rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-28584 
It is found that there is a command injection vulnerability in the setWiFiWpsStart interface in TOTOlink A7100RU (v7.4cu.2313_b20191024) router, which allows an attacker to execute arbitrary commands through a carefully constructed payload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-05T17:26:18.000Z
CVE-2022-28585 
EmpireCMS 7.5 has a SQL injection vulnerability in AdClass.php
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-03T17:02:58.000Z
CVE-2022-28586 
XSS in edit page of Hoosk 1.8.0 allows attacker to execute javascript code in user browser via edit page with XSS payload bypass filter some special chars.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-25T12:38:49.000Z
CVE-2022-28588 
In SpringBootMovie <=1.2 when adding movie names, malicious code can be stored because there are no filtering parameters, resulting in stored XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-03T17:42:00.000Z
CVE-2022-28589 
A stored cross-site scripting (XSS) vulnerability in Pixelimity 1.0 allows attackers to execute arbitrary web scripts or HTML via the Title field in admin/pages.php?action=add_new
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-03T13:59:31.000Z
CVE-2022-28590 
A Remote Code Execution (RCE) vulnerability exists in Pixelimity 1.0 via admin/admin-ajax.php?action=install_theme.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-03T13:57:33.000Z
CVE-2022-28598 
Frappe ERPNext 12.29.0 is vulnerable to XSS where the software does not neutralize or incorrectly neutralize user-controllable input before it is placed in output that is used as a web page that is served to other users.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-22T00:00:00.000Z
CVE-2022-28599 
A stored cross-site scripting (XSS) vulnerability exists in FUEL-CMS 1.5.1 that allows an authenticated user to upload a malicious .pdf file which acts as a stored XSS payload. If this stored XSS payload is triggered by an administrator it will trigger a XSS attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-03T18:01:45.000Z
CVE-2022-28601 
A Two-Factor Authentication (2FA) bypass vulnerability in "Simple 2FA Plugin for Moodle" by LMS Doctor allows remote attackers to overwrite the phone number used for confirmation via the profile.php file. Therefore, allowing them to bypass the phone verification mechanism.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-10T20:42:50.000Z
CVE-2022-28605 
Hardcoded admin token in SoundBar apps in Linkplay SDK 1.00 allows remote attackers to gain admin privilege access in linkplay antifactory
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-31T20:11:38.000Z
CVE-2022-28606 
An arbitrary file upload vulnerability exists in Wenzhou Huoyin Information Technology Co., Ltd. BossCMS 1.0, which can be exploited by an attacker to gain control of the server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-05T16:00:46.000Z
CVE-2022-28607 
An issue was discovered in asith-eranga ISIC tour booking through version published on Feb 13th 2018, allows attackers to gain sensitive information via the action parameter to /system/user/modules/mod_users/controller.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-01T00:00:00.000Z
CVE-2022-28611 
Improper input validation in some Intel(R) XMM(TM) 7560 Modem software before version M2_7560_R_01.2146.00 may allow a privileged user to potentially enable escalation of privilege via physical access.
Problem types: description: escalation of privilege
Affected products: vendor: n/a
product: Intel(R) XMM(TM) 7560 Modem software
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 6.8
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:P/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H
Published: 2022-11-11T15:48:45.794Z
CVE-2022-28612 WordPress Custom Popup Builder plugin <= 1.3.1 - Improper Access Control vulnerability leading to multiple Authenticated Stored XSS
Improper Access Control vulnerability leading to multiple Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerabilities in Muneeb's Custom Popup Builder plugin <= 1.3.1 at WordPress.
Problem types: cwe_id: CWE-284
description: CWE-284 Improper Access Control
cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Muneeb
product: Custom Popup Builder (WordPress plugin)
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: Vulnerability discovered by Ngo Van Thien (Patchstack Alliance)
Published: 2022-06-15T19:34:24.378Z
CVE-2022-28613 Specially Crafted Modbus TCP Packet Vulnerability in RTU500 series
A vulnerability exists in the HCI Modbus TCP function included in the product versions listed above. If the HCI Modbus TCP is en-abled and configured, an attacker could exploit the vulnerability by sending a specially crafted message to the RTU500, causing the receiving RTU500 CMU to reboot. The vulnerability is caused by the validation error in the length information carried in MBAP header in the HCI Modbus TCP function.
