rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-36690 
Ingredients Stock Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/?page=user/manage_user&id=.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-29T13:56:57.000Z
CVE-2022-36692 
Ingredients Stock Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f=delete_category.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-25T21:24:34.000Z
CVE-2022-36693 
Ingredients Stock Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f=delete_item.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-25T21:24:34.000Z
CVE-2022-36695 
Ingredients Stock Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f=delete_stockin.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-25T21:24:35.000Z
CVE-2022-36696 
Ingredients Stock Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f=delete_stockout.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-25T21:24:36.000Z
CVE-2022-36697 
Ingredients Stock Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f=delete_waste.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-25T21:24:36.000Z
CVE-2022-36698 
Ingredients Stock Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /categories/view_category.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-25T20:41:44.000Z
CVE-2022-36699 
Ingredients Stock Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /categories/manage_category.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-25T20:41:31.000Z
CVE-2022-36700 
Ingredients Stock Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /items/manage_item.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-25T20:42:01.000Z
CVE-2022-36701 
Ingredients Stock Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /items/view_item.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-25T20:41:50.000Z
CVE-2022-36703 
Ingredients Stock Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /stocks/manage_stockin.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-25T20:41:35.000Z
CVE-2022-36704 
Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the Id parameter at /librarian/studentdetails.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-28T22:46:17.000Z
CVE-2022-36705 
Ingredients Stock Management System v1.0 was discovered to contain a SQL injection vulnerability via the Id parameter at /stocks/manage_waste.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-28T22:46:18.000Z
CVE-2022-36706 
Ingredients Stock Management System v1.0 was discovered to contain a SQL injection vulnerability via the Id parameter at /stocks/manage_stockout.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-28T22:46:19.000Z
CVE-2022-36708 
Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the Id parameter at /student/bookdetails.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-28T22:46:20.000Z
CVE-2022-36709 
Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /staff/edit_book_details.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-29T23:09:47.000Z
CVE-2022-36711 
Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /staff/bookdetails.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-29T23:09:48.000Z
CVE-2022-36712 
Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /staff/studentdetails.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-29T23:09:49.000Z
CVE-2022-36713 
Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the Section parameter at /librarian/lab.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-29T23:09:50.000Z
CVE-2022-36714 
Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the Section parameter at /staff/lab.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-29T23:09:50.000Z
CVE-2022-36715 
Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the name parameter at /admin/search.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-25T21:55:24.000Z
CVE-2022-36716 
Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/changestock.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-25T21:55:24.000Z
CVE-2022-36719 
Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the ok parameter at /admin/history.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-25T21:55:25.000Z
CVE-2022-36720 
Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/modify1.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-25T21:55:26.000Z
CVE-2022-36721 
Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the Textbook parameter at /admin/modify.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-25T21:55:27.000Z
CVE-2022-36722 
Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the title parameter at /librarian/history.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-18T19:54:57.000Z
CVE-2022-36725 
Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the M_Id parameter at /student/dele.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-18T19:54:44.000Z
CVE-2022-36727 
Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the bookId parameter at /staff/delete.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-18T19:55:07.000Z
CVE-2022-36728 
Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the RollNo parameter at /staff/delstu.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-18T19:54:55.000Z
CVE-2022-36729 
Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the M_Id parameter at /librarian/del.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-18T19:54:42.000Z
CVE-2022-36730 
Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the bookId parameter at /librarian/delete.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-30T20:43:47.000Z
CVE-2022-36731 
Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the RollNo parameter at /librarian/delstu.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-30T20:43:48.000Z
CVE-2022-36732 
Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /librarian/dele.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-30T20:43:49.000Z
CVE-2022-36733 
Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the M_Id parameter at /admin/del.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-30T20:43:50.000Z
CVE-2022-36734 
Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the RollNo parameter at /admin/delstu.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-30T20:43:51.000Z
CVE-2022-36735 
Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the bookId parameter at /admin/delete.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-30T20:43:52.000Z
CVE-2022-36736 
Jitsi-2.10.5550 was discovered to contain a vulnerability in its web UI which allows attackers to perform a clickjacking attack via a crafted HTTP request. NOTE: this is disputed by the vendor
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-08T12:59:42.000Z
CVE-2022-36745 
LibreNMS v22.6.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component print-customoid.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-30T21:27:43.000Z
CVE-2022-36746 
LibreNMS v22.6.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component oxidized-cfg-check.inc.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-30T21:27:43.000Z
CVE-2022-36747 
Razor v0.8.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the function uploadchannel().
