rainbutterfly/cve_corpus huggingface dataset:
CVE-2023-3064 Mobatime mobile application - Sensitive information disclosure
Anonymous user may get the list of existing users managed by the application, that could ease further attacks (see CVE-2023-3065 and 3066)This issue affects Mobatime mobile application AMXGT100 through 1.3.20.


Problem types: cwe_id: CWE-200
description: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: Mobatime
product: Mobatime mobile application AMXGT100
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: testeurdestylos
Published: 2023-06-05T08:24:53.735Z
CVE-2023-3065 Mobatime mobile application - Authentication bypass
Improper Authentication vulnerability in Mobatime mobile application AMXGT100 allows Authentication Bypass.This issue affects Mobatime mobile application AMXGT100 through 1.3.20.


Problem types: cwe_id: CWE-287
description: CWE-287 Improper Authentication
Affected products: vendor: Mobatime
product: Mobatime mobile application AMXGT100
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 9.1
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
version: 3.1
Credits: lang: en
value: testeurdestylos
Published: 2023-06-05T08:27:33.950Z
CVE-2023-3066 Mobatime mobile application - Broken authorisation
Incorrect Authorization vulnerability in Mobatime mobile application AMXGT100 allows a low-privileged user to impersonate anyone else, including administratorsThis issue affects Mobatime mobile application AMXGT100: through 1.3.20.


Problem types: cwe_id: CWE-863
description: CWE-863 Incorrect Authorization
Affected products: vendor: Mobatime
product: Mobatime mobile application AMXGT100
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 8.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
version: 3.1
Credits: lang: en
value: testeurdestylos
Published: 2023-06-05T08:27:49.960Z
CVE-2023-3067 Cross-site Scripting (XSS) - Stored in zadam/trilium
Cross-site Scripting (XSS) - Stored in GitHub repository zadam/trilium prior to 0.59.4.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: zadam
product: zadam/trilium
Published: 2023-06-02T00:00:00.000Z
CVE-2023-3068 Campcodes Retro Cellphone Online Store modal_add_product.php sql injection
A vulnerability classified as critical has been found in Campcodes Retro Cellphone Online Store 1.0. Affected is an unknown function of the file /admin/modal_add_product.php. The manipulation of the argument category leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-230580.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Campcodes
product: Retro Cellphone Online Store
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: wenqifeng (VulDB User)
Published: 2023-06-02T15:31:03.441Z
CVE-2023-3069 Unverified Password Change in tsolucio/corebos
Unverified Password Change in GitHub repository tsolucio/corebos prior to 8.
Problem types: cwe_id: CWE-620
description: CWE-620 Unverified Password Change
Affected products: vendor: tsolucio
product: tsolucio/corebos
Published: 2023-06-02T00:00:00.000Z
CVE-2023-3070 Cross-site Scripting (XSS) - Stored in tsolucio/corebos
Cross-site Scripting (XSS) - Stored in GitHub repository tsolucio/corebos prior to 8.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: tsolucio
product: tsolucio/corebos
Published: 2023-06-02T00:00:00.000Z
CVE-2023-3071 Cross-site Scripting (XSS) - Stored in tsolucio/corebos
Cross-site Scripting (XSS) - Stored in GitHub repository tsolucio/corebos prior to 8.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: tsolucio
product: tsolucio/corebos
Published: 2023-06-02T00:00:00.000Z
CVE-2023-3072 Nomad ACL Policies without Label are Applied to Unexpected Resources
HashiCorp Nomad and Nomad Enterprise 0.7.0 up to 1.5.6 and 1.4.10 ACL policies using a block without a label generates unexpected results. Fixed in 1.6.0, 1.5.7, and 1.4.11.