Problem types: cwe_id: CWE-1284
description: CWE-1284 Improper Validation of Specified Quantity in Input
Affected products: vendor: Hitachi Energy
product: RTU500 series CMU Firmware
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2022-05-02T19:01:06.262Z
CVE-2022-28614 read beyond bounds via ap_rwrite()
The ap_rwrite() function in Apache HTTP Server 2.4.53 and earlier may read unintended memory if an attacker can cause the server to reflect very large input using ap_rwrite() or ap_rputs(), such as with mod_luas r:puts() function. Modules compiled and distributed separately from Apache HTTP Server that use the 'ap_rputs' function and may pass it a very large (INT_MAX or larger) string must be compiled against current headers to resolve the issue.
Problem types: cwe_id: CWE-190
description: CWE-190 Integer Overflow or Wraparound
cwe_id: CWE-200
description: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: Apache Software Foundation
product: Apache HTTP Server
Credits: lang: en
value: The Apache HTTP Server project would like to thank Ronald Crane (Zippenhop LLC) for reporting this issue
Published: 2022-06-08T10:00:48.000Z
CVE-2022-28615 Read beyond bounds in ap_strcmp_match()
Apache HTTP Server 2.4.53 and earlier may crash or disclose information due to a read beyond bounds in ap_strcmp_match() when provided with an extremely large input buffer. While no code distributed with the server can be coerced into such a call, third-party modules or lua scripts that use ap_strcmp_match() may hypothetically be affected.
Problem types: cwe_id: CWE-190
description: CWE-190 Integer Overflow or Wraparound
Affected products: vendor: Apache Software Foundation
product: Apache HTTP Server
Credits: lang: en
value: The Apache HTTP Server project would like to thank Ronald Crane (Zippenhop LLC) for reporting this issue
Published: 2022-06-08T10:00:51.000Z
CVE-2022-28616 
A remote server-side request forgery (ssrf) vulnerability was discovered in HPE OneView version(s): Prior to 7.0. HPE has provided a software update to resolve this vulnerability in HPE OneView.
Problem types: description: remote server-side request forgery (ssrf)
Affected products: vendor: n/a
product: HPE OneView
Published: 2022-05-17T20:04:17.000Z
CVE-2022-28617 
A remote bypass security restrictions vulnerability was discovered in HPE OneView version(s): Prior to 7.0. HPE has provided a software update to resolve this vulnerability in HPE OneView.
Problem types: description: remote bypass security restrictions
Affected products: vendor: n/a
product: HPE OneView
Published: 2022-05-17T19:59:15.000Z
CVE-2022-28618 
A command injection security vulnerability has been identified in HPE Nimble Storage Hybrid Flash Arrays, HPE Nimble Storage All Flash Arrays and HPE Nimble Storage Secondary Flash Arrays that could allow an attacker to execute arbitrary commands on a Nimble appliance. HPE has made the following software updates to resolve the vulnerability in HPE Nimble Storage: 5.0.10.100 or later, 5.2.1.0 or later, 6.0.0.100 or later.
Problem types: description: remote arbitrary code execution
Affected products: vendor: n/a
product: HPE Nimble Storage Hybrid Flash Arrays; Nimble Storage All Flash Arrays; Nimble Storage Secondary Flash Arrays
Published: 2022-05-20T20:50:19.000Z
CVE-2022-28619 
A potential security vulnerability has been identified in the installer of HPE Version Control Repository Manager. The vulnerability could allow local escalation of privilege. HPE has made the following software update to resolve the vulnerability in HPE Version Control Repository Manager installer 7.6.14.0.
Problem types: description: local escalation of privilege
Affected products: vendor: n/a
product: HPE Version Control Repository Manager
Published: 2022-06-24T15:00:09.000Z
CVE-2022-28620 
A remote authentication bypass vulnerability was discovered in HPE Cray Legacy Shasta System Solutions; HPE Slingshot; and HPE Cray EX supercomputers versions: Prior to node controller firmware associated with HPE Cray EX liquid cooled blades, and all versions of chassis controller firmware associated with HPE Cray EX liquid cooled cabinets prior to 1.6.27/1.5.33/1.4.27; All Slingshot versions prior to 1.7.2; All versions of node controller firmware associated with HPE Cray EX liquid cooled blades, and all versions of chassis controller firmware associated with HPE Cray EX liquid cooled cabinets prior to 1.6.27/1.5.33/1.4.27. HPE has provided a software update to resolve this vulnerability in HPE Cray Legacy Shasta System Solutions, HPE Slingshot, and HPE Cray EX Supercomputers.
