Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-45720 State: PUBLISHED Published: 2022-12-23T00:00:00.000Z Last Updated: 2025-04-15T14:01:18.937Z Vendors: n/a Products: n/a Problem Types: n/a Description: IP-COM M50 V15.11.0.33(10768) was discovered to contain multiple buffer overflows via the ip, mac, and remark parameters in the formIPMacBindModify function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://hackmd.io/%40AAN506JzR6urM5U8fNh1ng/SkCD5PEUo
CVE ID: CVE-2022-45721 State: PUBLISHED Published: 2022-12-23T00:00:00.000Z Last Updated: 2025-04-15T13:59:59.731Z Vendors: n/a Products: n/a Problem Types: n/a Description: IP-COM M50 V15.11.0.33(10768) was discovered to contain a buffer overflow via the picName parameter in the formDelWewifiPic function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://hackmd.io/%40AAN506JzR6urM5U8fNh1ng/BJUfyuABo
CVE ID: CVE-2022-45722 State: PUBLISHED Published: 2023-02-06T00:00:00 Last Updated: 2024-08-03T14:17:04.087Z Vendors: n/a Products: n/a Problem Types: n/a Description: ezEIP v5.3.0(0649) was discovered to contain a cross-site scripting (XSS) vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://ezip.com - https://github.com/God-Pattern/ezEIP/blob/main/XSS%20Vulnerability.md
CVE ID: CVE-2022-45724 State: PUBLISHED Published: 2023-02-13T00:00:00.000Z Last Updated: 2025-03-24T17:45:05.865Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect Access Control in Comfast router CF-WR6110N V2.3.1 allows a remote attacker on the same network to perform any HTTP request to an unauthenticated page to force the server to generate a SESSION_ID, and using this SESSION_ID an attacker can then perform authenticated requests. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://cf-wr6110n.com - http://comfast.com - http://sn0ox.com/research/2023/02/05/CVE-COMFAST-CF-WR610N.html
CVE ID: CVE-2022-45725 State: PUBLISHED Published: 2023-02-13T00:00:00.000Z Last Updated: 2025-03-24T17:39:32.390Z Vendors: n/a Products: n/a Problem Types: n/a Description: Improper Input Validation in Comfast router CF-WR6110N V2.3.1 allows a remote attacker on the same network to execute arbitrary code on the target via an HTTP POST request Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://cf-wr6110n.com - http://comfast.com - http://sn0ox.com/research/2023/02/05/CVE-COMFAST-CF-WR610N.html
CVE ID: CVE-2022-45728 State: PUBLISHED Published: 2023-01-12T00:00:00.000Z Last Updated: 2025-04-08T15:42:53.544Z Vendors: n/a Products: n/a Problem Types: n/a Description: Doctor Appointment Management System v1.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/sudoninja-noob/CVE-2022-45728/blob/main/CVE-2022-45728
CVE ID: CVE-2022-45729 State: PUBLISHED Published: 2023-01-12T00:00:00.000Z Last Updated: 2025-04-08T15:41:50.455Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in Doctor Appointment Management System v1.0.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Employee ID parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/sudoninja-noob/CVE-2022-45729/blob/main/CVE-2022-45729
CVE ID: CVE-2022-45730 State: PUBLISHED Published: 2023-01-25T00:00:00.000Z Last Updated: 2025-04-01T15:21:25.840Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in Doctor Appointment Management System v1.0.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Search function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://phpgurukul.com/doctor-appointment-management-system-using-php-and-mysql/ - https://github.com/Rajeshwar40/CVE/blob/main/CVE-2022-45730
CVE ID: CVE-2022-45748 State: PUBLISHED Published: 2023-01-20T00:00:00.000Z Last Updated: 2025-04-03T15:24:54.499Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered with assimp 5.1.4, a use after free occurred in function ColladaParser::ExtractDataObjectFromChannel in file /code/AssetLib/Collada/ColladaParser.cpp. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/assimp/assimp/issues/4286
CVE ID: CVE-2022-45755 State: PUBLISHED Published: 2023-02-08T00:00:00.000Z Last Updated: 2025-03-25T14:09:10.051Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in EyouCMS v1.6.0 allows attackers to execute arbitrary code via the home page description on the basic information page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/weng-xianhu/eyoucms/issues/39
