rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-31254 rmt-server-pubcloud allows to escalate from user _rmt to root
A Incorrect Default Permissions vulnerability in rmt-server-regsharing service of SUSE Linux Enterprise Server for SAP 15, SUSE Linux Enterprise Server for SAP 15-SP1, SUSE Manager Server 4.1; openSUSE Leap 15.3, openSUSE Leap 15.4 allows local attackers with access to the _rmt user to escalate to root. This issue affects: SUSE Linux Enterprise Server for SAP 15 rmt-server versions prior to 2.10. SUSE Linux Enterprise Server for SAP 15-SP1 rmt-server versions prior to 2.10. SUSE Manager Server 4.1 rmt-server versions prior to 2.10. openSUSE Leap 15.3 rmt-server versions prior to 2.10. openSUSE Leap 15.4 rmt-server versions prior to 2.10.
Problem types: cwe_id: CWE-276
description: CWE-276: Incorrect Default Permissions
Affected products: vendor: SUSE
product: SUSE Linux Enterprise Server for SAP 15
vendor: SUSE
product: SUSE Linux Enterprise Server for SAP 15-SP1
vendor: SUSE
product: SUSE Manager Server 4.1
vendor: openSUSE
product: openSUSE Leap 15.3
vendor: openSUSE
product: openSUSE Leap 15.4
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
Credits: lang: en
value: Johannes Segitz of SUSE
Published: 2023-02-07T00:00:00.000Z
CVE-2022-31255 SUMA/UYUNI directory path traversal vulnerability in CobblerSnipperViewAction
An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in spacewalk/Uyuni of SUSE Linux Enterprise Module for SUSE Manager Server 4.2, SUSE Linux Enterprise Module for SUSE Manager Server 4.3, SUSE Manager Server 4.2 allows remote attackers to read files available to the user running the process, typically tomcat. This issue affects: SUSE Linux Enterprise Module for SUSE Manager Server 4.2 hub-xmlrpc-api-0.7-150300.3.9.2, inter-server-sync-0.2.4-150300.8.25.2, locale-formula-0.3-150300.3.3.2, py27-compat-salt-3000.3-150300.7.7.26.2, python-urlgrabber-3.10.2.1py2_3-150300.3.3.2, spacecmd-4.2.20-150300.4.30.2, spacewalk-backend-4.2.25-150300.4.32.4, spacewalk-client-tools-4.2.21-150300.4.27.3, spacewalk-java-4.2.43-150300.3.48.2, spacewalk-utils-4.2.18-150300.3.21.2, spacewalk-web-4.2.30-150300.3.30.3, susemanager-4.2.38-150300.3.44.3, susemanager-doc-indexes-4.2-150300.12.36.3, susemanager-docs_en-4.2-150300.12.36.2, susemanager-schema-4.2.25-150300.3.30.3, susemanager-sls versions prior to 4.2.28. SUSE Linux Enterprise Module for SUSE Manager Server 4.3 spacewalk-java versions prior to 4.3.39. SUSE Manager Server 4.2 release-notes-susemanager versions prior to 4.2.10.
Problem types: cwe_id: CWE-22
description: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: SUSE
product: SUSE Linux Enterprise Module for SUSE Manager Server 4.2
vendor: SUSE
product: SUSE Linux Enterprise Module for SUSE Manager Server 4.3
vendor: SUSE
product: SUSE Manager Server 4.2
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
Credits: lang: en
value: Paolo Perego from SUSE
Published: 2022-11-10T07:30:16.818Z
CVE-2022-31256 sendmail: mail to root privilege escalation via sm-client.pre script
A Improper Link Resolution Before File Access ('Link Following') vulnerability in a script called by the sendmail systemd service of openSUSE Factory allows local attackers to escalate from user mail to root. This issue affects: SUSE openSUSE Factory sendmail versions prior to 8.17.1-1.1.
Problem types: cwe_id: CWE-59
description: CWE-59: Improper Link Resolution Before File Access ('Link Following')
Affected products: vendor: SUSE
product: openSUSE Factory
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: NONE
baseScore: 7.7
baseSeverity: HIGH
Credits: lang: en
value: Matthias Gerstner and Filippo Bonazzi from SUSE
Published: 2022-10-26T08:55:09.458Z
CVE-2022-31257 
A vulnerability has been identified in Mendix Applications using Mendix 7 (All versions < V7.23.31), Mendix Applications using Mendix 8 (All versions < V8.18.18), Mendix Applications using Mendix 9 (All versions < V9.14.0), Mendix Applications using Mendix 9 (V9.12) (All versions < V9.12.2), Mendix Applications using Mendix 9 (V9.6) (All versions < V9.6.12). In case of access to an active user session in an application that is built with an affected version, it’s possible to change that user’s password bypassing password validations within a Mendix application. This could allow to set weak passwords.
