Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-41329 State: PUBLISHED Published: 2023-03-07T16:22:02.418Z Last Updated: 2024-10-23T14:31:07.124Z Severity: MEDIUM (CVSS 5.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:F/RL:X/RC:C) Vendors: Fortinet Products: FortiProxy, FortiOS Problem Types: CWE-200 Description: An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in Fortinet FortiProxy version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.7, FortiOS version 7.2.0 through 7.2.3 and 7.0.0 through 7.0.9 allows an unauthenticated attackers to obtain sensitive logging informations on the device via crafted HTTP GET requests. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrich
ions on the device via crafted HTTP GET requests. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-22-364
CVE ID: CVE-2022-41330 State: PUBLISHED Published: 2023-04-11T16:05:38.973Z Last Updated: 2024-10-23T14:30:33.980Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:X/RC:C) Vendors: Fortinet Products: FortiProxy, FortiOS Problem Types: CWE-79 Description: An improper neutralization of input during web page generation vulnerability ('Cross-site Scripting') [CWE-79] in Fortinet FortiOS version 7.2.0 through 7.2.3, version 7.0.0 through 7.0.9, version 6.4.0 through 6.4.11 and before 6.2.12 and FortiProxy version 7.2.0 through 7.2.1 and before 7.0.7 allows an unauthenticated attacker to perform an XSS attack via crafted HTTP GET requests. Additional Analyst Notes: - CV
llows an unauthenticated attacker to perform an XSS attack via crafted HTTP GET requests. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-22-363
CVE ID: CVE-2022-41331 State: PUBLISHED Published: 2023-04-11T16:06:05.258Z Last Updated: 2024-10-23T14:29:35.185Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:C) Vendors: Fortinet Products: FortiPresence Problem Types: CWE-306 Description: A missing authentication for critical function vulnerability [CWE-306] in FortiPresence infrastructure server before version 1.2.1 allows a remote, unauthenticated attacker to access the Redis and MongoDB instances via crafted authentication requests. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-22-355
CVE ID: CVE-2022-41333 State: PUBLISHED Published: 2023-03-07T16:04:43.368Z Last Updated: 2025-02-13T16:33:04.755Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:X/RC:R) Vendors: Fortinet Products: FortiRecorder Problem Types: CWE-400 Description: An uncontrolled resource consumption vulnerability [CWE-400] in FortiRecorder version 6.4.3 and below, 6.0.11 and below login authentication mechanism may allow an unauthenticated attacker to make the device unavailable via crafted GET requests. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-22-388 - http://packetstormsecurity.com/files/171
ISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-22-388 - http://packetstormsecurity.com/files/171766/FortiRecorder-6.4.3-Denial-Of-Service.html
CVE ID: CVE-2022-41334 State: PUBLISHED Published: 2023-02-16T18:06:33.788Z Last Updated: 2024-10-23T14:46:36.145Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:F/RL:X/RC:C) Vendors: Fortinet Products: FortiOS Problem Types: CWE-79 Description: An improper neutralization of input during web page generation [CWE-79] vulnerability in FortiOS versions 7.0.0 to 7.0.7 and 7.2.0 to 7.2.3 may allow a remote, unauthenticated attacker to launch a cross site scripting (XSS) attack via the "redir" parameter of the URL seen when the "Sign in with FortiCloud" button is clicked. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fort
utton is clicked. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-22-224
CVE ID: CVE-2022-41335 State: PUBLISHED Published: 2023-02-16T18:05:14.761Z Last Updated: 2024-10-23T14:50:43.903Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:X/RC:C) Vendors: Fortinet Products: FortiSwitchManager, FortiOS, FortiProxy Problem Types: CWE-23 Description: A relative path traversal vulnerability [CWE-23] in Fortinet FortiOS version 7.2.0 through 7.2.2, 7.0.0 through 7.0.8 and before 6.4.10, FortiProxy version 7.2.0 through 7.2.1, 7.0.0 through 7.0.7 and before 2.0.10, FortiSwitchManager 7.2.0 and before 7.0.0 allows an authenticated attacker to read and write files on the underlying Linux system via crafted HTTP requests. Additional Analyst Notes
