Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-26243 State: PUBLISHED Published: 2022-03-23T18:57:15 Last Updated: 2024-08-03T04:56:37.936Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda AC10-1200 v15.03.06.23_EN was discovered to contain a buffer overflow in the setSmartPowerManagement function. Additional Analyst Notes: - CVE Program Container: References: - https://noob3xploiter.medium.com/hacking-the-tenda-ac10-1200-router-part-4-sscanf-buffer-overflow-75ae0e06abb6
CVE ID: CVE-2022-26244 State: PUBLISHED Published: 2022-03-29T23:07:43 Last Updated: 2024-08-03T04:56:38.027Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability in Hospital Patient Record Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the "special" field. Additional Analyst Notes: - CVE Program Container: References: - http://hospital.com - https://github.com/kishan0725/Hospital-Management-System/issues/23
CVE ID: CVE-2022-26245 State: PUBLISHED Published: 2022-03-27T13:36:08 Last Updated: 2024-08-03T04:56:37.952Z Vendors: n/a Products: n/a Problem Types: n/a Description: Falcon-plus v0.3 was discovered to contain a SQL injection vulnerability via the parameter grpName in /config/service/host.go. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/open-falcon/falcon-plus/issues/951
CVE ID: CVE-2022-26246 State: PUBLISHED Published: 2022-03-20T18:34:59 Last Updated: 2024-08-03T04:56:37.913Z Vendors: n/a Products: n/a Problem Types: n/a Description: TMS v2.28.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /TMS/admin/setting/mail/createorupdate. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/xiweicheng/tms/issues/15
CVE ID: CVE-2022-26247 State: PUBLISHED Published: 2022-03-20T18:34:59 Last Updated: 2024-08-03T04:56:37.917Z Vendors: n/a Products: n/a Problem Types: n/a Description: TMS v2.28.0 contains an insecure permissions vulnerability via the component /TMS/admin/user/Update2. This vulnerability allows attackers to modify the administrator account and password. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/xiweicheng/tms/issues/16
CVE ID: CVE-2022-26249 State: PUBLISHED Published: 2022-03-24T21:12:41 Last Updated: 2024-08-03T04:56:37.853Z Vendors: n/a Products: n/a Problem Types: n/a Description: Survey King v0.3.0 does not filter data properly when exporting excel files, allowing attackers to execute arbitrary code or access sensitive information via a CSV injection attack. Additional Analyst Notes: - CVE Program Container: References: - https://gitee.com/surveyking/surveyking/issues/I4V05A
CVE ID: CVE-2022-26250 State: PUBLISHED Published: 2022-04-06T00:22:49 Last Updated: 2024-08-03T04:56:37.926Z Vendors: n/a Products: n/a Problem Types: n/a Description: Synaman v5.1 and below was discovered to contain weak file permissions which allows authenticated attackers to escalate privileges. Additional Analyst Notes: - CVE Program Container: References: - http://synaman.com - http://synametrics.com - https://www.bencteux.fr/posts/synaman/
CVE ID: CVE-2022-26251 State: PUBLISHED Published: 2022-04-06T00:22:47 Last Updated: 2024-08-03T04:56:37.866Z Vendors: n/a Products: n/a Problem Types: n/a Description: The HTTP interface of Synaman v5.1 and below was discovered to allow authenticated attackers to execute arbitrary code and escalate privileges. Additional Analyst Notes: - CVE Program Container: References: - http://synaman.com - http://synametrics.com - https://www.bencteux.fr/posts/synaman/
CVE ID: CVE-2022-26252 State: PUBLISHED Published: 2022-03-27T15:03:59 Last Updated: 2024-08-03T04:56:37.896Z Vendors: n/a Products: n/a Problem Types: n/a Description: aaPanel v6.8.21 was discovered to be vulnerable to directory traversal. This vulnerability allows attackers to obtain the root user private SSH key(id_rsa). Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/50780
CVE ID: CVE-2022-26254 State: PUBLISHED Published: 2022-03-27T16:06:21 Last Updated: 2024-08-03T04:56:37.897Z Vendors: n/a Products: n/a Problem Types: n/a Description: WoWonder The Ultimate PHP Social Network Platform v4.0.0 was discovered to contain an access control issue which allows unauthenticated attackers to arbitrarily change group ID names. Additional Analyst Notes: - CVE Program Container: References: - https://youtu.be/b665r1ZfCg4
CVE ID: CVE-2022-26255 State: PUBLISHED Published: 2022-03-27T23:15:07 Last Updated: 2024-08-03T04:56:37.907Z Vendors: n/a Products: n/a Problem Types: n/a Description: Clash for Windows v0.19.8 was discovered to allow arbitrary code execution via a crafted payload injected into the Proxies name column. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Fndroid/clash_for_windows_pkg/issues/2710