Problem types: cwe_id: CWE-284
description: CWE-284: Improper Access Control
Affected products: vendor: Siemens
product: Mendix Applications using Mendix 7
vendor: Siemens
product: Mendix Applications using Mendix 8
vendor: Siemens
product: Mendix Applications using Mendix 9
vendor: Siemens
product: Mendix Applications using Mendix 9 (V9.12)
vendor: Siemens
product: Mendix Applications using Mendix 9 (V9.6)
Published: 2022-07-12T10:06:43.000Z
CVE-2022-31258 
In Checkmk before 1.6.0p29, 2.x before 2.0.0p25, and 2.1.x before 2.1.0b10, a site user can escalate to root by editing an OMD hook symlink.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 8.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AC:L/AV:L/A:H/C:H/I:H/PR:H/S:C/UI:N
version: 3.1
Published: 2022-05-20T22:02:46.000Z
CVE-2022-31259 
The route lookup process in beego before 1.12.9 and 2.x before 2.0.3 allows attackers to bypass access control. When a /p1/p2/:name route is configured, attackers can access it by appending .xml in various places (e.g., p1.xml instead of p1).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-21T00:00:00.000Z
CVE-2022-31260 
In Montala ResourceSpace through 9.8 before r19636, csv_export_results_metadata.php allows attackers to export collection metadata via a non-NULL k value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-17T19:57:00.000Z
CVE-2022-31261 
An XXE issue was discovered in Morpheus through 5.2.16 and 5.4.x through 5.4.4. A successful attack requires a SAML identity provider to be configured. In order to exploit the vulnerability, the attacker must know the unique SAML callback ID of the configured identity source. A remote attacker can send a request crafted with an XXE payload to invoke a malicious DTD hosted on a system that they control. This results in reading local files that the application has access to.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-24T14:49:47.000Z
CVE-2022-31262 
An exploitable local privilege escalation vulnerability exists in GOG Galaxy 2.0.46. Due to insufficient folder permissions, an attacker can hijack the %ProgramData%\GOG.com folder structure and change the GalaxyCommunication service executable to a malicious file, resulting in code execution as SYSTEM.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-17T14:37:42.000Z
CVE-2022-31263 
app/models/user.rb in Mastodon before 3.5.0 allows a bypass of e-mail restrictions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-24T03:48:25.000Z
CVE-2022-31264 
Solana solana_rbpf before 0.2.29 has an addition integer overflow via invalid ELF program headers. elf.rs has a panic via a malformed eBPF program.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-21T20:04:50.000Z
CVE-2022-31265 
The replay feature in the client in Wargaming World of Warships 0.11.4 allows remote attackers to execute code when a user launches a replay from an untrusted source.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-26T17:12:50.000Z
CVE-2022-31266 
In ILIAS through 7.10, lack of verification when changing an email address (on the Profile Page) allows remote attackers to take over accounts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-29T00:46:29.000Z
CVE-2022-31267 
Gitblit 1.9.2 allows privilege escalation via the Config User Service: a control character can be placed in a profile data field, such as an emailAddress%3Atext 'attacker@example.com\n\trole = "#admin"' value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-21T20:35:31.000Z
CVE-2022-31268 
A Path Traversal vulnerability in Gitblit 1.9.3 can lead to reading website files via /resources//../ (e.g., followed by a WEB-INF or META-INF pathname).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-21T20:35:09.000Z
CVE-2022-31269 
Nortek Linear eMerge E3-Series devices through 0.32-09c place admin credentials in /test.txt that allow an attacker to open a building's doors. (This occurs in situations where the CVE-2019-7271 default credentials have been changed.)
