Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-40762 State: PUBLISHED Published: 2022-09-16T21:35:45 Last Updated: 2024-08-03T12:28:42.627Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Memory Allocation with Excessive Size Value vulnerablity in the TEE_Realloc function in Samsung mTower through 0.3.0 allows a trusted application to trigger a Denial of Service (DoS) by invoking the function TEE_Realloc with an excessive number for the parameter len. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Samsung/mTower/blob/efd36709306a9afcca5b4782499d01be0c7a02a5/tee/lib/libutee/tee_api.c#L319 - https://github.com/Samsung/mTower/issues/82
CVE ID: CVE-2022-40764 State: PUBLISHED Published: 2022-10-03T14:03:59 Last Updated: 2024-08-03T12:28:42.504Z Vendors: n/a Products: n/a Problem Types: n/a Description: Snyk CLI before 1.996.0 allows arbitrary command execution, affecting Snyk IDE plugins and the snyk npm package. Exploitation could follow from the common practice of viewing untrusted files in the Visual Studio Code editor, for example. The original demonstration was with shell metacharacters in the vendor.json ignore field, affecting snyk-go-plugin before 1.19.1. This affects, for example, the Snyk TeamCity plugin (which does not update automatically) before 20220930.142957. Additional Analyst Notes: - CVE Program Container
y plugin (which does not update automatically) before 20220930.142957. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/snyk/snyk-go-plugin/releases/tag/v1.19.1 - https://github.com/snyk/cli/releases/tag/v1.996.0 - https://www.imperva.com/blog/how-scanning-your-projects-for-security-issues-can-lead-to-remote-code-execution/ - https://support.snyk.io/hc/en-us/articles/7015908293789-CVE-2022-40764-Command-Injection-vulnerability-affecting-Snyk-CLI-versions-prior-to-1-996-0
CVE ID: CVE-2022-40765 State: PUBLISHED Published: 2022-11-22T00:00:00.000Z Last Updated: 2025-10-21T23:15:31.091Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability in the Edge Gateway component of Mitel MiVoice Connect through 19.3 (22.22.6100.0) could allow an authenticated attacker with internal network access to conduct a command-injection attack, due to insufficient restriction of URL parameters. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mitel.com/support/security-advisories - https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-22-0007
CVE ID: CVE-2022-40766 State: PUBLISHED Published: 2022-09-18T04:05:57 Last Updated: 2024-08-03T12:28:42.430Z Vendors: n/a Products: n/a Problem Types: n/a Description: Modern Campus Omni CMS (formerly OU Campus) 10.2.4 allows login-page SQL injection via a '" OR 1 = 1 -- - , <?php' substring. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/Mr-Akuma/8d84b564fb051caa1b1ea31b24f6b9fb - https://moderncampus.com/products/web-content-management.html
CVE ID: CVE-2022-40768 State: PUBLISHED Published: 2022-09-18T00:00:00 Last Updated: 2024-08-03T12:28:41.522Z Vendors: n/a Products: n/a Problem Types: n/a Description: drivers/scsi/stex.c in the Linux kernel through 5.19.9 allows local users to obtain sensitive information from kernel memory because stex_queuecommand_lck lacks a memset for the PASSTHRU_CMD case. Additional Analyst Notes: - CVE Program Container: References: - https://www.openwall.com/lists/oss-security/2022/09/09/1 - https://lore.kernel.org/all/20220908145154.2284098-1-gregkh%40linuxfoundation.org/ - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/log/drivers/scsi/stex.c - http://www.openwall.com/lists/os
://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/log/drivers/scsi/stex.c - http://www.openwall.com/lists/oss-security/2022/09/19/1 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GGHENNMLCWIQV2LLA56BJNFIUZ7WB4IY/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VNN3VFQPECS6D4PS6ZWD7AFXTOSJDSSR/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/S2KTU5LFZNQS7YNGE56MT46VHMXL3DD2/ - https://lists.debian.org/debian-lts-announce/2022/12/msg00034.html - https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=6022f210461
-announce/2022/12/msg00034.html - https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=6022f210461fef67e6e676fd8544ca02d1bcfa7a
