rainbutterfly/cve_corpus huggingface dataset:
CVE-2023-2972 Prototype Pollution in antfu/utils
Prototype Pollution in GitHub repository antfu/utils prior to 0.7.3.
Problem types: cwe_id: CWE-1321
description: CWE-1321 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Affected products: vendor: antfu
product: antfu/utils
Published: 2023-05-30T00:00:00.000Z
CVE-2023-2973 SourceCodester Students Online Internship Timesheet Syste cross site scripting
A vulnerability, which was classified as problematic, has been found in SourceCodester Students Online Internship Timesheet Syste 1.0. Affected by this issue is some unknown functionality of the file /ajax.php?action=save_company. The manipulation of the argument name with the input <script>alert(document.cookie)</script> leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-230204.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross Site Scripting
Affected products: vendor: SourceCodester
product: Students Online Internship Timesheet Syste
CVSS v3.1: version: 3.1
baseScore: 2.4
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N
baseSeverity: LOW
Credits: lang: en
value: shallowdream (VulDB User)
Published: 2023-05-30T10:31:02.680Z
CVE-2023-2974 Quarkus-core: tls protocol configured with quarkus.http.ssl.protocols is not enforced, client can enforce weaker supported tls protocol
A vulnerability was found in quarkus-core. This vulnerability occurs because the TLS protocol configured with quarkus.http.ssl.protocols is not enforced, and the client can force the selection of the weaker supported TLS protocol.
Problem types: cwe_id: CWE-757
description: Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade')
Affected products: vendor: Red Hat
product: Red Hat build of Quarkus 2.13.8.Final
cpes: cpe:/a:redhat:quarkus:2.13
default_status: affected
vendor: Red Hat
product: Red Hat build of Quarkus 2.13.8.Final
cpes: cpe:/a:redhat:quarkus:2.13
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
version: 3.1
Credits: lang: en
value: This issue was discovered by Alexander Schwartz (Red Hat).
Published: 2023-07-04T13:24:29.648Z
CVE-2023-2975 AES-SIV implementation ignores empty associated data entries
Issue summary: The AES-SIV cipher implementation contains a bug that causes
it to ignore empty associated data entries which are unauthenticated as
a consequence.

Impact summary: Applications that use the AES-SIV algorithm and want to
authenticate empty data entries as associated data can be misled by removing,
adding or reordering such empty entries as these are ignored by the OpenSSL
implementation. We are currently unaware of any such applications.

The AES-SIV algorithm allows for authentication of multiple associated
data entries along with the encryption. To authenticate empty data the
application has to call EVP_EncryptUpdate() (or EVP_CipherUpdate()) with
NULL pointer as the output buffer and 0 as the input buffer length.
The AES-SIV implementation in OpenSSL just returns success for such a call
instead of performing the associated data authentication operation.
The empty data thus will not be authenticated.

As this issue does not affect non-empty associated data authentication and
we expect it to be rare for an application to use empty associated data
entries this is qualified as Low severity issue.
Problem types: cwe_id: CWE-354
description: CWE-354 Improper Validation of Integrity Check Value
Affected products: vendor: OpenSSL
product: OpenSSL
default_status: unaffected
Credits: lang: en
value: Juerg Wullschleger (Google)
lang: en
value: Tomas Mraz
Published: 2023-07-14T11:16:25.151Z
CVE-2023-2976 Use of temporary directory for file creation in `FileBackedOutputStream` in Guava
Use of Java's default temporary directory for file creation in `FileBackedOutputStream` in Google Guava versions 1.0 to 31.1 on Unix systems and Android Ice Cream Sandwich allows other users and apps on the machine with access to the default Java temporary directory to be able to access the files created by the class.

