Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-36728 State: PUBLISHED Published: 2022-08-18T19:54:55 Last Updated: 2024-08-03T10:14:28.159Z Vendors: n/a Products: n/a Problem Types: n/a Description: Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the RollNo parameter at /staff/delstu.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/k0xx11/bug_report/blob/main/vendors/kingbhob02/library-management-system/SQLi-17.md
CVE ID: CVE-2022-36729 State: PUBLISHED Published: 2022-08-18T19:54:42 Last Updated: 2024-08-03T10:14:27.987Z Vendors: n/a Products: n/a Problem Types: n/a Description: Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the M_Id parameter at /librarian/del.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/k0xx11/bug_report/blob/main/vendors/kingbhob02/library-management-system/SQLi-18.md
CVE ID: CVE-2022-36730 State: PUBLISHED Published: 2022-08-30T20:43:47 Last Updated: 2024-08-03T10:14:27.906Z Vendors: n/a Products: n/a Problem Types: n/a Description: Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the bookId parameter at /librarian/delete.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/k0xx11/bug_report/blob/main/vendors/kingbhob02/library-management-system/SQLi-20.md
CVE ID: CVE-2022-36731 State: PUBLISHED Published: 2022-08-30T20:43:48 Last Updated: 2024-08-03T10:14:27.987Z Vendors: n/a Products: n/a Problem Types: n/a Description: Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the RollNo parameter at /librarian/delstu.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/k0xx11/bug_report/blob/main/vendors/kingbhob02/library-management-system/SQLi-21.md
CVE ID: CVE-2022-36732 State: PUBLISHED Published: 2022-08-30T20:43:49 Last Updated: 2024-08-03T10:14:28.082Z Vendors: n/a Products: n/a Problem Types: n/a Description: Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /librarian/dele.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/k0xx11/bug_report/blob/main/vendors/kingbhob02/library-management-system/SQLi-19.md
CVE ID: CVE-2022-36733 State: PUBLISHED Published: 2022-08-30T20:43:50 Last Updated: 2024-08-03T10:14:28.138Z Vendors: n/a Products: n/a Problem Types: n/a Description: Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the M_Id parameter at /admin/del.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/k0xx11/bug_report/blob/main/vendors/kingbhob02/library-management-system/SQLi-22.md
CVE ID: CVE-2022-36734 State: PUBLISHED Published: 2022-08-30T20:43:51 Last Updated: 2024-08-03T10:14:27.968Z Vendors: n/a Products: n/a Problem Types: n/a Description: Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the RollNo parameter at /admin/delstu.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/k0xx11/bug_report/blob/main/vendors/kingbhob02/library-management-system/SQLi-24.md
CVE ID: CVE-2022-36735 State: PUBLISHED Published: 2022-08-30T20:43:52 Last Updated: 2024-08-03T10:14:28.081Z Vendors: n/a Products: n/a Problem Types: n/a Description: Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the bookId parameter at /admin/delete.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/k0xx11/bug_report/blob/main/vendors/kingbhob02/library-management-system/SQLi-23.md
CVE ID: CVE-2022-36736 State: PUBLISHED Published: 2022-09-08T12:59:42 Last Updated: 2024-08-03T10:14:28.135Z Vendors: n/a Products: n/a Problem Types: n/a Description: Jitsi-2.10.5550 was discovered to contain a vulnerability in its web UI which allows attackers to perform a clickjacking attack via a crafted HTTP request. NOTE: this is disputed by the vendor Additional Analyst Notes: - CVE Program Container: References: - https://meet.jit.si/ - https://github.com/UditChavda/Udit-Chavda-CVE/blob/main/CVE-2022-36736
CVE ID: CVE-2022-36745 State: PUBLISHED Published: 2022-08-30T21:27:43 Last Updated: 2024-08-03T10:14:27.917Z Vendors: n/a Products: n/a Problem Types: n/a Description: LibreNMS v22.6.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component print-customoid.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/librenms/librenms/pull/14126
