Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-24894 State: PUBLISHED Published: 2023-02-03T21:46:23.702Z Last Updated: 2025-03-10T21:16:23.607Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:L) Vendors: symfony Products: symfony Problem Types: CWE-285 Description: Symfony is a PHP framework for web and console applications and a set of reusable PHP components. The Symfony HTTP cache system, acts as a reverse proxy: It caches entire responses (including headers) and returns them to the clients. In a recent change in the `AbstractSessionListener`, the response might contain a `Set-Cookie` header. If the Symfony HTTP cache system is enabled, this response might bill stored and return to the next clie
Cookie` header. If the Symfony HTTP cache system is enabled, this response might bill stored and return to the next clients. An attacker can use this vulnerability to retrieve the victim's session. This issue has been patched and is available for branch 4.4. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/symfony/symfony/security/advisories/GHSA-h7vf-5wrv-9fhv - https://github.com/symfony/symfony/commit/d2f6322af9444ac5cd1ef3ac6f280dbef7f9d1fb - https://lists.debian.org/debian-lts-announce/2023/07/msg00014.html
CVE ID: CVE-2022-24895 State: PUBLISHED Published: 2023-02-03T21:45:26.887Z Last Updated: 2025-03-10T21:16:31.513Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: symfony Products: symfony Problem Types: CWE-384 Description: Symfony is a PHP framework for web and console applications and a set of reusable PHP components. When authenticating users Symfony by default regenerates the session ID upon login, but preserves the rest of session attributes. Because this does not clear CSRF tokens upon login, this might enables same-site attackers to bypass the CSRF protection mechanism by performing an attack similar to a session-fixation. This issue has been fixed i
bypass the CSRF protection mechanism by performing an attack similar to a session-fixation. This issue has been fixed in the 4.4 branch. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/symfony/symfony/security/advisories/GHSA-3gv2-29qc-v67m - https://github.com/symfony/security-bundle/commit/076fd2088ada33d760758d98ff07ddedbf567946 - https://github.com/symfony/symfony/commit/5909d74ecee359ea4982fcf4331aaf2e489a1fd4 - https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security-bundle/CVE-2022-24895.yaml - https://lists.debian.org/debian-lts-announce/2023/07/msg00014.html
CVE ID: CVE-2022-24896 State: PUBLISHED Published: 2022-06-06T19:30:15.000Z Last Updated: 2025-04-23T18:19:16.848Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Enalean Products: tuleap Problem Types: CWE-862 Description: Tuleap is a Free & Open Source Suite to manage software developments and collaboration. In versions prior to 13.7.99.239 Tuleap does not properly verify authorizations when displaying the content of tracker report renderer and chart widgets. Malicious users could use this vulnerability to retrieve the name of a tracker they cannot access as well as the name of the fields used in reports. Additional Analyst Notes: - CVE Program Container:
hey cannot access as well as the name of the fields used in reports. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Enalean/tuleap/security/advisories/GHSA-x962-x43g-qw39 - https://github.com/Enalean/tuleap/commit/8e99e7c82d9fe569799019b9e1d614d38a184313 - https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=8e99e7c82d9fe569799019b9e1d614d38a184313 - https://tuleap.net/plugins/tracker/?aid=26729
CVE ID: CVE-2022-24897 State: PUBLISHED Published: 2022-05-02T21:49:17.000Z Last Updated: 2025-04-22T18:02:07.004Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: xwiki Products: xwiki-commons Problem Types: CWE-22 Description: APIs to evaluate content with Velocity is a package for APIs to evaluate content with Velocity. Starting with version 2.3 and prior to 12.6.7, 12.10.3, and 13.0, the velocity scripts are not properly sandboxed against using the Java File API to perform read or write operations on the filesystem. Writing an attacking script in Velocity requires the Script rights in XWiki so not all users can use it, and it also requires finding an XWiki
