Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-37386 State: PUBLISHED Published: 2023-03-29T00:00:00.000Z Last Updated: 2025-02-14T20:32:57.714Z Severity: LOW (CVSS 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: Foxit Products: PDF Reader Problem Types: CWE-125 Description: This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Reader 11.2.2.53575. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the resetForm method. By performing actions in JavaScript, an attacker can trigger a read past the end of an allocated object. An attacker can
By performing actions in JavaScript, an attacker can trigger a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-17550. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.foxit.com/support/security-bulletins.html - https://www.zerodayinitiative.com/advisories/ZDI-22-1058/
CVE ID: CVE-2022-37387 State: PUBLISHED Published: 2023-03-29T00:00:00.000Z Last Updated: 2025-02-14T20:32:41.493Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Foxit Products: PDF Reader Problem Types: CWE-416 Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.2.2.53575. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of AcroForms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An
e issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17552. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.foxit.com/support/security-bulletins.html - https://www.zerodayinitiative.com/advisories/ZDI-22-1059/
CVE ID: CVE-2022-37388 State: PUBLISHED Published: 2023-03-29T00:00:00.000Z Last Updated: 2025-02-18T19:55:04.950Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Foxit Products: PDF Reader Problem Types: CWE-125 Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.2.2.53575. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. Crafted data in a PDF file can trigger a read past the end of an allocated buffer. An attacker can leverage this vulnerabil
fted data in a PDF file can trigger a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17516. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.foxit.com/support/security-bulletins.html - https://www.zerodayinitiative.com/advisories/ZDI-22-1060/
CVE ID: CVE-2022-37389 State: PUBLISHED Published: 2023-03-29T00:00:00.000Z Last Updated: 2025-02-18T19:44:24.348Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Foxit Products: PDF Reader Problem Types: CWE-416 Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.2.2.53575. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of AcroForms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An
e issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17545. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.foxit.com/support/security-bulletins.html - https://www.zerodayinitiative.com/advisories/ZDI-22-1061/
CVE ID: CVE-2022-37390 State: PUBLISHED Published: 2023-03-29T00:00:00.000Z Last Updated: 2025-02-18T19:43:28.760Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Foxit Products: PDF Reader Problem Types: CWE-416 Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.2.2.53575. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of AcroForms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An
e issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17551. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.foxit.com/support/security-bulletins.html - https://www.zerodayinitiative.com/advisories/ZDI-22-1062/
CVE ID: CVE-2022-37391 State: PUBLISHED Published: 2023-03-29T00:00:00.000Z Last Updated: 2025-02-18T19:37:50.474Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Foxit Products: PDF Reader Problem Types: CWE-416 Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.2.2.53575. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of AcroForms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An
e issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17661. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.foxit.com/support/security-bulletins.html - https://www.zerodayinitiative.com/advisories/ZDI-22-1063/
CVE ID: CVE-2022-37392 State: PUBLISHED Published: 2022-12-19T10:59:05.957Z Last Updated: 2025-04-17T14:20:28.706Z Vendors: Apache Software Foundation Products: Apache Traffic Server Problem Types: CWE-754 Description: Improper Check for Unusual or Exceptional Conditions vulnerability in handling the requests to Apache Traffic Server. This issue affects Apache Traffic Server 8.0.0 to 9.1.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/mrj2lg4s0hf027rk7gz8t7hbn9xpfg02
CVE ID: CVE-2022-37393 State: PUBLISHED Published: 2022-08-16T20:00:19.211637Z Last Updated: 2024-09-17T00:45:31.181Z Vendors: Synacor Products: Zimbra Server Problem Types: CWE-284 Description: Zimbra's sudo configuration permits the zimbra user to execute the zmslapd binary as root with arbitrary parameters. As part of its intended functionality, zmslapd can load a user-defined configuration file, which includes plugins in the form of .so files, which also execute as root. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/rapid7/metasploit-framework/pull/16807 - https://attackerkb.com/topics/92AeLOE1M1/cve-2022-37393/rapid7-analysis - https://darrenmartyn.
