Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
e a legitimate website. The attacker could trick the user and potentially acquire sensitive information such as the user's credentials. Additional Analyst Notes: - CVE Program Container: References: - https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html - https://github.com/CERTCC/VINCE/issues/45
CVE ID: CVE-2022-25800 State: PUBLISHED Published: 2022-07-14T11:42:28 Last Updated: 2024-08-03T04:49:43.692Z Vendors: n/a Products: n/a Problem Types: n/a Description: Best Practical RT for Incident Response (RTIR) before 4.0.3 and 5.x before 5.0.3 allows SSRF via the whois lookup tool. Additional Analyst Notes: - CVE Program Container: References: - https://docs.bestpractical.com/release-notes/rtir/index.html - https://docs.bestpractical.com/release-notes/rtir/5.0.3 - https://docs.bestpractical.com/release-notes/rtir/4.0.3
CVE ID: CVE-2022-25801 State: PUBLISHED Published: 2022-07-14T11:44:26 Last Updated: 2024-08-03T04:49:43.941Z Vendors: n/a Products: n/a Problem Types: n/a Description: Best Practical RT for Incident Response (RTIR) before 4.0.3 and 5.x before 5.0.3 allows SSRF via Scripted Action tools. Additional Analyst Notes: - CVE Program Container: References: - https://docs.bestpractical.com/release-notes/rtir/index.html - https://docs.bestpractical.com/release-notes/rtir/5.0.3 - https://docs.bestpractical.com/release-notes/rtir/4.0.3
CVE ID: CVE-2022-25802 State: PUBLISHED Published: 2022-07-14T11:49:40 Last Updated: 2024-08-03T04:49:43.460Z Vendors: n/a Products: n/a Problem Types: n/a Description: Best Practical Request Tracker (RT) before 4.4.6 and 5.x before 5.0.3 allows XSS via a crafted content type for an attachment. Additional Analyst Notes: - CVE Program Container: References: - https://docs.bestpractical.com/release-notes/rt/index.html - https://docs.bestpractical.com/release-notes/rt/4.4.6 - https://docs.bestpractical.com/release-notes/rt/5.0.3
CVE ID: CVE-2022-25803 State: PUBLISHED Published: 2022-07-14T11:51:19 Last Updated: 2024-08-03T04:49:43.287Z Vendors: n/a Products: n/a Problem Types: n/a Description: Best Practical Request Tracker (RT) before 5.0.3 has an Open Redirect via a ticket search. Additional Analyst Notes: - CVE Program Container: References: - https://docs.bestpractical.com/release-notes/rt/index.html - https://docs.bestpractical.com/release-notes/rt/5.0.3
CVE ID: CVE-2022-25804 State: PUBLISHED Published: 2022-06-09T00:45:20 Last Updated: 2024-08-03T04:49:43.831Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the IGEL Universal Management Suite (UMS) 6.07.100. Insecure permissions for the serverconfig registry key (under JavaSoft\Prefs\de\igel\rm\config in HKEY_LOCAL_MACHINE\SOFTWARE) allow an unprivileged local attacker to read the encrypted dbuser and dbpassword values for the UMS superuser. Additional Analyst Notes: - CVE Program Container: References: - https://www.igel.com/igel-solution-family/universal-management-suite/ - https://github.com/atredispartners/advisories/blob/master/ATREDIS-2022-0002.m
ution-family/universal-management-suite/ - https://github.com/atredispartners/advisories/blob/master/ATREDIS-2022-0002.md
CVE ID: CVE-2022-25805 State: PUBLISHED Published: 2022-06-09T00:45:14 Last Updated: 2024-08-03T04:49:43.929Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the IGEL Universal Management Suite (UMS) 6.07.100. The transmission of cleartext LDAP bind credentials by the cmd_mgt_load_mgt_tree command allows an attacker (who can intercept or inspect traffic between an authenticated UMS client and server) to compromise those LDAP bind credentials. Additional Analyst Notes: - CVE Program Container: References: - https://www.igel.com/igel-solution-family/universal-management-suite/ - https://github.com/atredispartners/advisories/blob/master/ATREDIS-2022-0002.md
CVE ID: CVE-2022-25806 State: PUBLISHED Published: 2022-06-09T00:45:07 Last Updated: 2024-08-03T04:49:43.737Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the IGEL Universal Management Suite (UMS) 6.07.100. A hardcoded DES key in the PrefDBCredentials class allows an attacker, who has discovered encrypted superuser credentials, to decrypt those credentials using a static 8-byte DES key. Additional Analyst Notes: - CVE Program Container: References: - https://www.igel.com/igel-solution-family/universal-management-suite/ - https://github.com/atredispartners/advisories/blob/master/ATREDIS-2022-0002.md