ript in Velocity requires the Script rights in XWiki so not all users can use it, and it also requires finding an XWiki API which returns a File. The problem has been patched in versions 12.6.7, 12.10.3, and 13.0. There is no easy workaround for fixing this vulnerability other than upgrading and being careful when giving Script rights. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/xwiki/xwiki-commons/security/advisories/GHSA-cvx5-m8vg-vxgc - https://github.com/xwiki/xwiki-commons/pull/127 - https://github.com/xwiki/xwiki-commons/commit/215951cfb0f808d0bf5b1097c9e7d1e503449ab8 - https://jira.xwiki.org/browse/XWIKI-5168
CVE ID: CVE-2022-24898 State: PUBLISHED Published: 2022-04-28T19:35:10.000Z Last Updated: 2025-04-22T18:02:24.536Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: xwiki Products: xwiki-commons Problem Types: CWE-611 Description: org.xwiki.commons:xwiki-commons-xml is a common module used by other XWiki top level projects. Starting in version 2.7 and prior to versions 12.10.10, 13.4.4, and 13.8-rc-1, it is possible for a script to access any file accessing to the user running XWiki application server with XML External Entity Injection through the XML script service. The problem has been patched in versions 12.10.10, 13.4.4, and 13.8-rc-1. There is no easy wor
h the XML script service. The problem has been patched in versions 12.10.10, 13.4.4, and 13.8-rc-1. There is no easy workaround for fixing this vulnerability other than upgrading and being careful when giving Script rights. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/xwiki/xwiki-commons/security/advisories/GHSA-m2r5-4w96-qxg5 - https://github.com/xwiki/xwiki-commons/commit/947e8921ebd95462d5a7928f397dd1b64f77c7d5 - https://jira.xwiki.org/browse/XWIKI-18946
CVE ID: CVE-2022-24899 State: PUBLISHED Published: 2022-05-05T23:45:13.000Z Last Updated: 2025-04-23T18:29:58.265Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: contao Products: contao Problem Types: CWE-79 Description: Contao is a powerful open source CMS that allows you to create professional websites and scalable web applications. In versions of Contao prior to 4.13.3 it is possible to inject code into the canonical tag. As a workaround users may disable canonical tags in the root page settings. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/contao/contao/commit/199206849a87ddd0fa5cf674eb3c5829
ntainer: - CISA ADP Vulnrichment: References: - https://github.com/contao/contao/commit/199206849a87ddd0fa5cf674eb3c58292fd8366c - https://github.com/contao/contao/security/advisories/GHSA-m8x6-6r63-qvj2 - https://contao.org/en/security-advisories/cross-site-scripting-via-canonical-url.html
CVE ID: CVE-2022-24900 State: PUBLISHED Published: 2022-04-29T13:50:11.000Z Last Updated: 2025-04-22T18:02:15.277Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L) Vendors: onlaj Products: Piano-LED-Visualizer Problem Types: CWE-73, CWE-22 Description: Piano LED Visualizer is software that allows LED lights to light up as a person plays a piano connected to a computer. Version 1.3 and prior are vulnerable to a path traversal attack. The `os.path.join` call is unsafe for use with untrusted input. When the `os.path.join` call encounters an absolute path, it ignores all the parameters it has encountered till that point and starts working with the new absolute path. Sin
ath, it ignores all the parameters it has encountered till that point and starts working with the new absolute path. Since the "malicious" parameter represents an absolute path, the result of `os.path.join` ignores the static directory completely. Hence, untrusted input is passed via the `os.path.join` call to `flask.send_file` can lead to path traversal attacks. A patch with a fix is available on the `master` branch of the GitHub repository. This can also be fixed by preventing flow of untrusted data to the vulnerable `send_file` function. In case the application logic necessiates this behaviour, one can either use the `flask.safe_join` to join untrusted paths or replace `flask.send_file` c
essiates this behaviour, one can either use the `flask.safe_join` to join untrusted paths or replace `flask.send_file` calls with `flask.send_from_directory` calls. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/onlaj/Piano-LED-Visualizer/security/advisories/GHSA-g78x-q3x8-r6m4 - https://github.com/onlaj/Piano-LED-Visualizer/issues/350 - https://github.com/onlaj/Piano-LED-Visualizer/pull/351 - https://github.com/onlaj/Piano-LED-Visualizer/commit/3f10602323cd8184e1c69a76b815655597bf0ee5 - https://github.com/onlaj/Piano-LED-Visualizer/blob/6a732caa812c83a807c711f3d091af99209cae7b/webinterface/views_api.py#L970
