rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-30421 
Improper Authentication vulnerability in Toshiba Storage Security Software V1.2.0.7413 is that allows for sensitive information to be obtained via(local) password authentication module.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-01-31T00:00:00.000Z
CVE-2022-30422 
Proietti Tech srl Planet Time Enterprise 4.2.0.1,4.2.0.0,4.1.0.0,4.0.0.0,3.3.1.0,3.3.0.0 is vulnerable to Remote code execution via the Viewstate parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-17T16:11:37.000Z
CVE-2022-30423 
Merchandise Online Store v1.0 by oretnom23 has an arbitrary code execution (RCE) vulnerability in the user profile upload point in the system information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-27T13:38:47.000Z
CVE-2022-30425 
Tenda Technology Co.,Ltd HG6 3.3.0-210926 was discovered to contain a command injection vulnerability via the pingAddr and traceAddr parameters. This vulnerability is exploited via a crafted POST request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-27T12:56:20.000Z
CVE-2022-30426 
There is a stack buffer overflow vulnerability, which could lead to arbitrary code execution in UEFI DXE driver on some Acer products. An attack could exploit this vulnerability to escalate privilege from ring 3 to ring 0, and hijack control flow during UEFI DXE execution. This affects Altos T110 F3 firmware version <= P13 (latest) and AP130 F2 firmware version <= P04 (latest) and Aspire 1600X firmware version <= P11.A3L (latest) and Aspire 1602M firmware version <= P11.A3L (latest) and Aspire 7600U firmware version <= P11.A4 (latest) and Aspire MC605 firmware version <= P11.A4L (latest) and Aspire TC-105 firmware version <= P12.B0L (latest) and Aspire TC-120 firmware version <= P11-A4 (latest) and Aspire U5-620 firmware version <= P11.A1 (latest) and Aspire X1935 firmware version <= P11.A3L (latest) and Aspire X3475 firmware version <= P11.A3L (latest) and Aspire X3995 firmware version <= P11.A3L (latest) and Aspire XC100 firmware version <= P11.B3 (latest) and Aspire XC600 firmware version <= P11.A4 (latest) and Aspire Z3-615 firmware version <= P11.A2L (latest) and Veriton E430G firmware version <= P21.A1 (latest) and Veriton B630_49 firmware version <= AAP02SR (latest) and Veriton E430 firmware version <= P11.A4 (latest) and Veriton M2110G firmware version <= P21.A3 (latest) and Veriton M2120G fir.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-22T23:06:15.000Z
CVE-2022-30427 
In ginadmin through 05-10-2022 the incoming path value is not filtered, resulting in directory traversal.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-25T15:26:04.000Z
CVE-2022-30428 
In ginadmin through 05-10-2022, the incoming path value is not filtered, resulting in arbitrary file reading.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-25T15:23:50.000Z
CVE-2022-30429 
Multiple cross-site scripting (XSS) vulnerabilities in Neos CMS allow attackers with the editor role or higher to inject arbitrary script or HTML code using the editor function, the deletion of assets, or a workspace title. The vulnerabilities were found in versions 3.3.29 and 8.0.1 and could also be present in all intermediate versions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-02T17:18:03.000Z
CVE-2022-30448 
Hospital Management System in PHP with Source Code (HMS) 1.0 was discovered to contain a File upload vulnerability in treatmentrecord.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-11T18:07:06.000Z
CVE-2022-30449 
Hospital Management System in PHP with Source Code (HMS) 1.0 was discovered to contain a SQL injection vulnerability via the editid parameter in room.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-11T18:14:52.000Z
CVE-2022-30450 
A Remote Code Execution (RCE) vulnerability exists in waimairen 9.1 via wx.php
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-11T18:11:01.000Z
CVE-2022-30451 
An authenticated user could execute code via a SQLi vulnerability in waimairenCMS before version 9.1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-11T18:09:51.000Z
CVE-2022-30452 
ShopWind <= v3.4.2 has a Sql injection vulnerability in Database.php
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-11T17:53:54.000Z
CVE-2022-30453 
ShopWind <= 3.4.2 has a RCE vulnerability in Database.php
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-11T17:55:12.000Z
CVE-2022-30454 
Merchandise Online Store 1.0 is vulnerable to SQL Injection via /vloggers_merch/classes/Master.php?f=delete_product.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-24T12:53:41.000Z
CVE-2022-30455 
Badminton Center Management System 1.0 is vulnerable to SQL Injection via /bcms/classes/Master.php?f=delete_court_rental, id.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-24T12:59:09.000Z
CVE-2022-30456 
Badminton Center Management System 1.0 is vulnerable to Cross Site Scripting (XSS) via /bcms/classes/Master.php?f=save_court_rental.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-24T12:56:42.000Z
CVE-2022-30458 
