Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
s service is permitted and credentials for the root user are hardcoded without automatically changing them upon first commissioning. The credentials for the SSH service are hardcoded in the firmware. The credentials grant an attacker access to a root shell on the PLC/RTU, allowing for remote code execution, configuration manipulation and denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://www.forescout.com/blog/ - https://www.cisa.gov/uscert/ics/advisories/icsa-22-242-06
CVE ID: CVE-2022-30319 State: PUBLISHED Published: 2022-07-28T15:50:53 Last Updated: 2024-11-20T16:16:57.817Z Vendors: n/a Products: n/a Problem Types: n/a Description: Saia Burgess Controls (SBC) PCD through 2022-05-06 allows Authentication bypass. According to FSCT-2022-0062, there is a Saia Burgess Controls (SBC) PCD S-Bus authentication bypass issue. The affected components are characterized as: S-Bus (5050/UDP) authentication. The potential impact is: Authentication bypass. The Saia Burgess Controls (SBC) PCD controllers utilize the S-Bus protocol (5050/UDP) for a variety of engineering purposes. It is possible to configure a password in order to restrict access to sensitive engineering
ety of engineering purposes. It is possible to configure a password in order to restrict access to sensitive engineering functionality. Authentication functions on the basis of a MAC/IP whitelist with inactivity timeout to which an authenticated client's MAC/IP is stored. UDP traffic can be spoofed to bypass the whitelist-based access control. Since UDP is stateless, an attacker capable of passively observing traffic can spoof arbitrary messages using the MAC/IP of an authenticated client. This allows the attacker access to sensitive engineering functionality such as uploading/downloading control logic and manipulating controller configuration. Additional Analyst Notes: - CVE Program Contain
ing/downloading control logic and manipulating controller configuration. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.forescout.com/blog/ - https://www.cisa.gov/uscert/ics/advisories/icsa-22-207-03
CVE ID: CVE-2022-30320 State: PUBLISHED Published: 2022-07-28T15:50:47 Last Updated: 2024-08-03T06:48:36.108Z Vendors: n/a Products: n/a Problem Types: n/a Description: Saia Burgess Controls (SBC) PCD through 2022-05-06 uses a Broken or Risky Cryptographic Algorithm. According to FSCT-2022-0063, there is a Saia Burgess Controls (SBC) PCD S-Bus weak credential hashing scheme issue. The affected components are characterized as: S-Bus (5050/UDP) authentication. The potential impact is: Authentication bypass. The Saia Burgess Controls (SBC) PCD controllers utilize the S-Bus protocol (5050/UDP) for a variety of engineering purposes. It is possible to configure a password in order to restrict acce
tocol (5050/UDP) for a variety of engineering purposes. It is possible to configure a password in order to restrict access to sensitive engineering functionality. Authentication is done by using the S-Bus 'write byte' message to a specific address and supplying a hashed version of the password. The hashing algorithm used is based on CRC-16 and as such not cryptographically secure. An insecure hashing algorithm is used. An attacker capable of passively observing traffic can intercept the hashed credentials and trivially find collisions allowing for authentication without having to bruteforce a keyspace defined by the actual strength of the password. This allows the attacker access to sensitiv
ing to bruteforce a keyspace defined by the actual strength of the password. This allows the attacker access to sensitive engineering functionality such as uploading/downloading control logic and manipulating controller configuration. Additional Analyst Notes: - CVE Program Container: References: - https://www.forescout.com/blog/ - https://www.cisa.gov/uscert/ics/advisories/icsa-22-207-03
