Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-39043 State: PUBLISHED Published: 2023-03-27T00:00:00.000Z Last Updated: 2025-02-19T20:23:21.067Z Severity: LOW (CVSS 2.4 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Juiker Products: Juiker app Problem Types: CWE-200 Description: Juiker app stores debug logs which contains sensitive information to mobile external storage. An unauthenticated physical attacker can access these files to acquire partial user information such as personal contacts. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-6922-4a37a-1.html
CVE ID: CVE-2022-39044 State: PUBLISHED Published: 2022-12-07T00:00:00.000Z Last Updated: 2025-04-23T16:07:13.452Z Vendors: BUFFALO INC. Products: Buffalo network devices Problem Types: Hidden Functionality Description: Hidden functionality vulnerability in multiple Buffalo network devices allows a network-adjacent attacker with an administrative privilege to execute an arbitrary OS command. The affected products/versions are as follows: WCR-300 firmware Ver. 1.87 and earlier, WHR-HP-G300N firmware Ver. 2.00 and earlier, WHR-HP-GN firmware Ver. 1.87 and earlier, WPL-05G300 firmware Ver. 1.88 and earlier, WZR-300HP firmware Ver. 2.00 and earlier, WZR-450HP firmware Ver. 2.00 and earlier, WZR-
firmware Ver. 1.88 and earlier, WZR-300HP firmware Ver. 2.00 and earlier, WZR-450HP firmware Ver. 2.00 and earlier, WZR-600DHP firmware Ver. 2.00 and earlier, WZR-900DHP firmware Ver. 1.15 and earlier, WZR-HP-AG300H firmware Ver. 1.76 and earlier, WZR-HP-G302H firmware Ver. 1.86 and earlier, WLAE-AG300N firmware Ver. 1.86 and earlier, FS-600DHP firmware Ver. 3.40 and earlier, FS-G300N firmware Ver. 3.14 and earlier, FS-HP-G300N firmware Ver. 3.33 and earlier, FS-R600DHP firmware Ver. 3.40 and earlier, BHR-4GRV firmware Ver. 2.00 and earlier, DWR-HP-G300NH firmware Ver. 1.84 and earlier, DWR-PG firmware Ver. 1.83 and earlier, HW-450HP-ZWE firmware Ver. 2.00 and earlier, WER-A54G54 firmware Ve
and earlier, DWR-PG firmware Ver. 1.83 and earlier, HW-450HP-ZWE firmware Ver. 2.00 and earlier, WER-A54G54 firmware Ver. 1.43 and earlier, WER-AG54 firmware Ver. 1.43 and earlier, WER-AM54G54 firmware Ver. 1.43 and earlier, WER-AMG54 firmware Ver. 1.43 and earlier, WHR-300 firmware Ver. 2.00 and earlier, WHR-300HP firmware Ver. 2.00 and earlier, WHR-AM54G54 firmware Ver. 1.43 and earlier, WHR-AMG54 firmware Ver. 1.43 and earlier, WHR-AMPG firmware Ver. 1.52 and earlier, WHR-G firmware Ver. 1.49 and earlier, WHR-G300N firmware Ver. 1.65 and earlier, WHR-G301N firmware Ver. 1.87 and earlier, WHR-G54S firmware Ver. 1.43 and earlier, WHR-G54S-NI firmware Ver. 1.24 and earlier, WHR-HP-AMPG firm
1.87 and earlier, WHR-G54S firmware Ver. 1.43 and earlier, WHR-G54S-NI firmware Ver. 1.24 and earlier, WHR-HP-AMPG firmware Ver. 1.43 and earlier, WHR-HP-G firmware Ver. 1.49 and earlier, WHR-HP-G54 firmware Ver. 1.43 and earlier, WLI-H4-D600 firmware Ver. 1.88 and earlier, WLI-TX4-AG300N firmware Ver. 1.53 and earlier, WS024BF firmware Ver. 1.60 and earlier, WS024BF-NW firmware Ver. 1.60 and earlier, WZR2-G108 firmware Ver. 1.33 and earlier, WZR2-G300N firmware Ver. 1.55 and earlier, WZR-450HP-CWT firmware Ver. 2.00 and earlier, WZR-450HP-UB firmware Ver. 2.00 and earlier, WZR-600DHP2 firmware Ver. 1.15 and earlier, WZR-AGL300NH firmware Ver. 1.55 and earlier, WZR-AMPG144NH firmware Ver. 1
