CVE-2022-3732

seccome Ehoney set sql injection

A vulnerability was found in seccome Ehoney and classified as critical. Affected by this issue is some unknown functionality of the file /api/v1/bait/set. The manipulation of the argument Payload leads to sql injection. The attack may be launched remotely. VDB-212414 is the identifier assigned to this vulnerability.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Ehoney Project

Products

Ehoney

CVE-2022-3733

SourceCodester Web-Based Student Clearance System edit-admin.php sql injection

A vulnerability was found in SourceCodester Web-Based Student Clearance System. It has been classified as critical. This affects an unknown part of the file Admin/edit-admin.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-212415.

CVSS 3.1 · 5 Medium EPSS < 1% KEV · Not listed

Vendors

Web-based Student Clearance System Project

Products

Web-based Student Clearance System

CVE-2022-3735

seccome Ehoney signup access control

A vulnerability was found in seccome Ehoney. It has been rated as critical. This issue affects some unknown processing of the file /api/public/signup. The manipulation leads to improper access controls. The identifier VDB-212417 was assigned to this vulnerability.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Ehoney Project

Products

Ehoney

CVE-2022-3770

Yunjing CMS upload_img.html unrestricted upload

A vulnerability classified as critical was found in Yunjing CMS. This vulnerability affects unknown code of the file /index/user/upload_img.html. The manipulation of the argument file leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-212500.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Xjyunjing

Products

Yunjing Content Management System

CVE-2022-3771

easyii CMS File Upload Management Upload.php file unrestricted upload

A vulnerability, which was classified as critical, has been found in easyii CMS. This issue affects the function file of the file helpers/Upload.php of the component File Upload Management. The manipulation leads to unrestricted upload. The attack may be initiated remotely. The identifier VDB-212501 was assigned to this vulnerability.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Easyiicms

Products

Easyiicms

CVE-2022-3774

SourceCodester Train Scheduler App resource injection

A vulnerability was found in SourceCodester Train Scheduler App 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /train_scheduler_app/?action=delete. The manipulation of the argument id leads to improper control of resource identifiers. The attack may be launched remotely. The identifier of this vulnerability is VDB-212504.

CVSS 3.1 · 5.4 Medium EPSS 1.5% KEV · Not listed

Vendors

Train Scheduler App Project

Products

Train Scheduler App

CVE-2022-3783

node-red-dashboard ui_text Format ui-component-ctrl.js cross site scripting

A vulnerability, which was classified as problematic, has been found in node-red-dashboard. This issue affects some unknown processing of the file components/ui-component/ui-component-ctrl.js of the component ui_text Format Handler. The manipulation leads to cross site scripting. The attack may be initiated remotely. The name of the patch is 9305d1a82f19b235dfad24a7d1dd4ed244db7743. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-212555.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed

Vendors

Nodered

Products

Node-red-dashboard

CVE-2022-3784

Axiomatic Bento4 mp4hls Ap4Mp4AudioInfo.cpp ReadBits heap-based overflow

A vulnerability classified as critical was found in Axiomatic Bento4 5e7bb34. Affected by this vulnerability is the function AP4_Mp4AudioDsiParser::ReadBits of the file Ap4Mp4AudioInfo.cpp of the component mp4hls. The manipulation leads to heap-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-212563.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Axiosys

Products

Bento4

CVE-2022-38757

CVE-2022-38757 ZENworks

A vulnerability has been identified in Micro Focus ZENworks 2020 Update 3a and prior versions. This vulnerability allows administrators with rights to perform actions (e.g., install a bundle) on a set of managed devices, to be able to exercise these rights on managed devices in the ZENworks zone but which are outside the scope of the administrator. This vulnerability does not result in the administrators gaining additional rights on the managed devices, either in the scope or outside the scope of the administrator.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Microfocus