CVE ID: CVE-2022-36746 State: PUBLISHED Published: 2022-08-30T21:27:43 Last Updated: 2024-08-03T10:14:28.155Z Vendors: n/a Products: n/a Problem Types: n/a Description: LibreNMS v22.6.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component oxidized-cfg-check.inc.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/librenms/librenms/pull/14126
CVE ID: CVE-2022-36747 State: PUBLISHED Published: 2022-08-30T21:27:44 Last Updated: 2024-08-03T10:14:28.151Z Vendors: n/a Products: n/a Problem Types: n/a Description: Razor v0.8.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the function uploadchannel(). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/cobub/razor/issues/176 - https://gist.github.com/enferas/b00038c9add210ab639c13e0729425c9
CVE ID: CVE-2022-36748 State: PUBLISHED Published: 2022-08-30T21:27:45 Last Updated: 2024-08-03T10:14:28.338Z Vendors: n/a Products: n/a Problem Types: n/a Description: PicUploader v2.6.3 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /master/index.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/xiebruce/PicUploader/issues/80
CVE ID: CVE-2022-36749 State: PUBLISHED Published: 2022-08-30T21:27:46 Last Updated: 2024-08-03T10:14:27.993Z Vendors: n/a Products: n/a Problem Types: n/a Description: RPi-Jukebox-RFID v2.3.0 was discovered to contain a command injection vulnerability via the component /htdocs/utils/Files.php. This vulnerability is exploited via a crafted payload injected into the file name of an uploaded file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/MiczFlor/RPi-Jukebox-RFID/issues/1859
CVE ID: CVE-2022-36750 State: PUBLISHED Published: 2022-08-10T16:29:51 Last Updated: 2024-08-03T10:14:28.420Z Vendors: n/a Products: n/a Problem Types: n/a Description: Clinic's Patient Management System v1.0 is vulnerable to SQL injection via /pms/update_user.php?id=. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/FF9118/bug_report/blob/main/vendors/oretnom23/clinics-patient-management-system/SQLi-1.md
CVE ID: CVE-2022-36752 State: PUBLISHED Published: 2022-07-28T22:50:03 Last Updated: 2024-08-03T10:14:27.993Z Vendors: n/a Products: n/a Problem Types: n/a Description: png2webp v1.0.4 was discovered to contain an out-of-bounds write via the function w2p. This vulnerability is exploitable via a crafted png file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/landfillbaby/png2webp/issues/3 - https://github.com/landfillbaby/png2webp/commit/8f21ad79b0cd98fc22d5b49734543101946abbff
CVE ID: CVE-2022-36754 State: PUBLISHED Published: 2022-09-02T22:30:08 Last Updated: 2024-08-03T10:14:28.409Z Vendors: n/a Products: n/a Problem Types: n/a Description: Expense Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /Home/debit_credit_p. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mikeccltt/0724/blob/main/ci_ems/sql.md
CVE ID: CVE-2022-36755 State: PUBLISHED Published: 2022-08-28T15:44:40 Last Updated: 2024-08-03T10:14:27.967Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DIR845L A1 contains a authentication vulnerability via an AUTHORIZED_GROUP=1 value, as demonstrated by a request for getcfg.php. Additional Analyst Notes: - CVE Program Container: References: - https://www.dlink.com/en/security-bulletin/ - https://drive.google.com/file/d/1yc4aYBiU_ao-YYCNGPfayhwWIaXxkWQJ/view?usp=sharing
CVE ID: CVE-2022-36756 State: PUBLISHED Published: 2022-08-28T15:46:48 Last Updated: 2024-08-03T10:14:28.010Z Vendors: n/a Products: n/a Problem Types: n/a Description: DIR845L A1 v1.00-v1.03 is vulnerable to command injection via /htdocs/upnpinc/gena.php. Additional Analyst Notes: - CVE Program Container: References: - https://www.dlink.com/en/security-bulletin/ - https://drive.google.com/file/d/1S9MODTsa70LS3UPFY1ohyPJXtqr17IkQ/view?usp=sharing
CVE ID: CVE-2022-36757 State: REJECTED Published: 2022-09-06T19:09:54 Last Updated: 2022-09-20T12:30:04 Description: No description available.