ated attacker to read and write files on the underlying Linux system via crafted HTTP requests. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-22-391
CVE ID: CVE-2022-41336 State: PUBLISHED Published: 2023-01-03T16:58:06.284Z Last Updated: 2024-10-23T14:51:08.943Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H/E:F/RL:X/RC:C) Vendors: Fortinet Products: FortiPortal Problem Types: CWE-79 Description: An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiPortal versions 6.0.0 through 6.0.11 and all versions of 5.3, 5.2, 5.1, 5.0 management interface may allow a remote authenticated attacker to perform a stored cross site scripting (XSS) attack via sending request with specially crafted columnindex parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrich
est with specially crafted columnindex parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-22-313
CVE ID: CVE-2022-41339 State: PUBLISHED Published: 2022-11-12T00:00:00.000Z Last Updated: 2025-05-01T13:26:18.384Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Zoho ManageEngine Mobile Device Manager Plus before 10.1.2207.5, the User Administration module allows privilege escalation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.manageengine.com/mobile-device-management/kb/CVE-2022-41339.html
CVE ID: CVE-2022-41340 State: PUBLISHED Published: 2022-09-24T18:22:27.000Z Last Updated: 2025-05-22T14:15:29.734Z Vendors: n/a Products: n/a Problem Types: n/a Description: The secp256k1-js package before 1.1.0 for Node.js implements ECDSA without required r and s validation, leading to signature forgery. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/lionello/secp256k1-js/issues/11 - https://github.com/lionello/secp256k1-js/commit/302800f0370b42e360a33774bb808274ac729c2e - https://github.com/lionello/secp256k1-js/compare/1.0.1...1.1.0 - https://www.npmjs.com/package/%40lionello/secp256k1-js
CVE ID: CVE-2022-41341 State: REJECTED Published: N/A Last Updated: 2025-05-28T18:20:50.830Z Description: No description available.
CVE ID: CVE-2022-41342 State: PUBLISHED Published: 2023-02-06T18:58:01.852Z Last Updated: 2025-01-27T18:26:09.622Z Severity: MEDIUM (CVSS 6 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:L) Vendors: n/a Products: Intel(R) C++ Compiler Classic before version 2021.7.1 for some Intel(R) oneAPI Toolkits Problem Types: escalation of privilege Description: Improper buffer restrictions in the Intel(R) C++ Compiler Classic before version 2021.7.1 for some Intel(R) oneAPI Toolkits before version 2022.3.1 may allow a privileged user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com
access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00773.html
CVE ID: CVE-2022-41343 State: PUBLISHED Published: 2022-09-25T00:00:00.000Z Last Updated: 2025-05-22T14:41:32.009Z Vendors: n/a Products: n/a Problem Types: n/a Description: registerFont in FontMetrics.php in Dompdf before 2.0.1 allows remote file inclusion because a URI validation failure does not halt font registration, as demonstrated by a @font-face rule. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/dompdf/dompdf/issues/2994 - https://github.com/dompdf/dompdf/pull/2995 - https://github.com/dompdf/dompdf/releases/tag/v2.0.1 - https://tantosec.com/blog/cve-2022-41343/
CVE ID: CVE-2022-41347 State: PUBLISHED Published: 2022-09-26T01:29:48.000Z Last Updated: 2025-05-21T18:49:00.723Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Zimbra Collaboration (ZCS) 8.8.x and 9.x (e.g., 8.8.15). The Sudo configuration permits the zimbra user to execute the NGINX binary as root with arbitrary parameters. As part of its intended functionality, NGINX can load a user-defined configuration file, which includes plugins in the form of .so files, which also execute as root. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories - https://wiki.zimbr