Automotive Shop Management System v1.0 is vulnerable to Cross Site Scripting (XSS) via /asms/classes/Master.php?f=save_product, name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-24T13:22:44.000Z
CVE-2022-30459 
ChatBot App with Suggestion in PHP/OOP v1.0 is vulnerable to SQL Injection via /simple_chat_bot/classes/Master.php?f=delete_response, id.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-24T13:34:39.000Z
CVE-2022-30460 
Simple Social Networking Site v1.0 is vulnerable to Cross Site Scripting (XSS) via /sns/classes/Users.php?f=save, firstname.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-24T13:15:23.000Z
CVE-2022-30461 
Water-billing-management-system v1.0 is vulnerable to SQL Injection via /wbms/classes/Master.php?f=delete_client, id
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-24T13:49:36.000Z
CVE-2022-30462 
Water-billing-management-system v1.0 is affected by: Cross Site Scripting (XSS) via /wbms/classes/Users.php?f=save, firstname.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-24T13:48:37.000Z
CVE-2022-30463 
Automotive Shop Management System v1.0 is vulnerable to SQL Injection via /asms/classes/Master.php?f=delete_product.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-24T13:24:52.000Z
CVE-2022-30464 
ChatBot App with Suggestion in PHP/OOP v1.0 is vulnerable to Cross Site Scripting (XSS) via /simple_chat_bot/classes/Master.php?f=save_response.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-24T13:33:31.000Z
CVE-2022-30466 
joyebike Joy ebike Wolf Manufacturing year 2022 is vulnerable to Authentication Bypass by Capture-replay.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-07T20:15:08.000Z
CVE-2022-30467 
Joy ebike Wolf Manufacturing year 2022 is vulnerable to Denial of service, which allows remote attackers to jam the key fob request via RF.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-29T19:12:55.000Z
CVE-2022-30469 
In Afian Filerun 20220202, lack of sanitization of the POST parameter "metadata[]" in `/?module=fileman&section=get&page=grid` leads to SQL injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-06T20:06:42.000Z
CVE-2022-30470 
In Afian Filerun 20220202 Changing the "search_tika_path" variable to a custom (and previously uploaded) jar file results in remote code execution in the context of the webserver user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-01T14:31:51.000Z
CVE-2022-30472 
Tenda AC Seris Router AC18_V15.03.05.19(6318) has a stack-based buffer overflow vulnerability in function fromAddressNat
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-26T15:21:13.000Z
CVE-2022-30473 
Tenda AC Series Router AC18_V15.03.05.19(6318) has a stack-based buffer overflow vulnerability in function form_fast_setting_wifi_set
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-26T15:19:49.000Z
CVE-2022-30474 
Tenda AC Series Router AC18_V15.03.05.19(6318) was discovered to contain a heap overflow in the httpd module when handling /goform/saveParentControlInfo request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-26T15:23:08.000Z
CVE-2022-30475 
Tenda AC Series Router AC18_V15.03.05.19(6318) was discovered to contain a stack-based buffer overflow in the httpd module when handling /goform/WifiExtraSet request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-26T15:24:38.000Z
CVE-2022-30476 
Tenda AC Series Router AC18_V15.03.05.19(6318) was discovered to contain a stack-based buffer overflow in the httpd module when handling /goform/SetFirewallCfg request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-26T15:25:45.000Z
CVE-2022-30477 
Tenda AC Series Router AC18_V15.03.05.19(6318) was discovered to contain a stack-based buffer overflow in the httpd module when handling /goform/SetClientState request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-26T15:26:42.000Z
CVE-2022-30478 
Ecommerce-project-with-php-and-mysqli-Fruits-Bazar 1.0 is vulnerable to SQL Injection in \search_product.php via the keyword parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-31T20:51:49.000Z
CVE-2022-30481 
Food-order-and-table-reservation-system- 1.0 is vulnerable to SQL Injection in categorywise-menu.php via the catid parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-31T20:40:41.000Z
CVE-2022-30482 
Ecommerce-project-with-php-and-mysqli-Fruits-Bazar- 1.0 is vulnerable to Cross Site Scripting (XSS) in \admin\add_cata.php via the ctg_name parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-31T20:44:04.000Z
CVE-2022-30489 
WAVLINK WN535 G3 was discovered to contain a cross-site scripting (XSS) vulnerability via the hostname parameter at /cgi-bin/login.cgi.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-13T12:49:41.000Z
CVE-2022-30490 
Badminton Center Management System V1.0 is vulnerable to SQL Injection via parameter 'id' in /bcms/admin/court_rentals/update_status.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-01T00:38:55.000Z
CVE-2022-30493 
In oretnom23 Automotive Shop Management System v1.0, the product id parameter suffers from a blind SQL Injection Vulnerability allowing remote attackers to dump all database credential and gain admin access(privilege escalation).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-26T16:31:02.000Z
CVE-2022-30494 
