Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-25080 State: PUBLISHED Published: 2022-02-22T22:44:10 Last Updated: 2024-08-03T04:29:01.588Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLink A830R V5.9c.4729_B20191112 was discovered to contain a command injection vulnerability in the "Main" function. This vulnerability allows attackers to execute arbitrary commands via the QUERY_STRING parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/EPhaha/IOT_vuln/blob/main/TOTOLink/A830R/README.md
CVE ID: CVE-2022-25081 State: PUBLISHED Published: 2022-02-22T22:44:10 Last Updated: 2024-08-03T04:29:01.591Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLink T10 V5.9c.5061_B20200511 was discovered to contain a command injection vulnerability in the "Main" function. This vulnerability allows attackers to execute arbitrary commands via the QUERY_STRING parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/EPhaha/IOT_vuln/blob/main/TOTOLink/T10/README.md
CVE ID: CVE-2022-25082 State: PUBLISHED Published: 2022-02-22T22:44:11 Last Updated: 2024-08-03T04:29:01.917Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLink A950RG V5.9c.4050_B20190424 and V4.1.2cu.5204_B20210112 were discovered to contain a command injection vulnerability in the "Main" function. This vulnerability allows attackers to execute arbitrary commands via the QUERY_STRING parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/EPhaha/IOT_vuln/blob/main/TOTOLink/A950RG/README.md
CVE ID: CVE-2022-25083 State: PUBLISHED Published: 2022-02-22T22:44:12 Last Updated: 2024-08-03T04:29:01.645Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLink A860R V4.1.2cu.5182_B20201027 was discovered to contain a command injection vulnerability in the "Main" function. This vulnerability allows attackers to execute arbitrary commands via the QUERY_STRING parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/EPhaha/IOT_vuln/blob/main/TOTOLink/A860R/README.md
CVE ID: CVE-2022-25084 State: PUBLISHED Published: 2022-02-22T22:44:12 Last Updated: 2024-08-03T04:29:01.919Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLink T6 V5.9c.4085_B20190428 was discovered to contain a command injection vulnerability in the "Main" function. This vulnerability allows attackers to execute arbitrary commands via the QUERY_STRING parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/EPhaha/IOT_vuln/blob/main/TOTOLink/T6/README.md
CVE ID: CVE-2022-25089 State: PUBLISHED Published: 2022-03-02T23:19:15 Last Updated: 2024-08-03T04:29:01.630Z Vendors: n/a Products: n/a Problem Types: n/a Description: Printix Secure Cloud Print Management through 1.3.1106.0 incorrectly uses Privileged APIs to modify values in HKEY_LOCAL_MACHINE via UITasks.PersistentRegistryData. Additional Analyst Notes: - CVE Program Container: References: - http://printix.com - https://www.exploit-db.com/exploits/50798 - https://github.com/ComparedArray/printix-CVE-2022-25089 - http://packetstormsecurity.com/files/167013/Printix-1.3.1106.0-Privileged-API-Abuse.html
CVE ID: CVE-2022-25090 State: PUBLISHED Published: 2022-03-09T15:36:48 Last Updated: 2024-08-03T04:29:01.672Z Vendors: n/a Products: n/a Problem Types: n/a Description: Printix Secure Cloud Print Management through 1.3.1106.0 creates a temporary temp.ini file in a directory with insecure permissions, leading to privilege escalation because of a race condition. Additional Analyst Notes: - CVE Program Container: References: - http://printix.com - https://www.exploit-db.com/exploits/50812 - http://packetstormsecurity.com/files/166242/Printix-Client-1.3.1106.0-Privilege-Escalation.html - https://github.com/ComparedArray/printix-CVE-2022-25090 - http://packetstormsecurity.com/files/167012/Printix
ion.html - https://github.com/ComparedArray/printix-CVE-2022-25090 - http://packetstormsecurity.com/files/167012/Printix-1.3.1106.0-Privilege-Escalation.html
CVE ID: CVE-2022-25091 State: PUBLISHED Published: 2023-04-27T00:00:00.000Z Last Updated: 2025-02-03T17:24:35.963Z Vendors: n/a Products: n/a Problem Types: n/a Description: Infopop Ultimate Bulletin Board up to v5.47a was discovered to allow all messages posted inside private forums to be disclosed by unauthenticated users via the quote reply feature. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://marc.info/?l=vuln-dev&m=97486849231786&w=2 - https://vulners.com/securityvulns/SECURITYVULNS:DOC:954 - https://web.archive.org/web/20030207100935/ - http://www.infopop.com/support/ubbclassic/version5.html - https://web.archive.org/web/200302071009