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-25T21:59:52.000Z
CVE-2022-31273 
An issue in TopIDP3000 Topsec Operating System tos_3.3.005.665b.15_smpidp allows attackers to perform a brute-force attack via a crafted session_id cookie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-14T12:15:41.000Z
CVE-2022-31277 
Xiaomi Lamp 1 v2.0.4_0066 was discovered to be vulnerable to replay attacks. This allows attackers to to bypass the expected access restrictions and gain control of the switch and other functions via a crafted POST request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-16T14:53:20.000Z
CVE-2022-31282 
Bento4 MP4Dump v1.2 was discovered to contain a segmentation violation via an unknown address at /Source/C++/Core/Ap4DataBuffer.cpp:175.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-10T17:21:01.000Z
CVE-2022-31285 
An issue was discovered in Bento4 1.2. The allocator is out of memory in /Source/C++/Core/Ap4Array.h.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-10T17:21:02.000Z
CVE-2022-31287 
An issue was discovered in Bento4 v1.2. There is an allocation size request error in /Ap4RtpAtom.cpp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-10T17:21:04.000Z
CVE-2022-31290 
A cross-site scripting (XSS) vulnerability in Known v1.2.2+2020061101 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Your Name text field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-08T11:10:34.000Z
CVE-2022-31291 
An issue in dlt_config_file_parser.c of dlt-daemon v2.18.8 allows attackers to cause a double free via crafted TCP packets.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-16T00:00:00.000Z
CVE-2022-31294 
An issue in the save_users() function of Online Discussion Forum Site 1 allows unauthenticated attackers to arbitrarily create or update user accounts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-16T17:46:23.000Z
CVE-2022-31295 
An issue in the delete_post() function of Online Discussion Forum Site 1 allows unauthenticated attackers to arbitrarily delete posts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-16T19:13:57.000Z
CVE-2022-31296 
Online Discussion Forum Site 1 was discovered to contain a blind SQL injection vulnerability via the component /odfs/posts/view_post.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-17T12:22:19.000Z
CVE-2022-31298 
A cross-site scripting vulnerability in the ads comment section of Haraj v3.7 allows attackers to execute arbitrary web scripts or HTML via a crafted POST request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-16T16:55:16.000Z
CVE-2022-31299 
Haraj v3.7 was discovered to contain a reflected cross-site scripting (XSS) vulnerability in the User Upgrade Form.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-16T21:22:59.000Z
CVE-2022-31300 
A cross-site scripting vulnerability in the DM Section component of Haraj v3.7 allows attackers to execute arbitrary web scripts or HTML via a crafted POST request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-16T14:24:28.000Z
CVE-2022-31301 
Haraj v3.7 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Post Ads component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-16T17:14:06.000Z
CVE-2022-31302 
maccms8 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Server Group text field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-21T12:51:38.000Z
CVE-2022-31303 
maccms10 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Server Group text field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-21T12:51:39.000Z
CVE-2022-31306 
Nginx NJS v0.7.2 was discovered to contain a segmentation violation in the function njs_array_convert_to_slow_array at src/njs_array.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-21T12:57:30.000Z
CVE-2022-31307 
Nginx NJS v0.7.2 was discovered to contain a segmentation violation in the function njs_string_offset at src/njs_string.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-21T12:57:31.000Z
CVE-2022-31308 
A vulnerability in live_mfg.shtml of WAVLINK AERIAL X 1200M M79X3.V5030.191012 allows attackers to obtain sensitive router information via execution of the exec cmd function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-14T13:09:53.000Z
CVE-2022-31309 
A vulnerability in live_check.shtml of WAVLINK AERIAL X 1200M M79X3.V5030.180719 allows attackers to obtain sensitive router information via execution of the exec cmd function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-14T13:09:53.000Z
CVE-2022-31311 
An issue in adm.cgi of WAVLINK AERIAL X 1200M M79X3.V5030.180719 allows attackers to execute arbitrary commands via a crafted POST request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-14T13:09:54.000Z
CVE-2022-31313 
api-res-py package in PyPI 0.1 is vulnerable to a code execution backdoor in the request package.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-08T19:13:13.000Z
CVE-2022-31321 
The foldername parameter in Bolt 5.1.7 was discovered to have incorrect input validation, allowing attackers to perform directory enumeration or cause a Denial of Service (DoS) via a crafted input.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-01T19:24:32.000Z
CVE-2022-31322 
Penta Security Systems Inc WAPPLES v6.0 r3 4.10-hotfix1 allows attackers to escalate privileges via overwriting files using SUID flagged executables.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-13T22:00:36.000Z
CVE-2022-31324 
An arbitrary file download vulnerability in the downloadAction() function of Penta Security Systems Inc WAPPLES v6.0 r3 4.10-hotfix1 allows attackers to download arbitrary files via a crafted POST request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-13T22:00:31.000Z