CVE ID: CVE-2022-26258 State: PUBLISHED Published: 2022-03-27T00:00:00.000Z Last Updated: 2025-10-21T23:15:43.432Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DIR-820L 1.05B03 was discovered to contain remote command execution (RCE) vulnerability via HTTP POST to get set ccp. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://dlink.com - https://www.dlink.com/en/security-bulletin/ - http://dir-820l.com - https://github.com/skyedai910/Vuln/tree/master/DIR-820L/command_execution_0 - https://github.com/zhizhuoshuma/cve_info_data/blob/ccaed4b94ba762eb8a8e003bfa762a7754b8182e/Vuln/Vuln/DIR-820L/command_execution_0/README.md
CVE ID: CVE-2022-26259 State: PUBLISHED Published: 2022-03-28T00:03:17 Last Updated: 2024-08-03T04:56:37.935Z Vendors: n/a Products: n/a Problem Types: n/a Description: A buffer over flow in Xiongmai DVR devices NBD80X16S-KL, NBD80X09S-KL, NBD80X08S-KL, NBD80X09RA-KL, AHB80X04R-MH, AHB80X04R-MH-V2, AHB80X04-R-MH-V3, AHB80N16T-GS, AHB80N32F4-LME, and NBD90S0VT-QW allows attackers to cause a Denial of Service (DoS) via a crafted RSTP request. Additional Analyst Notes: - CVE Program Container: References: - https://www.xiongmaitech.com/en/index.php/service/notice_info/51/2 - https://blog.ret2.me/post/2022-01-26-exploiting-xiongmai-dvrs/
CVE ID: CVE-2022-26260 State: PUBLISHED Published: 2022-03-22T18:15:20 Last Updated: 2024-08-03T04:56:37.922Z Vendors: n/a Products: n/a Problem Types: n/a Description: Simple-Plist v1.3.0 was discovered to contain a prototype pollution vulnerability via .parse(). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/wollardj/simple-plist/issues/60
CVE ID: CVE-2022-26263 State: PUBLISHED Published: 2022-03-25T16:45:10 Last Updated: 2024-08-03T04:56:37.909Z Vendors: n/a Products: n/a Problem Types: n/a Description: Yonyou u8 v13.0 was discovered to contain a DOM-based cross-site scripting (XSS) vulnerability via the component /u8sl/WebHelp. Additional Analyst Notes: - CVE Program Container: References: - http://yonyou.com - https://github.com/k0xx11/Vulscve/blob/master/yonyouu8-xss.md - https://www.yonyou.com/
CVE ID: CVE-2022-26265 State: PUBLISHED Published: 2022-03-18T22:57:01 Last Updated: 2024-08-03T04:56:37.946Z Vendors: n/a Products: n/a Problem Types: n/a Description: Contao Managed Edition v1.5.0 was discovered to contain a remote command execution (RCE) vulnerability via the component php_cli parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/JCCD/Contao-Managed-Edition-1.5-RCE/blob/main/VulnerabilityDetails.md
CVE ID: CVE-2022-26266 State: PUBLISHED Published: 2022-03-18T22:57:01 Last Updated: 2024-08-03T04:56:37.953Z Vendors: n/a Products: n/a Problem Types: n/a Description: Piwigo v12.2.0 was discovered to contain a SQL injection vulnerability via pwg.users.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/JCCD/Vul/blob/main/Piwigo_12.2.0_SQLinject.md
CVE ID: CVE-2022-26267 State: PUBLISHED Published: 2022-03-18T22:57:03 Last Updated: 2024-08-03T04:56:37.932Z Vendors: n/a Products: n/a Problem Types: n/a Description: Piwigo v12.2.0 was discovered to contain an information leak via the action parameter in /admin/maintenance_actions.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/JCCD/Vul/blob/main/Piwigo_12.2.0_InforMation_Disclosure.md
CVE ID: CVE-2022-26268 State: PUBLISHED Published: 2022-03-28T00:32:52 Last Updated: 2024-08-03T04:56:37.871Z Vendors: n/a Products: n/a Problem Types: n/a Description: Xiaohuanxiong v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /app/controller/Books.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/hiliqi/xiaohuanxiong/issues/33
CVE ID: CVE-2022-26269 State: PUBLISHED Published: 2022-03-29T00:34:58 Last Updated: 2024-08-03T04:56:37.849Z Vendors: n/a Products: n/a Problem Types: n/a Description: Suzuki Connect v1.0.15 allows attackers to tamper with displayed messages via spoofed CAN messages. Additional Analyst Notes: - CVE Program Container: References: - https://www.marutisuzuki.com/ - https://www.marutisuzuki.com/corporate/technology/suzuki-connect - https://github.com/nsbogam/CVE-2022-26269/blob/main/README.md
CVE ID: CVE-2022-26271 State: PUBLISHED Published: 2022-03-28T01:00:47 Last Updated: 2024-08-03T04:56:37.892Z Vendors: n/a Products: n/a Problem Types: n/a Description: 74cmsSE v3.4.1 was discovered to contain an arbitrary file read vulnerability via the $url parameter at \index\controller\Download.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/N1ce759/74cmsSE-Arbitrary-File-Reading/issues/1
