rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-23725 PingID Windows Login prior to 2.8 does not properly set permissions on the Windows Registry entries used to store sensitive API keys under some circumstances
PingID Windows Login prior to 2.8 does not properly set permissions on the Windows Registry entries used to store sensitive API keys under some circumstances.
Problem types: cwe_id: CWE-522
description: CWE-522 Insufficiently Protected Credentials
cwe_id: CWE-288
description: CWE-288 Authentication Bypass Using an Alternate Path or Channel
Affected products: vendor: Ping Identity
product: PingID Windows Login
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 7.7
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L
version: 3.1
Credits: lang: en
value: Ping Identity credits The Commonwealth Bank of Australia for the discovery of this vulnerability.
Published: 2022-06-30T19:25:46.000Z
CVE-2022-23726 
PingCentral versions prior to listed versions expose Spring Boot actuator endpoints that with administrative authentication return large amounts of sensitive environmental and application information.
Problem types: cwe_id: CWE-200
description: CWE-200 Information Exposure
Affected products: vendor: Ping Identity
product: PingCentral
CVSS v3.1: attackComplexity: HIGH
attackVector: ADJACENT_NETWORK
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N
version: 3.1
Published: 2022-09-30T14:35:09.086Z
CVE-2022-23727 
There is a privilege escalation vulnerability in some webOS TVs. Due to wrong setting environments, local attacker is able to perform specific operation to exploit this vulnerability. Exploitation may cause the attacker to obtain a higher privilege
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-28T19:09:30.000Z
CVE-2022-23728 
Attacker can reset the device with AT Command in the process of rebooting the device. The LG ID is LVE-SMP-210011.
Problem types: cwe_id: CWE-684
description: [CWE-684] Incorrect Provision of Specified Functionality
Affected products: vendor: n/a
product: LG mobile devices
Published: 2022-01-21T18:17:30.000Z
CVE-2022-23729 
When the device is in factory state, it can be access the shell without adb authentication process. The LG ID is LVE-SMP-210010.
Problem types: cwe_id: CWE-305
description: [CWE-305] Authentication Bypass by Primary Weakness
Affected products: vendor: n/a
product: LG mobile devices
Published: 2022-03-04T15:51:14.000Z
CVE-2022-23730 
The public API error causes for the attacker to be able to bypass API access control.
Problem types: cwe_id: CWE-284
description: CWE-284 Improper Access Control
Affected products: vendor: n/a
product: LG webOS TV
Published: 2022-03-11T17:54:10.000Z
CVE-2022-23731 
V8 javascript engine (heap vulnerability) can cause privilege escalation ,which can impact on some webOS TV models.
Problem types: cwe_id: CWE-264
description: CWE-264 Permissions, Privileges, and Access Controls
Affected products: vendor: n/a
product: LG webOS TV
Published: 2022-03-11T17:54:11.000Z
CVE-2022-23732 Path traversal in GitHub Enterprise Server management console leading to a bypass of CSRF protections
A path traversal vulnerability was identified in GitHub Enterprise Server management console that allowed the bypass of CSRF protections. This could potentially lead to privilege escalation. To exploit this vulnerability, an attacker would need to target a user that was actively logged into the management console. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.5 and was fixed in versions 3.1.19, 3.2.11, 3.3.6, 3.4.1. This vulnerability was reported via the GitHub Bug Bounty program.
Problem types: cwe_id: CWE-23
description: CWE-23, CWE-352
Affected products: vendor: GitHub
product: GitHub Enterprise Server
Credits: lang: en
value: bitquark
Published: 2022-04-05T00:10:11.000Z
CVE-2022-23733 Stored XSS vulnerability in GitHub Enterprise Server leading to injection of arbitrary attributes
A stored XSS vulnerability was identified in GitHub Enterprise Server that allowed the injection of arbitrary attributes. This injection was blocked by Github's Content Security Policy (CSP). This vulnerability affected all versions of GitHub Enterprise Server prior to 3.6 and was fixed in versions 3.3.11, 3.4.6 and 3.5.3. This vulnerability was reported via the GitHub Bug Bounty program.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS) - Stored
Affected products: vendor: GitHub
product: GitHub Enterprise Server
Credits: lang: en
value: None
Published: 2022-08-02T16:05:14.000Z
CVE-2022-23734 Deserialization of Untrusted Data vulnerability in GitHub Enterprise Server leading to Remote Code Execution
A deserialization of untrusted data vulnerability was identified in GitHub Enterprise Server that could potentially lead to remote code execution on the SVNBridge. To exploit this vulnerability, an attacker would need to gain access via a server-side request forgery (SSRF) that would let an attacker control the data being deserialized. This vulnerability affected all versions of GitHub Enterprise Server prior to v3.6 and was fixed in versions 3.5.3, 3.4.6, 3.3.11, and 3.2.16. This vulnerability was reported via the GitHub Bug Bounty program.
