Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-38476 State: PUBLISHED Published: 2022-12-22T00:00:00.000Z Last Updated: 2025-04-15T17:24:15.982Z Vendors: Mozilla Products: Firefox ESR, Thunderbird Problem Types: Data race and potential use-after-free in PK11_ChangePW Description: A data race could occur in the <code>PK11_ChangePW</code> function, potentially leading to a use-after-free vulnerability. In Firefox, this lock protected the data when a user changed their master password. This vulnerability affects Firefox ESR < 102.2 and Thunderbird < 102.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mozilla.org/security/advisories/mfsa2022-36/ - https://www.mozilla.o
- CISA ADP Vulnrichment: References: - https://www.mozilla.org/security/advisories/mfsa2022-36/ - https://www.mozilla.org/security/advisories/mfsa2022-34/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1760998
CVE ID: CVE-2022-38477 State: PUBLISHED Published: 2022-12-22T00:00:00.000Z Last Updated: 2025-04-15T17:22:09.462Z Vendors: Mozilla Products: Firefox ESR, Thunderbird, Firefox Problem Types: Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2 Description: Mozilla developer Nika Layzell and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 103 and Firefox ESR 102.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 102.2, Thunderbird < 102.2, and Firefox < 104. Additional Analyst Notes: - CVE Program Container: - C
ects Firefox ESR < 102.2, Thunderbird < 102.2, and Firefox < 104. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mozilla.org/security/advisories/mfsa2022-33/ - https://www.mozilla.org/security/advisories/mfsa2022-36/ - https://www.mozilla.org/security/advisories/mfsa2022-34/ - https://bugzilla.mozilla.org/buglist.cgi?bug_id=1760611%2C1770219%2C1771159%2C1773363
CVE ID: CVE-2022-38478 State: PUBLISHED Published: 2022-12-22T00:00:00.000Z Last Updated: 2025-04-15T17:20:18.313Z Vendors: Mozilla Products: Thunderbird, Firefox ESR, Firefox Problem Types: Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2, and Firefox ESR 91.13 Description: Members the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 103, Firefox ESR 102.1, and Firefox ESR 91.12. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 102.2, Thunderbird < 91.13, Firefox ESR < 91.13, Firefox ESR < 102.2, and Firefox < 104.
erability affects Thunderbird < 102.2, Thunderbird < 91.13, Firefox ESR < 91.13, Firefox ESR < 102.2, and Firefox < 104. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mozilla.org/security/advisories/mfsa2022-35/ - https://www.mozilla.org/security/advisories/mfsa2022-33/ - https://www.mozilla.org/security/advisories/mfsa2022-37/ - https://www.mozilla.org/security/advisories/mfsa2022-36/ - https://www.mozilla.org/security/advisories/mfsa2022-34/ - https://bugzilla.mozilla.org/buglist.cgi?bug_id=1770630%2C1776658
CVE ID: CVE-2022-38481 State: PUBLISHED Published: 2023-01-10T00:00:00.000Z Last Updated: 2025-05-30T16:02:22.261Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AC:L/AV:N/A:N/C:L/I:L/PR:N/S:C/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Mega HOPEX 15.2.0.6110 before V5CP2. The application is prone to reflected Cross-site Scripting (XSS) in several features. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mega.com/en/hopex-platform - https://excellium-services.com/cert-xlm-advisory/CVE-2022-38481 - https://cds.thalesgroup.com/en/tcs-cert/CVE-2022-38481
CVE ID: CVE-2022-38482 State: PUBLISHED Published: 2023-01-10T00:00:00.000Z Last Updated: 2025-05-30T16:02:22.870Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AC:L/AV:N/A:N/C:L/I:N/PR:N/S:U/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: A link-manipulation issue was discovered in Mega HOPEX 15.2.0.6110 before V5CP4. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mega.com/en/hopex-platform - https://excellium-services.com/cert-xlm-advisory/CVE-2022-38482 - https://cds.thalesgroup.com/en/tcs-cert/CVE-2022-38482
CVE ID: CVE-2022-38484 State: PUBLISHED Published: 2023-10-24T00:00:00 Last Updated: 2024-09-17T13:44:23.005Z Vendors: n/a Products: n/a Problem Types: n/a Description: An arbitrary file upload and directory traversal vulnerability exist in the file upload functionality of the System Setup menu in AgeVolt Portal prior to version 0.1. A remote authenticated attacker could leverage this vulnerability to upload files to any location on the target operating system with web server privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://citadelo.com/download/CVE-2022-38484.pdf