CVE ID: CVE-2022-25807 State: PUBLISHED Published: 2022-06-09T00:45:01 Last Updated: 2024-08-03T04:49:43.558Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the IGEL Universal Management Suite (UMS) 6.07.100. A hardcoded DES key in the LDAPDesPWEncrypter class allows an attacker, who has discovered encrypted LDAP bind credentials, to decrypt those credentials using a static 8-byte DES key. Additional Analyst Notes: - CVE Program Container: References: - https://www.igel.com/igel-solution-family/universal-management-suite/ - https://github.com/atredispartners/advisories/blob/master/ATREDIS-2022-0002.md
CVE ID: CVE-2022-25809 State: PUBLISHED Published: 2022-02-23T02:19:52 Last Updated: 2024-08-03T04:49:43.749Z Vendors: n/a Products: n/a Problem Types: n/a Description: Improper Neutralization of audio output from 3rd and 4th Generation Amazon Echo Dot devices allows arbitrary voice command execution on these devices via a malicious skill (in the case of remote attackers) or by pairing a malicious Bluetooth device (in the case of physically proximate attackers), aka an "Alexa versus Alexa (AvA)" attack. Additional Analyst Notes: - CVE Program Container: References: - https://arxiv.org/abs/2202.08619
CVE ID: CVE-2022-25810 State: PUBLISHED Published: 2022-08-22T14:58:31 Last Updated: 2024-08-03T04:49:43.477Z Vendors: Unknown Products: Transposh WordPress Translation Problem Types: CWE-862 Description: The Transposh WordPress Translation WordPress plugin through 1.0.8 exposes a couple of sensitive actions such has “tp_reset” under the Utilities tab (/wp-admin/admin.php?page=tp_utils), which can be used/executed as the lowest-privileged user. Basically all Utilities functionalities are vulnerable this way, which involves resetting configurations and backup/restore operations. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/9a934a84-f0c7-42e
ons. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/9a934a84-f0c7-42ed-b980-bb168b2c5892
CVE ID: CVE-2022-25811 State: PUBLISHED Published: 2022-08-22T14:58:47 Last Updated: 2024-08-03T04:49:44.141Z Vendors: Unknown Products: Transposh WordPress Translation Problem Types: CWE-89 Description: The Transposh WordPress Translation WordPress plugin through 1.0.8 does not sanitise and escape the order and orderby parameters before using them in a SQL statement, leading to a SQL injection Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/0e0d2c5f-3396-4a0a-a5c6-6a98de3802c9
CVE ID: CVE-2022-25812 State: PUBLISHED Published: 2022-08-22T14:59:06 Last Updated: 2024-08-03T04:49:43.741Z Vendors: Unknown Products: Transposh WordPress Translation Problem Types: CWE-94 Description: The Transposh WordPress Translation WordPress plugin before 1.0.8 does not validate its debug settings, which could allow allowing high privilege users such as admin to perform RCE Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/1f6bd346-4743-44b8-86d7-4fbe09bad657
CVE ID: CVE-2022-25813 State: PUBLISHED Published: 2022-09-02T07:10:18 Last Updated: 2024-08-03T04:49:43.983Z Vendors: Apache Software Foundation Products: Apache OFBiz Problem Types: CWE-1336 Description: In Apache OFBiz, versions 18.12.05 and earlier, an attacker acting as an anonymous user of the ecommerce plugin, can insert a malicious content in a message “Subject” field from the "Contact us" page. Then a party manager needs to list the communications in the party component to activate the SSTI. A RCE is then possible. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread/vmj5s0qb59t0lvzf3vol3z1sc3sgyb2b - http://www.openwall.com/lists/oss-secu
References: - https://lists.apache.org/thread/vmj5s0qb59t0lvzf3vol3z1sc3sgyb2b - http://www.openwall.com/lists/oss-security/2022/09/02/4
CVE ID: CVE-2022-25814 State: PUBLISHED Published: 2022-03-08T13:46:41 Last Updated: 2024-08-03T04:49:43.528Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Samsung Mobile Products: Samsung Mobile Devices Problem Types: CWE-276 Description: PendingIntent hijacking vulnerability in Wearable Manager Installer prior to SMR Mar-2022 Release 1 allows local attackers to perform unauthorized action without permission via hijacking the PendingIntent. Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=3