CVE ID: CVE-2022-24901 State: PUBLISHED Published: 2022-05-04T01:10:08.000Z Last Updated: 2025-04-23T18:31:29.148Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: parse-community Products: parse-server Problem Types: CWE-295, CWE-287 Description: Improper validation of the Apple certificate URL in the Apple Game Center authentication adapter allows attackers to bypass authentication, making the server vulnerable to DoS attacks. The vulnerability has been fixed by improving the URL validation and adding additional checks of the resource the URL points to before downloading it. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Reference
L points to before downloading it. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/parse-community/parse-server/security/advisories/GHSA-qf8x-vqjv-92gr
CVE ID: CVE-2022-24902 State: PUBLISHED Published: 2022-05-05T23:35:10.000Z Last Updated: 2025-04-23T18:30:13.330Z Severity: LOW (CVSS 2.9 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: PaulleDemon Products: tkVideoPlayer Problem Types: CWE-400 Description: TkVideoplayer is a simple library to play video files in tkinter. Uncontrolled memory consumption in versions of TKVideoplayer prior to 2.0.0 can theoretically lead to performance degradation. There are no known workarounds. This issue has been patched and users are advised to upgrade to version 2.0.0 or later. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/PaulleDemon/
dditional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/PaulleDemon/tkVideoPlayer/security/advisories/GHSA-jmhj-vh4q-hhmq - https://github.com/PaulleDemon/tkVideoPlayer/issues/3
CVE ID: CVE-2022-24903 State: PUBLISHED Published: 2022-05-05T00:00:00.000Z Last Updated: 2025-04-23T18:31:22.233Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: rsyslog Products: rsyslog Problem Types: CWE-120 Description: Rsyslog is a rocket-fast system for log processing. Modules for TCP syslog reception have a potential heap buffer overflow when octet-counted framing is used. This can result in a segfault or some other malfunction. As of our understanding, this vulnerability can not be used for remote code execution. But there may still be a slight chance for experts to do that. The bug occurs when the octet count is read. While there is a check for the m
be a slight chance for experts to do that. The bug occurs when the octet count is read. While there is a check for the maximum number of octets, digits are written to a heap buffer even when the octet count is over the maximum, This can be used to overrun the memory buffer. However, once the sequence of digits stop, no additional characters can be added to the buffer. In our opinion, this makes remote exploits impossible or at least highly complex. Octet-counted framing is one of two potential framing modes. It is relatively uncommon, but enabled by default on receivers. Modules `imtcp`, `imptcp`, `imgssapi`, and `imhttp` are used for regular syslog message reception. It is best practice not
dules `imtcp`, `imptcp`, `imgssapi`, and `imhttp` are used for regular syslog message reception. It is best practice not to directly expose them to the public. When this practice is followed, the risk is considerably lower. Module `imdiag` is a diagnostics module primarily intended for testbench runs. We do not expect it to be present on any production installation. Octet-counted framing is not very common. Usually, it needs to be specifically enabled at senders. If users do not need it, they can turn it off for the most important modules. This will mitigate the vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/rsyslog
ty. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/rsyslog/rsyslog/security/advisories/GHSA-ggw7-xr6h-mmr8 - https://github.com/rsyslog/rsyslog/commit/f211042ecbb472f9d8beb4678a65d272b6f07705 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GMNNXLCU2UORRVSZO24HL4KMVPK5PHVW/ - https://lists.debian.org/debian-lts-announce/2022/05/msg00028.html - https://www.debian.org/security/2022/dsa-5150 - https://security.netapp.com/advisory/ntap-20221111-0002/
