rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-28102 
A cross-site scripting (XSS) vulnerability in PHP MySQL Admin Panel Generator v1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected at /edit-db.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-28T14:00:27.000Z
CVE-2022-28104 
Foxit PDF Editor v11.3.1 was discovered to contain an arbitrary file upload vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-20T12:48:03.000Z
CVE-2022-28105 
Online Sports Complex Booking System v1.0 was discovered to contain a blind SQL injection vulnerability via the id parameter in /scbs/view_facility.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-20T12:48:14.000Z
CVE-2022-28106 
Online Sports Complex Booking System v1.0 was discovered to allow attackers to take over user accounts via a crafted POST request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-20T12:48:15.000Z
CVE-2022-28108 
Selenium Server (Grid) before 4 allows CSRF because it permits non-JSON content types such as application/x-www-form-urlencoded, multipart/form-data, and text/plain.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-19T02:55:37.000Z
CVE-2022-28109 
Selenium Selenium Grid (formerly Selenium Standalone Server) Fixed in 4.0.0-alpha-7 is affected by: DNS rebinding. The impact is: execute arbitrary code (remote). The component is: WebDriver endpoint of Selenium Grid / Selenium Standalone Server. The attack vector is: Triggered by browsing to to a malicious remote web server. The WebDriver endpoint of Selenium Server (Grid) is vulnerable to DNS rebinding. This can be used to execute arbitrary code on the machine.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-15T15:50:26.000Z
CVE-2022-28110 
Hotel Management System v1.0 was discovered to contain a SQL injection vulnerability via the username parameter at the login page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-10T12:01:23.000Z
CVE-2022-28111 
MyBatis PageHelper v1.x.x-v3.7.0 v4.0.0-v5.0.0,v5.1.0-v5.3.0 was discovered to contain a time-blind SQL injection vulnerability via the orderBy parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-04T00:00:00.000Z
CVE-2022-28113 
An issue in upload.csp of FANTEC GmbH MWiD25-DS Firmware v2.000.030 allows attackers to write files and reset the user passwords without having a valid session cookie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-15T18:08:17.000Z
CVE-2022-28114 
DSCMS v3.0 was discovered to contain an arbitrary file deletion vulnerability via /controller/Adv.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-28T14:10:51.000Z
CVE-2022-28115 
Online Sports Complex Booking v1.0 was discovered to contain a SQL injection vulnerability via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-05T19:03:03.000Z
CVE-2022-28116 
Online Banking System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-05T19:03:04.000Z
CVE-2022-28117 
A Server-Side Request Forgery (SSRF) in feed_parser class of Navigate CMS v2.9.4 allows remote attackers to force the application to make arbitrary requests via injection of arbitrary URLs into the feed parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-28T14:13:46.000Z
CVE-2022-28118 
SiteServer CMS v7.x allows attackers to execute arbitrary code via a crafted plug-in.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-03T00:08:02.000Z
CVE-2022-28120 
Beijing Runnier Network Technology Co., Ltd Open virtual simulation experiment teaching management platform software 2.0 has a file upload vulnerability, which can be exploited by an attacker to gain control of the server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-05T16:02:54.000Z
CVE-2022-28126 
Improper input validation in some Intel(R) XMM(TM) 7560 Modem software before version M2_7560_R_01.2146.00 may allow a privileged user to potentially enable escalation of privilege via local access.
Problem types: description: escalation of privilege
Affected products: vendor: n/a
product: Intel(R) XMM(TM) 7560 Modem software
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 6
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H
Published: 2022-11-11T15:48:46.764Z
CVE-2022-28127 
A data removal vulnerability exists in the web_server /action/remove/ API functionality of Robustel R1510 3.3.0. A specially-crafted network request can lead to arbitrary file deletion. An attacker can send a sequence of requests to trigger this vulnerability.
Problem types: cwe_id: CWE-20
description: CWE-20: Improper Input Validation
Affected products: vendor: Robustel
product: R1510
Published: 2022-06-30T19:05:20.796Z
CVE-2022-28128 
Untrusted search path vulnerability in AttacheCase ver.3.6.1.0 and earlier allows an attacker to gain privileges and execute arbitrary code via a Trojan horse DLL in an unspecified directory.