Products

Zenworks

CVE-2022-3785

Axiomatic Bento4 Avcinfo SetDataSize heap-based overflow

A vulnerability, which was classified as critical, has been found in Axiomatic Bento4. Affected by this issue is the function AP4_DataBuffer::SetDataSize of the component Avcinfo. The manipulation leads to heap-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-212564.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Axiosys

Products

Bento4

CVE-2022-3789

Tim Campus Confession Wall share.php sql injection

A vulnerability has been found in Tim Campus Confession Wall and classified as critical. Affected by this vulnerability is an unknown functionality of the file share.php. The manipulation of the argument post_id leads to sql injection. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-212611.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Tim Campus Confession Wall Project

Products

Tim Campus Confession Wall

CVE-2022-3797

eolinker apinto-dashboard login redirect

A vulnerability was found in eolinker apinto-dashboard. It has been rated as problematic. This issue affects some unknown processing of the file /login. The manipulation of the argument callback leads to open redirect. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-212633 was assigned to this vulnerability.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Eolink

Products

Apinto-dashboard

CVE-2022-3798

IBAX go-ibax tablesInfo sql injection

A vulnerability classified as critical has been found in IBAX go-ibax. Affected is an unknown function of the file /api/v2/open/tablesInfo. The manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-212634 is the identifier assigned to this vulnerability.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Ibax

Products

Go-ibax

CVE-2022-3799

IBAX go-ibax tablesInfo sql injection

A vulnerability classified as critical was found in IBAX go-ibax. Affected by this vulnerability is an unknown functionality of the file /api/v2/open/tablesInfo. The manipulation leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-212635.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Ibax

Products

Go-ibax

CVE-2022-3800

IBAX go-ibax rowsInfo sql injection

A vulnerability, which was classified as critical, has been found in IBAX go-ibax. Affected by this issue is some unknown functionality of the file /api/v2/open/rowsInfo. The manipulation of the argument table_name leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-212636.

CVSS 3.1 · 6.3 Medium EPSS 3.1% KEV · Not listed

Vendors

Ibax

Products

Go-ibax

CVE-2022-3802

IBAX go-ibax rowsInfo sql injection

A vulnerability has been found in IBAX go-ibax and classified as critical. This vulnerability affects unknown code of the file /api/v2/open/rowsInfo. The manipulation of the argument where leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-212638 is the identifier assigned to this vulnerability.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Ibax

Products

Go-ibax

CVE-2022-3803

eolinker apinto-dashboard cross site scripting

A vulnerability was found in eolinker apinto-dashboard and classified as problematic. This issue affects some unknown processing of the file /api/discoveries/. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-212639.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed

Vendors

Eolink

Products

Apinto-dashboard

CVE-2022-3804

eolinker apinto-dashboard login cross site scripting

A vulnerability was found in eolinker apinto-dashboard. It has been classified as problematic. Affected is an unknown function of the file /login. The manipulation of the argument callback leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-212640.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Eolink

Products

Apinto-dashboard

CVE-2022-3807

Axiomatic Bento4 Incomplete Fix CVE-2019-13238 resource consumption

A vulnerability was found in Axiomatic Bento4. It has been rated as problematic. Affected by this issue is some unknown functionality of the component Incomplete Fix CVE-2019-13238. The manipulation leads to resource consumption. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-212660.

CVSS 3.1 · 4.3 Medium EPSS 1.3% KEV · Not listed

Vendors

Axiosys

Products

Bento4

CVE-2022-3809

Axiomatic Bento4 mp4tag Mp4Tag.cpp ParseCommandLine denial of service

A vulnerability was found in Axiomatic Bento4 and classified as problematic. Affected by this issue is the function ParseCommandLine of the file Mp4Tag/Mp4Tag.cpp of the component mp4tag. The manipulation leads to denial of service. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-212666 is the identifier assigned to this vulnerability.

CVSS 3.1 · 4.3 Medium EPSS 1.0% KEV · Not listed

Vendors

Axiosys

Products

Bento4