CVE ID: CVE-2022-38485 State: PUBLISHED Published: 2023-10-24T00:00:00 Last Updated: 2024-10-27T17:47:17.635Z Vendors: n/a Products: n/a Problem Types: n/a Description: A directory traversal vulnerability exists in the AgeVolt Portal prior to version 0.1 that leads to Information Disclosure. A remote authenticated attacker could leverage this vulnerability to read files from any location on the target operating system with web server privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://citadelo.com/download/CVE-2022-38485.pdf
CVE ID: CVE-2022-38488 State: PUBLISHED Published: 2022-12-14T00:00:00.000Z Last Updated: 2025-04-22T16:00:35.149Z Vendors: n/a Products: n/a Problem Types: n/a Description: logrocket-oauth2-example through 2020-05-27 allows SQL injection via the /auth/register username parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/diogosouza/logrocket-oauth2-example - https://archive.ph/PecmD - https://blog.logrocket.com/implement-oauth-2-0-node-js/ - https://archive.ph/VlGDa - https://github.com/secoats/cve/tree/master/CVE-2022-38488_sqli_logrocket-oauth2-example
CVE ID: CVE-2022-38489 State: PUBLISHED Published: 2023-01-10T00:00:00.000Z Last Updated: 2025-04-09T15:34:51.340Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AC:L/AV:N/A:N/C:L/I:L/PR:H/S:C/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in EasyVista 2020.2.125.3 and 2022.1.109.0.03 It is prone to stored Cross-site Scripting (XSS). Version 2022.1.110.1.02 fixes the vulnerably. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://excellium-services.com/cert-xlm-advisory/CVE-2022-38489
CVE ID: CVE-2022-38490 State: PUBLISHED Published: 2023-01-10T00:00:00.000Z Last Updated: 2025-04-09T15:50:30.595Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AC:L/AV:N/A:N/C:H/I:H/PR:L/S:C/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in EasyVista 2020.2.125.3 and 2022.1.109.0.03. Some parameters allow SQL injection. Version 2022.1.110.1.02 corrects this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://excellium-services.com/cert-xlm-advisory/CVE-2022-38490
CVE ID: CVE-2022-38491 State: PUBLISHED Published: 2023-01-10T00:00:00.000Z Last Updated: 2025-04-09T15:49:52.399Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AC:L/AV:N/A:N/C:H/I:L/PR:N/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in EasyVista 2020.2.125.3 and 2022.1.109.0.03. Part of the application does not implement protection against brute-force attacks. Version 2022.1.133.0 corrects this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://excellium-services.com/cert-xlm-advisory/CVE-2022-38491
CVE ID: CVE-2022-38492 State: PUBLISHED Published: 2023-01-10T00:00:00.000Z Last Updated: 2025-04-09T15:49:02.239Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AC:L/AV:N/A:N/C:H/I:N/PR:L/S:C/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in EasyVista 2020.2.125.3 and 2022.1.109.0.03. One parameter allows SQL injection. Version 2022.1.110.1.02 fixes the vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://excellium-services.com/cert-xlm-advisory/CVE-2022-38492
CVE ID: CVE-2022-38493 State: PUBLISHED Published: 2022-08-20T19:41:15 Last Updated: 2024-08-03T10:54:03.986Z Vendors: n/a Products: n/a Problem Types: n/a Description: Rhonabwy 0.9.99 through 1.1.x before 1.1.7 doesn't check the RSA private key length before RSA-OAEP decryption. This allows attackers to cause a Denial of Service via a crafted JWE (JSON Web Encryption) token. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/babelouest/rhonabwy/commit/dd528b3aabd13863f855a68e76966e4e019fc399
CVE ID: CVE-2022-38495 State: PUBLISHED Published: 2022-09-13T20:16:46 Last Updated: 2024-08-03T10:54:03.774Z Vendors: n/a Products: n/a Problem Types: n/a Description: LIEF commit 365a16a was discovered to contain a heap-buffer overflow via the function print_binary at /c/macho_reader.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/lief-project/LIEF/issues/767
CVE ID: CVE-2022-38496 State: PUBLISHED Published: 2022-09-13T20:16:47 Last Updated: 2024-08-03T10:54:03.752Z Vendors: n/a Products: n/a Problem Types: n/a Description: LIEF commit 365a16a was discovered to contain a reachable assertion abort via the component BinaryStream.hpp. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/lief-project/LIEF/issues/765