ner: - CISA ADP Vulnrichment: References: - https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories - https://wiki.zimbra.com/wiki/Security_Center - https://darrenmartyn.ie/2021/10/25/zimbra-nginx-local-root-exploit/ - https://github.com/darrenmartyn/zimbra-hinginx
CVE ID: CVE-2022-41348 State: PUBLISHED Published: 2022-10-12T00:00:00.000Z Last Updated: 2025-05-15T14:57:23.535Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Zimbra Collaboration (ZCS) 9.0. XSS can occur via the onerror attribute of an IMG element, leading to information disclosure. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories - https://wiki.zimbra.com/wiki/Security_Center
CVE ID: CVE-2022-41349 State: PUBLISHED Published: 2022-10-12T00:00:00.000Z Last Updated: 2025-05-15T14:55:29.419Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Zimbra Collaboration Suite (ZCS) 8.8.15, the URL at /h/compose accepts an attachUrl parameter that is vulnerable to Reflected XSS. This allows executing arbitrary JavaScript on the victim's machine. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories - https://wiki.zimbra.com/wiki/Security_Center
CVE ID: CVE-2022-41350 State: PUBLISHED Published: 2022-10-12T00:00:00.000Z Last Updated: 2025-05-15T14:53:52.378Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Zimbra Collaboration Suite (ZCS) 8.8.15, /h/search?action=voicemail&action=listen accepts a phone parameter that is vulnerable to Reflected XSS. This allows executing arbitrary JavaScript on the victim's machine. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories - https://wiki.zimbra.com/wiki/Security_Center
CVE ID: CVE-2022-41351 State: PUBLISHED Published: 2022-10-12T00:00:00.000Z Last Updated: 2025-05-15T14:51:47.360Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Zimbra Collaboration Suite (ZCS) 8.8.15, at the URL /h/calendar, one can trigger XSS by adding JavaScript code to the view parameter and changing the value of the uncheck parameter to a string (instead of default value of 10). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories - https://wiki.zimbra.com/wiki/Security_Center
CVE ID: CVE-2022-41352 State: PUBLISHED Published: 2022-09-26T00:00:00.000Z Last Updated: 2025-10-21T23:15:34.543Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0. An attacker can upload arbitrary files through amavis via a cpio loophole (extraction to /opt/zimbra/jetty/webapps/zimbra/public) that can lead to incorrect access to any other user accounts. Zimbra recommends pax over cpio. Also, pax is in the prerequisites of Zimbra on Ubuntu; however, pax is no longer part of a default Red Hat installation after RHEL 6 (or CentOS 6). Once pax is installed, amavis automatically prefers it over cpio. Additional Analys
allation after RHEL 6 (or CentOS 6). Once pax is installed, amavis automatically prefers it over cpio. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories - https://wiki.zimbra.com/wiki/Security_Center - https://forums.zimbra.org/viewtopic.php?t=71153&p=306532 - http://packetstormsecurity.com/files/169458/Zimbra-Collaboration-Suite-TAR-Path-Traversal.html - https://www.secpod.com/blog/unpatched-rce-bug-in-zimbra-collaboration-suite-exploited-in-wild/
CVE ID: CVE-2022-41354 State: PUBLISHED Published: 2023-03-27T00:00:00.000Z Last Updated: 2025-02-19T18:46:38.230Z Vendors: n/a Products: n/a Problem Types: n/a Description: An access control issue in Argo CD v2.4.12 and below allows unauthenticated attackers to enumerate existing applications. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://argo.com - https://github.com/chunklhit/cve/blob/master/argo/argo-cd/application_enumeration.md - https://github.com/argoproj/argo-cd/security/advisories/GHSA-2q5c-qw9c-fmvq
CVE ID: CVE-2022-41355 State: PUBLISHED Published: 2022-10-06T00:00:00 Last Updated: 2024-08-03T12:42:46.200Z Vendors: n/a Products: n/a Problem Types: n/a Description: Online Leave Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /leave_system/classes/Master.php?f=delete_department. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Cvedig/Bug_report/blob/main/vendors/oretnom23/online-leave-management-system/SQLi-1.md