CVE ID: CVE-2022-25815 State: PUBLISHED Published: 2022-03-08T13:46:46 Last Updated: 2024-08-03T04:49:43.622Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Samsung Mobile Products: Samsung Mobile Devices Problem Types: CWE-276 Description: PendingIntent hijacking vulnerability in Weather application prior to SMR Mar-2022 Release 1 allows local attackers to perform unauthorized action without permission via hijacking the PendingIntent. Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=3
CVE ID: CVE-2022-25816 State: PUBLISHED Published: 2022-03-08T13:46:50 Last Updated: 2024-08-03T04:49:44.236Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: Samsung Mobile Products: Samsung Mobile Devices Problem Types: CWE-287 Description: Improper authentication in Samsung Lock and mask apps setting prior to SMR Mar-2022 Release 1 allows attacker to change enable/disable without authentication Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=3
CVE ID: CVE-2022-25817 State: PUBLISHED Published: 2022-03-08T13:46:56 Last Updated: 2024-08-03T04:49:43.533Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Samsung Mobile Products: Samsung Mobile Devices Problem Types: CWE-287 Description: Improper authentication in One UI Home prior to SMR Mar-2022 Release 1 allows attacker to generate pinned-shortcut without user consent. Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=3
CVE ID: CVE-2022-25818 State: PUBLISHED Published: 2022-03-08T13:47:00 Last Updated: 2024-08-03T04:49:44.017Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L) Vendors: Samsung Mobile Products: Samsung Mobile Devices Problem Types: CWE-20 Description: Improper boundary check in UWB stack prior to SMR Mar-2022 Release 1 allows arbitrary code execution. Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=3
CVE ID: CVE-2022-25819 State: PUBLISHED Published: 2022-03-08T13:47:08 Last Updated: 2024-08-03T04:49:43.402Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Samsung Mobile Products: Samsung Mobile Devices with Exynos chipsets Problem Types: CWE-125 Description: OOB read vulnerability in hdcp2 device node prior to SMR Mar-2022 Release 1 allow an attacker to view Kernel stack memory. Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=3
CVE ID: CVE-2022-25820 State: PUBLISHED Published: 2022-03-08T13:47:13 Last Updated: 2024-08-03T04:49:43.665Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Samsung Mobile Products: Samsung Mobile Devices Problem Types: CWE-307 Description: A vulnerable design in fingerprint matching algorithm prior to SMR Mar-2022 Release 1 allows physical attackers to perform brute force attack on screen lock password. Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=3
CVE ID: CVE-2022-25821 State: PUBLISHED Published: 2022-03-08T13:47:18 Last Updated: 2024-08-03T04:49:43.958Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Samsung Mobile Products: Samsung Mobile Devices Problem Types: CWE-125 Description: Improper use of SMS buffer pointer in Shannon baseband prior to SMR Mar-2022 Release 1 allows OOB read. Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=3
CVE ID: CVE-2022-25822 State: PUBLISHED Published: 2022-03-08T13:47:23 Last Updated: 2024-08-03T04:49:43.481Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Samsung Mobile Products: Samsung Mobile devices Problem Types: CWE-362 Description: An use after free vulnerability in sdp driver prior to SMR Mar-2022 Release 1 allows kernel crash. Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=3
CVE ID: CVE-2022-25823 State: PUBLISHED Published: 2022-03-08T13:47:34 Last Updated: 2024-08-03T04:49:43.748Z Severity: LOW (CVSS 1.9 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N) Vendors: Samsung Mobile Products: Galaxy Watch Plugin Problem Types: CWE-200 Description: Information Exposure vulnerability in Galaxy Watch Plugin prior to version 2.2.05.220126741 allows attackers to access user information in log. Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=3