CVE ID: CVE-2022-40769 State: PUBLISHED Published: 2022-09-18T16:01:08 Last Updated: 2024-08-03T12:28:42.680Z Vendors: n/a Products: n/a Problem Types: n/a Description: profanity through 1.60 has only four billion possible RNG initializations. Thus, attackers can recover private keys from Ethereum vanity addresses and steal cryptocurrency, as exploited in the wild in June 2022. Additional Analyst Notes: - CVE Program Container: References: - https://blog.1inch.io/a-vulnerability-disclosed-in-profanity-an-ethereum-vanity-address-tool-68ed7455fc8c - https://github.com/johguse/profanity - https://github.com/johguse/profanity/issues/61
CVE ID: CVE-2022-40770 State: PUBLISHED Published: 2022-11-23T00:00:00.000Z Last Updated: 2025-04-28T19:38:56.406Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine ServiceDesk Plus versions 13010 and prior are vulnerable to authenticated command injection. This can be exploited by high-privileged users. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://manageengine.com - https://www.manageengine.com/products/service-desk/CVE-2022-40770.html
CVE ID: CVE-2022-40771 State: PUBLISHED Published: 2022-11-23T00:00:00.000Z Last Updated: 2025-04-28T19:37:36.773Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine ServiceDesk Plus versions 13010 and prior are vulnerable to an XML External Entity attack that leads to Information Disclosure. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://manageengine.com - https://www.manageengine.com/products/service-desk/CVE-2022-40771.html
CVE ID: CVE-2022-40772 State: PUBLISHED Published: 2022-11-23T00:00:00.000Z Last Updated: 2025-04-28T19:34:22.092Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine ServiceDesk Plus versions 13010 and prior are vulnerable to a validation bypass that allows users to access sensitive data via the report module. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://manageengine.com - https://www.manageengine.com/products/service-desk/CVE-2022-40772.html
CVE ID: CVE-2022-40773 State: PUBLISHED Published: 2022-11-12T00:00:00.000Z Last Updated: 2025-05-01T13:30:33.850Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine ServiceDesk Plus MSP before 10609 and SupportCenter Plus before 11025 are vulnerable to privilege escalation. This allows users to obtain sensitive data during an exportMickeyList export of requests from the list view. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.manageengine.com/products/service-desk-msp/cve-2022-40773.html - https://www.zerodayinitiative.com/advisories/ZDI-22-1490/
CVE ID: CVE-2022-40774 State: PUBLISHED Published: 2022-09-18T18:11:52 Last Updated: 2024-08-03T12:28:42.909Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Bento4 through 1.6.0-639. There is a NULL pointer dereference in AP4_StszAtom::GetSampleSize. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/axiomatic-systems/Bento4/issues/757
CVE ID: CVE-2022-40775 State: PUBLISHED Published: 2022-09-18T18:11:44 Last Updated: 2024-08-03T12:28:42.946Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Bento4 through 1.6.0-639. A NULL pointer dereference occurs in AP4_StszAtom::WriteFields. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/axiomatic-systems/Bento4/issues/758
CVE ID: CVE-2022-40777 State: PUBLISHED Published: 2022-10-11T00:00:00 Last Updated: 2024-08-03T12:28:42.661Z Vendors: n/a Products: n/a Problem Types: n/a Description: Interspire Email Marketer through 6.5.0 allows arbitrary file upload via a surveys_submit.php "create survey and submit survey" operation, which can cause a .php file to be accessible under a /admin/temp/surveys/ URI. NOTE: this issue exists because of an incomplete fix for CVE-2018-19550. Additional Analyst Notes: - CVE Program Container: References: - https://twitter.com/huyvinhptit - https://www.interspire.com/security-bulletin-20220918/
CVE ID: CVE-2022-40778 State: PUBLISHED Published: 2022-09-19T06:08:32 Last Updated: 2024-08-03T12:28:42.599Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored Cross-Site Scripting (XSS) vulnerability in OPSWAT MetaDefender ICAP Server before 4.13.0 allows attackers to execute arbitrary JavaScript or HTML because of the blocked page response. Additional Analyst Notes: - CVE Program Container: References: - https://www.opswat.com/products/metadefender/icap - https://docs.opswat.com/mdicap/release-notes