t-framework/pull/16807 - https://attackerkb.com/topics/92AeLOE1M1/cve-2022-37393/rapid7-analysis - https://darrenmartyn.ie/2021/10/27/zimbra-zmslapd-local-root-exploit/
CVE ID: CVE-2022-37394 State: PUBLISHED Published: 2022-08-03T06:43:44 Last Updated: 2024-08-03T10:29:20.965Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in OpenStack Nova before 23.2.2, 24.x before 24.1.2, and 25.x before 25.0.2. By creating a neutron port with the direct vnic_type, creating an instance bound to that port, and then changing the vnic_type of the bound port to macvtap, an authenticated user may cause the compute service to fail to restart, resulting in a possible denial of service. Only Nova deployments configured with SR-IOV are affected. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.launchpad.net/ossa/+b
SR-IOV are affected. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.launchpad.net/ossa/+bug/1981813 - https://review.opendev.org/c/openstack/nova/+/849985 - https://review.opendev.org/c/openstack/nova/+/850003
CVE ID: CVE-2022-37395 State: PUBLISHED Published: 2022-09-20T19:46:56.000Z Last Updated: 2025-05-28T16:00:48.503Z Vendors: n/a Products: CV81-WDM FW Problem Types: The input verification Description: A Huawei device has an input verification vulnerability. Successful exploitation of this vulnerability may lead to DoS attacks.Affected product versions include:CV81-WDM FW versions 01.70.49.29.46. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20220810-01-8cfecdcc-en
CVE ID: CVE-2022-37396 State: PUBLISHED Published: 2022-08-03T15:40:10 Last Updated: 2024-08-03T10:29:21.005Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: JetBrains Products: Rider Problem Types: CWE-94 Description: In JetBrains Rider before 2022.2 Trust and Open Project dialog could be bypassed, leading to local code execution Additional Analyst Notes: - CVE Program Container: References: - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2022-37397 State: PUBLISHED Published: 2022-08-12T18:01:37 Last Updated: 2024-08-03T10:29:21.063Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L) Vendors: YugaByte, Inc. Products: Yugabyte DB Problem Types: CWE-287, CWE-16 Description: An issue was discovered in the YugabyteDB 2.6.1 when using LDAP-based authentication in YCQL with Microsoft’s Active Directory. When anonymous or unauthenticated LDAP binding is enabled, it allows bypass of authentication with an empty password. Additional Analyst Notes: - CVE Program Container: References: - https://www.yugabyte.com/
CVE ID: CVE-2022-37398 State: PUBLISHED Published: 2022-08-05T16:46:19.585398Z Last Updated: 2024-09-17T02:42:12.501Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H) Vendors: ASUSTOR Products: ADM Problem Types: CWE-121 Description: A stack-based buffer overflow vulnerability was found inside ADM when using WebDAV due to the lack of data size validation. An attacker can exploit this vulnerability to run arbitrary code. Affected ADM versions include: 3.5.9.RUE3 and below, 4.0.5.RVI1 and below as well as 4.1.0.RJD1 and below. Additional Analyst Notes: - CVE Program Container: References: - https://www.asustor.com/security/security_advisory_detail?id=12
CVE ID: CVE-2022-37400 State: PUBLISHED Published: 2022-08-13T06:40:11 Last Updated: 2024-08-03T10:29:20.978Z Vendors: Apache Software Foundation Products: Apache OpenOffice Problem Types: CWE-330 Description: Apache OpenOffice supports the storage of passwords for web connections in the user's configuration database. The stored passwords are encrypted with a single master key provided by the user. A flaw in OpenOffice existed where the required initialization vector for encryption was always the same which weakens the security of the encryption making them vulnerable if an attacker has access to the user's configuration data. This issue affects: Apache OpenOffice versions prior to 4.1.13. R
attacker has access to the user's configuration data. This issue affects: Apache OpenOffice versions prior to 4.1.13. Reference: CVE-2022-26306 - LibreOffice Additional Analyst Notes: - CVE Program Container: References: - https://www.openoffice.org/security/cves/CVE-2022-37400.html - http://www.openwall.com/lists/oss-security/2022/08/13/1
CVE ID: CVE-2022-37401 State: PUBLISHED Published: 2022-08-13T06:40:25 Last Updated: 2024-08-03T10:29:21.020Z Vendors: Apache Software Foundation Products: Apache OpenOffice Problem Types: CWE-331 Description: Apache OpenOffice supports the storage of passwords for web connections in the user's configuration database. The stored passwords are encrypted with a single master key provided by the user. A flaw in OpenOffice existed where master key was poorly encoded resulting in weakening its entropy from 128 to 43 bits making the stored passwords vulnerable to a brute force attack if an attacker has access to the users stored config. This issue affects: Apache OpenOffice versions prior to 4.1.1