CVE ID: CVE-2022-26272 State: PUBLISHED Published: 2022-03-24T21:50:52 Last Updated: 2024-08-03T04:56:37.994Z Vendors: n/a Products: n/a Problem Types: n/a Description: A remote code execution (RCE) vulnerability in Ionize v1.0.8.1 allows attackers to execute arbitrary code via a crafted string written to the file application/config/config.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ionize/ionize/issues/403
CVE ID: CVE-2022-26273 State: PUBLISHED Published: 2022-03-28T01:09:42 Last Updated: 2024-08-03T04:56:37.877Z Vendors: n/a Products: n/a Problem Types: n/a Description: EyouCMS v1.5.4 was discovered to lack parameter filtering in \user\controller\shop.php, leading to payment logic vulnerabilities. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/wwwxxxw/issue
CVE ID: CVE-2022-26276 State: PUBLISHED Published: 2022-03-12T00:29:31 Last Updated: 2024-08-03T04:56:37.923Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in index.php of OneNav v0.9.14 allows attackers to perform directory traversal. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/helloxz/onenav/issues/44
CVE ID: CVE-2022-26278 State: PUBLISHED Published: 2022-03-28T20:58:32 Last Updated: 2024-08-03T04:56:37.903Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda AC9 v15.03.2.21_cn was discovered to contain a stack overflow via the time parameter in the PowerSaveSet function. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pllrry/Tenda-AC9-V15.03.2.21_cn-Command-Execution-Vulnerability/tree/main/Tenda-AC9
CVE ID: CVE-2022-26279 State: PUBLISHED Published: 2022-03-24T21:58:39 Last Updated: 2024-08-03T04:56:37.940Z Vendors: n/a Products: n/a Problem Types: n/a Description: EyouCMS v1.5.5 was discovered to have no access control in the component /data/sqldata. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/eyoucms/eyoucms/issues/22 - https://www.eyoucms.com/rizhi/
CVE ID: CVE-2022-26280 State: PUBLISHED Published: 2022-03-28T21:28:45.000Z Last Updated: 2025-11-03T21:46:12.619Z Vendors: n/a Products: n/a Problem Types: n/a Description: Libarchive v3.6.0 was discovered to contain an out-of-bounds read via the component zipx_lzma_alone_init. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/libarchive/libarchive/issues/1672 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SBYGJICQ7FKDZ2IIOAH423IHWQ6MNONQ/ - https://security.gentoo.org/glsa/202208-26
CVE ID: CVE-2022-26281 State: PUBLISHED Published: 2022-04-05T01:50:35 Last Updated: 2024-08-03T04:56:37.912Z Vendors: n/a Products: n/a Problem Types: n/a Description: BigAnt Server v5.6.06 was discovered to contain an incorrect access control issue. Additional Analyst Notes: - CVE Program Container: References: - http://bigant.com - https://github.com/bzyo/cve-pocs/tree/master/CVE-2022-26281 - https://www.bigantsoft.com/
CVE ID: CVE-2022-26283 State: PUBLISHED Published: 2022-03-21T22:25:20 Last Updated: 2024-08-03T04:56:37.928Z Vendors: n/a Products: n/a Problem Types: n/a Description: Simple Subscription Website v1.0 was discovered to contain a SQL injection vulnerability via the id parameter in the view_plan endpoint. This vulnerability allows attackers to dump the application's database via crafted HTTP requests. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Dir0x/Multiple-SQLi-in-Simple-Subscription-Company/blob/main/view_plan_sqli.py
CVE ID: CVE-2022-26284 State: PUBLISHED Published: 2022-03-21T22:25:21 Last Updated: 2024-08-03T04:56:37.931Z Vendors: n/a Products: n/a Problem Types: n/a Description: Simple Client Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter in the manage_client endpoint. This vulnerability allows attackers to dump the application's database via crafted HTTP requests. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Dir0x/SQLi-exploit---Simple-Client-Management-System/blob/main/manage_client_sqli.py
CVE ID: CVE-2022-26285 State: PUBLISHED Published: 2022-03-21T22:25:22 Last Updated: 2024-08-03T04:56:37.893Z Vendors: n/a Products: n/a Problem Types: n/a Description: Simple Subscription Website v1.0 was discovered to contain a SQL injection vulnerability via the id parameter in the apply endpoint. This vulnerability allows attackers to dump the application's database via crafted HTTP requests. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Dir0x/Multiple-SQLi-in-Simple-Subscription-Company/blob/main/apply_sqli.py