Even though the security vulnerability is fixed in version 32.0.0, we recommend using version 32.0.1 as version 32.0.0 breaks some functionality under Windows.
Problem types: description: Creation of Temporary File With Insecure Permissions
Affected products: vendor: Google
product: Guava
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 5.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2023-06-14T17:36:40.640Z
CVE-2023-2977 
A vulnerbility was found in OpenSC. This security flaw cause a buffer overrun vulnerability in pkcs15 cardos_have_verifyrc_package. The attacker can supply a smart card package with malformed ASN1 context. The cardos_have_verifyrc_package function scans the ASN1 buffer for 2 tags, where remaining length is wrongly caculated due to moved starting pointer. This leads to possible heap-based buffer oob read. In cases where ASAN is enabled while compiling this causes a crash. Further info leak or more damage is possible.
Problem types: cwe_id: CWE-119
description: CWE-119
Affected products: vendor: n/a
product: OpenSC
Published: 2023-06-01T00:00:00.000Z
CVE-2023-2978 Abstrium Pydio Cells Change Subscription authorization
A vulnerability was found in Abstrium Pydio Cells 4.2.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the component Change Subscription Handler. The manipulation leads to authorization bypass. The exploit has been disclosed to the public and may be used. Upgrading to version 4.2.1 is able to address this issue. It is recommended to upgrade the affected component. VDB-230210 is the identifier assigned to this vulnerability.
Problem types: cwe_id: CWE-639
description: CWE-639 Authorization Bypass
Affected products: vendor: Abstrium
product: Pydio Cells
CVSS v3.1: version: 3.1
baseScore: 4.6
vectorString: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: ignatiusmichael (VulDB User)
Published: 2023-05-30T14:00:05.299Z
CVE-2023-2979 Abstrium Pydio Cells User Creation access control
A vulnerability classified as critical has been found in Abstrium Pydio Cells 4.2.0. This affects an unknown part of the component User Creation Handler. The manipulation leads to improper access controls. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.2.1 is able to address this issue. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-230211.
Problem types: cwe_id: CWE-284
description: CWE-284 Improper Access Controls
Affected products: vendor: Abstrium
product: Pydio Cells
CVSS v3.1: version: 3.1
baseScore: 4.7
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: ignatiusmichael (VulDB User)
Published: 2023-05-30T14:00:06.300Z
CVE-2023-2980 Abstrium Pydio Cells User Creation resource injection
A vulnerability classified as critical was found in Abstrium Pydio Cells 4.2.0. This vulnerability affects unknown code of the component User Creation Handler. The manipulation leads to improper control of resource identifiers. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.2.1 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-230212.
Problem types: cwe_id: CWE-99
description: CWE-99 Improper Control of Resource Identifiers
Affected products: vendor: Abstrium
product: Pydio Cells
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: ignatiusmichael (VulDB User)
Published: 2023-05-30T14:31:03.238Z
CVE-2023-2981 Abstrium Pydio Cells Chat cross site scripting
A vulnerability, which was classified as problematic, has been found in Abstrium Pydio Cells 4.2.0. This issue affects some unknown processing of the component Chat. The manipulation leads to basic cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.2.1 is able to address this issue. It is recommended to upgrade the affected component. The identifier VDB-230213 was assigned to this vulnerability.
Problem types: cwe_id: CWE-80
description: CWE-80 Basic Cross Site Scripting
Affected products: vendor: Abstrium
product: Pydio Cells
CVSS v3.1: version: 3.1
baseScore: 3.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
baseSeverity: LOW
Credits: lang: en
value: ignatiusmichael (VulDB User)
Published: 2023-05-30T15:00:04.651Z
CVE-2023-2982 WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) <= 7.6.4 - Authentication Bypass
The WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 7.6.4. This is due to insufficient encryption on the user being supplied during a login validated through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they know the email address associated with that user. This was partially patched in version 7.6.4 and fully patched in version 7.6.5.
Problem types: cwe_id: CWE-288
description: CWE-288 Authentication Bypass Using an Alternate Path or Channel
Affected products: vendor: cyberlord92
product: miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn)
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
baseScore: 9.8
baseSeverity: CRITICAL
Credits: lang: en
value: István Márton
Published: 2023-06-29T01:56:56.207Z
CVE-2023-2983 Privilege Defined With Unsafe Actions in pimcore/pimcore
Privilege Defined With Unsafe Actions in GitHub repository pimcore/pimcore prior to 10.5.23.
Problem types: cwe_id: CWE-267
description: CWE-267 Privilege Defined With Unsafe Actions
Affected products: vendor: pimcore
product: pimcore/pimcore
Published: 2023-05-30T00:00:00.000Z
CVE-2023-2984 Path Traversal: '\..\filename' in pimcore/pimcore
Path Traversal: '\..\filename' in GitHub repository pimcore/pimcore prior to 10.5.22.
Problem types: cwe_id: CWE-29
description: CWE-29 Path Traversal: '\..\filename'
Affected products: vendor: pimcore
product: pimcore/pimcore
Published: 2023-05-30T00:00:00.000Z
CVE-2023-2985 
A use after free flaw was found in hfsplus_put_super in fs/hfsplus/super.c in the Linux Kernel. This flaw could allow a local user to cause a denial of service problem.
Problem types: cwe_id: CWE-416
description: CWE-416
Affected products: vendor: n/a
product: Kernel
Published: 2023-06-01T00:00:00.000Z
CVE-2023-2986 Abandoned Cart Lite for WooCommerce <= 5.15.1 - Authentication Bypass
The Abandoned Cart Lite for WooCommerce plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.14.2. This is due to insufficient encryption on the user being supplied during the abandoned cart link decode through the plugin. This allows unauthenticated attackers to log in as users who have abandoned the cart, who are typically customers. Further security hardening was introduced in version 5.15.1 that ensures sites are no longer vulnerable through historical check-out links, and additional hardening was introduced in version 5.15.2 that ensured null key values wouldn't permit the authentication bypass.
Problem types: cwe_id: CWE-288
description: CWE-288 Authentication Bypass Using an Alternate Path or Channel
Affected products: vendor: tychesoftwares
product: Abandoned Cart Lite for WooCommerce
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
baseScore: 9.8
baseSeverity: CRITICAL
Credits: lang: en
value: István Márton
lang: en
value: Ayan Saha
Published: 2023-06-08T01:56:22.856Z
CVE-2023-2987 Wordapp <= 1.6.0 - Authorization Bypass through Use of Insufficiently Unique Cryptographic Signature
The Wordapp plugin for WordPress is vulnerable to authorization bypass due to an use of insufficiently unique cryptographic signature on the 'wa_pdx_op_config_set' function in versions up to, and including, 1.6.0. This makes it possible for unauthenticated attackers to the plugin to change the 'validation_token' in the plugin config, providing access to the plugin's remote control functionalities, such as creating an admin access URL, which can be used for privilege escalation.
Problem types: cwe_id: CWE-345
description: CWE-345 Insufficient Verification of Data Authenticity
Affected products: vendor: wordapp
product: Wordapp
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
baseScore: 9.8
baseSeverity: CRITICAL
Credits: lang: en
value: István Márton
Published: 2023-05-31T02:40:20.868Z
CVE-2023-2989 Fortra Globalscape Administration Server Out of Bounds Memory Read
Fortra Globalscape EFT versions before 8.1.0.16 suffer from an out of bounds memory read in their administration server, which can allow an attacker to crash the service or bypass authentication if successfully exploited