tack if an attacker has access to the users stored config. This issue affects: Apache OpenOffice versions prior to 4.1.13. Reference: CVE-2022-26307 - LibreOffice Additional Analyst Notes: - CVE Program Container: References: - https://www.openoffice.org/security/cves/CVE-2022-37401.html - http://www.openwall.com/lists/oss-security/2022/08/13/2
CVE ID: CVE-2022-37402 State: PUBLISHED Published: 2023-03-15T15:06:39.565Z Last Updated: 2025-01-13T15:51:31.813Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: AFS Analytics Products: AFS Analytics Problem Types: CWE-79 Description: Stored Cross-site Scripting (XSS) vulnerability in AFS Analytics plugin <= 4.18 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/addfreestats/wordpress-afs-analytics-plugin-4-15-auth-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2022-37403 State: PUBLISHED Published: 2022-09-09T14:39:54.413Z Last Updated: 2025-02-20T20:07:11.300Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: Nikhil Vaghela Products: Add User Role (WordPress plugin) Problem Types: CWE-79 Description: Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Nikhil Vaghela's Add User Role plugin <= 0.0.1 at WordPress. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/add-user-role/wordpress-add-user-role-plugin-0-0-1-authenticated-stored-cross-site-scripting-xss-vulnerability/_s_id=cve - https://wordpres
ress-add-user-role-plugin-0-0-1-authenticated-stored-cross-site-scripting-xss-vulnerability/_s_id=cve - https://wordpress.org/plugins/add-user-role/
CVE ID: CVE-2022-37404 State: PUBLISHED Published: 2022-09-09T14:39:54.607Z Last Updated: 2025-02-20T20:07:03.741Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: Christian Salazar Products: add2fav (WordPress plugin) Problem Types: CWE-79 Description: Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Christian Salazar's add2fav plugin <= 1.0 at WordPress. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/add2fav/wordpress-add2fav-plugin-1-0-authenticated-stored-cross-site-scripting-xss-vulnerability/_s_id=cve - https://wordpress.org/plugins/add2fav/
CVE ID: CVE-2022-37405 State: PUBLISHED Published: 2022-09-09T14:39:54.200Z Last Updated: 2025-02-20T20:07:18.939Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Mickey Kay Products: Better Font Awesome (WordPress plugin) Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Mickey Kay's Better Font Awesome plugin <= 2.0.1 at WordPress. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/better-font-awesome/wordpress-better-font-awesome-plugin-2-0-1-cross-site-request-forgery-csrf-vulnerability/_s_id=cve - https://wordpress.org/plugins/better
font-awesome-plugin-2-0-1-cross-site-request-forgery-csrf-vulnerability/_s_id=cve - https://wordpress.org/plugins/better-font-awesome/#developers
CVE ID: CVE-2022-37406 State: PUBLISHED Published: 2022-12-07T00:00:00.000Z Last Updated: 2025-04-23T16:08:44.952Z Vendors: RICOH COMPANY, LTD. Products: Aficio SP 4210N Problem Types: Cross-site scripting Description: Cross-site scripting vulnerability in Aficio SP 4210N firmware versions prior to Web Support 1.05 allows a remote authenticated attacker with an administrative privilege to inject an arbitrary script. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.ricoh.com/bb/html/dr_ut_e/rc3/model/sp42/sp42.htm - https://support.ricoh.com/bbv2/html/dr_ut_d/ipsio/history/w/bb/pub_j/dr_ut_d/4101044/4101044791/V101/5236968/redirect_CLUT
tps://support.ricoh.com/bbv2/html/dr_ut_d/ipsio/history/w/bb/pub_j/dr_ut_d/4101044/4101044791/V101/5236968/redirect_CLUTool_DOM/history.htm - https://jvn.jp/en/jp/JVN24659622/index.html
CVE ID: CVE-2022-37407 State: PUBLISHED Published: 2022-09-09T14:40:07.094Z Last Updated: 2025-02-20T20:06:11.406Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N) Vendors: WPChill Products: Gallery PhotoBlocks (WordPress plugin) Problem Types: CWE-79 Description: Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities in WPChill Gallery PhotoBlocks plugin <= 1.2.6 at WordPress. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wordpress.org/plugins/photoblocks-grid-gallery/ - https://patchstack.com/database/vulnerability/photoblocks-grid-gallery/wordpress-gallery-photoblocks-plugin-1-2-6-multiple-authen
atchstack.com/database/vulnerability/photoblocks-grid-gallery/wordpress-gallery-photoblocks-plugin-1-2-6-multiple-authenticated-stored-cross-site-scripting-xss-vulnerabilities/_s_id=cve
CVE ID: CVE-2022-37408 State: REJECTED Published: N/A Last Updated: 2025-05-28T18:20:42.691Z Description: No description available.