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-30T21:27:44.000Z
CVE-2022-36748 
PicUploader v2.6.3 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /master/index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-30T21:27:45.000Z
CVE-2022-36749 
RPi-Jukebox-RFID v2.3.0 was discovered to contain a command injection vulnerability via the component /htdocs/utils/Files.php. This vulnerability is exploited via a crafted payload injected into the file name of an uploaded file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-30T21:27:46.000Z
CVE-2022-36750 
Clinic's Patient Management System v1.0 is vulnerable to SQL injection via /pms/update_user.php?id=.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-10T16:29:51.000Z
CVE-2022-36752 
png2webp v1.0.4 was discovered to contain an out-of-bounds write via the function w2p. This vulnerability is exploitable via a crafted png file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-28T22:50:03.000Z
CVE-2022-36754 
Expense Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /Home/debit_credit_p.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-02T22:30:08.000Z
CVE-2022-36755 
D-Link DIR845L A1 contains a authentication vulnerability via an AUTHORIZED_GROUP=1 value, as demonstrated by a request for getcfg.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-28T15:44:40.000Z
CVE-2022-36756 
DIR845L A1 v1.00-v1.03 is vulnerable to command injection via /htdocs/upnpinc/gena.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-28T15:46:48.000Z
CVE-2022-36759 
Online Food Ordering System v1.0 was discovered to contain a SQL injection vulnerability via the component /dishes.php?res_id=.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-02T02:37:42.000Z
CVE-2022-36760 Apache HTTP Server: mod_proxy_ajp Possible request smuggling
Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server allows an attacker to smuggle requests to the AJP server it forwards requests to.  This issue affects Apache HTTP Server Apache HTTP Server 2.4 version 2.4.54 and prior versions.
Problem types: cwe_id: CWE-444
description: CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
Affected products: vendor: Apache Software Foundation
product: Apache HTTP Server
default_status: unaffected
Credits: lang: en
value: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec at Qi'anxin Group
Published: 2023-01-17T19:11:55.106Z
CVE-2022-36763 Heap Buffer Overflow in Tcg2MeasureGptTable
EDK2 is susceptible to a vulnerability in the Tcg2MeasureGptTable() function, allowing a user to trigger a heap buffer overflow via a local network. Successful exploitation of this vulnerability may result in a compromise of confidentiality, integrity, and/or availability.
Problem types: cwe_id: CWE-122
description: CWE-122: Heap-based Buffer Overflow
Affected products: vendor: TianoCore
product: edk2
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:H
version: 3.1
Credits: lang: en
value: Doug Flick
Published: 2024-01-09T16:09:11.058Z
CVE-2022-36764 Heap Buffer Overflow in Tcg2MeasurePeImage
EDK2 is susceptible to a vulnerability in the Tcg2MeasurePeImage() function, allowing a user to trigger a heap buffer overflow via a local network. Successful exploitation of this vulnerability may result in a compromise of confidentiality, integrity, and/or availability.
Problem types: cwe_id: CWE-122
description: CWE-122: Heap-based Buffer Overflow
Affected products: vendor: TianoCore
product: edk2
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:H
version: 3.1
Credits: lang: en
value: Doug Flick
Published: 2024-01-09T16:09:44.836Z
CVE-2022-36765 Integer Overflow in CreateHob
EDK2 is susceptible to a vulnerability in the CreateHob() function, allowing a user to trigger a integer overflow to buffer overflow via a local network. Successful exploitation of this vulnerability may result in a compromise of confidentiality, integrity, and/or availability.
Problem types: cwe_id: CWE-680
description: CWE-680: Integer Overflow to Buffer Overflow
Affected products: vendor: TianoCore
product: edk2
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:H
version: 3.1
Published: 2024-01-09T16:10:16.350Z
CVE-2022-36768 
IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the invscout command to obtain root privileges. IBM X-Force ID: 232014.
Problem types: description: Gain Privileges
Affected products: vendor: IBM
product: AIX
vendor: IBM
product: VIOS
Published: 2022-09-13T20:45:28.190Z
CVE-2022-36769 IBM Cloud Pak for Data file upload

IBM Cloud Pak for Data 4.5 and 4.6 could allow a privileged user to upload malicious files of dangerous types that can be automatically processed within the product's environment. IBM X-Force ID: 232034.