web/20030207100935/ - http://www.infopop.com/support/ubbclassic/version5.html - https://web.archive.org/web/20030207100935/http://www.infopop.com/support/ubbclassic/version5.html
CVE ID: CVE-2022-25094 State: PUBLISHED Published: 2022-02-25T23:22:08 Last Updated: 2024-08-03T04:29:01.806Z Vendors: n/a Products: n/a Problem Types: n/a Description: Home Owners Collection Management System v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the parameter "cover" in SystemSettings.php. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/50731
CVE ID: CVE-2022-25095 State: PUBLISHED Published: 2022-02-25T23:22:10 Last Updated: 2024-08-03T04:29:01.711Z Vendors: n/a Products: n/a Problem Types: n/a Description: Home Owners Collection Management System v1.0 allows unauthenticated attackers to compromise user accounts via a crafted POST request. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/50730
CVE ID: CVE-2022-25096 State: PUBLISHED Published: 2022-02-25T23:22:11 Last Updated: 2024-08-03T04:29:01.617Z Vendors: n/a Products: n/a Problem Types: n/a Description: Home Owners Collection Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter in /members/view_member.php. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/50732 - https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/2022/Home-Owners-Collection-Management - https://www.nu11secur1ty.com/2022/02/home-owners-collection-management-10-rce.html
CVE ID: CVE-2022-25098 State: PUBLISHED Published: 2022-02-23T21:11:25 Last Updated: 2024-08-03T04:29:01.780Z Vendors: n/a Products: n/a Problem Types: n/a Description: ECTouch v2 suffers from arbitrary file deletion due to insufficient filtering of the filename parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/dota-st/Vulnerability/blob/master/ECTouchV2.md
CVE ID: CVE-2022-25099 State: PUBLISHED Published: 2022-02-23T21:11:25 Last Updated: 2024-08-03T04:29:01.558Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability in the component /languages/index.php of WBCE CMS v1.5.2 allows attackers to execute arbitrary code via a crafted PHP file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/dota-st/Vulnerability/blob/master/WBCE_CMS.md
CVE ID: CVE-2022-25101 State: PUBLISHED Published: 2022-02-23T21:11:24 Last Updated: 2024-08-03T04:29:01.642Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability in the component /templates/install.php of WBCE CMS v1.5.2 allows attackers to execute arbitrary code via a crafted PHP file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/dota-st/Vulnerability/blob/master/WBCE_CMS_second.md
CVE ID: CVE-2022-25104 State: PUBLISHED Published: 2022-02-23T21:11:23 Last Updated: 2024-08-03T04:29:01.860Z Vendors: n/a Products: n/a Problem Types: n/a Description: HorizontCMS v1.0.0-beta.2 was discovered to contain an arbitrary file download vulnerability via the component /admin/file-manager/. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ttimot24/HorizontCMS/issues/43
CVE ID: CVE-2022-25106 State: PUBLISHED Published: 2022-03-04T19:20:01 Last Updated: 2024-08-03T04:29:01.837Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DIR-859 v1.05 was discovered to contain a stack-based buffer overflow via the function genacgi_main. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted payload. Additional Analyst Notes: - CVE Program Container: References: - https://www.dlink.com/en/security-bulletin/ - https://github.com/chunklhit/cve/blob/master/dlink/DIR859/BufferOverflow.md - https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10267
CVE ID: CVE-2022-25108 State: PUBLISHED Published: 2022-03-07T04:15:57 Last Updated: 2024-08-03T04:29:01.577Z Vendors: n/a Products: n/a Problem Types: n/a Description: Foxit PDF Reader and Editor before 11.2.1 and PhantomPDF before 10.1.7 allow a NULL pointer dereference during PDF parsing because the pointer is used without proper validation. Additional Analyst Notes: - CVE Program Container: References: - https://www.foxit.com/support/security-bulletins.html
CVE ID: CVE-2022-25114 State: PUBLISHED Published: 2022-03-02T22:39:24 Last Updated: 2024-08-03T04:29:01.649Z Vendors: n/a Products: n/a Problem Types: n/a Description: Event Management v1.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the full_name parameter under register.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/PuneethReddyHC/event-management-1.0