CVE ID: CVE-2022-37409 State: PUBLISHED Published: 2023-05-10T13:16:52.817Z Last Updated: 2025-01-27T18:07:10.923Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: n/a Products: Intel(R) IPP Cryptography software Problem Types: information disclosure, CWE-691 Description: Insufficient control flow management for the Intel(R) IPP Cryptography software before version 2021.6 may allow an authenticated user to potentially enable information disclosure via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00788.html
CVE ID: CVE-2022-37410 State: PUBLISHED Published: 2024-05-16T20:47:43.732Z Last Updated: 2024-08-03T10:29:20.980Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) Thunderbolt driver software Problem Types: escalation of privilege, CWE-284 Description: Improper access control for some Intel(R) Thunderbolt driver software before version 89 may allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00916.html
CVE ID: CVE-2022-37411 State: PUBLISHED Published: 2022-09-09T14:39:55.817Z Last Updated: 2025-02-20T20:06:24.719Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: Vinoj Cardoza Products: Captcha Code (WordPress plugin) Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Vinoj Cardoza's Captcha Code plugin <= 2.7 at WordPress. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/captcha-code-authentication/wordpress-captcha-code-plugin-2-7-cross-site-request-forgery-csrf-vulnerability-leading-to-plugin-settings-update/_s_id=cve - https://wordp
ode-plugin-2-7-cross-site-request-forgery-csrf-vulnerability-leading-to-plugin-settings-update/_s_id=cve - https://wordpress.org/plugins/captcha-code-authentication/
CVE ID: CVE-2022-37412 State: PUBLISHED Published: 2022-09-09T14:39:55.294Z Last Updated: 2025-02-20T20:06:46.910Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: Galerio & Urda Products: Better Delete Revision (WordPress plugin) Problem Types: CWE-79 Description: Authenticated (admin+) Reflected Cross-Site Scripting (XSS) vulnerability in Galerio & Urda's Better Delete Revision plugin <= 1.6.1 at WordPress. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/better-delete-revision/wordpress-better-delete-revision-plugin-1-6-1-authenticated-reflected-cross-site-scripting-xss-
y/better-delete-revision/wordpress-better-delete-revision-plugin-1-6-1-authenticated-reflected-cross-site-scripting-xss-vulnerability/_s_id=cve - https://wordpress.org/plugins/better-delete-revision/
CVE ID: CVE-2022-37415 State: PUBLISHED Published: 2022-08-05T03:57:05 Last Updated: 2024-08-03T10:29:21.030Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Uniwill SparkIO.sys driver 1.0 is vulnerable to a stack-based buffer overflow via IOCTL 0x40002008. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/alfarom256/220cb75816ca2b5556e7fc8d8d2803a0
CVE ID: CVE-2022-37416 State: PUBLISHED Published: 2022-08-05T04:08:12 Last Updated: 2024-08-03T10:29:21.035Z Vendors: n/a Products: n/a Problem Types: n/a Description: Ittiam libmpeg2 before 2022-07-27 uses memcpy with overlapping memory blocks in impeg2_mc_fullx_fully_8x8. Additional Analyst Notes: - CVE Program Container: References: - https://issuetracker.google.com/issues/231026247 - https://android-review.googlesource.com/c/platform/external/libmpeg2/+/2132593
CVE ID: CVE-2022-37418 State: PUBLISHED Published: 2022-08-24T05:09:42 Last Updated: 2024-08-03T10:29:20.978Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Remote Keyless Entry (RKE) receiving unit on certain Nissan, Kia, and Hyundai vehicles through 2017 allows remote attackers to perform unlock operations and force a resynchronization after capturing two consecutive valid key fob signals over the radio, aka a RollBack attack. The attacker retains the ability to unlock indefinitely. Additional Analyst Notes: - CVE Program Container: References: - https://www.blackhat.com/us-22/briefings/schedule/#rollback---a-new-time-agnostic-replay-attack-against-the-automotive-remote-key
ww.blackhat.com/us-22/briefings/schedule/#rollback---a-new-time-agnostic-replay-attack-against-the-automotive-remote-keyless-entry-systems-27185 - https://medium.com/codex/rollback-a-new-time-agnostic-replay-attack-against-the-automotive-remote-keyless-entry-systems-df5f99ba9490 - https://www.youtube.com/playlist?list=PLYodcy84oQL1gxwiuRm13xRXxTQL9cO5t - https://www.pcmag.com/news/is-your-car-key-fob-vulnerable-to-this-simple-replay-attack - https://hackaday.com/2022/08/17/rollback-breaks-into-your-car/
CVE ID: CVE-2022-37421 State: PUBLISHED Published: 2022-11-23T00:00:00.000Z Last Updated: 2025-04-25T20:35:25.056Z Vendors: n/a Products: n/a Problem Types: n/a Description: Silverstripe silverstripe/cms through 4.11.0 allows XSS. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.silverstripe.org/download/security-releases/ - https://www.silverstripe.org/blog/tag/release - https://forum.silverstripe.org/c/releases - https://www.silverstripe.org/download/security-releases/CVE-2022-37421