CVE ID: CVE-2022-26289 State: PUBLISHED Published: 2022-03-23T23:24:55 Last Updated: 2024-08-03T04:56:37.919Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /goform/exeCommand. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/GD008/vuln/blob/main/tenda_M3_exeCommand/M3_exeCommand.md
CVE ID: CVE-2022-26290 State: PUBLISHED Published: 2022-03-23T23:24:58 Last Updated: 2024-08-03T04:56:37.923Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /goform/WriteFacMac. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/GD008/vuln/blob/main/tenda_M3_WriteFacMac/M3_WriteFacMac.md
CVE ID: CVE-2022-26291 State: PUBLISHED Published: 2022-03-28T21:52:42 Last Updated: 2024-08-03T04:56:37.927Z Vendors: n/a Products: n/a Problem Types: n/a Description: lrzip v0.641 was discovered to contain a multiple concurrency use-after-free between the functions zpaq_decompress_buf() and clear_rulist(). This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted Irz file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ckolivas/lrzip/issues/206 - https://lists.debian.org/debian-lts-announce/2022/04/msg00012.html - https://www.debian.org/security/2022/dsa-5145
CVE ID: CVE-2022-26293 State: PUBLISHED Published: 2022-03-16T19:22:51 Last Updated: 2024-08-03T04:56:37.885Z Vendors: n/a Products: n/a Problem Types: n/a Description: Online Project Time Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter in the function save_employee at /ptms/classes/Users.php. Additional Analyst Notes: - CVE Program Container: References: - https://www.sourcecodester.com/ - https://www.exploit-db.com/exploits/50682 - https://www.nu11secur1ty.com/2022/03/cve-2022-26293.html - https://github.com/nu11secur1ty/CVE-mitre/tree/main/2022/CVE-2022-26293
CVE ID: CVE-2022-26295 State: PUBLISHED Published: 2022-03-16T19:22:53 Last Updated: 2024-08-03T04:56:37.932Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability in /ptms/?page=user of Online Project Time Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the user name field. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/50683
CVE ID: CVE-2022-26296 State: PUBLISHED Published: 2022-03-28T22:54:25 Last Updated: 2024-08-03T04:56:37.978Z Vendors: n/a Products: n/a Problem Types: n/a Description: BOOM: The Berkeley Out-of-Order RISC-V Processor commit d77c2c3 was discovered to allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/riscv-boom/riscv-boom/issues/577
CVE ID: CVE-2022-26300 State: PUBLISHED Published: 2022-03-16T23:02:07 Last Updated: 2024-08-03T04:56:37.954Z Vendors: n/a Products: n/a Problem Types: n/a Description: EOS v2.1.0 was discovered to contain a heap-buffer-overflow via the function txn_test_gen_plugin. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/EOSIO/eos/issues/10820
CVE ID: CVE-2022-26301 State: PUBLISHED Published: 2022-03-24T21:21:50 Last Updated: 2024-08-03T04:56:37.893Z Vendors: n/a Products: n/a Problem Types: n/a Description: TuziCMS v2.0.6 was discovered to contain a SQL injection vulnerability via the component App\Manage\Controller\ZhuantiController.class.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/yeyinshi/tuzicms/issues/11
CVE ID: CVE-2022-26302 State: PUBLISHED Published: 2022-06-14T07:05:34 Last Updated: 2024-08-03T04:56:37.894Z Vendors: FUJI ELECTRIC CO., LTD. / Hakko Electronics Co., Ltd. Products: V-SFT Problem Types: Heap-based Buffer Overflow Description: Heap-based buffer overflow exists in the simulator module contained in the graphic editor 'V-SFT' versions prior to v6.1.6.0, which may allow an attacker to obtain information and/or execute arbitrary code by having a user to open a specially crafted image file. Additional Analyst Notes: - CVE Program Container: References: - https://monitouch.fujielectric.com/site/download-e/09vsft6_inf/Search.php - https://jvn.jp/en/vu/JVNVU99188133/index.html
CVE ID: CVE-2022-26303 State: PUBLISHED Published: 2022-05-25T20:15:26.661Z Last Updated: 2025-04-15T19:00:53.345Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: Open Automation Software Products: OAS Platform Problem Types: CWE-306 Description: An external config control vulnerability exists in the OAS Engine SecureAddUser functionality of Open Automation Software OAS Platform V16.00.0112. A specially-crafted series of network requests can lead to the creation of an OAS user account. An attacker can send a sequence of requests to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talo
is vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2022-1488
CVE ID: CVE-2022-26304 State: REJECTED Published: N/A Last Updated: 2025-05-28T16:55:22.824Z Description: No description available.