Problem types: description: Untrusted search path vulnerability
Affected products: vendor: HiBARA Software
product: AttacheCase
Published: 2022-03-31T07:21:53.000Z
CVE-2022-28129 Insufficient Validation of HTTP/1.x Headers
Improper Input Validation vulnerability in HTTP/1.1 header parsing of Apache Traffic Server allows an attacker to send invalid headers. This issue affects Apache Traffic Server 8.0.0 to 9.1.2.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Apache Software Foundation
product: Apache Traffic Server
Credits: lang: en
value: Apache Traffic Server would like to thank Zhang Zeyu for reporting this issue.
Published: 2022-08-10T00:00:00.000Z
CVE-2022-28131 Stack exhaustion from deeply nested XML documents in encoding/xml
Uncontrolled recursion in Decoder.Skip in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a deeply nested XML document.
Problem types: description: CWE-674: Uncontrolled Recursion
Affected products: vendor: Go standard library
product: encoding/xml
default_status: unaffected
Credits: lang: en
value: Go Security Team
lang: en
value: Juho Nurminen of Mattermost
Published: 2022-08-09T00:00:00.000Z
CVE-2022-28132 
The T-Soft E-Commerce 4 web application is susceptible to SQL injection (SQLi) attacks when authenticated as an admin or privileged user. This vulnerability allows attackers to access and manipulate the database through crafted requests. By exploiting this flaw, attackers can bypass authentication mechanisms, view sensitive information stored in the database, and potentially exfiltrate data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-14T20:20:37.565Z
CVE-2022-28133 
Jenkins Bitbucket Server Integration Plugin 3.1.0 and earlier does not limit URL schemes for callback URLs on OAuth consumers, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to create BitBucket Server consumers.
Affected products: vendor: Jenkins project
product: Jenkins Bitbucket Server Integration Plugin
Published: 2022-03-29T12:30:43.000Z
CVE-2022-28134 
Jenkins Bitbucket Server Integration Plugin 3.1.0 and earlier does not perform permission checks in several HTTP endpoints, allowing attackers with Overall/Read permission to create, view, and delete BitBucket Server consumers.
Affected products: vendor: Jenkins project
product: Jenkins Bitbucket Server Integration Plugin
Published: 2022-03-29T12:30:45.000Z
CVE-2022-28135 
Jenkins instant-messaging Plugin 1.41 and earlier stores passwords for group chats unencrypted in the global configuration file of plugins based on Jenkins instant-messaging Plugin on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system.
Affected products: vendor: Jenkins project
product: Jenkins instant-messaging Plugin
Published: 2022-03-29T12:30:47.000Z
CVE-2022-28136 
A cross-site request forgery (CSRF) vulnerability in Jenkins JiraTestResultReporter Plugin 165.v817928553942 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials.
Affected products: vendor: Jenkins project
product: Jenkins JiraTestResultReporter Plugin
Published: 2022-03-29T12:30:48.000Z
CVE-2022-28137 
A missing permission check in Jenkins JiraTestResultReporter Plugin 165.v817928553942 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials.
Affected products: vendor: Jenkins project
product: Jenkins JiraTestResultReporter Plugin
Published: 2022-03-29T12:30:50.000Z
CVE-2022-28138 
A cross-site request forgery (CSRF) vulnerability in Jenkins RocketChat Notifier Plugin 1.4.10 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credential.
Affected products: vendor: Jenkins project
product: Jenkins RocketChat Notifier Plugin
Published: 2022-03-29T12:30:51.000Z
CVE-2022-28139 
A missing permission check in Jenkins RocketChat Notifier Plugin 1.4.10 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials.
Affected products: vendor: Jenkins project
product: Jenkins RocketChat Notifier Plugin
Published: 2022-03-29T12:30:53.000Z
CVE-2022-28140 
Jenkins Flaky Test Handler Plugin 1.2.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
Affected products: vendor: Jenkins project
product: Jenkins Flaky Test Handler Plugin
Published: 2022-03-29T12:30:55.000Z
CVE-2022-28141 
Jenkins Proxmox Plugin 0.5.0 and earlier stores the Proxmox Datacenter password unencrypted in the global config.xml file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.