CVE ID: CVE-2022-30321 State: PUBLISHED Published: 2022-05-25T11:19:42 Last Updated: 2024-08-03T06:48:35.687Z Vendors: n/a Products: n/a Problem Types: n/a Description: go-getter up to 1.5.11 and 2.0.2 allowed arbitrary host access via go-getter path traversal, symlink processing, and command injection flaws. Fixed in 1.6.1 and 2.1.0. Additional Analyst Notes: - CVE Program Container: References: - https://discuss.hashicorp.com - https://github.com/hashicorp/go-getter/releases - https://discuss.hashicorp.com/t/hcsec-2022-13-multiple-vulnerabilities-in-go-getter-library/39930
CVE ID: CVE-2022-30322 State: PUBLISHED Published: 2022-05-25T11:19:35 Last Updated: 2024-08-03T06:48:35.602Z Vendors: n/a Products: n/a Problem Types: n/a Description: go-getter up to 1.5.11 and 2.0.2 allowed asymmetric resource exhaustion when go-getter processed malicious HTTP responses. Fixed in 1.6.1 and 2.1.0. Additional Analyst Notes: - CVE Program Container: References: - https://discuss.hashicorp.com - https://github.com/hashicorp/go-getter/releases - https://discuss.hashicorp.com/t/hcsec-2022-13-multiple-vulnerabilities-in-go-getter-library/39930 - https://discuss.hashicorp.com/t/hcsec-2022-13-multiple-vulnerabilities-in-go-getter-library/
CVE ID: CVE-2022-30323 State: PUBLISHED Published: 2022-05-25T11:19:30 Last Updated: 2024-08-03T06:48:35.599Z Vendors: n/a Products: n/a Problem Types: n/a Description: go-getter up to 1.5.11 and 2.0.2 panicked when processing password-protected ZIP files. Fixed in 1.6.1 and 2.1.0. Additional Analyst Notes: - CVE Program Container: References: - https://discuss.hashicorp.com - https://github.com/hashicorp/go-getter/releases - https://discuss.hashicorp.com/t/hcsec-2022-13-multiple-vulnerabilities-in-go-getter-library/39930 - https://discuss.hashicorp.com/t/hcsec-2022-13-multiple-vulnerabilities-in-go-getter-library/
CVE ID: CVE-2022-30324 State: PUBLISHED Published: 2022-05-27T14:48:11 Last Updated: 2024-08-03T06:48:36.086Z Vendors: n/a Products: n/a Problem Types: n/a Description: HashiCorp Nomad and Nomad Enterprise version 0.2.0 up to 1.3.0 were impacted by go-getter vulnerabilities enabling privilege escalation through the artifact stanza in submitted jobs onto the client agent host. Fixed in 1.1.14, 1.2.8, and 1.3.1. Additional Analyst Notes: - CVE Program Container: References: - https://discuss.hashicorp.com - https://discuss.hashicorp.com/t/hcsec-2022-14-nomad-impacted-by-go-getter-vulnerabilities/39932
CVE ID: CVE-2022-30325 State: PUBLISHED Published: 2022-06-16T22:03:30 Last Updated: 2024-08-03T06:48:35.545Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was found on TRENDnet TEW-831DR 1.0 601.130.1.1356 devices. The default pre-shared key for the Wi-Fi networks is the same for every router except for the last four digits. The device default pre-shared key for both 2.4 GHz and 5 GHz networks can be guessed or brute-forced by an attacker within range of the Wi-Fi network. Additional Analyst Notes: - CVE Program Container: References: - https://research.nccgroup.com/?research=Technical+advisories - https://research.nccgroup.com/2022/06/10/technical-advisory-multiple-vu
ch.nccgroup.com/?research=Technical+advisories - https://research.nccgroup.com/2022/06/10/technical-advisory-multiple-vulnerabilities-in-trendnet-tew-831dr-wifi-router-cve-2022-30325-cve-2022-30326-cve-2022-30327-cve-2022-30328-cve-2022-30329/
CVE ID: CVE-2022-30326 State: PUBLISHED Published: 2022-06-16T22:04:08 Last Updated: 2024-08-03T06:48:36.321Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was found on TRENDnet TEW-831DR 1.0 601.130.1.1356 devices. The network pre-shared key field on the web interface is vulnerable to XSS. An attacker can use a simple XSS payload to crash the basic.config page of the web interface. Additional Analyst Notes: - CVE Program Container: References: - https://research.nccgroup.com/?research=Technical+advisories - https://research.nccgroup.com/2022/06/10/technical-advisory-multiple-vulnerabilities-in-trendnet-tew-831dr-wifi-router-cve-2022-30325-cve-2022-30326-cve-2022-30327-