Problem types: cwe_id: CWE-266
description: CWE-266: Incorrect Privilege Assignment
Affected products: vendor: HashiCorp
product: Nomad
default_status: unaffected
vendor: HashiCorp
product: Nomad Enterprise
default_status: unaffected
CVSS v3.1: baseScore: 4.1
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:L
version: 3.1
Published: 2023-07-19T23:34:56.155Z
CVE-2023-3073 Cross-site Scripting (XSS) - Stored in tsolucio/corebos
Cross-site Scripting (XSS) - Stored in GitHub repository tsolucio/corebos prior to 8 via evvtgendoc.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: tsolucio
product: tsolucio/corebos
Published: 2023-06-02T00:00:00.000Z
CVE-2023-3074 Cross-site Scripting (XSS) - Stored in tsolucio/corebos
Cross-site Scripting (XSS) - Stored in GitHub repository tsolucio/corebos prior to 8.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: tsolucio
product: tsolucio/corebos
Published: 2023-06-02T00:00:00.000Z
CVE-2023-3075 Cross-Site Request Forgery (CSRF) in tsolucio/corebos
Cross-Site Request Forgery (CSRF) in GitHub repository tsolucio/corebos prior to 8.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: tsolucio
product: tsolucio/corebos
Published: 2023-06-02T00:00:00.000Z
CVE-2023-3076 MStore API < 3.9.9 - Unauthenticated Privilege Escalation
The MStore API WordPress plugin before 3.9.9 does not prevent visitors from creating user accounts with the role of their choice via their wholesale REST API endpoint. This is only exploitable if the site owner paid to access the plugin's pro features.
Problem types: description: CWE-862 Missing Authorization
Affected products: vendor: Unknown
product: MStore API
default_status: unaffected
Credits: lang: en
value: Truoc Phan
lang: en
value: WPScan
Published: 2023-07-10T12:40:16.209Z
CVE-2023-3077 MStore API < 3.9.8 - Unauthenticated Blind SQLi
The MStore API WordPress plugin before 3.9.8 does not sanitise and escape a parameter before using it in a SQL statement, leading to a Blind SQL injection exploitable by unauthenticated users. This is only exploitable if the site owner elected to pay to get access to the plugins' pro features, and uses the woocommerce-appointments plugin.
Problem types: description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: MStore API
default_status: unaffected
Credits: lang: en
value: Truoc Phan
lang: en
value: WPScan
Published: 2023-07-10T12:40:19.779Z
CVE-2023-3078 
An uncontrolled search path vulnerability was reported in the Lenovo Universal Device Client (UDC) that could allow an attacker with local access to execute code with elevated privileges.
Problem types: cwe_id: CWE-427
description: CWE-427 Uncontrolled Search Path Element
Affected products: vendor: Lenovo
product: Universal Device Client (UDC)
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Lenovo thanks Jérôme TCHAN from the Offensive Security Center of Deloitte France for reporting this issue. 
Published: 2023-08-17T16:47:36.274Z
CVE-2023-3079 
Type confusion in V8 in Google Chrome prior to 114.0.5735.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Problem types: description: Type Confusion
Affected products: vendor: Google
product: Chrome
Published: 2023-06-05T21:40:06.622Z
CVE-2023-3080 WP Mail Catcher <= 2.1.2 - Unauthenticated Stored Cross-Site Scripting via Email Subject
The WP Mail Catcher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an email subject in versions up to, and including, 2.1.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: wardee
product: Mail logging – WP Mail Catcher
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
baseScore: 7.2
baseSeverity: HIGH
Credits: lang: en
value: Alex Thomas
Published: 2023-07-12T04:38:42.645Z
CVE-2023-3081 WP Mail Logging <= 1.11.1 - Unauthenticated Stored Cross-Site Scripting via Email
The WP Mail Logging plugin for WordPress is vulnerable to Stored Cross-Site Scripting via email contents in versions up to, and including, 1.11.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Note: An incomplete fix was released in 1.11.1.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: smub
product: WP Mail Logging
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
baseScore: 7.2
baseSeverity: HIGH
Credits: lang: en
value: Alex Thomas
Published: 2023-07-12T04:38:51.671Z
CVE-2023-3082 Post SMTP <= 2.5.7 - Unauthenticated Stored Cross-Site Scripting via Email
The Post SMTP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via email contents in versions up to, and including, 2.5.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: saadiqbal
product: Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
baseScore: 7.2
baseSeverity: HIGH
Credits: lang: en
value: Alex Thomas
Published: 2023-07-12T04:38:45.662Z
CVE-2023-3083 Cross-site Scripting (XSS) - Stored in nilsteampassnet/teampass
Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.9.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: nilsteampassnet
product: nilsteampassnet/teampass
Published: 2023-06-03T00:00:00.000Z
CVE-2023-3084 Cross-site Scripting (XSS) - Stored in nilsteampassnet/teampass
Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.9.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: nilsteampassnet
product: nilsteampassnet/teampass
Published: 2023-06-03T00:00:00.000Z
CVE-2023-3085 X-WRT luci 404 Error Template dispatcher.uc run_action cross site scripting
A vulnerability, which was classified as problematic, has been found in X-WRT luci up to 22.10_b202303061504. This issue affects the function run_action of the file modules/luci-base/ucode/dispatcher.uc of the component 404 Error Template Handler. The manipulation of the argument request_path leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 22.10_b202303121313 is able to address this issue. The patch is named 24d7da2416b9ab246825c33c213fe939a89b369c. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-230663.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross Site Scripting
Affected products: vendor: X-WRT
product: luci
CVSS v3.1: version: 3.1
baseScore: 3.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
baseSeverity: LOW
Credits: lang: en
value: VulDB GitHub Commit Analyzer
Published: 2023-06-03T10:31:02.697Z
CVE-2023-3086 Cross-site Scripting (XSS) - Stored in nilsteampassnet/teampass
Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.9.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: nilsteampassnet
product: nilsteampassnet/teampass
Published: 2023-06-03T00:00:00.000Z
CVE-2023-3087 FluentSMTP <= 2.2.4 - Unauthenticated Stored Cross-Site Scripting via Email Subject
The FluentSMTP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an email subject in versions up to, and including, 2.2.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: techjewel
product: FluentSMTP – WP SMTP Plugin with Amazon SES, SendGrid, MailGun, Postmark, Google and Any SMTP Provider
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
baseScore: 7.2
baseSeverity: HIGH
Credits: lang: en
value: Alex Thomas
Published: 2023-07-12T04:38:52.072Z
CVE-2023-3088 WP Mail Log <= 1.1.1 - Unauthenticated Stored Cross-Site Scripting via Email
The WP Mail Log plugin for WordPress is vulnerable to Stored Cross-Site Scripting via email contents in versions up to, and including, 1.1.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: wpvibes
product: WP Mail Log
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
baseScore: 7.2
baseSeverity: HIGH
Credits: lang: en
value: Alex Thomas
Published: 2023-07-12T04:38:46.572Z
CVE-2023-3089 Ocp & fips mode
A compliance problem was found in the Red Hat OpenShift Container Platform. Red Hat discovered that, when FIPS mode was enabled, not all of the cryptographic modules in use were FIPS-validated.
Problem types: cwe_id: CWE-693
description: Protection Mechanism Failure
Affected products: vendor: n/a
product: openshift
vendor: Red Hat
product: OpenShift Serverless
cpes: cpe:/a:redhat:serverless:1
default_status: affected
vendor: Red Hat
product: OpenShift Service Mesh 2.2.x
cpes: cpe:/a:redhat:service_mesh:2.2
default_status: affected
vendor: Red Hat
product: OpenShift Service Mesh 2.3.x
cpes: cpe:/a:redhat:service_mesh:2.3
default_status: affected
vendor: Red Hat
product: OpenShift Service Mesh 2.4
cpes: cpe:/a:redhat:service_mesh:2.4
default_status: affected
vendor: Red Hat
product: Red Hat Advanced Cluster Management for Kubernetes 2
cpes: cpe:/a:redhat:acm:2
default_status: affected
vendor: Red Hat
product: Red Hat JBoss A-MQ Streams
cpes: cpe:/a:redhat:amq_streams:1
default_status: affected
vendor: Red Hat
product: Red Hat OpenShift Container Platform 3.11
cpes: cpe:/a:redhat:openshift:3.11
default_status: unaffected
vendor: Red Hat
product: Red Hat OpenShift Container Platform 4
cpes: cpe:/a:redhat:openshift:4
default_status: affected
vendor: Red Hat
product: Red Hat OpenShift Container Platform 4
cpes: cpe:/a:redhat:openshift:4
default_status: affected
vendor: Red Hat
product: Red Hat OpenShift Container Platform 4
cpes: cpe:/a:redhat:openshift:4
default_status: affected
vendor: Red Hat
product: Red Hat Openshift Data Foundation 4
cpes: cpe:/a:redhat:openshift_data_foundation:4
default_status: affected
vendor: Red Hat
product: Red Hat Openshift sandboxed containers
cpes: cpe:/a:redhat:openshift_sandboxed_containers:1
default_status: affected
vendor: Red Hat
product: Red Hat OpenShift Virtualization 4
cpes: cpe:/a:redhat:container_native_virtualization:4
default_status: affected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L
version: 3.1
Credits: lang: en
value: This issue was discovered by David Benoit (Red Hat).