CVE ID: CVE-2022-36759 State: PUBLISHED Published: 2022-09-02T02:37:42 Last Updated: 2024-08-03T10:14:28.082Z Vendors: n/a Products: n/a Problem Types: n/a Description: Online Food Ordering System v1.0 was discovered to contain a SQL injection vulnerability via the component /dishes.php?res_id=. Additional Analyst Notes: - CVE Program Container: References: - https://hackmd.io/%40hieuleuxuan/OFOS_Sql_Injection
CVE ID: CVE-2022-36760 State: PUBLISHED Published: 2023-01-17T19:11:55.106Z Last Updated: 2025-04-04T18:08:02.696Z Vendors: Apache Software Foundation Products: Apache HTTP Server Problem Types: CWE-444 Description: Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server allows an attacker to smuggle requests to the AJP server it forwards requests to. This issue affects Apache HTTP Server Apache HTTP Server 2.4 version 2.4.54 and prior versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://httpd.apache.org/security/vulnerabilities_24.html - https://security.gentoo.org/gls
Vulnrichment: References: - https://httpd.apache.org/security/vulnerabilities_24.html - https://security.gentoo.org/glsa/202309-01
CVE ID: CVE-2022-36763 State: PUBLISHED Published: 2024-01-09T16:09:11.058Z Last Updated: 2025-11-03T19:27:13.432Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:H) Vendors: TianoCore Products: edk2 Problem Types: CWE-122 Description: EDK2 is susceptible to a vulnerability in the Tcg2MeasureGptTable() function, allowing a user to trigger a heap buffer overflow via a local network. Successful exploitation of this vulnerability may result in a compromise of confidentiality, integrity, and/or availability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/tianocore/edk2/security/advisories/GHSA-xvv8-66cq-prwr - https:
CISA ADP Vulnrichment: References: - https://github.com/tianocore/edk2/security/advisories/GHSA-xvv8-66cq-prwr - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SJ42V7O7F4OU6R7QSQQECLB6LDHKZIMQ/
CVE ID: CVE-2022-36764 State: PUBLISHED Published: 2024-01-09T16:09:44.836Z Last Updated: 2025-11-03T19:27:14.823Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:H) Vendors: TianoCore Products: edk2 Problem Types: CWE-122 Description: EDK2 is susceptible to a vulnerability in the Tcg2MeasurePeImage() function, allowing a user to trigger a heap buffer overflow via a local network. Successful exploitation of this vulnerability may result in a compromise of confidentiality, integrity, and/or availability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/tianocore/edk2/security/advisories/GHSA-4hcq-p8q8-hj8j - https:/
CISA ADP Vulnrichment: References: - https://github.com/tianocore/edk2/security/advisories/GHSA-4hcq-p8q8-hj8j - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SJ42V7O7F4OU6R7QSQQECLB6LDHKZIMQ/
CVE ID: CVE-2022-36765 State: PUBLISHED Published: 2024-01-09T16:10:16.350Z Last Updated: 2025-11-03T19:27:16.178Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:H) Vendors: TianoCore Products: edk2 Problem Types: CWE-680 Description: EDK2 is susceptible to a vulnerability in the CreateHob() function, allowing a user to trigger a integer overflow to buffer overflow via a local network. Successful exploitation of this vulnerability may result in a compromise of confidentiality, integrity, and/or availability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/tianocore/edk2/security/advisories/GHSA-ch4w-v7m3-g8wx - h
er: - CISA ADP Vulnrichment: References: - https://github.com/tianocore/edk2/security/advisories/GHSA-ch4w-v7m3-g8wx - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SJ42V7O7F4OU6R7QSQQECLB6LDHKZIMQ/
CVE ID: CVE-2022-36768 State: PUBLISHED Published: 2022-09-13T20:45:28.190424Z Last Updated: 2024-09-16T20:27:18.501Z Severity: HIGH (CVSS 8.4 CVSS:3.0/A:H/C:H/I:H/AC:L/S:U/PR:N/UI:N/AV:L/RL:O/E:U/RC:C) Vendors: IBM Products: AIX, VIOS Problem Types: Gain Privileges Description: IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the invscout command to obtain root privileges. IBM X-Force ID: 232014. Additional Analyst Notes: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/6619725 - https://exchange.xforce.ibmcloud.com/vulnerabilities/232014