Problem types: cwe_id: CWE-77
description: CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
Affected products: vendor: IBM
product: Cloud Pak for Data
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2023-04-26T02:52:02.470Z
CVE-2022-36771 
IBM QRadar User Behavior Analytics could allow an authenticated user to obtain sensitive information from that they should not have access to. IBM X-Force ID: 232791.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: QRadar User Behavior Analytics
Published: 2022-09-28T15:55:16.059Z
CVE-2022-36772 
IBM InfoSphere Information Server 11.7 could allow an authenticated user to obtain sensitive information that should only be available to a privileged user.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: InfoSphere Information Server
Published: 2022-10-07T17:00:30.307Z
CVE-2022-36773 
IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 233571.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Cognos Analytics
Published: 2022-09-01T19:00:29.851Z
CVE-2022-36774 
IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 is vulnerable to man in the middle attacks through manipulation of the client proxy configuration. IBM X-Force ID: 233575.
Problem types: description: File Manipulation
Affected products: vendor: IBM
product: Robotic Process Automation
Published: 2022-10-06T17:15:26.385Z
CVE-2022-36775 IBM Security Verify Access HOST header injection
IBM Security Verify Access 10.0.0.0, 10.0.1.0, 10.0.2.0, 10.0.3.0, and10.0.4.0 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers.  This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking.  IBM X-Force ID:  233576.
Problem types: description: 644 Improper Neutralization of HTTP Headers for Scripting Syntax
Affected products: vendor: IBM
product: Security Verify Access 
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
version: 3.1
Published: 2023-02-17T16:22:46.450Z
CVE-2022-36776 
IBM Cloud Pak for Security (CP4S) 1.10.0.0 79and 1.10.2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.  IBM X-Force ID:  233663.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: IBM
product: Cloud Pak for Security
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Published: 2022-11-11T18:44:09.367Z
CVE-2022-36777 IBM Cloud Pak for Security information disclosure
IBM Cloud Pak for Security (CP4S) 1.10.0.0 through 1.10.11.0 and IBM QRadar Suite Software 1.10.12.0 through 1.10.16.0could allow an authenticated user to obtain sensitive version information that could aid in further attacks against the system.  IBM X-Force ID:  233665.
Problem types: cwe_id: CWE-200
description: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: IBM
product: Cloud Pak for Security
default_status: unaffected
vendor: IBM
product: QRadar Suite Software
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Published: 2023-11-22T18:28:11.058Z
CVE-2022-36778 Synel - eHarmony Stored XSS
insert HTML / js code inside input how to get to the vulnerable input : Workers &gt; worker nickname &gt; inject in this input the code.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Synel
product: eHarmony
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: LOW
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Moriel Harush - Sophtix Security LTD
Published: 2022-09-13T14:58:01.033Z
CVE-2022-36779 PROSCEND - PROSCEND / ADVICE .Ltd - G/5G Industrial Cellular Router (with GPS)4 Unauthenticated OS Command Injection
PROSCEND - PROSCEND / ADVICE .Ltd - G/5G Industrial Cellular Router (with GPS)4 Unauthenticated OS Command Injection Proscend M330-w / M33-W5 / M350-5G / M350-W5G / M350-6 / M350-W6 / M301-G / M301-GW ADVICE ICR 111WG / https://www.proscend.com/en/category/industrial-Cellular-Router/industrial-Cellular-Router.html https://cdn.shopify.com/s/files/1/0036/9413/3297/files/ADVICE_Industrial_4G_LTE_Cellular_Router_ICR111WG.pdf?v=1620814301
Problem types: description: Unauthenticated OS Command Injection
Affected products: vendor: PROSCEND
product: PROSCEND M330-w / M330-W5
vendor: PROSCEND
product: PROSCEND M350-5G / M350-W5G / M350-6 / M350-W6
vendor: PROSCEND
product: PROSCEND M301-G / M301-GW
vendor: PROSCEND
product: ADVICE ICR 111WG
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: LOW
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: MetaData
Published: 2022-09-13T14:57:52.794Z
CVE-2022-36780 Avdor CIS - crystal quality Credentials Management Errors
Avdor CIS - crystal quality Credentials Management Errors. The product is phone call recorder, you can hear all the recorded calls without authenticate to the system. Attacker sends crafted URL to the system: ip:port//V=2;ChannellD=number;Ext=number;Command=startLM;Client=number;Request=number;R=number number - id of the recorded number.
Problem types: description: Credentials Management Errors
Affected products: vendor: Avdor CIS
product: crystal quality
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: LOW
baseScore: 4.9
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Dudu Moyal - Sophtix Security LTD.
Published: 2022-09-13T14:57:56.413Z