CVE-2023-0946
published 2023-02-21CVE-2023-0946: A vulnerability has been found in SourceCodester Best POS Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown…
PriorityP343critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.49%
41.3th percentile
A vulnerability has been found in SourceCodester Best POS Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file billing/index.php?id=9. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The identifier VDB-221593 was assigned to this vulnerability.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| mayurik | best_pos_management_system | — | — |
| sourcecodester | best_pos_management_system | — | — |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2022-4203 openssl: read buffer overflow in X.509 certificate verification
bugzilla·2023-01-25·CVSS 4.9
CVE-2022-4203 [MEDIUM] CVE-2022-4203 openssl: read buffer overflow in X.509 certificate verification
CVE-2022-4203 openssl: read buffer overflow in X.509 certificate verification
A read buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed the malicious certificate or for the application to continue certificate verification despite failure to construct a path to a trusted issuer.
Discussion:
Created openssl tracking bugs for this issue:
Affects: fedora-36 [bug 2167913]
Affects: fedora-37 [bug 2167916]
Created openssl3 tracking bugs for this issue:
Affects: epel-8 [bug 2167912]
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 9
Via RHSA-2023:0946 https://access.redhat.com/errata/RH
Bugzilla
CVE-2023-0217 openssl: NULL dereference validating DSA public key
bugzilla·2023-01-25·CVSS 7.5
CVE-2023-0217 [HIGH] CVE-2023-0217 openssl: NULL dereference validating DSA public key
CVE-2023-0217 openssl: NULL dereference validating DSA public key
An invalid pointer dereference on read can be triggered when an application tries to check a malformed DSA public key by the EVP_PKEY_public_check() function. This will most likely lead to an application crash. This function can be called on public keys supplied from untrusted sources which could allow an attacker to cause a denial of service attack.
Discussion:
Created openssl tracking bugs for this issue:
Affects: fedora-36 [bug 2167882]
Affects: fedora-37 [bug 2167883]
Created openssl3 tracking bugs for this issue:
Affects: epel-8 [bug 2167881]
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 9
Via RHSA-2023:0946 https://access.redhat.com/errata/RHSA-2023:0946
---
This iss
2023-02-21
Published