CVE ID: CVE-2022-25115 State: PUBLISHED Published: 2022-03-02T22:39:25 Last Updated: 2024-08-03T04:29:01.741Z Vendors: n/a Products: n/a Problem Types: n/a Description: A remote code execution (RCE) vulnerability in the Avatar parameter under /admin/?page=user/manage_user of Home Owners Collection Management System v1.0 allows attackers to execute arbitrary code via a crafted PNG file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/2022/Home-Owners-Collection-Management
CVE ID: CVE-2022-25125 State: PUBLISHED Published: 2022-03-03T18:01:35 Last Updated: 2024-08-03T04:29:01.957Z Vendors: n/a Products: n/a Problem Types: n/a Description: MCMS v5.2.4 was discovered to contain a SQL injection vulnerability via search.do in the file /mdiy/dict/listExcludeApp. Additional Analyst Notes: - CVE Program Container: References: - https://gitee.com/mingSoft/MCMS/issues/I4TGYI
CVE ID: CVE-2022-25130 State: PUBLISHED Published: 2022-02-18T23:09:17 Last Updated: 2024-08-03T04:29:01.840Z Vendors: n/a Products: n/a Problem Types: n/a Description: A command injection vulnerability in the function updateWifiInfo of TOTOLINK Technology routers T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 and T10 V2_Firmware V4.1.8cu.5207_B20210320 allows attackers to execute arbitrary commands via a crafted MQTT packet. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pjqwudi1/my_vuln/blob/main/totolink/vuln_18/18.md
CVE ID: CVE-2022-25131 State: PUBLISHED Published: 2022-02-18T23:09:17 Last Updated: 2024-08-03T04:29:01.655Z Vendors: n/a Products: n/a Problem Types: n/a Description: A command injection vulnerability in the function recvSlaveCloudCheckStatus of TOTOLINK Technology routers T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 and T10 V2_Firmware V4.1.8cu.5207_B20210320 allows attackers to execute arbitrary commands via a crafted MQTT packet. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pjqwudi1/my_vuln/blob/main/totolink/vuln_14/14.md
CVE ID: CVE-2022-25132 State: PUBLISHED Published: 2022-02-18T23:09:18 Last Updated: 2024-08-03T04:29:01.958Z Vendors: n/a Products: n/a Problem Types: n/a Description: A command injection vulnerability in the function meshSlaveDlfw of TOTOLINK Technology router T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 allows attackers to execute arbitrary commands via a crafted MQTT packet. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pjqwudi1/my_vuln/blob/main/totolink/vuln_16/16.md
CVE ID: CVE-2022-25133 State: PUBLISHED Published: 2022-02-18T23:09:19 Last Updated: 2024-08-03T04:29:01.917Z Vendors: n/a Products: n/a Problem Types: n/a Description: A command injection vulnerability in the function isAssocPriDevice of TOTOLINK Technology router T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 allows attackers to execute arbitrary commands via a crafted MQTT packet. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pjqwudi1/my_vuln/blob/main/totolink/vuln_20/20.md
CVE ID: CVE-2022-25134 State: PUBLISHED Published: 2022-02-18T23:09:19 Last Updated: 2024-08-03T04:29:01.843Z Vendors: n/a Products: n/a Problem Types: n/a Description: A command injection vulnerability in the function setUpgradeFW of TOTOLINK Technology router T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 allows attackers to execute arbitrary commands via a crafted MQTT packet. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pjqwudi1/my_vuln/blob/main/totolink/vuln_13/13.md
CVE ID: CVE-2022-25135 State: PUBLISHED Published: 2022-02-18T23:09:20 Last Updated: 2024-08-03T04:29:01.934Z Vendors: n/a Products: n/a Problem Types: n/a Description: A command injection vulnerability in the function recv_mesh_info_sync of TOTOLINK Technology router T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 allows attackers to execute arbitrary commands via a crafted MQTT packet. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pjqwudi1/my_vuln/blob/main/totolink/vuln_19/19.md
