rainbutterfly/cve_corpus huggingface dataset:
CVE-2023-0645 Out of Bounds read in libjxl
An out of bounds read exists in libjxl. An attacker using a specifically crafted file could cause an out of bounds read in the exif handler. We recommend upgrading to version 0.8.1 or past commit  https://github.com/libjxl/libjxl/pull/2101/commits/d95b050c1822a5b1ede9e0dc937e43fca1b10159 https://github.com/libjxl/libjxl/pull/2101/commits/d95b050c1822a5b1ede9e0dc937e43fca1b10159 
Problem types: cwe_id: CWE-125
description: CWE-125 Out-of-bounds Read
Affected products: vendor: Libjxl
product: Libjxl
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2023-04-11T13:22:06.779Z
CVE-2023-0646 dst-admin cavesConsole command injection
A vulnerability classified as critical was found in dst-admin 1.5.0. Affected by this vulnerability is an unknown functionality of the file /home/cavesConsole. The manipulation of the argument command leads to command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-220033 was assigned to this vulnerability.
Problem types: cwe_id: CWE-77
description: CWE-77 Command Injection
Affected products: vendor: n/a
product: dst-admin
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: yanfei.chen (VulDB User)
Published: 2023-02-02T13:26:30.361Z
CVE-2023-0647 dst-admin kickPlayer command injection
A vulnerability, which was classified as critical, has been found in dst-admin 1.5.0. Affected by this issue is some unknown functionality of the file /home/kickPlayer. The manipulation of the argument userId leads to command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-220034 is the identifier assigned to this vulnerability.
Problem types: cwe_id: CWE-77
description: CWE-77 Command Injection
Affected products: vendor: n/a
product: dst-admin
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: yanfei.chen (VulDB User)
Published: 2023-02-02T13:27:57.263Z
CVE-2023-0648 dst-admin masterConsole command injection
A vulnerability, which was classified as critical, was found in dst-admin 1.5.0. This affects an unknown part of the file /home/masterConsole. The manipulation of the argument command leads to command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-220035.
Problem types: cwe_id: CWE-77
description: CWE-77 Command Injection
Affected products: vendor: n/a
product: dst-admin
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: yanfei.chen (VulDB User)
Published: 2023-02-02T13:29:16.221Z
CVE-2023-0649 dst-admin sendBroadcast command injection
A vulnerability has been found in dst-admin 1.5.0 and classified as critical. This vulnerability affects unknown code of the file /home/sendBroadcast. The manipulation of the argument message leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-220036.
Problem types: cwe_id: CWE-77
description: CWE-77 Command Injection
Affected products: vendor: n/a
product: dst-admin
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: yanfei.chen (VulDB User)
Published: 2023-02-02T13:33:19.311Z
CVE-2023-0650 YAFNET Signature cross site scripting
A vulnerability was found in YAFNET up to 3.1.11 and classified as problematic. This issue affects some unknown processing of the component Signature Handler. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.1.12 is able to address this issue. The identifier of the patch is a1442a2bacc3335461b44c250e81f8d99c60735f. It is recommended to upgrade the affected component. The identifier VDB-220037 was assigned to this vulnerability.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross Site Scripting
Affected products: vendor: n/a
product: YAFNET
CVSS v3.1: version: 3.1
baseScore: 3.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
baseSeverity: LOW
Credits: lang: en
value: Chun-Li Lin
lang: en
value: lin7lic (VulDB User)
Published: 2023-02-02T13:38:51.044Z
CVE-2023-0651 FastCMS Template Management unrestricted upload
A vulnerability was found in FastCMS 0.1.0. It has been classified as critical. Affected is an unknown function of the component Template Management. The manipulation leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-434
description: Unrestricted Upload
Affected products: vendor: n/a
product: FastCMS
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: yanfei.chen (VulDB User)
Published: 2023-02-02T13:42:18.871Z
CVE-2023-0652 Local Privilege Escalation in Cloudflare WARP Installer (Windows)
Due to a hardlink created in the ProgramData folder during the repair process of the software, the installer (MSI) of WARP Client for Windows (<= 2022.12.582.0) allowed a malicious attacker to forge the destination of the hardlink and escalate privileges, overwriting SYSTEM protected files.
As Cloudflare WARP client for Windows (up to version 2022.5.309.0) allowed creation of mount points from its ProgramData folder, during installation of the WARP client, it was possible to escalate privileges and overwrite SYSTEM protected files.