CVE-2022-31325 
There is a SQL Injection vulnerability in ChurchCRM 4.4.5 via the 'PersonID' field in /churchcrm/WhyCameEditor.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-08T15:52:40.000Z
CVE-2022-31327 
Online Ordering System By janobe 2.3.2 is vulneranle to SQL Injection via /ordering/index.php?q=products&id=.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-31T15:24:31.000Z
CVE-2022-31328 
Online Ordering System By janobe 2.3.2 has SQL Injection via /ordering/admin/products/index.php?view=edit&id=.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-31T15:26:25.000Z
CVE-2022-31329 
Online Ordering System By janobe 2.3.2 is vulnerable to SQL Injection via /ordering/admin/orders/loaddata.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-31T15:27:56.000Z
CVE-2022-31335 
Online Ordering System 2.3.2 is vulnerable to SQL Injection via /ordering/admin/stockin/index.php?view=edit&id=.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-31T14:58:02.000Z
CVE-2022-31336 
Online Ordering System 2.3.2 is vulnerable to SQL Injection via /ordering/admin/stockin/loaddata.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-31T14:56:19.000Z
CVE-2022-31337 
Online Ordering System 2.3.2 is vulnerable to SQL Injection via /ordering/admin/category/index.php?view=edit&id=.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-31T14:54:32.000Z
CVE-2022-31338 
Online Ordering System 2.3.2 is vulnerable to SQL Injection via /ordering/admin/user/index.php?view=edit&id=.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-31T14:51:14.000Z
CVE-2022-31339 
Simple Inventory System v1.0 is vulnerable to SQL Injection via /inventory/login.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-01T13:22:45.000Z
CVE-2022-31340 
Simple Inventory System v1.0 is vulnerable to SQL Injection via /inventory/table_edit_ajax.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-01T13:21:21.000Z
CVE-2022-31342 
Online Car Wash Booking System v1.0 is vulnerable to Delete any file via /ocwbs/classes/Master.php?f=delete_img.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-01T13:42:05.000Z
CVE-2022-31343 
Online Car Wash Booking System v1.0 is vulnerable to SQL Injection via /ocwbs/admin/?page=bookings/view_details&id=.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-01T13:40:10.000Z
CVE-2022-31344 
Online Car Wash Booking System v1.0 is vulnerable to SQL Injection via /ocwbs/classes/Master.php?f=delete_booking.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-01T13:38:55.000Z
CVE-2022-31345 
Online Car Wash Booking System v1.0 is vulnerable to SQL Injection via /ocwbs/admin/?page=user/manage_user&id=.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-01T13:37:30.000Z
CVE-2022-31346 
Online Car Wash Booking System v1.0 is vulnerable to SQL Injection via /ocwbs/classes/Master.php?f=delete_service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-01T13:36:17.000Z
CVE-2022-31347 
Online Car Wash Booking System v1.0 is vulnerable to SQL Injection via /ocwbs/classes/Master.php?f=delete_vehicle.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-01T13:34:43.000Z
CVE-2022-31348 
Online Car Wash Booking System v1.0 is vulnerable to SQL Injection via /ocwbs/admin/bookings/update_status.php?id=.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-01T13:33:33.000Z
CVE-2022-31350 
Online Car Wash Booking System v1.0 is vulnerable to SQL Injection via /ocwbs/admin/vehicles/manage_vehicle.php?id=.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-01T13:31:04.000Z
CVE-2022-31351 
Online Car Wash Booking System v1.0 by oretnom23 has SQL injection via /ocwbs/admin/services/manage_price.php?id=.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-01T13:29:48.000Z
CVE-2022-31352 
Online Car Wash Booking System v1.0 by oretnom23 has SQL injection in /ocwbs/admin/services/manage_service.php?id=.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-01T13:28:24.000Z
CVE-2022-31353 
Online Car Wash Booking System v1.0 is vulnerable to SQL Injection via /ocwbs/admin/services/view_service.php?id=.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-01T13:27:02.000Z
CVE-2022-31354 
Online Car Wash Booking System v1.0 is vulnerable to SQL Injection via /ocwbs/classes/Master.php?f=get_vehicle_service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-01T13:25:22.000Z
CVE-2022-31355 
Online Ordering System v2.3.2 was discovered to contain a SQL injection vulnerability via /ordering/index.php?q=category&search=.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-17T13:35:47.000Z
CVE-2022-31356 
Online Ordering System v2.3.2 was discovered to contain a SQL injection vulnerability via /ordering/admin/store/index.php?view=edit&id=.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-17T13:29:55.000Z
CVE-2022-31357 
Online Ordering System v2.3.2 was discovered to contain a SQL injection vulnerability via /ordering/admin/inventory/index.php?view=edit&id=.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-17T13:29:55.000Z
CVE-2022-31358 
A reflected cross-site scripting (XSS) vulnerability in Proxmox Virtual Environment prior to v7.2-3 allows remote attackers to execute arbitrary web scripts or HTML via non-existent endpoints under path /api2/html/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-14T00:00:00.000Z
CVE-2022-31361 
Docebo Community Edition v4.0.5 and below was discovered to contain a SQL injection vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-22T17:16:54.000Z
CVE-2022-31362 
Docebo Community Edition v4.0.5 and below was discovered to contain an arbitrary file upload vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-22T17:16:13.000Z