CVE ID: CVE-2022-45756 State: PUBLISHED Published: 2022-12-12T00:00:00.000Z Last Updated: 2025-04-22T19:11:59.149Z Vendors: n/a Products: n/a Problem Types: n/a Description: SENS v1.0 is vulnerable to Cross Site Scripting (XSS). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/saysky/SENS/issues/17
CVE ID: CVE-2022-45758 State: PUBLISHED Published: 2022-12-12T00:00:00.000Z Last Updated: 2025-04-23T13:26:04.828Z Vendors: n/a Products: n/a Problem Types: n/a Description: SENS v1.0 is vulnerable to Cross Site Scripting (XSS) via com.liuyanzhao.sens.web.controller.admin, getRegister. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/saysky/SENS/issues/19
CVE ID: CVE-2022-45759 State: PUBLISHED Published: 2022-12-12T00:00:00.000Z Last Updated: 2025-04-22T19:12:53.868Z Vendors: n/a Products: n/a Problem Types: n/a Description: SENS v1.0 has a file upload vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/saysky/SENS/issues/20
CVE ID: CVE-2022-45760 State: PUBLISHED Published: 2022-12-12T00:00:00.000Z Last Updated: 2025-04-22T19:13:48.513Z Vendors: n/a Products: n/a Problem Types: n/a Description: SENS v1.0 is vulnerable to Incorrect Access Control vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/saysky/SENS/issues/21
CVE ID: CVE-2022-45766 State: PUBLISHED Published: 2023-02-10T00:00:00.000Z Last Updated: 2025-03-24T18:04:37.652Z Vendors: n/a Products: n/a Problem Types: n/a Description: Hardcoded credentials in Global Facilities Management Software (GFMS) Version 3 software distributed by Key Systems Management permits remote attackers to impact availability, confidentiality, accessibility and dependability of electronic key boxes. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.girlslearncyber.com/post/the-key-to-keeping-keys-safe
CVE ID: CVE-2022-45768 State: PUBLISHED Published: 2023-02-07T00:00:00.000Z Last Updated: 2025-03-25T14:46:21.544Z Vendors: n/a Products: n/a Problem Types: n/a Description: Command Injection vulnerability in Edimax Technology Co., Ltd. Wireless Router N300 Firmware BR428nS v3 allows attacker to execute arbitrary code via the formWlanMP function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.lovesandy.cc/2022/11/20/EDIMAX%E6%BC%8F%E6%B4%9E/ - https://github.com/Erebua/CVE/blob/main/Edimax.md
CVE ID: CVE-2022-45769 State: PUBLISHED Published: 2022-12-05T00:00:00.000Z Last Updated: 2025-04-24T13:45:40.341Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in ClicShopping_V3 v3.402 allows attackers to execute arbitrary web scripts or HTML via a crafted URL parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/clicshopping.org/2022/ClicShopping_V3
CVE ID: CVE-2022-45770 State: PUBLISHED Published: 2023-01-26T00:00:00.000Z Last Updated: 2025-03-31T18:37:59.637Z Vendors: n/a Products: n/a Problem Types: n/a Description: Improper input validation in adgnetworkwfpdrv.sys in Adguard For Windows x86 through 7.11 allows local privilege escalation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://adguard.com/en/versions/windows/release.html#version-71140780 - https://github.com/Marsel-marsel/CVE-2022-45770 - https://xakep.ru/2023/01/27/aguard-cve/ - https://hackmag.com/security/aguard-cve/
CVE ID: CVE-2022-45771 State: PUBLISHED Published: 2022-12-05T00:00:00.000Z Last Updated: 2025-04-24T13:43:51.956Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in the /api/audits component of Pwndoc v0.5.3 allows attackers to escalate privileges and execute arbitrary code via uploading a crafted audit file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/pwndoc/pwndoc - https://github.com/pwndoc/pwndoc/issues/401
CVE ID: CVE-2022-45778 State: PUBLISHED Published: 2022-12-27T00:00:00.000Z Last Updated: 2025-04-14T12:56:50.618Z Vendors: n/a Products: n/a Problem Types: n/a Description: https://www.hillstonenet.com.cn/ Hillstone Firewall SG-6000 <= 5.0.4.0 is vulnerable to Incorrect Access Control. There is a permission bypass vulnerability in the Hillstone WEB application firewall. An attacker can enter the background of the firewall with super administrator privileges through a configuration error in report.m. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gist.github.com/yinfei6/6ffff06db3f7d4c24de2f784c0db10df
CVE ID: CVE-2022-45781 State: PUBLISHED Published: 2023-11-14T00:00:00 Last Updated: 2024-09-03T17:13:00.707Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer Overflow vulnerability in Tenda AX1803 v1.0.0.1_2994 and earlier allows attackers to run arbitrary code via /goform/SetOnlineDevName. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cnblogs.com/FALL3N/p/16813932.html