Problem types: cwe_id: CWE-125
description: CWE-125 Out-of-bounds Read
Affected products: vendor: Fortra
product: Globalscape EFT
default_status: unaffected
Published: 2023-06-22T19:14:17.275Z
CVE-2023-2990 Fortra Globalscape Administration Server Denial of Service
Fortra Globalscape EFT versions before 8.1.0.16 suffer from a denial of service vulnerability, where a compressed message that decompresses to itself can cause infinite recursion and crash the service

Problem types: cwe_id: CWE-400
description: CWE-400 Uncontrolled Resource Consumption
Affected products: vendor: Fortra
product: Globalscape EFT
default_status: unaffected
Published: 2023-06-22T19:17:28.531Z
CVE-2023-2991 Fortra Globalscape Administration Server Information Disclosure
Fortra Globalscape EFT's administration server suffers from an information disclosure vulnerability where the serial number of the harddrive that Globalscape is installed on can be remotely determined via a "trial extension request" message

Problem types: cwe_id: CWE-200
description: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: Fortra
product: Globalscape EFT
default_status: unaffected
Published: 2023-06-22T19:22:24.434Z
CVE-2023-2992 
An unauthenticated  denial of service vulnerability exists in the SMM v1, SMM v2, and FPC management web server which can be triggered under crafted conditions.  Rebooting SMM or FPC will restore access to the management web server.
Problem types: cwe_id: CWE-405
description: CWE-405: Asymmetric Resource Consumption (Amplification)
Affected products: vendor: Lenovo
product: System Management Module (SMM)
default_status: unaffected
vendor: Lenovo
product: Fan Power Controller (FPC)
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2023-06-26T19:44:40.121Z
CVE-2023-2993 
A valid, authenticated user with limited privileges may be able to use specifically crafted web management server API calls to execute a limited number of commands on SMM v1, SMM v2, and FPC that the user does not normally have sufficient privileges to execute.
Problem types: cwe_id: CWE-281
description: CWE-281 Improper Preservation of Permissions
Affected products: vendor: Lenovo
product: System Management Module (SMM) 
default_status: unaffected
vendor: Lenovo
product: Fan Power Controller (FPC)
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
version: 3.1
Published: 2023-06-26T19:44:50.040Z
CVE-2023-2995 Leyka < 3.30.4 - Admin+ Stored XSS
The Leyka WordPress plugin before 3.30.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Leyka
default_status: unaffected
Credits: lang: en
value: An Dang
lang: en
value: WPScan
Published: 2023-09-19T19:37:08.838Z
CVE-2023-2996 Jetpack < 12.1.1 - Author+ Arbitrary File Manipulation via API
The Jetpack WordPress plugin before 12.1.1 does not validate uploaded files, allowing users with author roles or above to manipulate existing files on the site, deleting arbitrary files, and in rare cases achieve Remote Code Execution via phar deserialization.
Problem types: description: CWE-20 Improper Input Validation
Affected products: vendor: Unknown
product: Jetpack
default_status: unaffected
Credits: lang: en
value: Miguel Neto
lang: en
value: WPScan
Published: 2023-06-27T13:17:07.479Z
CVE-2023-2998 Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.14.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: thorsten
product: thorsten/phpmyfaq
Published: 2023-05-31T00:00:00.000Z
CVE-2023-2999 Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.14.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: thorsten
product: thorsten/phpmyfaq
Published: 2023-05-31T00:00:00.000Z
CVE-2023-30013 
TOTOLINK X5000R V9.1.0u.6118_B20201102 and V9.1.0u.6369_B20230113 contain a command insertion vulnerability in setting/setTracerouteCfg. This vulnerability allows an attacker to execute arbitrary commands through the "command" parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-05T00:00:00.000Z
CVE-2023-30014 
SQL Injection vulnerability in oretnom23 Judging Management System v1.0, allows remote attackers to execute arbitrary code and obtain sensitive information via sub_event_id parameter in sub_event_stat_update.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-01-12T00:00:00.000Z