Problem types: description: remote authentication bypass
Affected products: vendor: n/a
product: Cray Legacy Shasta System Solutions; HPE Slingshot; HPE Cray EX supercomputers
Published: 2022-06-24T15:00:10.000Z
CVE-2022-28621 
A remote disclosure of sensitive information vulnerability was discovered in HPE NonStop DSM/SCM version: T6031H03^ADP. HPE has provided a software update to resolve this vulnerability in HPE NonStop DSM/SCM.
Problem types: description: remote disclosure of sensitive information
Affected products: vendor: n/a
product: HPE NonStop DSM/SCM T6031
Published: 2022-06-28T17:48:43.000Z
CVE-2022-28622 
A potential security vulnerability has been identified in HPE StoreOnce Software. The SSH server supports weak key exchange algorithms which could lead to remote unauthorized access. HPE has made the following software update to resolve the vulnerability in HPE StoreOnce Software 4.3.2.
Problem types: description: remote unauthorized access
Affected products: vendor: n/a
product: HPE StoreOnce Software
Published: 2022-06-27T18:51:25.000Z
CVE-2022-28623 
Security vulnerabilities in HPE IceWall SSO 10.0 certd could be exploited remotely to allow SQL injection or unauthorized data injection. HPE has provided the following updated modules to resolve these vulnerabilities. HPE IceWall SSO version 10.0 certd library Patch 9 for RHEL and HPE IceWall SSO version 10.0 certd library Patch 9 for HP-UX.
Problem types: description: remote sql injection; remote unauthorized data injection
Affected products: vendor: n/a
product: HPE IceWall SSO
Published: 2022-07-08T12:39:00.000Z
CVE-2022-28624 
A potential security vulnerability has been identified in certain HPE FlexNetwork and FlexFabric switch products. The vulnerability could be remotely exploited to allow cross site scripting (XSS). HPE has made the following software updates to resolve the vulnerability. HPE FlexNetwork 5130EL_7.10.R3507P02 and HPE FlexFabric 5945_7.10.R6635.
Problem types: description: remote cross-site scripting (xss)
Affected products: vendor: n/a
product: HPE FlexNetwork 5130 EI Switch Series; HPE FlexFabric 5945 Switch Series
Published: 2022-07-08T12:36:51.000Z
CVE-2022-28625 
A local disclosure of sensitive information vulnerability was discovered in HPE OneView version(s): Prior to 7.0 or 6.60.01. A low privileged user could locally exploit this vulnerability to disclose sensitive information resulting in a complete loss of confidentiality, integrity, and availability. To exploit this vulnerability, HPE OneView must be configured with credential access to external repositories. HPE has provided a software update to resolve this vulnerability in HPE OneView.
Problem types: description: local disclosure of sensitive information
Affected products: vendor: n/a
product: HPE OneView
Published: 2022-08-31T15:59:33.000Z
CVE-2022-28626 
A local arbitrary code execution vulnerability was discovered in HPE Integrated Lights-Out 5 (iLO 5) firmware version(s): Prior to 2.71. A highly privileged user could locally exploit this vulnerability to execute arbitrary code resulting in a complete loss of confidentiality, integrity, and availability. HPE has provided a firmware update to resolve this vulnerability in HPE Integrated Lights-Out 5 (iLO 5).
Problem types: description: local arbitrary code execution
Affected products: vendor: n/a
product: HPE Integrated Lights-Out 5 (iLO 5)
Published: 2022-08-11T17:16:14.000Z
CVE-2022-28627 
A local arbitrary code execution vulnerability was discovered in HPE Integrated Lights-Out 5 (iLO 5) firmware version(s): Prior to 2.71. An unprivileged user could locally exploit this vulnerability to execute arbitrary code resulting in a complete loss of confidentiality, integrity, and availability. HPE has provided a firmware update to resolve this vulnerability in HPE Integrated Lights-Out 5 (iLO 5).
Problem types: description: local arbitrary code execution
Affected products: vendor: n/a
product: HPE Integrated Lights-Out 5 (iLO 5)
Published: 2022-08-11T17:16:41.000Z
CVE-2022-28628 
A local arbitrary code execution vulnerability was discovered in HPE Integrated Lights-Out 5 (iLO 5) firmware version(s): Prior to 2.71. An unprivileged user could locally exploit this vulnerability to execute arbitrary code resulting in a complete loss of confidentiality, integrity, and availability. HPE has provided a firmware update to resolve this vulnerability in HPE Integrated Lights-Out 5 (iLO 5).