CVE ID: CVE-2022-38497 State: PUBLISHED Published: 2022-09-13T20:16:48 Last Updated: 2024-08-03T10:54:03.669Z Vendors: n/a Products: n/a Problem Types: n/a Description: LIEF commit 365a16a was discovered to contain a segmentation violation via the component CoreFile.tcc:69. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/lief-project/LIEF/issues/766
CVE ID: CVE-2022-38509 State: PUBLISHED Published: 2022-09-19T21:01:51.000Z Last Updated: 2025-05-29T15:37:58.482Z Vendors: n/a Products: n/a Problem Types: n/a Description: Wedding Planner v1.0 was discovered to contain a SQL injection vulnerability via the booking_id parameter at /admin/budget.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ptanly/bug_report/blob/main/vendors/pushpam02/wedding-planner/SQLi-1.md
CVE ID: CVE-2022-38510 State: PUBLISHED Published: 2022-08-28T23:58:58 Last Updated: 2024-08-03T10:54:03.770Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda_TX9pro V22.03.02.10 was discovered to contain a buffer overflow via the component httpd/SetNetControlList. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/whiter6666/CVE/blob/main/Tenda_TX9pro/SetNetControlList.md
CVE ID: CVE-2022-38511 State: PUBLISHED Published: 2022-08-28T23:58:59 Last Updated: 2024-08-03T10:54:04.064Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK A810R V5.9c.4050_B20190424 was discovered to contain a command injection vulnerability via the component downloadFile.cgi. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/whiter6666/CVE/blob/main/TOTOLINK_A810R/downloadFile.md
CVE ID: CVE-2022-38512 State: PUBLISHED Published: 2022-09-22T00:17:41.000Z Last Updated: 2025-05-27T18:08:06.811Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Translation module in Liferay Portal v7.4.3.12 through v7.4.3.36, and Liferay DXP 7.4 update 8 through 36 does not check permissions before allowing a user to export a web content for translation, allowing attackers to download a web content page's XLIFF translation file via crafted URL. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://liferay.com - https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-38512
CVE ID: CVE-2022-38527 State: PUBLISHED Published: 2022-09-19T21:16:03.000Z Last Updated: 2025-05-29T15:27:42.766Z Vendors: n/a Products: n/a Problem Types: n/a Description: UCMS v1.6.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Import function under the Site Management page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Zoe0427/UCMS-v1.6/blob/gh-pages/UCMS_v1.6.0%20XSS.md
CVE ID: CVE-2022-38528 State: PUBLISHED Published: 2022-09-06T21:08:26 Last Updated: 2024-08-03T10:54:03.759Z Vendors: n/a Products: n/a Problem Types: n/a Description: Open Asset Import Library (assimp) commit 3c253ca was discovered to contain a segmentation violation via the component Assimp::XFileImporter::CreateMeshes. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/assimp/assimp/issues/4662
CVE ID: CVE-2022-38529 State: PUBLISHED Published: 2022-09-06T21:08:27 Last Updated: 2024-08-03T10:54:03.894Z Vendors: n/a Products: n/a Problem Types: n/a Description: tinyexr commit 0647fb3 was discovered to contain a heap-buffer overflow via the component rleUncompress. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/syoyo/tinyexr/issues/169
CVE ID: CVE-2022-38530 State: PUBLISHED Published: 2022-09-06T00:00:00 Last Updated: 2024-08-03T10:54:04.002Z Vendors: n/a Products: n/a Problem Types: n/a Description: GPAC v2.1-DEV-rev232-gfcaa01ebb-master was discovered to contain a stack overflow when processing ISOM_IOD. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gpac/gpac/issues/2216 - https://www.debian.org/security/2023/dsa-5411
CVE ID: CVE-2022-38531 State: PUBLISHED Published: 2022-09-07T23:17:34 Last Updated: 2024-08-03T10:54:04.070Z Vendors: n/a Products: n/a Problem Types: n/a Description: FPT G-97RG6M R4.2.98.035 and G-97RG3 R4.2.43.078 are vulnerable to Remote Command Execution in the ping function. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/SLoSnow9879/FPT-Router-RCE