Problem types: cwe_id: CWE-502
description: CWE-502	Deserialization of Untrusted Data
Affected products: vendor: GitHub
product: GitHub Enterprise Server
Credits: lang: en
value: Alex Chapman
Published: 2022-10-19T00:00:00.000Z
CVE-2022-23737 Improper Privilege Management in GitHub Enterprise Server leading to page creation and deletion
An improper privilege management vulnerability was identified in GitHub Enterprise Server that allowed users with improper privileges to create or delete pages via the API. To exploit this vulnerability, an attacker would need to be added to an organization's repo with write permissions. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.7 and was fixed in versions 3.2.20, 3.3.15, 3.4.10, 3.5.7, and 3.6.3. This vulnerability was reported via the GitHub Bug Bounty program.
Problem types: cwe_id: CWE-269
description: CWE-269
Affected products: vendor: GitHub
product: GitHub Enterprise Server
Credits: lang: en
value: Ali Shehab and Ali Kalout
Published: 2022-12-01T00:00:00.000Z
CVE-2022-23738 Incomplete cache verification issue in GitHub Enterprise Server leading to exposure of private repo files
An improper cache key vulnerability was identified in GitHub Enterprise Server that allowed an unauthorized actor to access private repository files through a public repository. To exploit this, an actor would need to already be authorized on the GitHub Enterprise Server instance, be able to create a public repository, and have a site administrator visit a specially crafted URL. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.6 and was fixed in versions 3.2.20, 3.3.15, 3.4.10, 3.5.7, 3.6.3. This vulnerability was reported via the GitHub Bug Bounty program.
Problem types: cwe_id: CWE-200
description: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: GitHub
product: GitHub Enterprise Server
Credits: lang: en
value: ahacker1
Published: 2022-11-01T00:00:00.000Z
CVE-2022-23739 Incorrect authorization check in GitHub Enterprise Server leading to escalation of privileges in GraphQL API requests from GitHub Apps using scoped user-to-server tokens
An incorrect authorization vulnerability was identified in GitHub Enterprise Server, allowing for escalation of privileges in GraphQL API requests from GitHub Apps. This vulnerability allowed an app installed on an organization to gain access to and modify most organization-level resources that are not tied to a repository regardless of granted permissions, such as users and organization-wide projects. Resources associated with repositories were not impacted, such as repository file content, repository-specific projects, issues, or pull requests. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.7.1 and was fixed in versions 3.3.16, 3.4.11, 3.5.8, 3.6.4, 3.7.1. This vulnerability was reported via the GitHub Bug Bounty program.
Problem types: cwe_id: CWE-863
description: CWE-863
Affected products: vendor: GitHub
product: GitHub Enterprise Server
Credits: lang: en
value: ahacker1
Published: 2023-01-17T00:00:00.000Z
CVE-2022-23740 Improper Neutralization of Argument Delimiters in a Command in GitHub Enterprise Server leading to Remote Code Execution
CRITICAL: An improper neutralization of argument delimiters in a command vulnerability was identified in GitHub Enterprise Server that enabled remote code execution. To exploit this vulnerability, an attacker would need permission to create and build GitHub Pages using GitHub Actions. This vulnerability affected only version 3.7.0 of GitHub Enterprise Server and was fixed in version 3.7.1. This vulnerability was reported via the GitHub Bug Bounty program.
Problem types: cwe_id: CWE-88
description: CWE-88
Affected products: vendor: GitHub
product: GitHub Enterprise Server
Credits: lang: en
value: yvvdwf
Published: 2022-11-23T00:00:00.000Z
CVE-2022-23741 Incorrect authorization in GitHub Enterprise Server token generation leading to full admin access
An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed a scoped user-to-server token to escalate to full admin/owner privileges. An attacker would require an account with admin access to install a malicious GitHub App. This vulnerability was fixed in versions 3.3.17, 3.4.12, 3.5.9, and 3.6.5. This vulnerability was reported via the GitHub Bug Bounty program.
Problem types: cwe_id: CWE-863
description: CWE-863
Affected products: vendor: GitHub
product: GitHub Enterprise Server
Credits: lang: en
value: Vaibhav Singh (@vaib25vicky)
Published: 2022-12-14T00:00:00.000Z
CVE-2022-23742 
Check Point Endpoint Security Client for Windows versions earlier than E86.40 copy files for forensics reports from a directory with low privileges. An attacker can replace those files with malicious or linked content, such as exploiting CVE-2020-0896 on unpatched systems or using symbolic links.
