Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-48090 State: PUBLISHED Published: 2023-01-13T00:00:00.000Z Last Updated: 2025-04-07T19:25:41.172Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tramyardg hotel-mgmt-system version 2022.4 is vulnerable to SQL Injection via /app/dao/CustomerDAO.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/tramyardg/hotel-mgmt-system/issues/21
CVE ID: CVE-2022-48091 State: PUBLISHED Published: 2023-01-13T00:00:00.000Z Last Updated: 2025-04-07T18:50:00.400Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tramyardg hotel-mgmt-system version 2022.4 is vulnerable to Cross Site Scripting (XSS) via process_update_profile.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/tramyardg/hotel-mgmt-system/issues/22
CVE ID: CVE-2022-48093 State: PUBLISHED Published: 2023-02-01T00:00:00.000Z Last Updated: 2025-03-27T14:21:34.196Z Vendors: n/a Products: n/a Problem Types: n/a Description: Seacms v12.7 was discovered to contain a remote code execution (RCE) vulnerability via the ip parameter at admin_ ip.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.yuque.com/litanhua-fost9/hu05qa/ng2cb9ln0i0oqpo7?singleDo
CVE ID: CVE-2022-48094 State: PUBLISHED Published: 2023-02-01T00:00:00.000Z Last Updated: 2025-03-27T14:18:37.463Z Vendors: n/a Products: n/a Problem Types: n/a Description: lmxcms v1.41 was discovered to contain an arbitrary file read vulnerability via TemplateAction.class.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.yuque.com/litanhua-fost9/hu05qa/gp3psgfdt1czpf45?singleDoc
CVE ID: CVE-2022-48107 State: PUBLISHED Published: 2023-01-27T00:00:00.000Z Last Updated: 2025-03-28T15:53:06.884Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DIR_878_FW1.30B08 was discovered to contain a command injection vulnerability via the component /setnetworksettings/IPAddress. This vulnerability allows attackers to escalate privileges to root via a crafted payload. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.dlink.com/en/security-bulletin/ - https://github.com/migraine-sudo/D_Link_Vuln/tree/main/cmd%20inject%20in%20IPAddress
CVE ID: CVE-2022-48108 State: PUBLISHED Published: 2023-01-27T00:00:00.000Z Last Updated: 2025-03-28T15:50:01.582Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DIR_878_FW1.30B08 was discovered to contain a command injection vulnerability via the component /SetNetworkSettings/SubnetMask. This vulnerability allows attackers to escalate privileges to root via a crafted payload. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.dlink.com/en/security-bulletin/ - https://github.com/migraine-sudo/D_Link_Vuln/tree/main/cmd%20inject%20in%20Netmask
CVE ID: CVE-2022-48110 State: PUBLISHED Published: 2023-02-13T00:00:00.000Z Last Updated: 2025-03-24T12:58:49.454Z Vendors: n/a Products: n/a Problem Types: n/a Description: CKSource CKEditor 5 35.4.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Full Featured CKEditor5 widget. NOTE: the vendor's position is that this is not a vulnerability. The CKEditor 5 documentation discusses that it is the responsibility of an integrator (who is adding CKEditor 5 functionality to a website) to choose the correct security settings for their use case. Also, safe default values are established (e.g., config.htmlEmbed.showPreviews is false). Additional Analyst Notes: - CVE Pro
safe default values are established (e.g., config.htmlEmbed.showPreviews is false). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://ckeditor.com/docs/ckeditor5/latest/features/html-embed.html - https://packetstormsecurity.com/files/170927/CKSource-CKEditor5-35.4.0-Cross-Site-Scripting.html
CVE ID: CVE-2022-48111 State: PUBLISHED Published: 2023-03-10T00:00:00.000Z Last Updated: 2025-02-27T19:12:12.856Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in the check_login function of SIPE s.r.l WI400 between version 8 and 11 included allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the f parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://sipe.com - http://wi400.com - https://labs.yarix.com/advisories/CVE-2022-48111/ - https://labs.yarix.com/2023/02/siri-wi400-xss-on-login-page-cve-2022-48111/ - https://devisions.github.io/blog/
48111/ - https://labs.yarix.com/2023/02/siri-wi400-xss-on-login-page-cve-2022-48111/ - https://devisions.github.io/blog/cve-2022-48111
CVE ID: CVE-2022-48113 State: PUBLISHED Published: 2023-02-02T00:00:00.000Z Last Updated: 2025-03-26T19:15:13.916Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability in TOTOLINK N200RE_v5 firmware V9.3.5u.6139 allows unauthenticated attackers to access the telnet service via a crafted POST request. Attackers are also able to leverage this vulnerability to login as root via hardcoded credentials. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wefir.blogspot.com/2022/12/totolink-n200rev5-telnet-backdoor.html