Problem types: cwe_id: CWE-59
description: CWE-59 Improper Link Resolution Before File Access ('Link Following')
Affected products: vendor: Cloudflare
product: WARP
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Jan-Luca Gruber
Published: 2023-04-06T09:42:33.513Z
CVE-2023-0654 Spoofing User's Activity Loads in WARP Mobile Client (Android)
Due to a misconfiguration, the WARP Mobile Client (< 6.29) for Android was susceptible to a tapjacking attack. In the event that an attacker built a malicious application and managed to install it on a victim's device, the attacker would be able to trick the user into believing that the app shown on the screen was the WARP client when in reality it was the attacker's app.


Problem types: cwe_id: CWE-1021
description: CWE-1021 Improper Restriction of Rendered UI Layers or Frames
Affected products: vendor: Cloudflare
product: WARP Client
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 3.9
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
version: 3.1
Published: 2023-08-29T15:05:19.623Z
CVE-2023-0655 
SonicWall Email Security contains a vulnerability that could permit a remote unauthenticated attacker access to an error page that includes sensitive information about users email addresses.
Problem types: cwe_id: CWE-209
description: CWE-209: Generation of Error Message Containing Sensitive Information
Affected products: vendor: SonicWall
product: SonicWall Email Security
Published: 2023-02-14T00:00:00.000Z
CVE-2023-0656 
A Stack-based buffer overflow vulnerability in the SonicOS allows a remote unauthenticated attacker to cause Denial of Service (DoS), which could cause an impacted firewall to crash.
Problem types: cwe_id: CWE-121
description: CWE-121: Stack-based Buffer Overflow
Affected products: vendor: SonicWall
product: SonicOS
Published: 2023-03-02T00:00:00.000Z
CVE-2023-0657 Keycloak: impersonation via logout token exchange
A flaw was found in Keycloak. This issue occurs due to improperly enforcing token types when validating signatures locally. This could allow an authenticated attacker to exchange a logout token for an access token and possibly gain access to data outside of enforced permissions.
Problem types: cwe_id: CWE-273
description: Improper Check for Dropped Privileges
Affected products: default_status: unaffected
vendor: Red Hat
product: Red Hat build of Keycloak 22
cpes: cpe:/a:redhat:build_keycloak:22::el9
default_status: affected
vendor: Red Hat
product: Red Hat build of Keycloak 22
cpes: cpe:/a:redhat:build_keycloak:22::el9
default_status: affected
vendor: Red Hat
product: Red Hat build of Keycloak 22
cpes: cpe:/a:redhat:build_keycloak:22::el9
default_status: affected
vendor: Red Hat
product: Red Hat build of Keycloak 22.0.10
cpes: cpe:/a:redhat:build_keycloak:22
default_status: unaffected
vendor: Red Hat
product: Red Hat Single Sign-On 7
cpes: cpe:/a:redhat:red_hat_single_sign_on:7
default_status: affected
CVSS v3.1: attackComplexity: HIGH
attackVector: ADJACENT_NETWORK
availabilityImpact: NONE
baseScore: 3.4
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N
version: 3.1
Published: 2024-11-17T10:19:03.717Z
CVE-2023-0658 Multilaser RE057/RE170 Backup File param.file.tgz information disclosure
A vulnerability, which was classified as critical, was found in Multilaser RE057 and RE170 2.1/2.2. This affects an unknown part of the file /param.file.tgz of the component Backup File Handler. The manipulation leads to information disclosure. It is possible to initiate the attack remotely. The identifier VDB-220053 was assigned to this vulnerability.
Problem types: cwe_id: CWE-200
description: CWE-200 Information Disclosure
Affected products: vendor: Multilaser
product: RE057
vendor: Multilaser
product: RE170
CVSS v3.1: version: 3.1
baseScore: 5.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
baseSeverity: MEDIUM
Credits: lang: en
value: c4ng4c3ir0 (VulDB User)
Published: 2023-02-02T19:42:09.183Z
CVE-2023-0659 BDCOM 1704-WGL Backup File param.file.tgz information disclosure
A vulnerability was found in BDCOM 1704-WGL 2.0.6314. It has been classified as critical. This affects an unknown part of the file /param.file.tgz of the component Backup File Handler. The manipulation leads to information disclosure. It is possible to initiate the attack remotely. The identifier VDB-220101 was assigned to this vulnerability.
Problem types: cwe_id: CWE-200
description: CWE-200 Information Disclosure
Affected products: vendor: BDCOM
product: 1704-WGL
CVSS v3.1: version: 3.1
baseScore: 5.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
baseSeverity: MEDIUM
Credits: lang: en
value: c4ng4c3ir0 (VulDB User)
Published: 2023-02-03T13:03:29.786Z
CVE-2023-0660 Smart Slider 3 < 3.5.1.14 - Contributor+ Stored XSS
The Smart Slider 3 WordPress plugin before 3.5.1.14 does not properly validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Smart Slider 3
default_status: unaffected
Credits: lang: en
value: Erwan LR (WPScan)
lang: en
value: WPScan
Published: 2023-03-27T15:37:19.768Z
CVE-2023-0661 
Improper access control in Devolutions Server allows an authenticated user to access unauthorized sensitive data.