Problem types: cwe_id: CWE-65
description: CWE-65: Windows Hard Link
Affected products: vendor: n/a
product: Check Point Endpoint Security Client for Windows
Published: 2022-05-12T19:23:18.000Z
CVE-2022-23743 
Check Point ZoneAlarm before version 15.8.200.19118 allows a local actor to escalate privileges during the upgrade process. In addition, weak permissions in the ProgramData\CheckPoint\ZoneAlarm\Data\Updates directory allow a local attacker the ability to execute an arbitrary file write, leading to execution of code as local system, in ZoneAlarm versions before v15.8.211.192119
Problem types: cwe_id: CWE-269
description: CWE-269: Improper Privilege Management
Affected products: vendor: n/a
product: ZoneAlarm.
Published: 2022-05-11T00:00:00.000Z
CVE-2022-23744 
Check Point Endpoint before version E86.50 failed to protect against specific registry change which allowed to disable endpoint protection by a local administrator.
Problem types: cwe_id: CWE-470
description: CWE-470: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
Affected products: vendor: n/a
product: Enterprise Endpoint Security Windows Clients.
Published: 2022-07-07T15:51:44.000Z
CVE-2022-23745 
A potential memory corruption issue was found in Capsule Workspace Android app (running on GrapheneOS). This could result in application crashing but could not be used to gather any sensitive information.
Problem types: cwe_id: CWE-1218
description: CWE-1218: Memory Buffer Errors
Affected products: vendor: n/a
product: Checkpoint Harmony Capsule Workspace
Published: 2022-07-18T16:09:20.000Z
CVE-2022-23746 
The IPsec VPN blade has a dedicated portal for downloading and connecting through SSL Network Extender (SNX). If the portal is configured for username/password authentication, it is vulnerable to a brute-force attack on usernames and passwords.
Problem types: cwe_id: CWE-307
description: CWE-307: Improper Restriction of Excessive Authentication Attempts
Affected products: vendor: n/a
product: Gateway & Management, IPsec VPN blade SNX portal.
Published: 2022-11-30T00:00:00.000Z
CVE-2022-23747 
In Sony Xperia series 1, 5, and Pro, an out of bound memory access can occur due to lack of validation of the number of frames being passed during music playback.
Problem types: cwe_id: CWE-120
description: CWE-120
Affected products: vendor: n/a
product: Sony Xperia
Published: 2022-08-17T20:52:26.000Z
CVE-2022-23748 
mDNSResponder.exe is vulnerable to DLL Sideloading attack. Executable improperly specifies how to load the DLL, from which folder and under what conditions. In these scenarios, a malicious attacker could be using the valid and legitimate executable to load malicious files.
Problem types: cwe_id: CWE-114
description: CWE-114: Process Control
Affected products: vendor: n/a
product: Audinate Dante Application Library for Windows
Published: 2022-11-17T00:00:00.000Z
CVE-2022-23763 DOUZONE BIZON NeoRS file download and execute vulnerability
Origin validation error vulnerability in NeoRS’s ActiveX moudle allows attackers to download and execute arbitrary files. Remote attackers can use this vulerability to encourage users to access crafted web pages, causing damage such as malicious code infections.
Problem types: cwe_id: CWE-346
description: CWE-346 Origin Validation Error
Affected products: vendor: DOUZONE BIZON Co.,Ltd
product: NeoRS
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Published: 2022-06-28T13:49:01.000Z
CVE-2022-23764 TERUTEN WebCube update remote code execution vulnerability
The vulnerability causing from insufficient verification procedures for downloaded files during WebCube update. Remote attackers can bypass this verification logic to update both digitally signed and unauthorized files, enabling remote code execution.
Problem types: cwe_id: CWE-346
description: CWE-346 Origin Validation Error
Affected products: vendor: TERUTEN Co.,Ltd
product: WebCube
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Published: 2022-08-17T20:23:03.000Z
CVE-2022-23765 IPTIME NAS family CSRF vulnerability
This vulnerability occured by sending a malicious POST request to a specific page while logged in random user from some family of IPTIME NAS. Remote attackers can steal root privileges by changing the password of the root through a POST request.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: EFM Networks Co.,Ltd
product: NAS1dual, NAS2dual, NAS4dual
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Published: 2022-08-17T20:24:23.000Z
CVE-2022-23766 BigFileAgent arbitrary file execution vulnerability
An improper input validation vulnerability leading to arbitrary file execution was discovered in BigFileAgent. In order to cause arbitrary files to be executed, the attacker makes the victim access a web page d by them or inserts a script using XSS into a general website.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Bluetree Co., Ltd
product: BigFileAgent
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Published: 2022-09-19T19:52:07.000Z
CVE-2022-23767 SecureGate authentication bypass vulnerability
This vulnerability of SecureGate is SQL-Injection using login without password. A path traversal vulnerability is also identified during file transfer. An attacker can take advantage of these vulnerabilities to perform various attacks such as obtaining privileges and executing remote code, thereby taking over the victim’s system.