CVE ID: CVE-2022-48114 State: PUBLISHED Published: 2023-02-02T00:00:00.000Z Last Updated: 2025-03-26T19:09:37.859Z Vendors: n/a Products: n/a Problem Types: n/a Description: RuoYi up to v4.7.5 was discovered to contain a SQL injection vulnerability via the component /tool/gen/createTable. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitee.com/y_project/RuoYi/issues/I65V2B
CVE ID: CVE-2022-48115 State: PUBLISHED Published: 2023-02-17T00:00:00.000Z Last Updated: 2025-03-18T16:03:35.936Z Vendors: n/a Products: n/a Problem Types: n/a Description: The dropdown menu in jspreadsheet before v4.6.0 was discovered to be vulnerable to cross-site scripting (XSS). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/jspreadsheet/ce/issues/1587 - https://github.com/jspreadsheet/ce
CVE ID: CVE-2022-48116 State: PUBLISHED Published: 2023-01-27T00:00:00.000Z Last Updated: 2025-03-28T15:47:41.166Z Vendors: n/a Products: n/a Problem Types: n/a Description: AyaCMS v3.1.2 was discovered to contain a remote code execution (RCE) vulnerability via the component /admin/tpl_edit.inc.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/loadream/AyaCMS/issues/10
CVE ID: CVE-2022-48118 State: PUBLISHED Published: 2023-01-27T00:00:00.000Z Last Updated: 2025-03-28T15:45:22.080Z Vendors: n/a Products: n/a Problem Types: n/a Description: Jorani v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Acronym parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/bbalet/jorani/issues/379
CVE ID: CVE-2022-48120 State: PUBLISHED Published: 2023-01-20T00:00:00.000Z Last Updated: 2025-04-03T15:44:41.014Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection vulnerability in kishan0725 Hospital Management System thru commit 4770d740f2512693ef8fd9aa10a8d17f79fad9bd (on March 13, 2021), allows attackers to execute arbitrary commands via the contact and doctor parameters to /search.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/kishan0725/Hospital-Management-System/issues/32
CVE ID: CVE-2022-48121 State: PUBLISHED Published: 2023-01-20T00:00:00.000Z Last Updated: 2025-04-03T15:41:00.759Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the rsabits parameter in the setting/delStaticDhcpRules function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Am1ngl/ttt/tree/main/16
CVE ID: CVE-2022-48122 State: PUBLISHED Published: 2023-01-20T00:00:00.000Z Last Updated: 2025-04-03T15:40:17.303Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the dayvalid parameter in the setting/delStaticDhcpRules function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Am1ngl/ttt/tree/main/17
CVE ID: CVE-2022-48123 State: PUBLISHED Published: 2023-01-20T00:00:00.000Z Last Updated: 2025-04-03T15:26:58.233Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the servername parameter in the setting/delStaticDhcpRules function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Am1ngl/ttt/tree/main/15
CVE ID: CVE-2022-48124 State: PUBLISHED Published: 2023-01-20T00:00:00.000Z Last Updated: 2025-04-03T15:21:29.815Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the FileName parameter in the setting/setOpenVpnCertGenerationCfg function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Am1ngl/ttt/tree/main/14
CVE ID: CVE-2022-48125 State: PUBLISHED Published: 2023-01-20T00:00:00.000Z Last Updated: 2025-04-03T15:20:18.754Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the password parameter in the setting/setOpenVpnCertGenerationCfg function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Am1ngl/ttt/tree/main/13
CVE ID: CVE-2022-48126 State: PUBLISHED Published: 2023-01-20T00:00:00.000Z Last Updated: 2025-04-03T20:40:22.875Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the username parameter in the setting/setOpenVpnCertGenerationCfg function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Am1ngl/ttt/tree/main/12
CVE ID: CVE-2022-48130 State: PUBLISHED Published: 2023-02-02T00:00:00.000Z Last Updated: 2025-03-26T19:01:14.647Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda W20E v15.11.0.6 was discovered to contain multiple stack overflows in the function formSetStaticRoute via the parameters staticRouteNet, staticRouteMask, staticRouteGateway, staticRouteWAN. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Stevenbaga/fengsha/blob/main/W20E/formSetStaticRoute.md
CVE ID: CVE-2022-48137 State: REJECTED Published: N/A Last Updated: 2023-05-30T00:00:00 Description: No description available.