CVE ID: CVE-2022-25136 State: PUBLISHED Published: 2022-02-18T23:09:21 Last Updated: 2024-08-03T04:29:01.884Z Vendors: n/a Products: n/a Problem Types: n/a Description: A command injection vulnerability in the function meshSlaveUpdate of TOTOLINK Technology routers T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 and T10 V2_Firmware V4.1.8cu.5207_B20210320 allows attackers to execute arbitrary commands via a crafted MQTT packet. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pjqwudi1/my_vuln/blob/main/totolink/vuln_17/17.md
CVE ID: CVE-2022-25137 State: PUBLISHED Published: 2022-02-18T23:09:22 Last Updated: 2024-08-03T04:29:01.648Z Vendors: n/a Products: n/a Problem Types: n/a Description: A command injection vulnerability in the function recvSlaveUpgstatus of TOTOLINK Technology routers T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 and T10 V2_Firmware V4.1.8cu.5207_B20210320 allows attackers to execute arbitrary commands via a crafted MQTT packet. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pjqwudi1/my_vuln/blob/main/totolink/vuln_15/15.md
CVE ID: CVE-2022-25138 State: PUBLISHED Published: 2022-03-03T16:56:35 Last Updated: 2024-08-03T04:29:01.741Z Vendors: n/a Products: n/a Problem Types: n/a Description: Axelor Open Suite v5.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Name parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ArianeBlow/Axelor_Stored_XSS/blob/main/README.md - https://forum.axelor.com/t/vuln-sur-axelor-je-suis-gentil/4768
CVE ID: CVE-2022-25139 State: PUBLISHED Published: 2022-02-14T21:47:20 Last Updated: 2024-08-03T04:29:01.781Z Vendors: n/a Products: n/a Problem Types: n/a Description: njs through 0.7.0, used in NGINX, was discovered to contain a heap use-after-free in njs_await_fulfilled. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nginx/njs/issues/451 - https://github.com/nginx/njs/commit/6a07c2156a07ef307b6dcf3c2ca8571a5f1af7a6 - https://security.netapp.com/advisory/ntap-20220303-0007/
CVE ID: CVE-2022-25146 State: PUBLISHED Published: 2022-03-02T23:28:42 Last Updated: 2024-08-03T04:29:01.763Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Remote App module in Liferay Portal Liferay Portal v7.4.3.4 through v7.4.3.8 and Liferay DXP 7.4 before update 5 does not check if the origin of event messages it receives matches the origin of the Remote App, allowing attackers to exfiltrate the CSRF token via a crafted event message. Additional Analyst Notes: - CVE Program Container: References: - http://liferay.com - https://www.securitum.pl - https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-25146-csrf-toke
/portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-25146-csrf-token-exfiltration-via-remote-apps
CVE ID: CVE-2022-25147 State: PUBLISHED Published: 2023-01-31T15:54:51.395Z Last Updated: 2025-02-13T16:32:27.154Z Vendors: Apache Software Foundation Products: Apache Portable Runtime Utility (APR-util) Problem Types: CWE-190 Description: Integer Overflow or Wraparound vulnerability in apr_base64 functions of Apache Portable Runtime Utility (APR-util) allows an attacker to write beyond bounds of a buffer. This issue affects Apache Portable Runtime Utility (APR-util) 1.6.1 and prior versions. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread/np5gjqlohc4f62lr09vrn61vl44cylh8 - https://security.netapp.com/advisory/ntap-20240315-0001/
CVE ID: CVE-2022-25148 State: PUBLISHED Published: 2022-02-24T00:00:00 Last Updated: 2024-08-03T04:29:01.616Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: WP Statistics Products: WP Statistics Problem Types: CWE-89 Description: The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the current_page_id parameter found in the ~/includes/class-wp-statistics-hits.php file which allows attackers without authentication to inject arbitrary SQL queries to obtain sensitive information, in versions up to and including 13.1.5. Additional Analyst Notes: - CVE Program Container: References: - https://gi
ion, in versions up to and including 13.1.5. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/Xib3rR4dAr/5dbd58b7f57a5037fe461fba8e696042 - https://www.wordfence.com/vulnerability-advisories/#CVE-2022-25148 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2679983%40wp-statistics&new=2679983%40wp-statistics&sfp_email=&sfph_mail= - http://packetstormsecurity.com/files/174482/WordPress-WP-Statistics-13.1.5-SQL-Injection.html