Affected products: vendor: Jenkins project
product: Jenkins Proxmox Plugin
Published: 2022-03-29T12:30:56.000Z
CVE-2022-28142 
Jenkins Proxmox Plugin 0.6.0 and earlier disables SSL/TLS certificate validation globally for the Jenkins controller JVM when configured to ignore SSL/TLS issues.
Affected products: vendor: Jenkins project
product: Jenkins Proxmox Plugin
Published: 2022-03-29T12:30:58.000Z
CVE-2022-28143 
A cross-site request forgery (CSRF) vulnerability in Jenkins Proxmox Plugin 0.7.0 and earlier allows attackers to connect to an attacker-specified host using attacker-specified username and password (perform a connection test), disable SSL/TLS validation for the entire Jenkins controller JVM as part of the connection test (see CVE-2022-28142), and test a rollback with attacker-specified parameters.
Affected products: vendor: Jenkins project
product: Jenkins Proxmox Plugin
Published: 2022-03-29T12:30:59.000Z
CVE-2022-28144 
Jenkins Proxmox Plugin 0.7.0 and earlier does not perform a permission check in several HTTP endpoints, allowing attackers with Overall/Read permission to connect to an attacker-specified host using attacker-specified username and password (perform a connection test), disable SSL/TLS validation for the entire Jenkins controller JVM as part of the connection test (see CVE-2022-28142), and test a rollback with attacker-specified parameters.
Affected products: vendor: Jenkins project
product: Jenkins Proxmox Plugin
Published: 2022-03-29T12:31:01.000Z
CVE-2022-28145 
Jenkins Continuous Integration with Toad Edge Plugin 2.3 and earlier does not apply Content-Security-Policy headers to report files it serves, resulting in a stored cross-site scripting (XSS) exploitable by attackers with Item/Configure permission or otherwise able to control report contents.
Affected products: vendor: Jenkins project
product: Jenkins Continuous Integration with Toad Edge Plugin
Published: 2022-03-29T12:31:03.000Z
CVE-2022-28146 
Jenkins Continuous Integration with Toad Edge Plugin 2.3 and earlier allows attackers with Item/Configure permission to read arbitrary files on the Jenkins controller by specifying an input folder on the Jenkins controller as a parameter to its build steps.
Affected products: vendor: Jenkins project
product: Jenkins Continuous Integration with Toad Edge Plugin
Published: 2022-03-29T12:31:05.000Z
CVE-2022-28147 
A missing permission check in Jenkins Continuous Integration with Toad Edge Plugin 2.3 and earlier allows attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system.
Affected products: vendor: Jenkins project
product: Jenkins Continuous Integration with Toad Edge Plugin
Published: 2022-03-29T12:31:07.000Z
CVE-2022-28148 
The file browser in Jenkins Continuous Integration with Toad Edge Plugin 2.3 and earlier may interpret some paths to files as absolute on Windows, resulting in a path traversal vulnerability allowing attackers with Item/Read permission to obtain the contents of arbitrary files on Windows controllers.
Affected products: vendor: Jenkins project
product: Jenkins Continuous Integration with Toad Edge Plugin
Published: 2022-03-29T12:31:08.000Z
CVE-2022-28149 
Jenkins Job and Node ownership Plugin 0.13.0 and earlier does not escape the names of the secondary owners, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
Affected products: vendor: Jenkins project
product: Jenkins Job and Node ownership Plugin
Published: 2022-03-29T12:31:10.000Z
CVE-2022-28150 
A cross-site request forgery (CSRF) vulnerability in Jenkins Job and Node ownership Plugin 0.13.0 and earlier allows attackers to change the owners and item-specific permissions of a job.
Affected products: vendor: Jenkins project
product: Jenkins Job and Node ownership Plugin
Published: 2022-03-29T12:31:11.000Z
CVE-2022-28151 
A missing permission check in Jenkins Job and Node ownership Plugin 0.13.0 and earlier allows attackers with Item/Read permission to change the owners and item-specific permissions of a job.
Affected products: vendor: Jenkins project
product: Jenkins Job and Node ownership Plugin
Published: 2022-03-29T12:31:13.000Z
CVE-2022-28152 
A cross-site request forgery (CSRF) vulnerability in Jenkins Job and Node ownership Plugin 0.13.0 and earlier allows attackers to restore the default ownership of a job.