CVE ID: CVE-2022-38532 State: PUBLISHED Published: 2022-09-19T21:41:38 Last Updated: 2024-08-03T10:54:03.671Z Vendors: n/a Products: n/a Problem Types: n/a Description: Micro-Star International Co., Ltd MSI Center 1.0.50.0 was discovered to contain a vulnerability in the component C_Features of MSI.CentralServer.exe. This vulnerability allows attackers to escalate privileges via running a crafted executable. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nam3lum/msi-central_privesc
CVE ID: CVE-2022-38533 State: PUBLISHED Published: 2022-08-25T00:00:00 Last Updated: 2024-08-03T10:54:04.032Z Vendors: n/a Products: n/a Problem Types: n/a Description: In GNU Binutils before 2.40, there is a heap-buffer-overflow in the error function bfd_getl32 when called from the strip_main function in strip-new via a crafted file. Additional Analyst Notes: - CVE Program Container: References: - https://sourceware.org/bugzilla/show_bug.cgi?id=29482 - https://sourceware.org/bugzilla/show_bug.cgi?id=29482#c2 - https://sourceware.org/bugzilla/show_bug.cgi?id=29495 - https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=45d92439aebd0386ef8af76e1796d08cfe457e1d - https://github.com/bmin
/sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=45d92439aebd0386ef8af76e1796d08cfe457e1d - https://github.com/bminor/binutils-gdb/commit/45d92439aebd0386ef8af76e1796d08cfe457e1d - https://security.netapp.com/advisory/ntap-20221104-0007/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6AKZ2DTS3ATVN5PANNVLKLE5OP4OF25Q/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7MTEHT3G6YKJ7F7MSGWYSI4UM3XBAYXZ/ - https://security.gentoo.org/glsa/202309-15
CVE ID: CVE-2022-38534 State: PUBLISHED Published: 2022-09-15T17:58:19 Last Updated: 2024-08-03T10:54:03.893Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK-720R v4.1.5cu.374 was discovered to contain a remote code execution (RCE) vulnerability via the setdiagnosicfg function. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Jfox816/TOTOLINK-720R/blob/fb6ba109ba9c5bd1b0d8e22c88ee14bdc4a75e6b/TOTOLINK%20720%20RCode%20Execution.md
CVE ID: CVE-2022-38535 State: PUBLISHED Published: 2022-09-15T17:58:20 Last Updated: 2024-08-03T10:54:03.796Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK-720R v4.1.5cu.374 was discovered to contain a remote code execution (RCE) vulnerability via the setTracerouteCfg function. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Jfox816/TOTOLINK-720R/blob/177ee39a5a8557a6bd19586731b0e624548b67ee/totolink%20720%20RCode%20Execution2.md
CVE ID: CVE-2022-38537 State: PUBLISHED Published: 2022-09-13T00:00:00 Last Updated: 2024-08-03T10:54:03.797Z Vendors: n/a Products: n/a Problem Types: n/a Description: Archery v1.4.5 to v1.8.5 was discovered to contain multiple SQL injection vulnerabilities via the start_file, end_file, start_time, and stop_time parameters in the binlog2sql interface. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/hhyo/Archery/blob/v1.8.5/sql/urls.py#L135 - https://github.com/hhyo/Archery/issues/1842 - https://announcements.bybit.com/en-US/article/bybit-improves-the-security-of-the-open-source-community-blt626818c0ee8c48a6/
CVE ID: CVE-2022-38538 State: PUBLISHED Published: 2022-09-13T00:00:00 Last Updated: 2024-08-03T10:54:04.003Z Vendors: n/a Products: n/a Problem Types: n/a Description: Archery v1.7.0 to v1.8.5 was discovered to contain a SQL injection vulnerability via the checksum parameter in the report module. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/hhyo/Archery/blob/v1.8.5/sql/urls.py#L145 - https://announcements.bybit.com/en-US/article/bybit-improves-the-security-of-the-open-source-community-blt626818c0ee8c48a6/ - https://github.com/hhyo/Archery/issues/1841
CVE ID: CVE-2022-38539 State: PUBLISHED Published: 2022-09-13T14:45:19 Last Updated: 2024-08-03T10:54:03.885Z Vendors: n/a Products: n/a Problem Types: n/a Description: Archery v1.7.5 to v1.8.5 was discovered to contain a SQL injection vulnerability via the where parameter at /archive/apply. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/hhyo/Archery/blob/v1.8.5/sql/urls.py#L155 - https://github.com/hhyo/Archery/issues/1842 - https://announcements.bybit.com/en-US/article/bybit-improves-the-security-of-the-open-source-community-blt626818c0ee8c48a6/