CVE ID: CVE-2022-41358 State: PUBLISHED Published: 2022-10-20T00:00:00.000Z Last Updated: 2025-05-08T15:48:53.075Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability in Garage Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the categoriesName parameter in createCategories.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.sourcecodester.com/php/15485/garage-management-system-using-phpmysql-source-code.html - http://packetstormsecurity.com/files/168718/Garage-Management-System-1.0-Cross-Site-Scripting.html - http
ce-code.html - http://packetstormsecurity.com/files/168718/Garage-Management-System-1.0-Cross-Site-Scripting.html - https://github.com/thecasual/CVE-2022-41358 - https://cxsecurity.com/issue/WLB-2022100037 - https://vulmon.com/vulnerabilitydetails?qid=CVE-2022-41358 - https://www.samwallace.dev/research/Stored%20XSS%20in%20GMS%201.0
CVE ID: CVE-2022-41376 State: PUBLISHED Published: 2022-10-11T00:00:00.000Z Last Updated: 2025-05-20T13:44:53.125Z Vendors: n/a Products: n/a Problem Types: n/a Description: Metro UI v4.4.0 to v4.5.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the Javascript function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://alicangonullu.org/konu/138
CVE ID: CVE-2022-41377 State: PUBLISHED Published: 2022-10-07T00:00:00 Last Updated: 2024-08-03T12:42:45.769Z Vendors: n/a Products: n/a Problem Types: n/a Description: Online Pet Shop We App v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /pet_shop/admin/?page=maintenance/manage_category. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/hegeoo/bug_report/blob/main/vendors/oretnom23/online-pet-shop-we-app/SQLi-2.md
CVE ID: CVE-2022-41378 State: PUBLISHED Published: 2022-10-07T00:00:00 Last Updated: 2024-08-03T12:42:46.193Z Vendors: n/a Products: n/a Problem Types: n/a Description: Online Pet Shop We App v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /pet_shop/admin/?page=inventory/manage_inventory. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/hegeoo/bug_report/blob/main/vendors/oretnom23/online-pet-shop-we-app/SQLi-1.md
CVE ID: CVE-2022-41379 State: PUBLISHED Published: 2022-10-07T00:00:00 Last Updated: 2024-08-03T12:42:46.208Z Vendors: n/a Products: n/a Problem Types: n/a Description: An arbitrary file upload vulnerability in the component /leave_system/classes/Users.php?f=save of Online Leave Management System v1.0 allows attackers to execute arbitrary code via a crafted PHP file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/hegeoo/bug_report/blob/main/vendors/oretnom23/online-leave-management-system/RCE-1.md
CVE ID: CVE-2022-41380 State: PUBLISHED Published: 2022-10-11T00:00:00.000Z Last Updated: 2025-05-20T13:42:35.719Z Vendors: n/a Products: n/a Problem Types: n/a Description: The d8s-yaml package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-file-system package. The affected version is 0.1.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://pypi.org/project/democritus-file-system/ - https://pypi.org/project/d8s-yaml/ - https://github.com/democritus-project/d8s-yaml/issues/4
CVE ID: CVE-2022-41381 State: PUBLISHED Published: 2022-10-11T00:00:00.000Z Last Updated: 2025-05-20T13:40:14.185Z Vendors: n/a Products: n/a Problem Types: n/a Description: The d8s-utility package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-file-system package. The affected version is 0.1.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://pypi.org/project/d8s-utility/ - https://pypi.org/project/democritus-file-system/ - https://github.com/democritus-project/d8s-utility/issues/10
CVE ID: CVE-2022-41382 State: PUBLISHED Published: 2022-10-11T00:00:00.000Z Last Updated: 2025-05-20T13:38:26.690Z Vendors: n/a Products: n/a Problem Types: n/a Description: The d8s-json package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-file-system package. The affected version is 0.1.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://pypi.org/project/d8s-json/ - https://pypi.org/project/democritus-file-system/ - https://github.com/democritus-project/d8s-json/issues/10