CVE ID: CVE-2022-40784 State: PUBLISHED Published: 2022-09-26T15:00:56.000Z Last Updated: 2025-05-22T13:58:48.147Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unlimited strcpy on user input when setting a locale file leads to stack buffer overflow in mIPC camera firmware 5.3.1.2003161406. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://hackmd.io/%40_zOX-PXQQFmCETA_RZIgow/BkOhIU1oc
CVE ID: CVE-2022-40785 State: PUBLISHED Published: 2022-09-26T14:57:22.000Z Last Updated: 2025-05-22T14:08:59.436Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unsanitized input when setting a locale file leads to shell injection in mIPC camera firmware 5.3.1.2003161406. This allows an attacker to gain remote code execution on cameras running the firmware when a victim logs into a specially crafted mobile app. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://hackmd.io/%40_zOX-PXQQFmCETA_RZIgow/BkOhIU1oc
CVE ID: CVE-2022-40797 State: PUBLISHED Published: 2022-11-09T00:00:00.000Z Last Updated: 2025-05-01T15:51:32.573Z Vendors: n/a Products: n/a Problem Types: n/a Description: Roxy Fileman 1.4.6 allows Remote Code Execution via a .phar upload, because the default FORBIDDEN_UPLOADS value in conf.json only blocks .php, .php4, and .php5 files. (Visiting any .phar file invokes the PHP interpreter in some realistic web-server configurations.) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://salsa.debian.org/php-team/php/-/blob/dc253886b5b2e9bc8d9e36db787abb083a667fd8/debian/php-cgi.conf#L5-6 - https://gist.github.com/Hadi999/1f66fe7c5a217ca261ebfec36
886b5b2e9bc8d9e36db787abb083a667fd8/debian/php-cgi.conf#L5-6 - https://gist.github.com/Hadi999/1f66fe7c5a217ca261ebfec36c630d18 - https://web.archive.org/web/20210126213412/https://roxyfileman.com/download.php?f=1.4.6-php - http://packetstormsecurity.com/files/169964/Roxy-Fileman-1.4.6-Remote-Shell-Upload.html
CVE ID: CVE-2022-40798 State: PUBLISHED Published: 2022-10-19T00:00:00.000Z Last Updated: 2025-05-08T19:39:57.254Z Vendors: n/a Products: n/a Problem Types: n/a Description: OcoMon 4.0RC1 is vulnerable to Incorrect Access Control. Through a request the user can obtain the real email, sending the same request with correct email its possible to account takeover. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://ocomonphp.sourceforge.io/ - https://gist.github.com/ninj4c0d3r/89bdd6702bf00d768302f5e0e5bb8adc
CVE ID: CVE-2022-40799 State: PUBLISHED Published: 2022-11-29T00:00:00.000Z Last Updated: 2025-10-21T23:15:30.649Z Vendors: n/a Products: n/a Problem Types: n/a Description: Data Integrity Failure in 'Backup Config' in D-Link DNR-322L <= 2.60B15 allows an authenticated attacker to execute OS level commands on the device. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/lu-ka/cve-2022-40799
CVE ID: CVE-2022-40805 State: PUBLISHED Published: 2022-09-19T14:45:20 Last Updated: 2024-08-03T12:28:42.524Z Vendors: n/a Products: n/a Problem Types: n/a Description: The d8s-urls for python 0.1.0, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. A potential code execution backdoor inserted by third parties is the democritus-hypothesis package. Additional Analyst Notes: - CVE Program Container: References: - https://pypi.org/project/democritus-hypothesis/ - https://github.com/democritus-project/d8s-urls/issues/10
CVE ID: CVE-2022-40806 State: PUBLISHED Published: 2022-09-19T14:51:36 Last Updated: 2024-08-03T12:28:42.482Z Vendors: n/a Products: n/a Problem Types: n/a Description: The d8s-uuids for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-hypothesis package. The affected version is 0.1.0 Additional Analyst Notes: - CVE Program Container: References: - https://pypi.org/project/democritus-hypothesis/ - https://github.com/democritus-project/d8s-uuids/issues/5
CVE ID: CVE-2022-40807 State: PUBLISHED Published: 2022-09-19T14:55:28 Last Updated: 2024-08-03T12:28:42.616Z Vendors: n/a Products: n/a Problem Types: n/a Description: The d8s-domains for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-hypothesis package. The affected version is 0.1.0 Additional Analyst Notes: - CVE Program Container: References: - https://pypi.org/project/democritus-hypothesis/ - https://github.com/democritus-project/d8s-domains/issues/8