Problem types: description: local arbitrary code execution
Affected products: vendor: n/a
product: HPE Integrated Lights-Out 5 (iLO 5)
Published: 2022-08-11T17:16:30.000Z
CVE-2022-28629 
A local arbitrary code execution vulnerability was discovered in HPE Integrated Lights-Out 5 (iLO 5) firmware version(s): Prior to 2.71. A low privileged user could locally exploit this vulnerability to execute arbitrary code resulting in a complete loss of confidentiality, integrity, and availability. HPE has provided a firmware update to resolve this vulnerability in HPE Integrated Lights-Out 5 (iLO 5).
Problem types: description: local arbitrary code execution
Affected products: vendor: n/a
product: HPE Integrated Lights-Out 5 (iLO 5)
Published: 2022-08-11T17:16:53.000Z
CVE-2022-28630 
A local arbitrary code execution vulnerability was discovered in HPE Integrated Lights-Out 5 (iLO 5) firmware version(s): Prior to 2.71. An unprivileged user could locally exploit this vulnerability to execute arbitrary code resulting in a complete loss of confidentiality and integrity, and a partial loss of availability. User interaction is required to exploit this vulnerability. HPE has provided a firmware update to resolve this vulnerability in HPE Integrated Lights-Out 5 (iLO 5).
Problem types: description: local arbitrary code execution
Affected products: vendor: n/a
product: HPE Integrated Lights-Out 5 (iLO 5)
Published: 2022-08-11T17:17:05.000Z
CVE-2022-28631 
A potential arbitrary code execution and a denial of service (DoS) vulnerability within an isolated process were discovered in HPE Integrated Lights-Out 5 (iLO 5) firmware version(s): Prior to 2.71. An unprivileged user could exploit this vulnerability in an adjacent network to potentially execute arbitrary code in an isolated process resulting in a complete loss of confidentiality, integrity, and availability within that process. In addition, an unprivileged user could exploit a denial of service (DoS) vulnerability in an isolated process resulting in a complete loss of availability within that process. HPE has provided a firmware update to resolve this vulnerability in HPE Integrated Lights-Out 5 (iLO 5).
Problem types: description: adjacent arbitrary code execution and denial of service (DoS)
Affected products: vendor: n/a
product: HPE Integrated Lights-Out 5 (iLO 5)
Published: 2022-08-11T17:17:19.000Z
CVE-2022-28632 
A potential arbitrary code execution and a denial of service (DoS) vulnerability within an isolated process were discovered in HPE Integrated Lights-Out 5 (iLO 5) firmware version(s): Prior to 2.71. An unprivileged user could exploit this vulnerability in an adjacent network to potentially execute arbitrary code in an isolated process resulting in a complete loss of confidentiality, integrity, and availability within that process. In addition, an unprivileged user could exploit a denial of service (DoS) vulnerability in an isolated process resulting in a complete loss of availability within that process. HPE has provided a firmware update to resolve this vulnerability in HPE Integrated Lights-Out 5 (iLO 5).
Problem types: description: adjacent arbitrary code execution and denial of service (DoS)
Affected products: vendor: n/a
product: HPE Integrated Lights-Out 5 (iLO 5)
Published: 2022-08-11T17:17:33.000Z
CVE-2022-28633 
A local disclosure of sensitive information and a local unauthorized data modification vulnerability were discovered in HPE Integrated Lights-Out 5 (iLO 5) firmware version(s): Prior to 2.71. An unprivileged user could locally exploit this vulnerability to read and write to the iLO 5 firmware file system resulting in a complete loss of confidentiality and a partial loss of integrity and availability. HPE has provided a firmware update to resolve this vulnerability in HPE Integrated Lights-Out 5 (iLO 5).
Problem types: description: local disclosure of sensitive information and local unauthorized data modification
Affected products: vendor: n/a
product: HPE Integrated Lights-Out 5 (iLO 5)
Published: 2022-08-11T17:18:12.000Z
CVE-2022-28634 
A local arbitrary code execution vulnerability was discovered in HPE Integrated Lights-Out 5 (iLO 5) firmware version(s): Prior to 2.71. A highly privileged user could locally exploit this vulnerability to execute arbitrary code resulting in a complete loss of confidentiality, integrity, and availability. HPE has provided a firmware update to resolve this vulnerability in HPE Integrated Lights-Out 5 (iLO 5).