CVE ID: CVE-2022-45782 State: PUBLISHED Published: 2023-02-01T00:00:00.000Z Last Updated: 2025-03-27T16:12:49.683Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in dotCMS core 5.3.8.5 through 5.3.8.15 and 21.03 through 22.10.1. A cryptographically insecure random generation algorithm for password-reset token generation leads to account takeover. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.dotcms.com/security/SI-66
CVE ID: CVE-2022-45783 State: PUBLISHED Published: 2023-02-01T00:00:00.000Z Last Updated: 2025-03-27T16:11:28.208Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in dotCMS core 4.x through 22.10.2. An authenticated directory traversal vulnerability in the dotCMS API can lead to Remote Code Execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.dotcms.com/security/SI-67
CVE ID: CVE-2022-45786 State: PUBLISHED Published: 2023-02-04T20:40:58.631Z Last Updated: 2025-03-26T13:58:49.953Z Vendors: Apache Software Foundation Products: Apache AGE Problem Types: CWE-89 Description: There are issues with the AGE drivers for Golang and Python that enable SQL injections to occur. This impacts AGE for PostgreSQL 11 & AGE for PostgreSQL 12, all versions up-to-and-including 1.1.0, when using those drivers. The fix is to update to the latest Golang and Python drivers in addition to the latest version of AGE that is used for PostgreSQL 11 or PostgreSQL 12. The update of AGE will add a new function to enable parameterization of the cypher() function, which, in conjunction wi
The update of AGE will add a new function to enable parameterization of the cypher() function, which, in conjunction with the driver updates, will resolve this issue. Background (for those who want more information): After thoroughly researching this issue, we found that due to the nature of the cypher() function, it was not easy to parameterize the values passed into it. This enabled SQL injections, if the developer of the driver wasn't careful. The developer of the Golang and Pyton drivers didn't fully utilize parameterization, likely because of this, thus enabling SQL injections. The obvious fix to this issue is to use parameterization in the drivers for all PG SQL queries. However, para
njections. The obvious fix to this issue is to use parameterization in the drivers for all PG SQL queries. However, parameterizing all PG queries is complicated by the fact that the cypher() function call itself cannot be parameterized directly, as it isn't a real function. At least, not the parameters that would take the graph name and cypher query. The reason the cypher() function cannot have those values parameterized is because the function is a placeholder and never actually runs. The cypher() function node, created by PG in the query tree, is transformed and replaced with a query tree for the actual cypher query during the analyze phase. The problem is that parameters - that would be p
with a query tree for the actual cypher query during the analyze phase. The problem is that parameters - that would be passed in and that the cypher() function transform needs to be resolved - are only resolved in the execution phase, which is much later. Since the transform of the cypher() function needs to know the graph name and cypher query prior to execution, they can't be passed as parameters. The fix that we are testing right now, and are proposing to use, is to create a function that will be called prior to the execution of the cypher() function transform. This new function will allow values to be passed as parameters for the graph name and cypher query. As this command will be execu
function will allow values to be passed as parameters for the graph name and cypher query. As this command will be executed prior to the cypher() function transform, its values will be resolved. These values can then be cached for the immediately following cypher() function transform to use. As added features, the cached values will store the calling session's pid, for validation. And, the cypher() function transform will clear this cached information after function invocation, regardless of whether it was used. This method will allow the parameterizing of the cypher() function indirectly and provide a way to lock out SQL injection attacks. Additional Analyst Notes: - CVE Program Container:
tion indirectly and provide a way to lock out SQL injection attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/of8x0gt5d2vfrm5ksxw55bwn2849ck1w