CVE ID: CVE-2022-48138 State: REJECTED Published: N/A Last Updated: 2023-05-30T00:00:00 Description: No description available.
CVE ID: CVE-2022-48140 State: PUBLISHED Published: 2023-02-02T00:00:00.000Z Last Updated: 2025-03-26T19:00:32.739Z Vendors: n/a Products: n/a Problem Types: n/a Description: DedeCMS v5.7.97 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /file_manage_view.php?fmdo=edit&filename. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ChandlerChin/dedecms/blob/main/xss.docx
CVE ID: CVE-2022-48149 State: PUBLISHED Published: 2023-02-22T00:00:00.000Z Last Updated: 2025-03-12T15:00:19.689Z Vendors: n/a Products: n/a Problem Types: n/a Description: Online Student Admission System in PHP Free Source Code 1.0 was discovered to contain a SQL injection vulnerability via the username parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://medium.com/%40ahmedmehsania/cve-2022-48149-80e4139aa503
CVE ID: CVE-2022-48150 State: PUBLISHED Published: 2023-04-21T00:00:00.000Z Last Updated: 2025-02-05T14:48:21.977Z Vendors: n/a Products: n/a Problem Types: n/a Description: Shopware v5.5.10 was discovered to contain a cross-site scripting (XSS) vulnerability via the recovery/install/ URI. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/sahilop123/-CVE-2022-48150
CVE ID: CVE-2022-48152 State: PUBLISHED Published: 2023-01-20T00:00:00.000Z Last Updated: 2025-04-03T18:49:50.778Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection vulnerability in RemoteClinic 2.0 allows attackers to execute arbitrary commands and gain sensitive information via the id parameter to /medicines/profile.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/remoteclinic/RemoteClinic/issues/20
CVE ID: CVE-2022-48161 State: PUBLISHED Published: 2023-01-31T00:00:00.000Z Last Updated: 2025-03-27T14:47:50.642Z Vendors: n/a Products: n/a Problem Types: n/a Description: Easy Images v2.0 was discovered to contain an arbitrary file download vulnerability via the component /application/down.php. This vulnerability is exploited via a crafted GET request. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/sunset-move/EasyImages2.0-arbitrary-file-download-vulnerability
CVE ID: CVE-2022-48164 State: PUBLISHED Published: 2023-02-06T00:00:00.000Z Last Updated: 2025-03-26T19:28:04.409Z Vendors: n/a Products: n/a Problem Types: n/a Description: An access control issue in the component /cgi-bin/ExportLogs.sh of Wavlink WL-WN533A8 M33A8.V5030.190716 allows unauthenticated attackers to download configuration data and log files and obtain admin credentials. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://docs.google.com/document/d/1JgqpBYRxyU0WKDSqkvi4Yo0723k7mrIUeuH9i1eEs8U/edit?usp=sharing - https://github.com/strik3r0x1/Vulns/blob/main/WAVLINK_WN533A8.md
CVE ID: CVE-2022-48165 State: PUBLISHED Published: 2023-02-03T00:00:00 Last Updated: 2024-08-03T15:02:36.686Z Vendors: n/a Products: n/a Problem Types: n/a Description: An access control issue in the component /cgi-bin/ExportLogs.sh of Wavlink WL-WN530H4 M30H4.V5030.210121 allows unauthenticated attackers to download configuration data and log files and obtain admin credentials. Additional Analyst Notes: - CVE Program Container: References: - https://docs.google.com/document/d/1HD4GKumkZpa6FNHuf0QQSKFvoYhCfwXpbyWiJdx1VtE/edit?usp=sharing - https://github.com/strik3r0x1/Vulns/blob/main/WAVLINK_WL-WN530H4.md
CVE ID: CVE-2022-48166 State: PUBLISHED Published: 2023-02-06T00:00:00.000Z Last Updated: 2025-03-25T20:00:01.376Z Vendors: n/a Products: n/a Problem Types: n/a Description: An access control issue in Wavlink WL-WN530HG4 M30HG4.V5030.201217 allows unauthenticated attackers to download configuration data and log files and obtain admin credentials. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://docs.google.com/document/d/1zvbuu3Hkk3CAkojAivlUESvtHblHJNLJdpGOoNtk-Vo/edit?usp=sharing - https://github.com/strik3r0x1/Vulns/blob/main/WAVLINK%20WN530HG4.md