hnical-advisory-multiple-vulnerabilities-in-trendnet-tew-831dr-wifi-router-cve-2022-30325-cve-2022-30326-cve-2022-30327-cve-2022-30328-cve-2022-30329/
CVE ID: CVE-2022-30327 State: PUBLISHED Published: 2022-06-16T22:04:08 Last Updated: 2024-08-03T06:48:35.593Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was found on TRENDnet TEW-831DR 1.0 601.130.1.1356 devices. The web interface is vulnerable to CSRF. An attacker can change the pre-shared key of the Wi-Fi router if the interface's IP address is known. Additional Analyst Notes: - CVE Program Container: References: - https://research.nccgroup.com/?research=Technical+advisories - https://research.nccgroup.com/2022/06/10/technical-advisory-multiple-vulnerabilities-in-trendnet-tew-831dr-wifi-router-cve-2022-30325-cve-2022-30326-cve-2022-30327-cve-2022-30328-cve-2022-303
lnerabilities-in-trendnet-tew-831dr-wifi-router-cve-2022-30325-cve-2022-30326-cve-2022-30327-cve-2022-30328-cve-2022-30329/
CVE ID: CVE-2022-30328 State: PUBLISHED Published: 2022-06-16T22:04:08 Last Updated: 2024-08-03T06:48:35.835Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was found on TRENDnet TEW-831DR 1.0 601.130.1.1356 devices. The username and password setup for the web interface does not require entering the existing password. A malicious user can change the username and password of the interface. Additional Analyst Notes: - CVE Program Container: References: - https://research.nccgroup.com/?research=Technical+advisories - https://research.nccgroup.com/2022/06/10/technical-advisory-multiple-vulnerabilities-in-trendnet-tew-831dr-wifi-router-cve-2022-30325-cve-2022-30326-cve-2022-3
0/technical-advisory-multiple-vulnerabilities-in-trendnet-tew-831dr-wifi-router-cve-2022-30325-cve-2022-30326-cve-2022-30327-cve-2022-30328-cve-2022-30329/
CVE ID: CVE-2022-30329 State: PUBLISHED Published: 2022-06-16T22:04:08 Last Updated: 2024-08-03T06:48:35.803Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was found on TRENDnet TEW-831DR 1.0 601.130.1.1356 devices. An OS injection vulnerability exists within the web interface, allowing an attacker with valid credentials to execute arbitrary shell commands. Additional Analyst Notes: - CVE Program Container: References: - https://research.nccgroup.com/?research=Technical+advisories - https://research.nccgroup.com/2022/06/10/technical-advisory-multiple-vulnerabilities-in-trendnet-tew-831dr-wifi-router-cve-2022-30325-cve-2022-30326-cve-2022-30327-cve-2022-30328-cve-2022-30
ulnerabilities-in-trendnet-tew-831dr-wifi-router-cve-2022-30325-cve-2022-30326-cve-2022-30327-cve-2022-30328-cve-2022-30329/
CVE ID: CVE-2022-30330 State: PUBLISHED Published: 2022-05-07T03:25:34 Last Updated: 2024-08-03T06:48:35.769Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the KeepKey firmware before 7.3.2,Flaws in the supervisor interface can be exploited to bypass important security restrictions on firmware operations. Using these flaws, malicious firmware code can elevate privileges, permanently make the device inoperable or overwrite the trusted bootloader code to compromise the hardware wallet across reboots or storage wipes. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/keepkey/keepkey-firmware/releases/tag/v7.3.2 - https://github.com/keepkey/keepk
tainer: References: - https://github.com/keepkey/keepkey-firmware/releases/tag/v7.3.2 - https://github.com/keepkey/keepkey-firmware/commit/447c1f038a31378ab9589965c098467d9ea6cccc - https://blog.inhq.net/posts/keepkey-CVE-2022-30330/