CVE ID: CVE-2022-40808 State: PUBLISHED Published: 2022-09-19T15:00:22 Last Updated: 2024-08-03T12:28:42.932Z Vendors: n/a Products: n/a Problem Types: n/a Description: The d8s-dates for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-hypothesis package. The affected version is 0.1.0 Additional Analyst Notes: - CVE Program Container: References: - https://pypi.org/project/democritus-hypothesis/ - https://github.com/democritus-project/d8s-dates/issues/26
CVE ID: CVE-2022-40809 State: PUBLISHED Published: 2022-09-19T15:03:41 Last Updated: 2024-08-03T12:28:42.614Z Vendors: n/a Products: n/a Problem Types: n/a Description: The d8s-dicts for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-hypothesis package. The affected version is 0.1.0 Additional Analyst Notes: - CVE Program Container: References: - https://pypi.org/project/democritus-hypothesis/ - https://github.com/democritus-project/d8s-dicts/issues/6
CVE ID: CVE-2022-40810 State: PUBLISHED Published: 2022-09-19T15:06:55 Last Updated: 2024-08-03T12:28:42.500Z Vendors: n/a Products: n/a Problem Types: n/a Description: The d8s-ip-addresses for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-hypothesis package. The affected version is 0.1.0 Additional Analyst Notes: - CVE Program Container: References: - https://pypi.org/project/democritus-hypothesis/ - https://github.com/democritus-project/d8s-ip-addresses/issues/13
CVE ID: CVE-2022-40811 State: PUBLISHED Published: 2022-09-19T14:47:20 Last Updated: 2024-08-03T12:28:42.671Z Vendors: n/a Products: n/a Problem Types: n/a Description: The d8s-urls for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-file-system package. The affected version is 0.1.0. Additional Analyst Notes: - CVE Program Container: References: - https://pypi.org/project/democritus-file-system/ - https://github.com/democritus-project/d8s-urls/issues/11
CVE ID: CVE-2022-40812 State: PUBLISHED Published: 2022-09-19T15:13:14 Last Updated: 2024-08-03T12:28:42.921Z Vendors: n/a Products: n/a Problem Types: n/a Description: The d8s-pdfs for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-file-system package. The affected version is 0.1.0. Additional Analyst Notes: - CVE Program Container: References: - https://pypi.org/project/democritus-file-system/ - https://github.com/democritus-project/d8s-pdfs/issues/6
CVE ID: CVE-2022-40816 State: PUBLISHED Published: 2022-09-27T15:27:48.000Z Last Updated: 2025-05-21T15:07:27.671Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zammad 5.2.1 is vulnerable to Incorrect Access Control. Zammad's asset handling mechanism has logic to ensure that customer users are not able to see personal information of other users. This logic was not effective when used through a web socket connection, so that a logged-in attacker would be able to fetch personal data of other users by querying the Zammad API. This issue is fixed in , 5.2.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://zammad.com/de/advisories/zaa
onal Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://zammad.com/de/advisories/zaa-2022-09
CVE ID: CVE-2022-40817 State: PUBLISHED Published: 2022-09-27T15:24:41.000Z Last Updated: 2025-05-21T15:08:20.985Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zammad 5.2.1 has a fine-grained permission model that allows to configure read-only access to tickets. However, agents were still wrongly able to perform some operations on such tickets, like adding and removing links, tags. and related answers. This issue has been fixed in 5.2.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://zammad.com/de/advisories/zaa-2022-10
CVE ID: CVE-2022-40824 State: PUBLISHED Published: 2022-10-07T00:00:00 Last Updated: 2024-08-03T12:28:42.555Z Vendors: n/a Products: n/a Problem Types: n/a Description: B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php or_where() function. Note: Multiple third parties have disputed this as not a valid vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/726232111/CodeIgniter3.1.13-SQL-Inject/blob/main/README.md - https://github.com/bcit-ci/CodeIgniter/issues/6161