CVE ID: CVE-2022-48174 State: PUBLISHED Published: 2023-08-22T00:00:00.000Z Last Updated: 2025-11-03T20:35:11.485Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugs.busybox.net/show_bug.cgi?id=15216
CVE ID: CVE-2022-48175 State: PUBLISHED Published: 2023-01-30T00:00:00.000Z Last Updated: 2025-03-28T14:13:24.627Z Vendors: n/a Products: n/a Problem Types: n/a Description: Rukovoditel v3.2.1 was discovered to contain a remote code execution (RCE) vulnerability in the component /rukovoditel/index.php?module=dashboard/ajax_request. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/y1s3m0/vulnfind/blob/main/rukovoditel/rce_ajax_request.md
CVE ID: CVE-2022-48176 State: PUBLISHED Published: 2023-01-30T00:00:00.000Z Last Updated: 2025-03-28T14:12:40.732Z Vendors: n/a Products: n/a Problem Types: n/a Description: Netgear routers R7000P before v1.3.3.154, R6900P before v1.3.3.154, R7960P before v1.4.4.94, and R8000P before v1.4.4.94 were discovered to contain a pre-authentication stack overflow. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.netgear.com/about/security/ - https://hdwsec.fr/blog/20221109-netgear/ - https://kb.netgear.com/000065242/Security-Advisory-for-Pre-authentication-Stack-Overflow-on-some-Routers-and-Nighthawk-WiFi-Mesh-Systems-PSV-2022-0146
CVE ID: CVE-2022-48177 State: PUBLISHED Published: 2023-04-15T00:00:00.000Z Last Updated: 2025-02-06T15:51:33.777Z Vendors: n/a Products: n/a Problem Types: n/a Description: X2CRM Open Source Sales CRM 6.6 and 6.9 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the adin/importModels Import Records Model field (model parameter). This vulnerability allows attackers to create malicious JavaScript that will be executed by the victim user's browser. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://sourceforge.net/projects/x2engine/ - http://packetstormsecurity.com/files/171792/X2CRM-6.6-6.9-Cross-Site-Scripting.ht
//sourceforge.net/projects/x2engine/ - http://packetstormsecurity.com/files/171792/X2CRM-6.6-6.9-Cross-Site-Scripting.html
CVE ID: CVE-2022-48178 State: PUBLISHED Published: 2023-04-15T00:00:00.000Z Last Updated: 2025-02-06T15:49:15.652Z Vendors: n/a Products: n/a Problem Types: n/a Description: X2CRM Open Source Sales CRM 6.6 and 6.9 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Create Action function, aka an index.php/actions/update URI. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://sourceforge.net/projects/x2engine/ - http://packetstormsecurity.com/files/171792/X2CRM-6.6-6.9-Cross-Site-Scripting.html
CVE ID: CVE-2022-48181 State: PUBLISHED Published: 2023-06-05T21:01:48.880Z Last Updated: 2025-01-08T15:55:59.489Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Lenovo Products: ThinkStation BIOS Problem Types: CWE-787 Description: An ErrorMessage driver stack-based buffer overflow vulnerability in BIOS of some ThinkPad models could allow an attacker with local access to elevate their privileges and execute arbitrary code. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.lenovo.com/us/en/product_security/LEN-124495
CVE ID: CVE-2022-48182 State: PUBLISHED Published: 2023-10-09T20:55:55.993Z Last Updated: 2024-09-19T13:18:03.342Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) Vendors: Lenovo Products: ThinkPad T14s X13 Gen3 BIOS - Windows, ThinkPad X13 Gen3 BIOS - Windows, ThinkPad T14s Gen 3 BIOS - Linux, ThinkPad X13 Gen3 BIOS - Linux Problem Types: CWE-1263 Description: A vulnerability was reported in ThinkPad T14s Gen 3 and X13 Gen3 that could cause the BIOS tamper detection mechanism to not trigger under specific circumstances which could allow unauthorized access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.leno