In oretnom23 Automotive Shop Management System v1.0, the first and last name user fields suffer from a stored XSS Injection Vulnerability allowing remote attackers to gain admin access and view internal IPs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-26T16:29:28.000Z
CVE-2022-30495 
In oretnom23 Automotive Shop Management System v1.0, the name id parameter is vulnerable to IDOR - Broken Access Control allowing attackers to change the admin password(vertical privilege escalation)
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-26T16:32:46.000Z
CVE-2022-30496 
SQL injection in Logon Page of IDCE MV's application, version 1.0, allows an attacker to inject SQL payloads in the user field, connecting to a database to access enterprise's private and sensitive information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-27T18:26:19.000Z
CVE-2022-30500 
Jfinal cms 5.1.0 is vulnerable to SQL Injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-26T15:56:46.000Z
CVE-2022-30503 
Nginx NJS v0.7.2 was discovered to contain a segmentation violation in the function njs_set_number at src/njs_value.h.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-27T13:13:50.000Z
CVE-2022-30506 
An arbitrary file upload vulnerability was discovered in MCMS 5.2.7, allowing an attacker to execute arbitrary code through a crafted ZIP file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-27T13:27:33.000Z
CVE-2022-30508 
DedeCMS v5.7.93 was discovered to contain arbitrary file deletion vulnerability in upload.php via the delete parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-26T17:30:18.000Z
CVE-2022-30510 
School Dormitory Management System 1.0 is vulnerable to SQL Injection via reports/daily_collection_report.php:59.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-27T11:43:48.000Z
CVE-2022-30511 
School Dormitory Management System 1.0 is vulnerable to SQL Injection via accounts/view_details.php:4.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-27T15:09:59.000Z
CVE-2022-30512 
School Dormitory Management System 1.0 is vulnerable to SQL Injection via accounts/payment_history.php:31.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-27T14:00:30.000Z
CVE-2022-30513 
School Dormitory Management System v1.0 is vulnerable to reflected cross-site scripting (XSS) via admin/inc/navigation.php:125
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-27T16:34:36.000Z
CVE-2022-30514 
School Dormitory Management System v1.0 is vulnerable to reflected cross-site scripting (XSS) via admin/inc/navigation.php:126.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-27T15:04:52.000Z
CVE-2022-30515 
ZKTeco BioTime 8.5.4 is missing authentication on folders containing employee photos, allowing an attacker to view them through filename enumeration.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-08T00:00:00.000Z
CVE-2022-30516 
In Hospital-Management-System v1.0, the editid parameter in the doctor.php page is vulnerable to SQL injection attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-26T16:17:46.000Z
CVE-2022-30517 
Mogu blog 5.2 is vulnerable to Cross Site Scripting (XSS).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-12T22:55:43.000Z
CVE-2022-30518 
ChatBot Application with a Suggestion Feature 1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /simple_chat_bot/admin/responses/view_response.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-20T12:53:19.000Z
CVE-2022-30519 
XSS in signing form in Reprise Software RLM License Administration v14.2BL4 allows remote attacker to inject arbitrary code via password field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-29T00:00:00.000Z
CVE-2022-30521 
The LAN-side Web-Configuration Interface has Stack-based Buffer Overflow vulnerability in the D-Link Wi-Fi router firmware DIR-890L DIR890LA1_FW107b09.bin and previous versions. The function created at 0x17958 of /htdocs/cgibin will call sprintf without checking the length of strings in parameters given by HTTP header and can be controlled by users easily. The attackers can exploit the vulnerability to carry out arbitrary code by means of sending a specially constructed payload to port 49152.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-27T00:00:00.000Z
CVE-2022-30522 mod_sed denial of service
If Apache HTTP Server 2.4.53 is configured to do transformations with mod_sed in contexts where the input to mod_sed may be very large, mod_sed may make excessively large memory allocations and trigger an abort.
Problem types: cwe_id: CWE-789
description: CWE-789: Memory Allocation with Excessive Size Value
Affected products: vendor: Apache Software Foundation
product: Apache HTTP Server
Credits: lang: en
value: This issue was found by Brian Moussalli from the JFrog Security Research team
Published: 2022-06-08T10:00:54.000Z
CVE-2022-30523 
Trend Micro Password Manager (Consumer) version 5.0.0.1266 and below is vulnerable to a Link Following Privilege Escalation Vulnerability that could allow a low privileged local attacker to delete the contents of an arbitrary folder as SYSTEM which can then be used for privilege escalation on the affected machine.