Problem types: description: n/a
Affected products: vendor: Devolutions
product: Devolutions Server
default_status: unaffected
Published: 2023-02-03T15:48:17.672Z
CVE-2023-0662 DoS vulnerability when parsing multipart request body
In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, excessive number of parts in HTTP form upload can cause high resource consumption and excessive number of log entries. This can cause denial of service on the affected server by exhausting CPU resources or disk space.
Problem types: cwe_id: CWE-400
description: CWE-400 Uncontrolled Resource Consumption
Affected products: vendor: PHP Group
product: PHP
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: Jakob Ackermann
Published: 2023-02-16T06:24:01.692Z
CVE-2023-0663 Calendar Event Management System Login Page sql injection
A vulnerability was found in Calendar Event Management System 2.3.0. It has been rated as critical. This issue affects some unknown processing of the component Login Page. The manipulation of the argument name/pwd leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-220175.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: n/a
product: Calendar Event Management System
CVSS v3.1: version: 3.1
baseScore: 7.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
baseSeverity: HIGH
Credits: lang: en
value: Gab3 (VulDB User)
Published: 2023-02-03T20:40:32.253Z
CVE-2023-0664 
A flaw was found in the QEMU Guest Agent service for Windows. A local unprivileged user may be able to manipulate the QEMU Guest Agent's Windows installer via repair custom actions to elevate their privileges on the system.
Problem types: cwe_id: CWE-250
description: CWE-250
Affected products: vendor: n/a
product: QEMU
Published: 2023-03-29T00:00:00.000Z
CVE-2023-0665 Vault PKI Issuer Endpoint Did Not Correctly Authorize Access to Issuer Metadata
HashiCorp Vault's PKI mount issuer endpoints did not correctly authorize access to remove an issuer or modify issuer metadata, potentially resulting in denial of service of the PKI mount. This bug did not affect public or private key material, trust chains or certificate issuance. Fixed in Vault 1.13.1, 1.12.5, and 1.11.9.
Problem types: cwe_id: CWE-285
description: CWE-285 Improper Authorization
Affected products: vendor: HashiCorp
product: Vault
default_status: unaffected
vendor: HashiCorp
product: Vault Enterprise
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: LOW
availabilityImpact: LOW
baseSeverity: MEDIUM
baseScore: 6.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Published: 2023-03-30T00:21:47.676Z
CVE-2023-0666 Wireshark RTPS Parsing Buffer Overflow
Due to failure in validating the length provided by an attacker-crafted RTPS packet, Wireshark version 4.0.5 and prior, by default, is susceptible to a heap-based buffer overflow, and possibly code execution in the context of the process running Wireshark.
Problem types: cwe_id: CWE-122
description: CWE-122: Heap-based Buffer Overflow
Affected products: vendor: Wireshark Foundation
product: Wireshark
default_status: unaffected
Credits: lang: en
value: Austin Hackers Anonymous!
lang: en
value: Austin Hackers Anonymous!
Published: 2023-06-07T02:25:27.974Z
CVE-2023-0667 Wireshark MSMMS parsing buffer overflow
Due to failure in validating the length provided by an attacker-crafted MSMMS packet, Wireshark version 4.0.5 and prior, in an unusual configuration, is susceptible to a heap-based buffer overflow, and possibly code execution in the context of the process running Wireshark
Problem types: cwe_id: CWE-122
description: CWE-122 Heap-based Buffer Overflow
Affected products: vendor: Wireshark Foundation
product: Wireshark
default_status: unaffected
Credits: lang: en
value: zenofex
lang: en
value: WanderingGlitch
lang: en
value: Austin Hackers Anonymous!
Published: 2023-06-07T02:38:07.798Z
CVE-2023-0668 Wireshark IEEE-C37.118 parsing buffer overflow
Due to failure in validating the length provided by an attacker-crafted IEEE-C37.118 packet, Wireshark version 4.0.5 and prior, by default, is susceptible to a heap-based buffer overflow, and possibly code execution in the context of the process running Wireshark.
Problem types: cwe_id: CWE-125
description: CWE-125 Out-of-bounds Read
Affected products: vendor: Wireshark Foundation
product: Wireshark
default_status: unaffected
Credits: lang: en
value: zenofex
lang: en
value: WanderingGlitch
lang: en
value: Austin Hackers Anonymous!
Published: 2023-06-07T02:32:45.095Z
CVE-2023-0669 Fortra GoAnywhere MFT License Response Servlet Command Injection
Fortra (formerly, HelpSystems) GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due to deserializing an arbitrary attacker-controlled object. This issue was patched in version 7.1.2.
