
product: orchardcms/orchardcore
Published: 2022-03-10T23:40:10.000Z
CVE-2022-0822 Cross-site Scripting (XSS) - Reflected in orchardcms/orchardcore
Cross-site Scripting (XSS) - Reflected in GitHub repository orchardcms/orchardcore prior to 1.3.0.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: orchardcms
product: orchardcms/orchardcore
Published: 2022-03-11T00:50:09.000Z
CVE-2022-0823 
An improper control of interaction frequency vulnerability in Zyxel GS1200 series switches could allow a local attacker to guess the password by using a timing side-channel attack.
Problem types: cwe_id: CWE-203
description: CWE-203: Observable Discrepancy
Affected products: vendor: Zyxel
product: Zyxel GS1200 series firmware
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 6.2
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2022-06-07T01:10:12.000Z
CVE-2022-0824 Improper Access Control to Remote Code Execution in webmin/webmin
Improper Access Control to Remote Code Execution in GitHub repository webmin/webmin prior to 1.990.
Problem types: cwe_id: CWE-284
description: CWE-284 Improper Access Control
Affected products: vendor: webmin
product: webmin/webmin
Published: 2022-03-02T00:00:00.000Z
CVE-2022-0825 Amelia < 1.0.49 - Customer+ Arbitrary Appointments Status Update
The Amelia WordPress plugin before 1.0.49 does not have proper authorisation when managing appointments, allowing any customer to update other's booking status, as well as retrieve sensitive information about the bookings, such as the full name and phone number of the person who booked it.
Problem types: cwe_id: CWE-863
description: CWE-863 Incorrect Authorization
Affected products: vendor: Unknown
product: Amelia – Events & Appointments Booking Calendar
Credits: lang: en
value: Huli from Cymetrics
Published: 2022-04-04T15:35:49.000Z
CVE-2022-0826 WP Video Gallery <= 1.7.1 - Unauthenticated SQLi
The WP Video Gallery WordPress plugin through 1.7.1 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action, leading to an SQL Injection exploitable by unauthenticated users
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: WP Video Gallery
Credits: lang: en
value: cydave
Published: 2022-05-09T16:50:35.000Z
CVE-2022-0827 Bestbooks <= 2.6.3 - Unauthenticated SQLi
The Bestbooks WordPress plugin through 2.6.3 does not sanitise and escape some parameters before using them in a SQL statement via an AJAX action, leading to an SQL Injection exploitable by unauthenticated users
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: Bestbooks
Credits: lang: en
value: cydave
Published: 2022-06-13T12:41:35.000Z
CVE-2022-0828 Download Manager < 3.2.39 - Unauthenticated brute force of files master key
The Download Manager WordPress plugin before 3.2.34 uses the uniqid php function to generate the master key for a download, allowing an attacker to brute force the key with reasonable resources giving direct download access regardless of role based restrictions or password protections set for the download.
Problem types: description: CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
Affected products: vendor: Unknown
product: Download Manager
default_status: unaffected
Credits: lang: en
value: Diogo Real
lang: en
value: WPScan
Published: 2022-04-11T14:40:50.000Z
CVE-2022-0829 Improper Authorization in webmin/webmin
Improper Authorization in GitHub repository webmin/webmin prior to 1.990.
Problem types: cwe_id: CWE-285
description: CWE-285 Improper Authorization
Affected products: vendor: webmin
product: webmin/webmin
Published: 2022-03-02T12:10:12.000Z
CVE-2022-0830 FormBuilder <= 1.08 - Stored Cross-Site Scripting via CSRF
The FormBuilder WordPress plugin through 1.08 does not have CSRF checks in place when creating/updating and deleting forms, and does not sanitise as well as escape its form field values. As a result, attackers could make logged in admin update and delete arbitrary forms via a CSRF attack, and put Cross-Site Scripting payloads in them.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: FormBuilder
Credits: lang: en
value: Chiragh Arora
Published: 2022-04-04T15:35:50.000Z
CVE-2022-0831 Cross-site Scripting (XSS) - Stored in pimcore/pimcore
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.3.3.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: pimcore
product: pimcore/pimcore
Published: 2022-03-04T13:35:10.000Z
CVE-2022-0832 Cross-site Scripting (XSS) - Stored in pimcore/pimcore
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.3.3.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: pimcore
product: pimcore/pimcore
Published: 2022-03-04T13:40:10.000Z
CVE-2022-0833 Church Admin < 3.4.135 - Unauthenticated Plugin's Backup Disclosure
The Church Admin WordPress plugin before 3.4.135 does not have authorisation and CSRF in some of its action as well as requested files, allowing unauthenticated attackers to repeatedly request the "refresh-backup" action, and simultaneously keep requesting a publicly accessible temporary file generated by the plugin in order to disclose the final backup filename, which can then be fetched by the attacker to download the backup of the plugin's DB data
Problem types: description: CWE-862 Missing Authorization
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: Church Admin
default_status: unaffected
Credits: lang: en
value: cydave
lang: en
value: WPScan
Published: 2022-03-28T17:23:26.000Z
CVE-2022-0834 Amelia <= 1.0.46 - Stored Cross Site Scripting via lastName
The Amelia WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the lastName parameter found in the ~/src/Application/Controller/User/Customer/AddCustomerController.php file which allows attackers to inject arbitrary web scripts onto a pages that executes whenever a user accesses the booking calendar with the date the attacker has injected the malicious payload into. This affects versions up to and including 1.0.46.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: ameliabooking
product: Booking for Appointments and Events Calendar – Amelia
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
baseScore: 7.2
baseSeverity: HIGH
Credits: lang: en
value: Vinay Kumar
Published: 2022-03-23T19:46:49.000Z
CVE-2022-0835 AVEVA System Platform Cleartext Storage of Sensitive Information in Memory
AVEVA System Platform 2020 stores sensitive information in cleartext, which may allow access to an attacker or a low-privileged user.