CVE ID: CVE-2022-38540 State: PUBLISHED Published: 2022-09-13T00:00:00 Last Updated: 2024-08-03T10:54:04.001Z Vendors: n/a Products: n/a Problem Types: n/a Description: Archery v1.4.0 to v1.8.5 was discovered to contain a SQL injection vulnerability via the ThreadIDs parameter in the create_kill_session interface. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/hhyo/Archery/blob/v1.8.5/sql/urls.py#L148 - https://announcements.bybit.com/en-US/article/bybit-improves-the-security-of-the-open-source-community-blt626818c0ee8c48a6/ - https://github.com/hhyo/Archery/issues/1841
CVE ID: CVE-2022-38541 State: PUBLISHED Published: 2022-09-13T00:00:00 Last Updated: 2024-08-03T10:54:04.050Z Vendors: n/a Products: n/a Problem Types: n/a Description: Archery v1.8.3 to v1.8.5 was discovered to contain multiple SQL injection vulnerabilities via the start_time and stop_time parameters in the my2sql interface. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/hhyo/Archery/blob/v1.8.5/sql/urls.py#L136 - https://github.com/hhyo/Archery/issues/1842 - https://announcements.bybit.com/en-US/article/bybit-improves-the-security-of-the-open-source-community-blt626818c0ee8c48a6/
CVE ID: CVE-2022-38542 State: PUBLISHED Published: 2022-09-13T14:45:22 Last Updated: 2024-08-03T10:54:03.671Z Vendors: n/a Products: n/a Problem Types: n/a Description: Archery v1.4.0 to v1.8.5 was discovered to contain a SQL injection vulnerability via the ThreadIDs parameter in the kill_session interface. The project has released an update, please upgrade to v1.9.0 and above. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/hhyo/Archery/blob/v1.8.5/sql/urls.py#L149 - https://announcements.bybit.com/en-US/article/bybit-improves-the-security-of-the-open-source-community-blt626818c0ee8c48a6/ - https://github.com/hhyo/Archery/issues/1841
CVE ID: CVE-2022-38545 State: PUBLISHED Published: 2022-09-19T22:32:56 Last Updated: 2024-08-03T10:54:03.851Z Vendors: n/a Products: n/a Problem Types: n/a Description: Valine v1.4.18 was discovered to contain a remote code execution (RCE) vulnerability which allows attackers to execute arbitrary code via a crafted POST request. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/xCss/Valine/issues/400
CVE ID: CVE-2022-38546 State: PUBLISHED Published: 2022-12-21T00:00:00.000Z Last Updated: 2025-04-15T18:52:24.120Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Zyxel Products: NBG7510 firmware Problem Types: CWE-284 Description: A DNS misconfiguration was found in Zyxel NBG7510 firmware versions prior to V1.00(ABZY.3)C0, which could allow an unauthenticated attacker to access the DNS server when the device is switched to the AP mode. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-dns-misconfiguration-in-nbg7510-home-router
CVE ID: CVE-2022-38547 State: PUBLISHED Published: 2023-02-07T00:00:00.000Z Last Updated: 2025-03-25T15:39:42.181Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Zyxel Products: ZyWALL/USG series firmware, VPN series firmware, USG FLEX series firmware, ATP series firmware Problem Types: CWE-78 Description: A post-authentication command injection vulnerability in the CLI command of Zyxel ZyWALL/USG series firmware versions 4.20 through 4.72, VPN series firmware versions 4.30 through 5.32, USG FLEX series firmware versions 4.50 through 5.32, and ATP series firmware versions 4.32 through 5.32, which could allow an authenticated attacker with administrator privil
nd ATP series firmware versions 4.32 through 5.32, which could allow an authenticated attacker with administrator privileges to execute OS commands. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-post-authentication-rce-in-firewalls
CVE ID: CVE-2022-38550 State: PUBLISHED Published: 2022-09-19T22:51:09.000Z Last Updated: 2025-05-27T18:05:07.872Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability in the /weibo/list component of Jeesns v2.0.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Pick-program/JEESNS/issues/1
CVE ID: CVE-2022-38553 State: PUBLISHED Published: 2022-09-26T09:59:06.000Z Last Updated: 2025-05-21T16:14:51.489Z Vendors: n/a Products: n/a Problem Types: n/a Description: Academy Learning Management System before v5.9.1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the Search parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://academy.com - https://codecanyon.net/item/academy-course-based-learning-management-system/22703468 - https://demo.creativeitem.com/academy/home/ - https://demo.creativeitem.com/academy/home/search?query=%22%3E%3Cscript%3Ealert%28%22XSS%22%29%3C/script%3E - https://github.com