d access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.lenovo.com/us/en/product_security/LEN-106014
CVE ID: CVE-2022-48183 State: PUBLISHED Published: 2023-10-09T20:56:44.367Z Last Updated: 2024-09-19T13:17:42.466Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) Vendors: Lenovo Products: ThinkPad T14s X13 Gen3 BIOS - Windows, ThinkPad X13 Gen3 BIOS - Windows, ThinkPad T14s Gen 3 BIOS - Linux, ThinkPad X13 Gen3 BIOS - Linux Problem Types: CWE-1263 Description: A vulnerability was reported in ThinkPad T14s Gen 3 and X13 Gen3 that could cause the BIOS tamper detection mechanism to not trigger under specific circumstances which could allow unauthorized access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.leno
CVE ID: CVE-2022-48185 State: REJECTED Published: N/A Last Updated: 2024-07-29T19:54:49.634Z Description: No description available.
CVE ID: CVE-2022-48186 State: PUBLISHED Published: 2023-05-01T14:50:30.256Z Last Updated: 2025-01-30T15:22:12.968Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Lenovo Products: Baiying Problem Types: CWE-295 Description: A certificate validation vulnerability exists in the Baiying Android application which could lead to information disclosure. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://iknow.lenovo.com.cn/detail/dc_206093.html
CVE ID: CVE-2022-48187 State: REJECTED Published: N/A Last Updated: 2023-05-12T00:00:00 Description: No description available.
CVE ID: CVE-2022-48188 State: PUBLISHED Published: 2023-06-05T21:03:07.044Z Last Updated: 2025-01-08T15:50:42.163Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Lenovo Products: ThinkStation BIOS Problem Types: CWE-787 Description: A buffer overflow vulnerability in the SecureBootDXE BIOS driver of some Lenovo Desktop and ThinkStation models could allow an attacker with local access to elevate their privileges to execute arbitrary code. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.lenovo.com/us/en/product_security/LEN-124495
CVE ID: CVE-2022-48189 State: PUBLISHED Published: 2023-10-30T14:39:23.160Z Last Updated: 2024-09-09T15:02:40.079Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Lenovo Products: ThinkPad BIOS Problem Types: CWE-20 Description: An SMM driver input validation vulnerability in the BIOS of some ThinkPad models could allow an attacker with local access and elevated privileges to execute arbitrary code. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.lenovo.com/us/en/product_security/LEN-106014
CVE ID: CVE-2022-48190 State: REJECTED Published: N/A Last Updated: 2023-10-30T13:55:03.942Z Description: No description available.
CVE ID: CVE-2022-48191 State: PUBLISHED Published: 2023-01-18T23:07:41.149Z Last Updated: 2025-04-03T19:53:47.060Z Vendors: Trend Micro, Inc. Products: Trend Micro Maxium Security (Consumer) Problem Types: n/a Description: A vulnerability exists in Trend Micro Maximum Security 2022 (17.7) wherein a low-privileged user can write a known malicious executable to a specific location and in the process of removal and restoral an attacker could replace an original folder with a mount point to an arbitrary location, allowing a escalation of privileges on an affected system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://helpcenter.trendmicro.com/en
onal Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://helpcenter.trendmicro.com/en-us/article/tmka-11252 - https://www.zerodayinitiative.com/advisories/ZDI-23-053/