CVE ID: CVE-2022-41383 State: PUBLISHED Published: 2022-10-11T00:00:00.000Z Last Updated: 2025-05-20T14:46:02.980Z Vendors: n/a Products: n/a Problem Types: n/a Description: The d8s-archives package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-file-system package. The affected version is 0.1.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://pypi.org/project/d8s-archives/ - https://pypi.org/project/democritus-file-system/ - https://github.com/democritus-project/d8s-archives/issues/13
CVE ID: CVE-2022-41384 State: PUBLISHED Published: 2022-10-11T00:00:00.000Z Last Updated: 2025-05-20T14:44:08.841Z Vendors: n/a Products: n/a Problem Types: n/a Description: The d8s-domains package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-urls package. The affected version is 0.1.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://pypi.org/project/d8s-domains/ - https://pypi.org/project/democritus-urls/ - https://github.com/democritus-project/d8s-domains/issues/9
CVE ID: CVE-2022-41385 State: PUBLISHED Published: 2022-10-11T00:00:00.000Z Last Updated: 2025-05-20T14:35:16.815Z Vendors: n/a Products: n/a Problem Types: n/a Description: The d8s-html package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-urls package. The affected version is 0.1.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://pypi.org/project/d8s-html/ - https://pypi.org/project/democritus-urls/ - https://github.com/democritus-project/d8s-html/issues/12
CVE ID: CVE-2022-41386 State: PUBLISHED Published: 2022-10-11T00:00:00.000Z Last Updated: 2025-05-20T13:50:17.650Z Vendors: n/a Products: n/a Problem Types: n/a Description: The d8s-utility package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-urls package. The affected version is 0.1.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://pypi.org/project/d8s-utility/ - https://pypi.org/project/democritus-urls/ - https://github.com/democritus-project/d8s-utility/issues/11
CVE ID: CVE-2022-41387 State: PUBLISHED Published: 2022-10-11T00:00:00.000Z Last Updated: 2025-05-20T13:47:21.996Z Vendors: n/a Products: n/a Problem Types: n/a Description: The d8s-pdfs package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-urls package. The affected version is 0.1.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://pypi.org/project/d8s-pdfs/ - https://pypi.org/project/democritus-urls/ - https://github.com/democritus-project/d8s-pdfs/issues/7
CVE ID: CVE-2022-41390 State: PUBLISHED Published: 2022-10-13T00:00:00.000Z Last Updated: 2025-05-15T14:42:31.134Z Vendors: n/a Products: n/a Problem Types: n/a Description: OcoMon v4.0 was discovered to contain a SQL injection vulnerability via the cod parameter at download.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gist.github.com/fgimenesp/a30dcc4fb7912334b6fb1b145a56ad88
CVE ID: CVE-2022-41391 State: PUBLISHED Published: 2022-10-13T00:00:00.000Z Last Updated: 2025-05-15T14:40:18.708Z Vendors: n/a Products: n/a Problem Types: n/a Description: OcoMon v4.0 was discovered to contain a SQL injection vulnerability via the cod parameter at showImg.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gist.github.com/fgimenesp/a30dcc4fb7912334b6fb1b145a56ad88
CVE ID: CVE-2022-41392 State: PUBLISHED Published: 2022-10-07T00:00:00 Last Updated: 2024-08-03T12:42:45.891Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in TotalJS commit 8c2c8909 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Website name text field under Main Settings. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/totaljs/cms/issues/38 - https://www.edoardoottavianelli.it/CVE-2022-41392/ - https://www.youtube.com/watch?v=BOPLYnveBqk
CVE ID: CVE-2022-41395 State: PUBLISHED Published: 2022-11-15T00:00:00.000Z Last Updated: 2025-04-30T14:46:34.856Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda AC1200 Router Model W15Ev2 V15.11.0.10(1576) was discovered to contain a command injection vulnerability via the dmzHost parameter in the setDMZ function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://boschko.ca/tenda_ac1200_router/ - https://boschko.ca/tenda_ac1200_router