CVE ID: CVE-2022-45787 State: PUBLISHED Published: 2023-01-06T09:31:40.118Z Last Updated: 2025-04-09T19:32:09.206Z Vendors: Apache Software Foundation Products: Apache James MIME4J Problem Types: CWE-312 Description: Unproper laxist permissions on the temporary files used by MIME4J TempFileStorageProvider may lead to information disclosure to other local users. This issue affects Apache James MIME4J version 0.8.8 and prior versions. We recommend users to upgrade to MIME4j version 0.8.9 or later. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/26s8p9stl1z261c4qw15bsq03tt7t0rj
CVE ID: CVE-2022-45788 State: PUBLISHED Published: 2023-01-30T00:00:00.000Z Last Updated: 2025-02-05T20:07:14.882Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Schneider Electric Products: EcoStruxure Control Expert , EcoStruxure Process Expert, Modicon M340 CPU (part numbers BMXP34*), Modicon M580 CPU (part numbers BMEP* and BMEH*) , Modicon M580 CPU Safety (part numbers BMEP58*S and BMEH58*S), Modicon Momentum Unity M1E Processor (171CBU*), Modicon MC80 (BMKC80), Legacy Modicon Quantum (140CPU65*) and Premium CPUs (TSXP57*) Problem Types: CWE-754 Description: A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists that could c
: CWE-754 Description: A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists that could cause arbitrary code execution, denial of service and loss of confidentiality & integrity when a malicious project file is loaded onto the controller. Affected Products: EcoStruxure Control Expert (All Versions), EcoStruxure Process Expert (All Versions), Modicon M340 CPU - part numbers BMXP34* (All Versions), Modicon M580 CPU - part numbers BMEP* and BMEH* (All Versions), Modicon M580 CPU Safety - part numbers BMEP58*S and BMEH58*S (All Versions), Modicon Momentum Unity M1E Processor - 171CBU* (All Versions), Modicon MC80 - BMKC80 (All Versions), Legacy Modicon Quantum - 14
Momentum Unity M1E Processor - 171CBU* (All Versions), Modicon MC80 - BMKC80 (All Versions), Legacy Modicon Quantum - 140CPU65* and Premium CPUs - TSXP57* (All Versions) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-010-05&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-010-05_Modicon_Controllers_Security_Notification.pdf
CVE ID: CVE-2022-45789 State: PUBLISHED Published: 2023-01-31T00:00:00.000Z Last Updated: 2025-02-05T20:07:07.568Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Schneider Electric Products: EcoStruxure Control Expert , EcoStruxure Process Expert, Modicon M340 CPU (part numbers BMXP34*), Modicon M580 CPU (part numbers BMEP* and BMEH*) , Modicon M580 CPU Safety (part numbers BMEP58*S and BMEH58*S) Problem Types: CWE-294 Description: A CWE-294: Authentication Bypass by Capture-replay vulnerability exists that could cause execution of unauthorized Modbus functions on the controller when hijacking an authenticated Modbus session. Affected Products: EcoStruxure Co
zed Modbus functions on the controller when hijacking an authenticated Modbus session. Affected Products: EcoStruxure Control Expert (All Versions), EcoStruxure Process Expert (All Versions), Modicon M340 CPU - part numbers BMXP34* (All Versions), Modicon M580 CPU - part numbers BMEP* and BMEH* (All Versions), Modicon M580 CPU Safety - part numbers BMEP58*S and BMEH58*S (All Versions) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-010-06&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-010-06_Modicon_Controllers_Security_Notification.pdf
CVE ID: CVE-2022-45790 State: PUBLISHED Published: 2024-01-22T17:22:14.476Z Last Updated: 2024-11-13T16:53:38.204Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N) Vendors: Omron Products: CJ-series and CS-series CPU modules Problem Types: CWE-307 Description: The Omron FINS protocol has an authenticated feature to prevent access to memory regions. Authentication is susceptible to bruteforce attack, which may allow an adversary to gain access to protected memory. This access can allow overwrite of values including programmed logic. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/ic
otes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-262-05 - https://www.fa.omron.co.jp/product/security/assets/pdf/en/OMSR-2023-010_en.pdf - https://www.dragos.com/advisory/omron-plc-and-engineering-software-network-and-file-format-access/
CVE ID: CVE-2022-45791 State: REJECTED Published: N/A Last Updated: 2024-01-22T17:39:47.179Z Description: No description available.