CVE ID: CVE-2022-30331 State: PUBLISHED Published: 2022-09-05T00:00:00 Last Updated: 2024-08-03T06:48:36.131Z Vendors: n/a Products: n/a Problem Types: n/a Description: The User-Defined Functions (UDF) feature in TigerGraph 3.6.0 allows installation of a query (in the GSQL query language) without proper validation. Consequently, an attacker can execute arbitrary C++ code. NOTE: the vendor's position is "GSQL was behaving as expected." Additional Analyst Notes: - CVE Program Container: References: - https://docs.tigergraph.com/home/ - https://neo4j.com/security/cve-2022-30331/ - https://docs.tigergraph.com/home/cve-2022-30331
CVE ID: CVE-2022-30332 State: PUBLISHED Published: 2023-01-10T00:00:00.000Z Last Updated: 2025-08-28T15:45:19.557Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AC:L/AV:N/A:N/C:L/I:N/PR:N/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: In Talend Administration Center 7.3.1.20200219 before TAC-15950, the Forgot Password feature provides different error messages for invalid reset attempts depending on whether the email address is associated with any account. This allows remote attackers to enumerate accounts via a series of requests. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cwe.mitre.org/data/definitions/204.html - https://hel
A ADP Vulnrichment: - CVE Program Container: References: - https://cwe.mitre.org/data/definitions/204.html - https://help.talend.com/r/62tbPt7y~tPTxAB7y7KpeQ/H45WqEF32geNEZiGJnRwmw - https://excellium-services.com/cert-xlm-advisory/CVE-2022-30332 - https://cds.thalesgroup.com/en/tcs-cert/CVE-2022-30332
CVE ID: CVE-2022-30333 State: PUBLISHED Published: 2022-05-09T00:00:00.000Z Last Updated: 2025-10-21T23:15:40.223Z Vendors: n/a Products: n/a Problem Types: n/a Description: RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an extract (aka unpack) operation, as demonstrated by creating a ~/.ssh/authorized_keys file. NOTE: WinRAR and Android RAR are unaffected. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.rarlab.com/rar_add.htm - https://www.rarlab.com/rar/rarlinux-x32-612.tar.gz - https://blog.sonarsource.com/zimbra-pre-auth-rce-via-unrar-0day/ - http://packetstormsecurity.com/files/167989/Z
ar.gz - https://blog.sonarsource.com/zimbra-pre-auth-rce-via-unrar-0day/ - http://packetstormsecurity.com/files/167989/Zimbra-UnRAR-Path-Traversal.html - https://lists.debian.org/debian-lts-announce/2023/08/msg00022.html - https://security.gentoo.org/glsa/202309-04
CVE ID: CVE-2022-30334 State: PUBLISHED Published: 2022-05-07T04:29:24 Last Updated: 2024-08-03T06:48:35.806Z Vendors: n/a Products: n/a Problem Types: n/a Description: Brave before 1.34, when a Private Window with Tor Connectivity is used, leaks .onion URLs in Referer and Origin headers. NOTE: although this was fixed by Brave, the Brave documentation still advises "Note that Private Windows with Tor Connectivity in Brave are just regular private windows that use Tor as a proxy. Brave does NOT implement most of the privacy protections from Tor Browser." Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/1337624 - https://github.com/brave/brave-core
otes: - CVE Program Container: References: - https://hackerone.com/reports/1337624 - https://github.com/brave/brave-core/pull/10760 - https://github.com/brave/brave-browser/issues/18071 - https://support.brave.com/hc/en-us/articles/360018121491-What-is-a-Private-Window-with-Tor-Connectivity-
CVE ID: CVE-2022-30335 State: PUBLISHED Published: 2022-05-09T18:38:11 Last Updated: 2024-08-03T06:48:36.140Z Vendors: n/a Products: n/a Problem Types: n/a Description: Bonanza Wealth Management System (BWM) 7.3.2 allows SQL injection via the login form. Users who supply the application with a SQL injection payload in the User Name textbox could collect all passwords in encrypted format from the Microsoft SQL Server component. Additional Analyst Notes: - CVE Program Container: References: - https://incognitolab.com - https://www.wealth.co.th/products/bonanza-wealth-management/ - https://gist.github.com/aliceicl/b2f25f3a0a3ba9973e4977f922d04008