CVE ID: CVE-2022-36769 State: PUBLISHED Published: 2023-04-26T02:52:02.470Z Last Updated: 2025-01-31T16:13:49.538Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: IBM Products: Cloud Pak for Data Problem Types: CWE-77 Description: IBM Cloud Pak for Data 4.5 and 4.6 could allow a privileged user to upload malicious files of dangerous types that can be automatically processed within the product's environment. IBM X-Force ID: 232034. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/6980959 - https://exchange.xforce.ibmcloud.com/vulnerabilities/232034
CVE ID: CVE-2022-36771 State: PUBLISHED Published: 2022-09-28T15:55:16.059Z Last Updated: 2025-05-21T14:25:03.232Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/C:L/PR:L/A:N/I:N/AC:L/AV:N/S:U/UI:N/RL:O/E:U/RC:C) Vendors: IBM Products: QRadar User Behavior Analytics Problem Types: Obtain Information Description: IBM QRadar User Behavior Analytics could allow an authenticated user to obtain sensitive information from that they should not have access to. IBM X-Force ID: 232791. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/6824197 - https://exchange.xforce.ibmcloud.com/vulnerabilities/232791
CVE ID: CVE-2022-36772 State: PUBLISHED Published: 2022-10-07T17:00:30.307735Z Last Updated: 2024-09-16T16:24:13.044Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/UI:N/A:N/PR:L/I:N/AC:L/S:U/C:L/E:U/RC:C/RL:O) Vendors: IBM Products: InfoSphere Information Server Problem Types: Obtain Information Description: IBM InfoSphere Information Server 11.7 could allow an authenticated user to obtain sensitive information that should only be available to a privileged user. Additional Analyst Notes: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/6612325 - https://exchange.xforce.ibmcloud.com/vulnerabilities/233299
CVE ID: CVE-2022-36773 State: PUBLISHED Published: 2022-09-01T19:00:29.851093Z Last Updated: 2024-09-16T19:40:32.329Z Severity: HIGH (CVSS 7.1 CVSS:3.0/AC:L/I:N/AV:N/C:H/A:L/UI:N/S:U/PR:L/RC:C/RL:O/E:U) Vendors: IBM Products: Cognos Analytics Problem Types: Obtain Information Description: IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 233571. Additional Analyst Notes: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/6615285 - https://exchange.xforce
t Notes: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/6615285 - https://exchange.xforce.ibmcloud.com/vulnerabilities/233571 - https://security.netapp.com/advisory/ntap-20221014-0005/
CVE ID: CVE-2022-36774 State: PUBLISHED Published: 2022-10-06T17:15:26.385934Z Last Updated: 2024-09-16T23:02:10.208Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/C:N/I:H/S:U/UI:N/A:N/PR:N/AV:A/AC:L/E:U/RL:O/RC:C) Vendors: IBM Products: Robotic Process Automation Problem Types: File Manipulation Description: IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 is vulnerable to man in the middle attacks through manipulation of the client proxy configuration. IBM X-Force ID: 233575. Additional Analyst Notes: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/6826013 - https://exchange.xforce.ibmcloud.com/vulnerabilities/233575
CVE ID: CVE-2022-36775 State: PUBLISHED Published: 2023-02-17T16:22:46.450Z Last Updated: 2025-03-12T20:07:43.499Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: IBM Products: Security Verify Access Problem Types: 644 Improper Neutralization of HTTP Headers for Scripting Syntax Description: IBM Security Verify Access 10.0.0.0, 10.0.1.0, 10.0.2.0, 10.0.3.0, and10.0.4.0 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking. IBM X-Force ID: 233576. Additional An
able system, including cross-site scripting, cache poisoning or session hijacking. IBM X-Force ID: 233576. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/6953617 - https://exchange.xforce.ibmcloud.com/vulnerabilities/233576
CVE ID: CVE-2022-36776 State: PUBLISHED Published: 2022-11-11T18:44:09.367Z Last Updated: 2025-05-01T13:39:54.714Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: IBM Products: Cloud Pak for Security Problem Types: CWE-79 Description: IBM Cloud Pak for Security (CP4S) 1.10.0.0 79and 1.10.2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 233663. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/suppor
63. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/6833574 - https://exchange.xforce.ibmcloud.com/vulnerabilities/233663
CVE ID: CVE-2022-36777 State: PUBLISHED Published: 2023-11-22T18:28:11.058Z Last Updated: 2024-11-21T18:56:39.591Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: IBM Products: Cloud Pak for Security, QRadar Suite Software Problem Types: CWE-200 Description: IBM Cloud Pak for Security (CP4S) 1.10.0.0 through 1.10.11.0 and IBM QRadar Suite Software 1.10.12.0 through 1.10.16.0could allow an authenticated user to obtain sensitive version information that could aid in further attacks against the system. IBM X-Force ID: 233665. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7080058
t Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7080058 - https://exchange.xforce.ibmcloud.com/vulnerabilities/233665
CVE ID: CVE-2022-36778 State: PUBLISHED Published: 2022-09-13T14:58:01.033588Z Last Updated: 2024-09-17T03:38:08.487Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L) Vendors: Synel Products: eHarmony Problem Types: CWE-79 Description: insert HTML / js code inside input how to get to the vulnerable input : Workers &gt; worker nickname &gt; inject in this input the code. Additional Analyst Notes: - CVE Program Container: References: - https://www.gov.il/en/departments/faq/cve_advisories
CVE ID: CVE-2022-36779 State: PUBLISHED Published: 2022-09-13T14:57:52.794084Z Last Updated: 2024-09-16T16:33:09.230Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L) Vendors: PROSCEND Products: PROSCEND M330-w / M330-W5, PROSCEND M350-5G / M350-W5G / M350-6 / M350-W6, PROSCEND M301-G / M301-GW, ADVICE ICR 111WG Problem Types: Unauthenticated OS Command Injection Description: PROSCEND - PROSCEND / ADVICE .Ltd - G/5G Industrial Cellular Router (with GPS)4 Unauthenticated OS Command Injection Proscend M330-w / M33-W5 / M350-5G / M350-W5G / M350-6 / M350-W6 / M301-G / M301-GW ADVICE ICR 111WG / https://www.proscend.com/en/category/industrial-Cellular-Router/industrial-Ce
0-W6 / M301-G / M301-GW ADVICE ICR 111WG / https://www.proscend.com/en/category/industrial-Cellular-Router/industrial-Cellular-Router.html https://cdn.shopify.com/s/files/1/0036/9413/3297/files/ADVICE_Industrial_4G_LTE_Cellular_Router_ICR111WG.pdf?v=1620814301 Additional Analyst Notes: - CVE Program Container: References: - https://www.gov.il/en/departments/faq/cve_advisories
CVE ID: CVE-2022-36780 State: PUBLISHED Published: 2022-09-13T14:57:56.413432Z Last Updated: 2024-09-17T02:36:24.508Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L) Vendors: Avdor CIS Products: crystal quality Problem Types: Credentials Management Errors Description: Avdor CIS - crystal quality Credentials Management Errors. The product is phone call recorder, you can hear all the recorded calls without authenticate to the system. Attacker sends crafted URL to the system: ip:port//V=2;ChannellD=number;Ext=number;Command=startLM;Client=number;Request=number;R=number number - id of the recorded number. Additional Analyst Notes: - CVE Program Container: References: - h
t=number;R=number number - id of the recorded number. Additional Analyst Notes: - CVE Program Container: References: - https://www.gov.il/en/Departments/faq/cve_advisories
CVE ID: CVE-2022-36781 State: PUBLISHED Published: 2022-09-28T19:11:20.650962Z Last Updated: 2024-09-16T20:16:20.390Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: ConnectWise Products: ScreenConnect Problem Types: Session Code Bypass Description: ConnectWise ScreenConnect versions 22.6 and below contained a flaw allowing potential brute force attacks on custom access tokens due to inadequate rate-limiting controls in the default configuration. Attackers could exploit this vulnerability to gain unauthorized access by repeatedly attempting access code combinations. ConnectWise has addressed this issue in later versions by implementing rate-limiting controls
access code combinations. ConnectWise has addressed this issue in later versions by implementing rate-limiting controls as a preventive measure against brute force attacks. Additional Analyst Notes: - CVE Program Container: References: - https://www.gov.il/en/Departments/faq/cve_advisories
CVE ID: CVE-2022-36782 State: PUBLISHED Published: 2022-09-13T14:58:04.852468Z Last Updated: 2024-09-16T18:54:37.400Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Pal Electronics Systems Products: Pal Gate Problem Types: Authorization Errors Description: Pal Electronics Systems - Pal Gate Authorization Errors. The vulnerability is an authorization problem in PalGate device management android client app. Gates of bulidings and parking lots with a simple button in any smartphone. The API was found after a decompiling and static research using Jadx, and a dynamic analasys using Frida. The attacker can iterate over all the IOT devices to see every entry and e