Problem types: cwe_id: CWE-288
description: CWE-288 Authentication Bypass Using an Alternate Path or Channel
cwe_id: CWE-89
description: CWE-89 SQL Injection
cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: HANSSAK Co.,Ltd
product: SecureGate
vendor: HANSSAK Co.,Ltd
product: WebLink
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2022-09-19T19:50:37.000Z
CVE-2022-23768 Neo Information Sys. NIS-HAP11AC remote access and manipulation vulnerability
This Vulnerability in NIS-HAP11AC is caused by an exposed external port for the telnet service. Remote attackers use this vulnerability to induce all attacks such as source code hijacking, remote control of the device.
Problem types: cwe_id: CWE-284
description: CWE-284 Improper Access Control
Affected products: vendor: Neo Information Systems Co., Ltd
product: Home AP NIS-HAP11AC
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2022-09-19T19:48:57.000Z
CVE-2022-23769 Secuever reverseWall-MDS Remote Code Execution Vulnerability
Remote code execution vulnerability due to insufficient user privilege verification in reverseWall-MDS. Remote attackers can exploit the vulnerability such as stealing account, through remote code execution.
Problem types: cwe_id: CWE-287
description: CWE-287 Improper Authentication
Affected products: vendor: Secuever Co.,Ltd
product: reverseWall-MDS
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: ADJACENT_NETWORK
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
Published: 2022-10-17T00:00:00.000Z
CVE-2022-23770 WISA Smart Wing CMS Remote Command Execution Vulnerability
This vulnerability could allow a remote attacker to execute remote commands with improper validation of parameters of certain API constructors. Remote attackers could use this vulnerability to execute malicious commands such as directory traversal.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: WISA corp.
product: Smart Wing CMS
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
Published: 2022-10-17T00:00:00.000Z
CVE-2022-23771 IPTIME NAS1DUAL CSRF Vulnerability
This vulnerability occurs in user accounts creation and deleteion related pages of IPTIME NAS products. The vulnerability could be exploited by a lack of validation when a POST request is made to this page. An attacker can use this vulnerability to or delete user accounts, or to escalate arbitrary user privileges.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: EFM Networks Co., Ltd
product: NAS1dual, NAS2dual, NAS4dual
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector: ADJACENT_NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 8
baseSeverity: HIGH
Published: 2022-10-17T00:00:00.000Z
CVE-2022-23772 
Rat.SetString in math/big in Go before 1.16.14 and 1.17.x before 1.17.7 has an overflow that can lead to Uncontrolled Memory Consumption.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-11T00:11:15.000Z
CVE-2022-23773 
cmd/go in Go before 1.16.14 and 1.17.x before 1.17.7 can misinterpret branch names that falsely appear to be version tags. This can lead to incorrect access control if an actor is supposed to be able to create branches but not tags.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-11T00:16:08.000Z
CVE-2022-23774 
Docker Desktop before 4.4.4 on Windows allows attackers to move arbitrary files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-01T05:30:18.000Z
CVE-2022-23775 
TrueStack Direct Connect 1.4.7 has Incorrect Access Control.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-25T15:42:53.000Z
CVE-2022-23779 
Zoho ManageEngine Desktop Central before 10.1.2137.8 exposes the installed server name to anyone. The internal hostname can be discovered by reading HTTP redirect responses.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-02T14:31:30.000Z
CVE-2022-23790 XSS in Firmanet Software and Technology Customer Relation Manager
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Firmanet Software and Technology Customer Relation Manager allows Cross-Site Scripting (XSS).

This issue affects Customer Relation Manager: before 2022.03.13.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Firmanet Software and Technology
product: Customer Relation Manager
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
baseSeverity: MEDIUM
baseScore: 6.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Credits: lang: en
value: Bugra TURKOGLU
Published: 2023-03-14T08:12:39.727Z
CVE-2022-23791 XSS in Firmanet Software and Technology Customer Relation Manager
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Firmanet Software and Technology Customer Relation Manager allows Cross-Site Scripting (XSS).

This issue affects Customer Relation Manager: before 2022.03.13.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Firmanet Software and Technology
product: Customer Relation Manager
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
baseSeverity: MEDIUM
baseScore: 6.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Credits: lang: en
value: Bugra TURKOGLU
Published: 2023-03-14T08:13:03.739Z