Problem types: description: Link Following Privilege Escalation
Affected products: vendor: Trend Micro
product: Trend Micro Password Manager
Published: 2022-05-16T14:45:13.000Z
CVE-2022-30524 
There is an invalid memory access in the TextLine class in TextOutputDev.cc in Xpdf 4.0.4 because the text extractor mishandles characters at large y coordinates. It can be triggered by (for example) sending a crafted pdf file to the pdftotext binary, which allows a remote attacker to cause a Denial of Service (Segmentation fault) or possibly have unspecified other impact.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-09T18:00:09.000Z
CVE-2022-30525 
A OS command injection vulnerability in the CGI program of Zyxel USG FLEX 100(W) firmware versions 5.00 through 5.21 Patch 1, USG FLEX 200 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 500 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 700 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 50(W) firmware versions 5.10 through 5.21 Patch 1, USG20(W)-VPN firmware versions 5.10 through 5.21 Patch 1, ATP series firmware versions 5.10 through 5.21 Patch 1, VPN series firmware versions 4.60 through 5.21 Patch 1, which could allow an attacker to modify specific files and then execute some OS commands on a vulnerable device.
Problem types: cwe_id: CWE-78
description: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: Zyxel
product: USG FLEX 100(W) firmware
vendor: Zyxel
product: USG FLEX 200 firmware
vendor: Zyxel
product: USG FLEX 500 firmware
vendor: Zyxel
product: USG FLEX 700 firmware
vendor: Zyxel
product: ATP series firmware
vendor: Zyxel
product: VPN series firmware
vendor: Zyxel
product: USG FLEX 50(W) firmware
vendor: Zyxel
product: USG 20(W)-VPN firmware
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2022-05-12T13:05:11.000Z
CVE-2022-30526 
A privilege escalation vulnerability was identified in the CLI command of Zyxel USG FLEX 100(W) firmware versions 4.50 through 5.30, USG FLEX 200 firmware versions 4.50 through 5.30, USG FLEX 500 firmware versions 4.50 through 5.30, USG FLEX 700 firmware versions 4.50 through 5.30, USG FLEX 50(W) firmware versions 4.16 through 5.30, USG20(W)-VPN firmware versions 4.16 through 5.30, ATP series firmware versions 4.32 through 5.30, VPN series firmware versions 4.30 through 5.30, USG/ZyWALL series firmware versions 4.09 through 4.72, which could allow a local attacker to execute some OS commands with root privileges in some directories on a vulnerable device.
Problem types: cwe_id: CWE-269
description: CWE-269: Improper Privilege Management
Affected products: vendor: Zyxel
product: USG FLEX 100(W) firmware
vendor: Zyxel
product: USG FLEX 200 firmware
vendor: Zyxel
product: USG FLEX 500 firmware
vendor: Zyxel
product: USG FLEX 700 firmware
vendor: Zyxel
product: ATP series firmware
vendor: Zyxel
product: VPN series firmware
vendor: Zyxel
product: USG FLEX 50(W) firmware
vendor: Zyxel
product: USG 20(W)-VPN firmware
vendor: Zyxel
product: USG/ZyWALL series firmware
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2022-07-19T05:45:14.000Z
CVE-2022-30527 
A vulnerability has been identified in SINEC NMS (All versions < V2.0). The affected application assigns improper access rights to specific folders containing executable files and libraries.

This could allow an authenticated local attacker to inject arbitrary code and escalate privileges.
Problem types: cwe_id: CWE-732
description: CWE-732: Incorrect Permission Assignment for Critical Resource
Affected products: vendor: Siemens
product: SINEC NMS
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
baseScore: 7.8
baseSeverity: HIGH
Published: 2023-10-10T10:20:55.760Z
CVE-2022-30528 
SQL Injection vulnerability in asith-eranga ISIC tour booking through version published on Feb 13th 2018, allows attackers to execute arbitrary commands via the username parameter to /system/user/modules/mod_users/controller.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-01T00:00:00.000Z
CVE-2022-30529 
File upload vulnerability in asith-eranga ISIC tour booking through version published on Feb 13th 2018, allows attackers to upload arbitrary files via /system/application/libs/js/tinymce/plugins/filemanager/dialog.php and /system/application/libs/js/tinymce/plugins/filemanager/upload.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-22T00:00:00.000Z
CVE-2022-30530 
Protection mechanism failure in the Intel(R) DSA software before version 22.4.26 may allow an authenticated user to potentially enable escalation of privilege via local access.
Problem types: description: escalation of privilege
Affected products: vendor: n/a
product: Intel(R) DSA software
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 7.8
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
Published: 2023-02-16T20:00:03.469Z