CVE ID: CVE-2022-30337 State: PUBLISHED Published: 2022-07-21T16:02:24.431Z Last Updated: 2025-02-20T20:17:29.609Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: JoomUnited Products: WP Meta SEO (WordPress plugin) Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in JoomUnited WP Meta SEO plugin <= 4.4.8 at WordPress allows an attacker to update the social settings. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wordpress.org/plugins/wp-meta-seo/#developers - https://patchstack.com/database/vulnerability/wp-meta-seo/wordpress-wp-meta-seo-plugin-4-4-8-social-settings-update-
s - https://patchstack.com/database/vulnerability/wp-meta-seo/wordpress-wp-meta-seo-plugin-4-4-8-social-settings-update-vis-cross-site-request-forgery-csrf-vulnerability
CVE ID: CVE-2022-30338 State: PUBLISHED Published: 2023-05-10T13:16:51.097Z Last Updated: 2025-01-27T18:07:46.830Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) VROC software Problem Types: escalation of privilege, CWE-276 Description: Incorrect default permissions in the Intel(R) VROC software before version 7.7.6.1003 may allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00692.html
CVE ID: CVE-2022-30339 State: PUBLISHED Published: 2023-02-16T20:00:02.775Z Last Updated: 2025-01-27T18:20:50.938Z Severity: MEDIUM (CVSS 6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H) Vendors: n/a Products: Intel(R) Integrated Sensor Solution Problem Types: denial of service Description: Out-of-bounds read in firmware for the Intel(R) Integrated Sensor Solution before versions 5.4.2.4579v3, 5.4.1.4479 and 5.0.0.4143 may allow a privileged user to potentially enable denial of service via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00721.html
CVE ID: CVE-2022-30349 State: PUBLISHED Published: 2022-05-27T17:20:26 Last Updated: 2024-08-03T06:48:35.816Z Vendors: n/a Products: n/a Problem Types: n/a Description: siteserver SSCMS 6.15.51 is vulnerable to Cross Site Scripting (XSS). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/siteserver/cms/issues/3238
CVE ID: CVE-2022-30350 State: PUBLISHED Published: 2023-03-30T00:00:00.000Z Last Updated: 2025-02-18T16:22:38.595Z Vendors: n/a Products: n/a Problem Types: n/a Description: Avanquest Software RAD PDF (PDFEscape Online) 3.19.2.2 is vulnerable to Information Leak / Disclosure. The PDFEscape Online tool provides users with a "white out" functionality for redacting images, text, and other graphics from a PDF document. However, this mechanism does not remove underlying text or PDF object specification information from the PDF. As a result, for example, redacted text may be copy-pasted by a PDF reader. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https
-pasted by a PDF reader. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.pdfescape.com/open/ - https://arxiv.org/pdf/2206.02285.pdf
CVE ID: CVE-2022-30351 State: PUBLISHED Published: 2023-03-30T00:00:00.000Z Last Updated: 2025-02-18T16:19:02.169Z Vendors: n/a Products: n/a Problem Types: n/a Description: PDFZorro PDFZorro Online r20220428 using TCPDF 6.2.5, despite having workflows claiming to correctly remove redacted information from a supplied PDF file, does not properly sanitize this information in all cases, causing redacted information, including images and text embedded in the PDF file, to be leaked unintentionally. In cases where PDF text objects are present it is possible to copy-paste redacted information into the system clipboard. Once a document is "locked" and marked for redaction once, all redactions perfor
information into the system clipboard. Once a document is "locked" and marked for redaction once, all redactions performed after this feature is triggered are vulnerable. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.pdfzorro.com/pdf-edit/ - https://arxiv.org/pdf/2206.02285.pdf