Affected products: vendor: Jenkins project
product: Jenkins Job and Node ownership Plugin
Published: 2022-03-29T12:31:14.000Z
CVE-2022-28153 
Jenkins SiteMonitor Plugin 0.6 and earlier does not escape URLs of sites to monitor in tooltips, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
Affected products: vendor: Jenkins project
product: Jenkins SiteMonitor Plugin
Published: 2022-03-29T12:31:16.000Z
CVE-2022-28154 
Jenkins Coverage/Complexity Scatter Plot Plugin 1.1.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
Affected products: vendor: Jenkins project
product: Jenkins Coverage/Complexity Scatter Plot Plugin
Published: 2022-03-29T12:31:18.000Z
CVE-2022-28155 
Jenkins Pipeline: Phoenix AutoTest Plugin 1.3 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
Affected products: vendor: Jenkins project
product: Jenkins Pipeline: Phoenix AutoTest Plugin
Published: 2022-03-29T12:31:19.000Z
CVE-2022-28156 
Jenkins Pipeline: Phoenix AutoTest Plugin 1.3 and earlier allows attackers with Item/Configure permission to copy arbitrary files and directories from the Jenkins controller to the agent workspace.
Affected products: vendor: Jenkins project
product: Jenkins Pipeline: Phoenix AutoTest Plugin
Published: 2022-03-29T12:31:21.000Z
CVE-2022-28157 
Jenkins Pipeline: Phoenix AutoTest Plugin 1.3 and earlier allows attackers with Item/Configure permission to upload arbitrary files from the Jenkins controller via FTP to an attacker-specified FTP server.
Affected products: vendor: Jenkins project
product: Jenkins Pipeline: Phoenix AutoTest Plugin
Published: 2022-03-29T12:31:22.000Z
CVE-2022-28158 
A missing permission check in Jenkins Pipeline: Phoenix AutoTest Plugin 1.3 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
Affected products: vendor: Jenkins project
product: Jenkins Pipeline: Phoenix AutoTest Plugin
Published: 2022-03-29T12:31:24.000Z
CVE-2022-28159 
Jenkins Tests Selector Plugin 1.3.3 and earlier does not escape the Properties File Path option for Choosing Tests parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
Affected products: vendor: Jenkins project
product: Jenkins Tests Selector Plugin
Published: 2022-03-29T12:31:25.000Z
CVE-2022-28160 
Jenkins Tests Selector Plugin 1.3.3 and earlier allows users with Item/Configure permission to read arbitrary files on the Jenkins controller.
Affected products: vendor: Jenkins project
product: Jenkins Tests Selector Plugin
Published: 2022-03-29T12:31:27.000Z
CVE-2022-28161 
An information exposure through log file vulnerability in Brocade SANNav versions before Brocade SANnav 2.2.0 could allow an authenticated, local attacker to view sensitive information such as ssh passwords in filetansfer.log in debug mode. To exploit this vulnerability, the attacker would need to have valid user credentials and turn on debug mode.
Problem types: description: Exposure of Sensitive Information
Affected products: vendor: n/a
product: Brocade SANNav
Published: 2022-05-09T16:33:41.000Z
CVE-2022-28162 
Brocade SANnav before version SANnav 2.2.0 logs the REST API Authentication token in plain text.
Problem types: description: Cleartext Transmission of Sensitive Information
Affected products: vendor: n/a
product: Brocade SANNav
Published: 2022-05-09T16:31:49.000Z
CVE-2022-28163 
In Brocade SANnav before Brocade SANnav 2.2.0, multiple endpoints associated with Zone management are susceptible to SQL injection, allowing an attacker to run arbitrary SQL commands.
Problem types: description: SQL Injection
Affected products: vendor: n/a
product: Brocade SANNav
Published: 2022-05-06T16:01:38.000Z
CVE-2022-28164 
Brocade SANnav before SANnav 2.2.0 application uses the Blowfish symmetric encryption algorithm for the storage of passwords. This could allow an authenticated attacker to decrypt stored account passwords.