Problem types: description: local arbitrary code execution
Affected products: vendor: n/a
product: HPE Integrated Lights-Out 5 (iLO 5)
Published: 2022-08-11T17:18:25.000Z
CVE-2022-28635 
A potential local arbitrary code execution and a local denial of service (DoS) vulnerability within an isolated process were discovered in HPE Integrated Lights-Out 5 (iLO 5) firmware version(s): Prior to 2.71. An unprivileged user could locally exploit this vulnerability to potentially execute arbitrary code in an isolated process resulting in a complete loss of confidentiality, integrity, and availability within that process. In addition, an unprivileged user could exploit a denial of service (DoS) vulnerability in an isolated process resulting in a complete loss of availability within that process. A successful attack depends on conditions beyond the attackers control. HPE has provided a firmware update to resolve this vulnerability in HPE Integrated Lights-Out 5 (iLO 5).
Problem types: description: local arbitrary code execution and denial of service (DoS)
Affected products: vendor: n/a
product: HPE Integrated Lights-Out 5 (iLO 5)
Published: 2022-08-11T17:18:00.000Z
CVE-2022-28636 
A potential local arbitrary code execution and a local denial of service (DoS) vulnerability within an isolated process were discovered in HPE Integrated Lights-Out 5 (iLO 5) firmware version(s): Prior to 2.71. An unprivileged user could locally exploit this vulnerability to potentially execute arbitrary code in an isolated process resulting in a complete loss of confidentiality, integrity, and availability within that process. In addition, an unprivileged user could exploit a denial of service (DoS) vulnerability in an isolated process resulting in a complete loss of availability within that process. A successful attack depends on conditions beyond the attackers control. HPE has provided a firmware update to resolve this vulnerability in HPE Integrated Lights-Out 5 (iLO 5).
Problem types: description: local arbitrary code execution and denial of service (DoS)
Affected products: vendor: n/a
product: HPE Integrated Lights-Out 5 (iLO 5)
Published: 2022-08-11T17:17:47.000Z
CVE-2022-28637 
A local Denial of Service (DoS) and local arbitrary code execution vulnerability that could potentially lead to a loss of confidentiality, integrity, and availability were discovered in HPE Integrated Lights-Out 5 (iLO 5) in Version: 2.71. Hewlett Packard Enterprise has provided updated firmware for HPE Integrated Lights-Out 5 (iLO 5) that addresses these security vulnerabilities.
Problem types: description: local denial of service (DoS); potential local arbitrary code execution
Affected products: vendor: n/a
product: HPE Integrated Lights-Out 5 (iLO 5)
Published: 2022-09-20T20:07:13.000Z
CVE-2022-28638 
An isolated local disclosure of information and potential isolated local arbitrary code execution vulnerability that could potentially lead to a loss of confidentiality, integrity, and availability were discovered in HPE Integrated Lights-Out 5 (iLO 5) in Version: 2.71. Hewlett Packard Enterprise has provided updated firmware for HPE Integrated Lights-Out 5 (iLO 5) that addresses these security vulnerabilities.
Problem types: description: isolated local disclosure of information; potential isolated local arbitrary code execution
Affected products: vendor: n/a
product: HPE Integrated Lights-Out 5 (iLO 5)
Published: 2022-09-20T20:04:47.000Z
CVE-2022-28639 
A remote potential adjacent denial of service (DoS) and potential adjacent arbitrary code execution vulnerability that could potentially lead to a loss of confidentiality, integrity, and availability were discovered in HPE Integrated Lights-Out 5 (iLO 5) in Version: 2.71. Hewlett Packard Enterprise has provided updated firmware for HPE Integrated Lights-Out 5 (iLO 5) that addresses these security vulnerabilities.
Problem types: description: remote potential adjacent denial of service (DoS); potential adjacent arbitrary code execution
Affected products: vendor: n/a
product: HPE Integrated Lights-Out 5 (iLO 5)
Published: 2022-09-20T20:06:05.000Z
CVE-2022-28640 
A potential local adjacent arbitrary code execution vulnerability that could potentially lead to a loss of confidentiality, integrity, and availability was discovered in HPE Integrated Lights-Out 5 (iLO 5) in Version: 2.71. Hewlett Packard Enterprise has provided updated firmware for HPE Integrated Lights-Out 5 (iLO 5) that addresses this security vulnerability.
Problem types: description: potential local arbitrary code execution
Affected products: vendor: n/a
product: HPE Integrated Lights-Out 5 (iLO 5)
Published: 2022-09-20T20:01:58.000Z