CVE ID: CVE-2022-26305 State: PUBLISHED Published: 2022-07-25T00:00:00 Last Updated: 2024-08-03T05:03:31.146Z Vendors: The Document Foundation Products: LibreOffice Problem Types: CWE-295 Description: An Improper Certificate Validation vulnerability in LibreOffice existed where determining if a macro was signed by a trusted author was done by only matching the serial number and issuer string of the used certificate with that of a trusted certificate. This is not sufficient to verify that the macro was actually signed with the certificate. An adversary could therefore create an arbitrary certificate with a serial number and an issuer string identical to a trusted certificate which LibreOffice
an arbitrary certificate with a serial number and an issuer string identical to a trusted certificate which LibreOffice would present as belonging to the trusted author, potentially leading to the user to execute arbitrary code contained in macros improperly trusted. This issue affects: The Document Foundation LibreOffice 7.2 versions prior to 7.2.7; 7.3 versions prior to 7.3.1. Additional Analyst Notes: - CVE Program Container: References: - https://www.libreoffice.org/about-us/security/advisories/cve-2022-26305 - https://lists.debian.org/debian-lts-announce/2023/03/msg00022.html
CVE ID: CVE-2022-26306 State: PUBLISHED Published: 2022-07-25T00:00:00 Last Updated: 2024-08-03T05:03:31.153Z Vendors: The Document Foundation Products: LibreOffice Problem Types: CWE-326 Description: LibreOffice supports the storage of passwords for web connections in the user’s configuration database. The stored passwords are encrypted with a single master key provided by the user. A flaw in LibreOffice existed where the required initialization vector for encryption was always the same which weakens the security of the encryption making them vulnerable if an attacker has access to the user's configuration data. This issue affects: The Document Foundation LibreOffice 7.2 versions prior to 7
access to the user's configuration data. This issue affects: The Document Foundation LibreOffice 7.2 versions prior to 7.2.7; 7.3 versions prior to 7.3.1. Additional Analyst Notes: - CVE Program Container: References: - https://www.libreoffice.org/about-us/security/advisories/cve-2022-26306 - http://www.openwall.com/lists/oss-security/2022/08/13/1 - https://lists.debian.org/debian-lts-announce/2023/03/msg00022.html
CVE ID: CVE-2022-26307 State: PUBLISHED Published: 2022-07-25T00:00:00 Last Updated: 2024-08-03T05:03:31.842Z Vendors: The Document Foundation Products: LibreOffice Problem Types: CWE-326 Description: LibreOffice supports the storage of passwords for web connections in the user’s configuration database. The stored passwords are encrypted with a single master key provided by the user. A flaw in LibreOffice existed where master key was poorly encoded resulting in weakening its entropy from 128 to 43 bits making the stored passwords vulerable to a brute force attack if an attacker has access to the users stored config. This issue affects: The Document Foundation LibreOffice 7.2 versions prior t
cker has access to the users stored config. This issue affects: The Document Foundation LibreOffice 7.2 versions prior to 7.2.7; 7.3 versions prior to 7.3.3. Additional Analyst Notes: - CVE Program Container: References: - https://www.libreoffice.org/about-us/security/advisories/cve-2022-26307 - http://www.openwall.com/lists/oss-security/2022/08/13/2 - https://lists.debian.org/debian-lts-announce/2023/03/msg00022.html
CVE ID: CVE-2022-26308 State: PUBLISHED Published: 2022-08-01T12:44:04.444400Z Last Updated: 2024-09-17T02:31:29.597Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: Artica PFMS Products: Pandora FMS Problem Types: CWE-284 Description: Pandora FMS v7.0NG.760 and below allows an improper access control in Configuration (Credential store) where a user with the role of Operator (Write) could create, delete, view existing keys which are outside the intended role. Additional Analyst Notes: - CVE Program Container: References: - https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/ - https://www.incibe.es/en/cve-assignment-publication/coordinated-c