Problem types: cwe_id: CWE-316
description: CWE-316: Cleartext Storage of Sensitive Information in Memory
Affected products: vendor: AVEVA
product: AVEVA System Platform
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 8.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L
version: 3.1
Credits: lang: en
value: Noam Moshe of Claroty and Ilya Karpov, Evgeniy Druzhinin, and Konstantin Kondratev of Rostelecom-Solar reported this vulnerability to AVEVA.
Published: 2022-04-11T19:38:30.000Z
CVE-2022-0836 SEMA API < 4.02 - Unauthenticated SQLi
The SEMA API WordPress plugin before 4.02 does not properly sanitise and escape some parameters before using them in SQL statements via an AJAX action, leading to SQL Injections exploitable by unauthenticated users
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: SEMA API
Credits: lang: en
value: cydave
Published: 2022-05-09T16:50:37.000Z
CVE-2022-0837 Amelia < 1.0.48 - Customer+ SMS Service Abuse and Sensitive Data Disclosure
The Amelia WordPress plugin before 1.0.48 does not have proper authorisation when handling Amelia SMS service, allowing any customer to send paid test SMS notification as well as retrieve sensitive information about the admin, such as the email, account balance and payment history. A malicious actor can abuse this vulnerability to drain out the account balance by keep sending SMS notification.
Problem types: description: CWE-862 Missing Authorization
Affected products: vendor: Unknown
product: Amelia
default_status: unaffected
Credits: lang: en
value: Huli from Cymetrics
lang: en
value: WPScan
Published: 2022-04-04T15:35:52.000Z
CVE-2022-0838 Cross-site Scripting (XSS) - Reflected in hestiacp/hestiacp
Cross-site Scripting (XSS) - Reflected in GitHub repository hestiacp/hestiacp prior to 1.5.10.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: hestiacp
product: hestiacp/hestiacp
Published: 2022-03-04T08:10:11.000Z
CVE-2022-0839 Improper Restriction of XML External Entity Reference in liquibase/liquibase
Improper Restriction of XML External Entity Reference in GitHub repository liquibase/liquibase prior to 4.8.0.
Problem types: cwe_id: CWE-611
description: CWE-611 Improper Restriction of XML External Entity Reference
Affected products: vendor: liquibase
product: liquibase/liquibase
Published: 2022-03-04T14:25:10.000Z
CVE-2022-0840 Easy Social Icons < 3.2.1 - Admin+ Stored Cross-Site Scripting in add icon
The Easy Social Icons WordPress plugin before 3.2.1 does not properly escape the image_file field when adding a new social icon, allowing high privileged users to inject arbitrary javascript even when the unfiltered_html capability is disallowed.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Easy Social Icons
Credits: lang: en
value: qerogram
Published: 2022-04-11T14:40:52.000Z
CVE-2022-0841 OS Command Injection in ljharb/npm-lockfile
OS Command Injection in GitHub repository ljharb/npm-lockfile in v2.0.3 and v2.0.4.
Problem types: cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command
Affected products: vendor: ljharb
product: ljharb/npm-lockfile
Published: 2022-03-03T15:50:10.000Z
CVE-2022-0842 ePO blind SQL Injection vulnerability
A blind SQL injection vulnerability in McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13 allows a remote authenticated attacker to potentially obtain information from the ePO database. The data obtained is dependent on the privileges the attacker has and to obtain sensitive data the attacker would require administrator privileges.
Problem types: cwe_id: CWE-89
description: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: McAfee,LLC
product: McAfee ePolicy Orchestrator (ePO)
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: HIGH
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N
version: 3.1
Published: 2022-03-23T14:10:13.000Z