CVE ID: CVE-2022-24904 State: PUBLISHED Published: 2022-05-20T13:55:11.000Z Last Updated: 2025-04-23T18:25:13.878Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: argoproj Products: argo-cd Problem Types: CWE-61, CWE-59 Description: Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD starting with version 0.7.0 and prior to versions 2.1.15m 2.2.9, and 2.3.4 is vulnerable to a symlink following bug allowing a malicious user with repository write access to leak sensitive files from Argo CD's repo-server. A malicious Argo CD user with write access for a repository which is (or may be) used in a directory-type Application may commit
ous Argo CD user with write access for a repository which is (or may be) used in a directory-type Application may commit a symlink which points to an out-of-bounds file. Sensitive files which could be leaked include manifest files from other Applications' source repositories (potentially decrypted files, if you are using a decryption plugin) or any JSON-formatted secrets which have been mounted as files on the repo-server. A patch for this vulnerability has been released in Argo CD versions 2.3.4, 2.2.9, and 2.1.15. Users of versions 2.3.0 or above who do not have any Jsonnet/directory-type Applications may disable the Jsonnet/directory config management tool as a workaround. Additional Anal
et/directory-type Applications may disable the Jsonnet/directory config management tool as a workaround. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/argoproj/argo-cd/security/advisories/GHSA-6gcg-hp2x-q54h - https://github.com/argoproj/argo-cd/releases/tag/v2.1.15 - https://github.com/argoproj/argo-cd/releases/tag/v2.2.9 - https://github.com/argoproj/argo-cd/releases/tag/v2.3.4
CVE ID: CVE-2022-24905 State: PUBLISHED Published: 2022-05-20T14:05:11.000Z Last Updated: 2025-04-23T18:25:05.362Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: argoproj Products: argo-cd Problem Types: CWE-20 Description: Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. A vulnerability was found in Argo CD prior to versions 2.3.4, 2.2.9, and 2.1.15 that allows an attacker to spoof error messages on the login screen when single sign on (SSO) is enabled. In order to exploit this vulnerability, an attacker would have to trick the victim to visit a specially crafted URL which contains the message to be displayed. As far as the researc
e to trick the victim to visit a specially crafted URL which contains the message to be displayed. As far as the research of the Argo CD team concluded, it is not possible to specify any active content (e.g. Javascript) or other HTML fragments (e.g. clickable links) in the spoofed message. A patch for this vulnerability has been released in Argo CD versions 2.3.4, 2.2.9, and 2.1.15. There are currently no known workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/argoproj/argo-cd/releases/tag/v2.1.15 - https://github.com/argoproj/argo-cd/releases/tag/v2.2.9 - https://github.com/argoproj/argo-cd/releases/tag/v2.3.4 - https:/
ps://github.com/argoproj/argo-cd/releases/tag/v2.2.9 - https://github.com/argoproj/argo-cd/releases/tag/v2.3.4 - https://github.com/argoproj/argo-cd/security/advisories/GHSA-xmg8-99r8-jc2j
CVE ID: CVE-2022-24906 State: PUBLISHED Published: 2022-05-20T15:40:17.000Z Last Updated: 2025-04-22T18:00:53.353Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N) Vendors: nextcloud Products: security-advisories Problem Types: CWE-200 Description: Nextcloud Deck is a Kanban-style project & personal management tool for Nextcloud, similar to Trello. The full path of the application is exposed to unauthorized users. It is recommended that the Nextcloud Deck app is upgraded to 1.2.11, 1.4.6, or 1.5.4. There is no workaround available. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/nextcloud/security-advisories/se
tes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-hx9w-xfrg-2qvp - https://github.com/nextcloud/deck/pull/3384 - https://hackerone.com/reports/1354334
CVE ID: CVE-2022-24907 State: PUBLISHED Published: 2023-03-28T00:00:00.000Z Last Updated: 2025-02-19T19:24:11.328Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Foxit Products: PDF Reader Problem Types: CWE-125 Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.1.0.52543. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JP2 images. Crafted data in a JP2 image can trigger a read past the end of an allocated buffer. An attacker can leverage this vulnerab