CVE ID: CVE-2022-25149 State: PUBLISHED Published: 2022-02-24T18:27:08.000Z Last Updated: 2025-01-31T18:55:15.260Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: WP Statistics Products: WP Statistics Problem Types: CWE-89 Description: The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the IP parameter found in the ~/includes/class-wp-statistics-hits.php file which allows attackers without authentication to inject arbitrary SQL queries to obtain sensitive information, in versions up to and including 13.1.5. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Referen
versions up to and including 13.1.5. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gist.github.com/Xib3rR4dAr/5dbd58b7f57a5037fe461fba8e696042 - https://www.wordfence.com/vulnerability-advisories/#CVE-2022-25149 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2679983%40wp-statistics&new=2679983%40wp-statistics&sfp_email=&sfph_mail=
CVE ID: CVE-2022-25150 State: PUBLISHED Published: 2022-02-14T18:50:01 Last Updated: 2024-08-03T04:29:01.795Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Malwarebytes Binisoft Windows Firewall Control before 6.8.1.0, programs executed from the Tools tab can be used to escalate privileges. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/bugs?report_id=1205932 - https://binisoft.org/changelog.txt
CVE ID: CVE-2022-25151 State: PUBLISHED Published: 2022-06-08T00:00:00Z Last Updated: 2025-03-11T13:40:40.103Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: ITarian Products: ITarian SaaS platform / on-premise Problem Types: CWE-614 Description: Within the Service Desk module of the ITarian platform (SAAS and on-premise), a remote attacker can obtain sensitive information, caused by the failure to set the HTTP Only flag. A remote attacker could exploit this vulnerability to gain access to the management interface by using this vulnerability in combination with a successful Cross-Site Scripting attack on a user. Additional Analyst Notes: - CISA ADP Vulnrichme
in combination with a successful Cross-Site Scripting attack on a user. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://csirt.divd.nl/DIVD-2021-00037 - https://csirt.divd.nl/CVE-2022-25151
CVE ID: CVE-2022-25152 State: PUBLISHED Published: 2022-06-08T00:00:00Z Last Updated: 2025-03-11T13:40:38.630Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: ITarian Products: ITarian platform (SAAS / on-premise) Problem Types: CWE-358 Description: The ITarian platform (SAAS / on-premise) offers the possibility to run code on agents via a function called procedures. It is possible to require a mandatory approval process. Due to a vulnerability in the approval process, present in any version prior to 6.35.37347.20040, a malicious actor (with a valid session token) can create a procedure, bypass approval, and execute the procedure. This results in the abili
ith a valid session token) can create a procedure, bypass approval, and execute the procedure. This results in the ability for any user with a valid session token to perform arbitrary code execution and full system take-over on all agents. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://csirt.divd.nl/DIVD-2021-00037 - https://csirt.divd.nl/CVE-2022-25152
CVE ID: CVE-2022-25153 State: PUBLISHED Published: 2022-06-08T00:00:00Z Last Updated: 2025-03-11T13:39:17.610Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: ITarian Products: Endpoint Manager Communication Client for Windows Problem Types: CWE-275 Description: The ITarian Endpoint Manage Communication Client, prior to version 6.43.41148.21120, is compiled using insecure OpenSSL settings. Due to this setting, a malicious actor with low privileges access to a system can escalate his privileges to SYSTEM abusing an insecure openssl.conf lookup. Additional Analyst Notes: - CVE Program Container: References: - https://csirt.divd.nl/DIVD-2021-00037 - https://csirt
. Additional Analyst Notes: - CVE Program Container: References: - https://csirt.divd.nl/DIVD-2021-00037 - https://csirt.divd.nl/CVE-2022-25153
CVE ID: CVE-2022-25154 State: PUBLISHED Published: 2022-04-05T05:58:21 Last Updated: 2024-08-03T04:29:01.886Z Vendors: n/a Products: n/a Problem Types: n/a Description: A DLL hijacking vulnerability in Samsung portable SSD T5 PC software before 1.6.9 could allow a local attacker to escalate privileges. (An attacker must already have user privileges on Windows 7, 10, or 11 to exploit this vulnerability.) Additional Analyst Notes: - CVE Program Container: References: - https://semiconductor.samsung.com/support/quality-support/product-security-updates/