Problem types: cwe_id: CWE-502
description: CWE-502 Deserialization of Untrusted Data
Affected products: vendor: Fortra
product: Goanywhere MFT
default_status: unaffected
Credits: lang: en
value: Brian Krebs of Krebs on Security
lang: en
value: Ron Bowes of Rapid7
lang: en
value: Caitlin Condon of Rapid7
lang: en
value: Fryco of Frycos Security
Published: 2023-02-06T19:16:19.265Z
CVE-2023-0670 
Ulearn version a5a7ca20de859051ea0470542844980a66dfc05d allows an attacker with administrator permissions to obtain remote code execution on the server through the image upload functionality. This occurs because the application does not validate that the uploaded image is actually an image.
Problem types: description: Insecure file upload
Affected products: vendor: n/a
product: Ulearn
Published: 2023-04-05T00:00:00.000Z
CVE-2023-0671  Code Injection in froxlor/froxlor
Code Injection in GitHub repository froxlor/froxlor prior to 2.0.10.
Problem types: cwe_id: CWE-94
description: CWE-94 Improper Control of Generation of Code
Affected products: vendor: froxlor
product: froxlor/froxlor
Published: 2023-02-04T00:00:00.000Z
CVE-2023-0673 SourceCodester Online Eyewear Shop sql injection
A vulnerability classified as critical was found in SourceCodester Online Eyewear Shop 1.0. Affected by this vulnerability is an unknown functionality of the file oews/?p=products/view_product.php. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The associated identifier of this vulnerability is VDB-220195.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: SourceCodester
product: Online Eyewear Shop
CVSS v3.1: version: 3.1
baseScore: 5
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: Pierfrancesco Conti
lang: en
value: secpconti (VulDB User)
Published: 2023-02-04T07:29:30.815Z
CVE-2023-0674 XXL-JOB New Password updatePwd cross-site request forgery
A vulnerability, which was classified as problematic, has been found in XXL-JOB 2.3.1. Affected by this issue is some unknown functionality of the file /user/updatePwd of the component New Password Handler. The manipulation leads to cross-site request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-220196.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery
Affected products: vendor: n/a
product: XXL-JOB
CVSS v3.1: version: 3.1
baseScore: 4.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
baseSeverity: MEDIUM
Credits: lang: en
value: boyi (VulDB User)
Published: 2023-02-04T07:34:05.519Z
CVE-2023-0675 Calendar Event Management System sql injection
A vulnerability, which was classified as critical, was found in Calendar Event Management System 2.3.0. This affects an unknown part. The manipulation of the argument start/end leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-220197 was assigned to this vulnerability.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: n/a
product: Calendar Event Management System
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: Gab3 (VulDB User)
Published: 2023-02-04T07:36:32.302Z
CVE-2023-0676 Cross-site Scripting (XSS) - Reflected in phpipam/phpipam
Cross-site Scripting (XSS) - Reflected in GitHub repository phpipam/phpipam prior to 1.5.1.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: phpipam
product: phpipam/phpipam
Published: 2023-02-04T00:00:00.000Z
CVE-2023-0677 Cross-site Scripting (XSS) - Reflected in phpipam/phpipam
Cross-site Scripting (XSS) - Reflected in GitHub repository phpipam/phpipam prior to v1.5.1.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: phpipam
product: phpipam/phpipam
Published: 2023-02-04T00:00:00.000Z
CVE-2023-0678 Missing Authorization in phpipam/phpipam
Missing Authorization in GitHub repository phpipam/phpipam prior to v1.5.1.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: phpipam
product: phpipam/phpipam
Published: 2023-02-04T00:00:00.000Z
CVE-2023-0679 SourceCodester Canteen Management System removeUser.php sql injection
A vulnerability was found in SourceCodester Canteen Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file removeUser.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-220220.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: SourceCodester
product: Canteen Management System
CVSS v3.1: version: 3.1
baseScore: 5
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: zxc65805735 (VulDB User)
Published: 2023-02-06T12:56:10.387Z
CVE-2023-0681 Rapid7 Nexpose Uncontrolled URL Redirect
Rapid7 InsightVM versions 6.6.178 and lower suffers from an open redirect vulnerability, whereby an attacker has the ability to redirect the user to a site of the attacker’s choice using the ‘page’ parameter of the ‘data/console/redirect’ component of the application. This issue was resolved in the February, 2023 release of version 6.6.179. 


Problem types: cwe_id: CWE-601
description: CWE-601 URL Redirection to Untrusted Site ('Open Redirect')
Affected products: vendor: Rapid7
product: Nexpose
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: Beau Taub of 2U, Inc.
Published: 2023-03-20T17:26:01.588Z