afted data in a JP2 image can trigger a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-16186. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.foxit.com/support/security-bulletins.html - https://www.zerodayinitiative.com/advisories/ZDI-22-350/
CVE ID: CVE-2022-24908 State: PUBLISHED Published: 2023-03-28T00:00:00.000Z Last Updated: 2025-02-19T19:23:26.991Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Foxit Products: PDF Reader Problem Types: CWE-125 Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.1.0.52543. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JP2 images. Crafted data in a JP2 image can trigger a read past the end of an allocated buffer. An attacker can leverage this vulnerab
afted data in a JP2 image can trigger a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-16187. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.foxit.com/support/security-bulletins.html - https://www.zerodayinitiative.com/advisories/ZDI-22-351/
CVE ID: CVE-2022-24910 State: PUBLISHED Published: 2022-05-12T17:01:33.206Z Last Updated: 2025-04-15T19:03:26.619Z Severity: HIGH (CVSS 8.2 CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: InHand Networks Products: InRouter302 Problem Types: CWE-120 Description: A buffer overflow vulnerability exists in the httpd parse_ping_result API functionality of InHand Networks InRouter302 V3.5.4. A specially-crafted file can lead to remote code execution. An attacker can send a sequence of requests to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.inhandnetworks.com/upload/attachment/202205/10/InHand-PSA-2022-01.p
: - CISA ADP Vulnrichment: References: - https://www.inhandnetworks.com/upload/attachment/202205/10/InHand-PSA-2022-01.pdf - https://talosintelligence.com/vulnerability_reports/TALOS-2022-1471
CVE ID: CVE-2022-24912 State: PUBLISHED Published: 2022-07-29T10:00:15.439904Z Last Updated: 2024-09-17T02:53:19.536Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: n/a Products: github.com/runatlantis/atlantis/server/controllers/events Problem Types: Timing Attack Description: The package github.com/runatlantis/atlantis/server/controllers/events before 0.19.7 are vulnerable to Timing Attack in the webhook event validator code, which does not use a constant-time comparison function to validate the webhook secret. It can allow an attacker to recover this secret as an attacker and then forge webhook events. Additional Analyst Notes: - CVE Program Container: Ref
recover this secret as an attacker and then forge webhook events. Additional Analyst Notes: - CVE Program Container: References: - https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMRUNATLANTISATLANTISSERVERCONTROLLERSEVENTS-2950851 - https://github.com/runatlantis/atlantis/issues/2391 - https://github.com/runatlantis/atlantis/commit/48870911974adddaa4c99c8089e79b7d787fa820
CVE ID: CVE-2022-24913 State: PUBLISHED Published: 2023-01-12T05:00:01.920Z Last Updated: 2025-04-08T18:07:05.122Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: n/a Products: com.fasterxml.util:java-merge-sort Problem Types: CWE-377 Description: Versions of the package com.fasterxml.util:java-merge-sort before 1.1.0 are vulnerable to Insecure Temporary File in the StdTempFileProvider() function in StdTempFileProvider.java, which uses the permissive File.createTempFile() function, exposing temporary file contents. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-JAVA-COMFASTERXMLUTI
- CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-JAVA-COMFASTERXMLUTIL-3227926 - https://github.com/cowtowncoder/java-merge-sort/commit/450fdee70b5f181c2afc5d817f293efa1a543902 - https://github.com/cowtowncoder/java-merge-sort/pull/21
CVE ID: CVE-2022-24914 State: REJECTED Published: N/A Last Updated: 2025-05-28T18:19:14.643Z Description: No description available.
CVE ID: CVE-2022-24915 State: PUBLISHED Published: 2022-03-09T15:34:08.852Z Last Updated: 2025-04-16T18:00:07.673Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: IPCOMM Products: IPCOMM ipDIO Problem Types: CWE-94 Description: The absence of filters when loading some sections in the web application of the vulnerable device allows attackers to inject malicious code that will be interpreted when a legitimate user accesses the web section where the information is displayed. Injection can be done on specific parameters. The injected code is executed when a legitimate user attempts to upload, copy, download, or delete an existing configuration (Administrative Servic