CVE ID: CVE-2022-25824 State: PUBLISHED Published: 2022-03-08T13:47:40 Last Updated: 2024-08-03T04:49:43.776Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Samsung Mobile Products: BixbyTouch Problem Types: CWE-284 Description: Improper access control vulnerability in BixbyTouch prior to version 2.2.00.6 in China models allows untrusted applications to load arbitrary URL and local files in webview. Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=3
CVE ID: CVE-2022-25825 State: PUBLISHED Published: 2022-03-08T13:47:53 Last Updated: 2024-08-03T04:49:43.758Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Samsung Mobile Products: Samsung Account Problem Types: CWE-287 Description: Improper access control vulnerability in Samsung Account prior to version 13.1.0.1 allows attackers to access to the authcode for sign-in. Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=3
CVE ID: CVE-2022-25826 State: PUBLISHED Published: 2022-03-08T13:48:05 Last Updated: 2024-08-03T04:49:43.591Z Severity: LOW (CVSS 1.9 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N) Vendors: Samsung Mobile Products: Galaxy S3 PlugIn Problem Types: CWE-200 Description: Information Exposure vulnerability in Galaxy S3 Plugin prior to version 2.2.03.22012751 allows attacker to access password information of connected WiFiAp in the log Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=3
CVE ID: CVE-2022-25827 State: PUBLISHED Published: 2022-03-08T13:48:13 Last Updated: 2024-08-03T04:49:43.807Z Severity: LOW (CVSS 1.9 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N) Vendors: Samsung Mobile Products: Galaxy Watch PlugIn Problem Types: CWE-200 Description: Information Exposure vulnerability in Galaxy Watch Plugin prior to version 2.2.05.22012751 allows attacker to access password information of connected WiFiAp in the log Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=3
CVE ID: CVE-2022-25828 State: PUBLISHED Published: 2022-03-08T13:48:47 Last Updated: 2024-08-03T04:49:43.938Z Severity: LOW (CVSS 1.9 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N) Vendors: Samsung Mobile Products: Watch Active PlugIn Problem Types: CWE-200 Description: Information Exposure vulnerability in Watch Active Plugin prior to version 2.2.07.22012751 allows attacker to access password information of connected WiFiAp in the log Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=3
CVE ID: CVE-2022-25829 State: PUBLISHED Published: 2022-03-08T13:48:52 Last Updated: 2024-08-03T04:49:44.177Z Severity: LOW (CVSS 1.9 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N) Vendors: Samsung Mobile Products: Watch Active2 PlugIn Problem Types: CWE-200 Description: Information Exposure vulnerability in Watch Active2 Plugin prior to version 2.2.08.22012751 allows attacker to access password information of connected WiFiAp in the log Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=3
CVE ID: CVE-2022-25830 State: PUBLISHED Published: 2022-03-08T13:48:59 Last Updated: 2024-08-03T04:49:43.584Z Severity: LOW (CVSS 1.9 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N) Vendors: Samsung Mobile Products: Galaxy Watch3 Plugin Problem Types: CWE-200 Description: Information Exposure vulnerability in Galaxy Watch3 Plugin prior to version 2.2.09.22012751 allows attacker to access password information of connected WiFiAp in the log Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=3
CVE ID: CVE-2022-25831 State: PUBLISHED Published: 2022-04-11T19:36:57 Last Updated: 2024-08-03T04:49:43.766Z Severity: LOW (CVSS 2 CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Samsung Mobile Products: Samsung Mobile Devices Problem Types: CWE-284 Description: Improper access control vulnerability in S Secure prior to SMR Apr-2022 Release 1 allows physical attackers to access secured data in certain conditions. Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=4
CVE ID: CVE-2022-25832 State: PUBLISHED Published: 2022-04-11T19:36:58 Last Updated: 2024-08-03T04:49:43.674Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Samsung Mobile Products: Samsung Mobile Devices Problem Types: CWE-287 Description: Improper authentication vulnerability in S Secure prior to SMR Apr-2022 Release 1 allows physical attackers to use locked Myfiles app without authentication. Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=4