Published: 2023-07-05T12:21:03.036Z
CVE-2023-3090 Out-of-bounds write in Linux kernel's ipvlan network driver
A heap out-of-bounds write vulnerability in the Linux Kernel ipvlan network driver can be exploited to achieve local privilege escalation.

The out-of-bounds write is caused by missing skb->cb  initialization in the ipvlan network driver. The vulnerability is reachable if CONFIG_IPVLAN is enabled.


We recommend upgrading past commit 90cbed5247439a966b645b34eb0a2e037836ea8e.
Problem types: cwe_id: CWE-787
description: CWE-787 Out-of-bounds Write
Affected products: vendor: Linux
product: Kernel
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2023-06-28T19:06:41.221Z
CVE-2023-3091 Captura CRYPTBASE.dll uncontrolled search path
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in Captura up to 8.0.0. It has been declared as critical. This vulnerability affects unknown code in the library CRYPTBASE.dll. The manipulation leads to uncontrolled search path. Attacking locally is a requirement. The complexity of an attack is rather high. The exploitation appears to be difficult. The identifier of this vulnerability is VDB-230668. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Problem types: cwe_id: CWE-427
description: CWE-427 Uncontrolled Search Path
Affected products: vendor: n/a
product: Captura
CVSS v3.1: version: 3.1
baseScore: 7
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
baseSeverity: HIGH
Credits: lang: en
value: ignatiusmichael (VulDB User)
Published: 2023-06-03T23:31:02.994Z
CVE-2023-3092 SMTP Mail <= 1.3.46 - Unauthenticated Stored Cross-Site Scripting via Email Subject
The SMTP Mail plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an email subject in versions up to, and including, 1.3.46 due to insufficient input sanitization and output escaping when the 'Save Data SendMail' feature is enabled. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: photoboxone
product: SMTP Mail
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
baseScore: 7.2
baseSeverity: HIGH
Credits: lang: en
value: Alex Thomas
Published: 2023-07-12T04:38:47.062Z
CVE-2023-3093 YaySMTP <= 2.4.5 - Unauthenticated Stored Cross-Site Scripting via Email
The YaySMTP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via email contents in versions up to, and including, 2.4.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: yaycommerce
product: YaySMTP and Email Logs: Amazon SES, SendGrid, Outlook, Mailgun, Brevo, Google and Any SMTP Service
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
baseScore: 7.2
baseSeverity: HIGH
Credits: lang: en
value: Alex Thomas
Published: 2023-07-12T04:38:45.199Z
CVE-2023-3094 code-projects Agro-School Management System btn_functions.php doUpdateQuestion sql injection
A vulnerability classified as critical has been found in code-projects Agro-School Management System 1.0. Affected is the function doUpdateQuestion of the file btn_functions.php. The manipulation of the argument question_id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-230670 is the identifier assigned to this vulnerability.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: code-projects
product: Agro-School Management System
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: ZhangWang (VulDB User)
Published: 2023-06-04T09:00:04.748Z
CVE-2023-3095 Improper Access Control in nilsteampassnet/teampass
Improper Access Control in GitHub repository nilsteampassnet/teampass prior to 3.0.9.
Problem types: cwe_id: CWE-284
description: CWE-284 Improper Access Control
Affected products: vendor: nilsteampassnet
product: nilsteampassnet/teampass
Published: 2023-06-04T00:00:00.000Z
CVE-2023-3096 KylinSoft kylin-software-properties changedSource access control
A vulnerability was found in KylinSoft kylin-software-properties on KylinOS. It has been declared as critical. This vulnerability affects the function changedSource. The manipulation leads to improper access controls. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. Upgrading to version 0.0.1-130 is able to address this issue. It is recommended to upgrade the affected component. VDB-230686 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-284
description: CWE-284 Improper Access Controls
Affected products: vendor: KylinSoft
product: kylin-software-properties
CVSS v3.1: version: 3.1
baseScore: 5.3
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: Set3r.Pan (VulDB User)
Published: 2023-06-05T05:31:02.930Z