CVE ID: CVE-2022-30352 State: PUBLISHED Published: 2022-05-27T13:43:58 Last Updated: 2024-08-03T06:48:35.793Z Vendors: n/a Products: n/a Problem Types: n/a Description: phpABook 0.9i is vulnerable to SQL Injection due to insufficient sanitization of user-supplied data in the "auth_user" parameter in index.php script. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/50071 - https://www.cybersecurity-help.cz/vulnerabilities/54518/
CVE ID: CVE-2022-30354 State: PUBLISHED Published: 2024-10-25T00:00:00.000Z Last Updated: 2025-03-13T00:55:23.288Z Vendors: n/a Products: n/a Problem Types: n/a Description: OvalEdge 5.2.8.0 and earlier is affected by a Sensitive Data Exposure vulnerability via a GET request to /user/getUserWithTeam. Authentication is required. The information disclosed is associated with all registered user ID numbers. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cve.offsecguy.com/ovaledge/vulnerabilities/sensitive-data-exposure#cve-2022-30354
CVE ID: CVE-2022-30355 State: PUBLISHED Published: 2024-10-25T00:00:00 Last Updated: 2024-10-25T19:09:42.951Z Vendors: n/a Products: n/a Problem Types: n/a Description: OvalEdge 5.2.8.0 and earlier is affected by an Account Takeover vulnerability via a POST request to /profile/updateProfile via the userId and email parameters. Authentication is required. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cve.offsecguy.com/ovaledge/vulnerabilities/account-takeover#cve-2022-30355
CVE ID: CVE-2022-30356 State: PUBLISHED Published: 2024-10-25T00:00:00 Last Updated: 2024-10-29T19:30:27.231Z Vendors: n/a Products: n/a Problem Types: n/a Description: OvalEdge 5.2.8.0 and earlier is affected by a Privilege Escalation vulnerability via a POST request to /user/assignuserrole via the userid and role parameters . Authentication is required with OE_ADMIN role privilege. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cve.offsecguy.com/ovaledge/vulnerabilities/privilege-escalation#cve-2022-30356
CVE ID: CVE-2022-30357 State: PUBLISHED Published: 2024-10-25T00:00:00 Last Updated: 2024-10-25T20:08:42.618Z Vendors: n/a Products: n/a Problem Types: n/a Description: OvalEdge 5.2.8.0 and earlier is affected by an Account Takeover vulnerability via a POST request to /profile/updateProfile via the userId and email parameters. Authentication is required. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cve.offsecguy.com/ovaledge/vulnerabilities/account-takeover#cve-2022-30357
CVE ID: CVE-2022-30358 State: PUBLISHED Published: 2024-10-25T00:00:00 Last Updated: 2024-10-29T19:32:04.696Z Vendors: n/a Products: n/a Problem Types: n/a Description: OvalEdge 5.2.8.0 and earlier is affected by an Account Takeover vulnerability via a POST request to /user/updatePassword via the userId and newPsw parameters. Authentication is required. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cve.offsecguy.com/ovaledge/vulnerabilities/account-takeover#cve-2022-30358
CVE ID: CVE-2022-30359 State: PUBLISHED Published: 2024-10-25T00:00:00 Last Updated: 2024-10-29T19:33:12.225Z Vendors: n/a Products: n/a Problem Types: n/a Description: OvalEdge 5.2.8.0 and earlier is affected by a Sensitive Data Exposure vulnerability via a GET request to /user/getUserList. Authentication is required. The information disclosed is associated with the all registered users, including user ID, status, email address, role(s), user type, license type, and personal details such as first name, last name, gender, and user preferences. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cve.offsecguy.com/ovaledge/vulnerabilities/sensitive-data-exposure#cve-2022-3
SA ADP Vulnrichment: References: - https://cve.offsecguy.com/ovaledge/vulnerabilities/sensitive-data-exposure#cve-2022-30359