Problem types: description: Inadequate Encryption Strength
Affected products: vendor: n/a
product: Brocade SANNav
Published: 2022-05-06T16:01:05.000Z
CVE-2022-28165 
A vulnerability in the role-based access control (RBAC) functionality of the Brocade SANNav before 2.2.0 could allow an authenticated, remote attacker to access resources that they should not be able to access and perform actions that they should not be able to perform. The vulnerability exists because restrictions are not performed on Server side to ensure the user has required permission before processing requests.
Problem types: description: Improper Access Control
Affected products: vendor: n/a
product: Brocade SANNav
Published: 2022-05-06T16:08:34.000Z
CVE-2022-28166 
In Brocade SANnav version before SANN2.2.0.2 and Brocade SANNav before 2.1.1.8, the implementation of TLS/SSL Server Supports the Use of Static Key Ciphers (ssl-static-key-ciphers) on ports 443 & 18082.
Problem types: description: Inadequate Encryption Strength
Affected products: vendor: n/a
product: Brocade SANnav
Published: 2022-06-27T17:51:51.000Z
CVE-2022-28167 
Brocade SANnav before Brocade SANvav v. 2.2.0.2 and Brocade SANanv v.2.1.1.8 logs the Brocade Fabric OS switch password in plain text in asyncjobscheduler-manager.log
Problem types: description: Plaintext Storage of a Password
Affected products: vendor: n/a
product: Brocade SANnav
Published: 2022-06-27T17:51:56.000Z
CVE-2022-28168 
In Brocade SANnav before Brocade SANnav v2.2.0.2 and Brocade SANnav2.1.1.8, encoded scp-server passwords are stored using Base64 encoding, which could allow an attacker able to access log files to easily decode the passwords.
Problem types: description: Inadequate Encryption Strength.
Affected products: vendor: n/a
product: Brocade SANnav
Published: 2022-06-27T17:52:02.000Z
CVE-2022-28169 
Brocade Webtools in Brocade Fabric OS versions before Brocade Fabric OS versions v9.1.1, v9.0.1e, and v8.2.3c could allow a low privilege webtools, user, to gain elevated admin rights, or privileges, beyond what is intended or entitled for that user. By exploiting this vulnerability, a user whose role is not an admin can create a new user with an admin role using the operator session id. The issue was replicated after intercepting the admin, and operator authorization headers sent unencrypted and editing a user addition request to use the operator's authorization header.
Problem types: description: Privilege escalation
Affected products: vendor: n/a
product: Brocade Fabric OS
Published: 2022-10-25T00:00:00.000Z
CVE-2022-28170 
Brocade Fabric OS Web Application services before Brocade Fabric v9.1.0, v9.0.1e, v8.2.3c, v7.4.2j store server and user passwords in the debug statements. This could allow a local user to extract the passwords from a debug file.
Problem types: description: Insertion of Sensitive Information Into Debugging Code
Affected products: vendor: n/a
product: Brocade Fabric OS
Published: 2022-10-25T00:00:00.000Z
CVE-2022-28171 
The web module in some Hikvision Hybrid SAN/Cluster Storage products have the following security vulnerability. Due to the insufficient input validation, attacker can exploit the vulnerability to execute restricted commands by sending messages with malicious commands to the affected device.
Problem types: cwe_id: CWE-78
description: CWE-78 OS Command Injection
Affected products: vendor: hikvision
product: DS-A71024/48/72R,DS-A80624S,DS-A81016S,DS-A72024/72R,DS-A80316S,DS-A82024D
vendor: hikvision
product: DS-A71024/48R-CVS,DS-A72024/48R-CVS
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
Credits: lang: en
value: Thurein Soe
Published: 2022-06-27T17:48:51.569Z
CVE-2022-28172 
The web module in some Hikvision Hybrid SAN/Cluster Storage products have the following security vulnerability. Due to the insufficient input validation, attacker can exploit the vulnerability to XSS attack by sending messages with malicious commands to the affected device.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: hikvision
product: DS-A71024/48/72R,DS-A80624S,DS-A81016S,DS-A72024/72R,DS-A80316S,DS-A82024D
vendor: hikvision
product: DS-A71024/48R-CVS,DS-A72024/48R-CVS
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
Credits: lang: en
value: Thurein Soe
Published: 2022-06-27T17:50:40.922Z