CVE ID: CVE-2022-40825 State: PUBLISHED Published: 2022-10-07T00:00:00 Last Updated: 2024-08-03T12:28:42.579Z Vendors: n/a Products: n/a Problem Types: n/a Description: B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php where_in() function. Note: Multiple third parties have disputed this as not a valid vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/726232111/CodeIgniter3.1.13-SQL-Inject/blob/main/README.md - https://github.com/bcit-ci/CodeIgniter/issues/6161
CVE ID: CVE-2022-40826 State: PUBLISHED Published: 2022-10-07T00:00:00 Last Updated: 2024-08-03T12:28:42.612Z Vendors: n/a Products: n/a Problem Types: n/a Description: B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php or_having() function. Note: Multiple third parties have disputed this as not a valid vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/726232111/CodeIgniter3.1.13-SQL-Inject/blob/main/README.md - https://github.com/bcit-ci/CodeIgniter/issues/6161
CVE ID: CVE-2022-40827 State: PUBLISHED Published: 2022-10-07T00:00:00.000Z Last Updated: 2025-04-09T18:23:28.270Z Vendors: n/a Products: n/a Problem Types: n/a Description: B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php where() function. Note: Multiple third parties have disputed this as not a valid vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/726232111/CodeIgniter3.1.13-SQL-Inject/blob/main/README.md
CVE ID: CVE-2022-40828 State: PUBLISHED Published: 2022-10-07T00:00:00.000Z Last Updated: 2025-04-09T18:24:00.396Z Vendors: n/a Products: n/a Problem Types: n/a Description: B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php or_where_not_in() function. Note: Multiple third parties have disputed this as not a valid vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/726232111/CodeIgniter3.1.13-SQL-Inject/blob/main/README.md - https://github.com/bcit-ci/CodeIgniter/issues/6161
CVE ID: CVE-2022-40829 State: PUBLISHED Published: 2022-10-07T00:00:00 Last Updated: 2024-08-03T12:28:42.625Z Vendors: n/a Products: n/a Problem Types: n/a Description: B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php or_like() function. Note: Multiple third parties have disputed this as not a valid vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/726232111/CodeIgniter3.1.13-SQL-Inject/blob/main/README.md - https://github.com/bcit-ci/CodeIgniter/issues/6161
CVE ID: CVE-2022-40830 State: PUBLISHED Published: 2022-10-07T00:00:00 Last Updated: 2024-08-03T12:28:42.554Z Vendors: n/a Products: n/a Problem Types: n/a Description: B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php where_not_in() function. Note: Multiple third parties have disputed this as not a valid vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/726232111/CodeIgniter3.1.13-SQL-Inject/blob/main/README.md - https://github.com/bcit-ci/CodeIgniter/issues/6161
CVE ID: CVE-2022-40831 State: PUBLISHED Published: 2022-10-07T00:00:00 Last Updated: 2024-08-03T12:28:42.882Z Vendors: n/a Products: n/a Problem Types: n/a Description: B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php like() function. Note: Multiple third parties have disputed this as not a valid vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/726232111/CodeIgniter3.1.13-SQL-Inject/blob/main/README.md - https://github.com/bcit-ci/CodeIgniter/issues/6161
CVE ID: CVE-2022-40832 State: PUBLISHED Published: 2022-10-07T00:00:00 Last Updated: 2024-08-03T12:28:42.560Z Vendors: n/a Products: n/a Problem Types: n/a Description: B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php having() function. Note: Multiple third parties have disputed this as not a valid vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/726232111/CodeIgniter3.1.13-SQL-Inject/blob/main/README.md - https://github.com/bcit-ci/CodeIgniter/issues/6161
CVE ID: CVE-2022-40833 State: PUBLISHED Published: 2022-10-07T00:00:00 Last Updated: 2024-08-03T12:28:42.527Z Vendors: n/a Products: n/a Problem Types: n/a Description: B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php or_where_in() function. Note: Multiple third parties have disputed this as not a valid vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/726232111/CodeIgniter3.1.13-SQL-Inject/blob/main/README.md - https://github.com/bcit-ci/CodeIgniter/issues/6161