CVE ID: CVE-2022-25833 State: PUBLISHED Published: 2022-04-11T19:36:59 Last Updated: 2024-08-03T04:49:43.612Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Samsung Mobile Products: Samsung Mobile Devices Problem Types: CWE-287 Description: Improper authentication in ImsService prior to SMR Apr-2022 Release 1 allows attackers to get IMSI without READ_PRIVILEGED_PHONE_STATE permission. Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=4
CVE ID: CVE-2022-25834 State: PUBLISHED Published: 2023-06-07T00:00:00 Last Updated: 2025-01-07T16:19:30.605Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Percona XtraBackup (PXB) through 2.2.24 and 3.x through 8.0.27-19, a crafted filename on the local file system could trigger unexpected command shell execution of arbitrary commands. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.percona.com/doc/percona-xtrabackup/2.4/index.html - https://docs.percona.com/percona-xtrabackup/8.0/release-notes/8.0/8.0.32-26.0.html#improvements
CVE ID: CVE-2022-25836 State: PUBLISHED Published: 2022-12-12T00:00:00.000Z Last Updated: 2025-04-22T20:15:08.966Z Vendors: n/a Products: n/a Problem Types: n/a Description: Bluetooth® Low Energy Pairing in Bluetooth Core Specification v4.0 through v5.3 may permit an unauthenticated MITM to acquire credentials with two pairing devices via adjacent access when the MITM negotiates Legacy Passkey Pairing with the pairing Initiator and Secure Connections Passkey Pairing with the pairing Responder and brute forces the Passkey entered by the user into the Initiator. The MITM attacker can use the identified Passkey value to complete authentication with the Responder via Bluetooth pairing method con
cker can use the identified Passkey value to complete authentication with the Responder via Bluetooth pairing method confusion. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.bluetooth.com/learn-about-bluetooth/key-attributes/bluetooth-security/reporting-security/
CVE ID: CVE-2022-25837 State: PUBLISHED Published: 2022-12-12T00:00:00.000Z Last Updated: 2025-04-22T20:21:36.394Z Vendors: n/a Products: n/a Problem Types: n/a Description: Bluetooth® Pairing in Bluetooth Core Specification v1.0B through v5.3 may permit an unauthenticated MITM to acquire credentials with two pairing devices via adjacent access when at least one device supports BR/EDR Secure Connections pairing and the other BR/EDR Legacy PIN code pairing if the MITM negotiates BR/EDR Secure Simple Pairing in Secure Connections mode using the Passkey association model with the pairing Initiator and BR/EDR Legacy PIN code pairing with the pairing Responder and brute forces the Passkey entered
the pairing Initiator and BR/EDR Legacy PIN code pairing with the pairing Responder and brute forces the Passkey entered by the user into the Responder as a 6-digit PIN code. The MITM attacker can use the identified PIN code value as the Passkey value to complete authentication with the Initiator via Bluetooth pairing method confusion. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.bluetooth.com/learn-about-bluetooth/key-attributes/bluetooth-security/reporting-security/
CVE ID: CVE-2022-25838 State: PUBLISHED Published: 2022-02-24T02:43:16 Last Updated: 2024-08-03T04:49:43.583Z Vendors: n/a Products: n/a Problem Types: n/a Description: Laravel Fortify before 1.11.1 allows reuse within a short time window, thus calling into question the "OT" part of the "TOTP" concept. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/laravel/fortify/issues/201#issuecomment-1009282153
CVE ID: CVE-2022-25839 State: PUBLISHED Published: 2022-03-11T20:00:15.762099Z Last Updated: 2024-09-16T22:35:35.422Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P) Vendors: n/a Products: url-js Problem Types: Improper Input Validation Description: The package url-js before 2.1.0 are vulnerable to Improper Input Validation due to improper parsing, which makes it is possible for the hostname to be spoofed. http://\\\\\\\\localhost and http://localhost are the same URL. However, the hostname is not parsed as localhost, and the backslash is reflected as it is. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-URLJS-241403
ted as it is. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-URLJS-2414030 - https://github.com/duzun/URL.js/commit/9dc9fcc99baa4cbda24403d81a589e9b0f4121d0