CVE-2023-30015 
SQL Injection vulnerability in oretnom23 Judging Management System v1.0, allows remote attackers to execute arbitrary code and obtain sensitive information via txtsearch parameter in review_search.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-01-12T00:00:00.000Z
CVE-2023-30016 
SQL Injection vulnerability in oretnom23 Judging Management System v1.0, allows remote attackers to execute arbitrary code and obtain sensitive information via sub_event_id parameter in sub_event_details_edit.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-01-12T00:00:00.000Z
CVE-2023-30018 
Judging Management System v1.0 is vulnerable to SQL Injection. via /php-jms/review_se_result.php?mainevent_id=.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-08T00:00:00.000Z
CVE-2023-30019 
imgproxy <=3.14.0 is vulnerable to Server-Side Request Forgery (SSRF) due to a lack of sanitization of the imageURL parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-08T00:00:00.000Z
CVE-2023-30024 
The MagicJack device, a VoIP solution for internet phone calls, contains a hidden NAND flash memory partition allowing unauthorized read/write access. Attackers can exploit this by replacing the original software with a malicious version, leading to ransomware deployment on the host computer. Affected devices have firmware versions prior to magicJack A921 USB Phone Jack Rev 3.0 V1.4.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-28T00:00:00.000Z
CVE-2023-30053 
TOTOLINK A7100RU V7.4cu.2313_B20191024 is vulnerable to Command Injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-05T00:00:00.000Z
CVE-2023-30054 
TOTOLINK A7100RU V7.4cu.2313_B20191024 has a Command Injection vulnerability. An attacker can obtain a stable root shell through a specially constructed payload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-05T00:00:00.000Z
CVE-2023-30056 
A session takeover vulnerability exists in FICO Origination Manager Decision Module 4.8.1 due to insufficient protection of the JSESSIONID cookie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-09T00:00:00.000Z
CVE-2023-30057 
Multiple stored cross-site scripting (XSS) vulnerabilities in FICO Origination Manager Decision Module 4.8.1 allow attackers to execute arbitrary web scripts or HTML via a crafted payload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-09T00:00:00.000Z
CVE-2023-30058 
novel-plus 3.6.2 is vulnerable to SQL Injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-11T00:00:00.000Z
CVE-2023-30059 
An insecure direct object reference in MK-Auth 23.01K4.9 allows attackers to access and send support calls for other users via manipulation of the chamado parameter through a crafted GET request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-05-12T00:00:00.000Z
CVE-2023-30061 
D-Link DIR-879 v105A1 is vulnerable to Authentication Bypass via phpcgi.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-01T00:00:00.000Z
CVE-2023-30063 
D-Link DIR-890L FW1.10 A1 is vulnerable to Authentication bypass.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-01T00:00:00.000Z
CVE-2023-30065 
MitraStar GPT-2741GNAC-N2 with firmware BR_g5.9_1.11(WVK.0)b32 was discovered to contain a remote code execution (RCE) vulnerability in the ping function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-05T00:00:00.000Z
CVE-2023-30076 
Sourcecodester Judging Management System v1.0 is vulnerable to SQL Injection via /php-jms/print_judges.php?print_judges.php=&se_name=&sub_event_id=.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-20T00:00:00.000Z
CVE-2023-30077 
Judging Management System v1.0 by oretnom23 was discovered to vulnerable to SQL injection via /php-jms/review_result.php?mainevent_id=, mainevent_id.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-04T00:00:00.000Z
CVE-2023-30082 
A denial of service attack might be launched against the server if an unusually lengthy password (more than 10000000 characters) is supplied using the osTicket application. This can cause the website to go down or stop responding. When a long password is entered, this procedure will consume all available CPU and memory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-06-14T00:00:00.000Z