CVE ID: CVE-2022-45792 State: PUBLISHED Published: 2024-01-22T17:46:36.699Z Last Updated: 2025-06-17T21:19:25.577Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Omron Products: Sysmac Studio Problem Types: CWE-22 Description: Project files may contain malicious contents which the software will use to create files on the filesystem. This allows directory traversal and overwriting files with the privileges of the logged-in user. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.dragos.com/advisory/omron-plc-and-engineering-software-network-and-file-format-access/
CVE ID: CVE-2022-45793 State: PUBLISHED Published: 2024-01-10T20:49:36.082Z Last Updated: 2025-04-17T15:42:42.580Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) Vendors: Omron Products: Sysmac Studio Problem Types: CWE-276 Description: Sysmac Studio installs executables in a directory with poor permissions. This can allow a locally-authenticated attacker to overwrite files which will result in code execution with privileges of a different user. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-262-04 - https://www.dragos.com/advisory/omron-plc-and-engineering-software-ne
sa.gov/news-events/ics-advisories/icsa-23-262-04 - https://www.dragos.com/advisory/omron-plc-and-engineering-software-network-and-file-format-access/ - https://www.fa.omron.co.jp/product/security/assets/pdf/en/OMSR-2023-009_en.pdf
CVE ID: CVE-2022-45794 State: PUBLISHED Published: 2024-01-10T22:56:58.836Z Last Updated: 2025-05-22T15:46:32.685Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: Omron Products: CJ-series and CS-series CPU modules Problem Types: CWE-306 Description: An attacker with network access to the affected PLC (CJ-series and CS-series PLCs, all versions) may use a network protocol to read and write files on the PLC internal memory and memory card. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.fa.omron.co.jp/product/security/assets/pdf/en/OMSR-2023-002_en.pdf - https://www.dragos.com/advisory/omron-plc-and-engineer
omron.co.jp/product/security/assets/pdf/en/OMSR-2023-002_en.pdf - https://www.dragos.com/advisory/omron-plc-and-engineering-software-network-and-file-format-access/
CVE ID: CVE-2022-45795 State: REJECTED Published: N/A Last Updated: 2024-01-22T17:34:44.443Z Description: No description available.
CVE ID: CVE-2022-45796 State: PUBLISHED Published: 2022-12-16T00:00:00.000Z Last Updated: 2025-04-17T16:02:57.941Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: SHARP Products: SHARP multifunction printers Problem Types: CWE-77 Description: Command injection vulnerability in nw_interface.html in SHARP multifunction printers (MFPs)'s Digital Full-color Multifunctional System 202 or earlier, 120 or earlier, 600 or earlier, 121 or earlier, 500 or earlier, 402 or earlier, 790 or earlier, and Digital Multifunctional System (Monochrome) 200 or earlier, 211 or earlier, 102 or earlier, 453 or earlier, 400 or earlier, 202 or earlier, 602 or earlier, 500 or earlie
r earlier, 211 or earlier, 102 or earlier, 453 or earlier, 400 or earlier, 202 or earlier, 602 or earlier, 500 or earlier, 401 or earlier allows remote attackers to execute arbitrary commands via unspecified vectors. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://global.sharp/products/copier/info/info_security_2022-11.html - https://jvn.jp/en/vu/JVNVU96195138/index.html - https://zuso.ai/advisory/ZA-2022-01.html - http://seclists.org/fulldisclosure/2024/Jul/0