, WZR-600DHP2 firmware Ver. 1.15 and earlier, WZR-AGL300NH firmware Ver. 1.55 and earlier, WZR-AMPG144NH firmware Ver. 1.49 and earlier, WZR-AMPG300NH firmware Ver. 1.51 and earlier, WZR-D1100H firmware Ver. 2.00 and earlier, WZR-G144N firmware Ver. 1.48 and earlier, WZR-G144NH firmware Ver. 1.48 and earlier, WZR-HP-G300NH firmware Ver. 1.84 and earlier, WZR-HP-G301NH firmware Ver. 1.84 and earlier, and WZR-HP-G450H firmware Ver. 1.90 and earlier. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.buffalo.jp/news/detail/20221003-01.html - https://jvn.jp/en/vu/JVNVU92805279/index.html
CVE ID: CVE-2022-39045 State: PUBLISHED Published: 2023-01-26T21:24:48.149Z Last Updated: 2024-08-03T11:10:32.326Z Severity: HIGH (CVSS 7.2 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Siretta Products: QUARTZ-GOLD Problem Types: CWE-22 Description: A file write vulnerability exists in the httpd upload.cgi functionality of Siretta QUARTZ-GOLD G5.0.1.5-210720-141020. A specially-crafted HTTP request can lead to arbitrary file upload. An attacker can send an HTTP request to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2022-1611
CVE ID: CVE-2022-39046 State: PUBLISHED Published: 2022-08-31T00:00:00 Last Updated: 2024-08-03T11:10:32.492Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AC:L/AV:N/A:N/C:H/I:N/PR:N/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the GNU C Library (glibc) 2.36. When the syslog function is passed a crafted input string larger than 1024 bytes, it reads uninitialized memory from the heap and prints it to the target log file, potentially revealing a portion of the contents of the heap. Additional Analyst Notes: - CVE Program Container: References: - https://sourceware.org/bugzilla/show_bug.cgi?id=29536 - https://security.netapp.com/advisory/ntap-20221104-0002
ences: - https://sourceware.org/bugzilla/show_bug.cgi?id=29536 - https://security.netapp.com/advisory/ntap-20221104-0002/ - https://security.gentoo.org/glsa/202310-03 - http://www.openwall.com/lists/oss-security/2024/01/30/8 - http://www.openwall.com/lists/oss-security/2024/01/30/6 - http://packetstormsecurity.com/files/176932/glibc-syslog-Heap-Based-Buffer-Overflow.html - http://seclists.org/fulldisclosure/2024/Feb/3
CVE ID: CVE-2022-39047 State: PUBLISHED Published: 2022-08-31T05:15:00 Last Updated: 2024-08-03T11:10:32.453Z Vendors: n/a Products: n/a Problem Types: n/a Description: Freeciv before 2.6.7 and before 3.0.3 is prone to a buffer overflow vulnerability in the Modpack Installer utility's handling of the modpack URL. Additional Analyst Notes: - CVE Program Container: References: - https://www.openwall.com/lists/oss-security/2022/08/05/1 - https://osdn.net/projects/freeciv/ticket/45299 - https://bugs.debian.org/1017579 - http://www.openwall.com/lists/oss-security/2022/08/31/1
CVE ID: CVE-2022-39048 State: PUBLISHED Published: 2023-04-10T00:00:00.000Z Last Updated: 2025-02-07T20:14:00.361Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Servicenow Products: Now Platform Problem Types: Cross Site Scripting (XSS) Description: A XSS vulnerability was identified in the ServiceNow UI page assessment_redirect. To exploit this vulnerability, an attacker would need to persuade an authenticated user to click a maliciously crafted URL. Successful exploitation potentially could be used to conduct various client-side attacks, including, but not limited to, phishing, redirection, theft of CSRF tokens, and use of an authenticated user's browser
, including, but not limited to, phishing, redirection, theft of CSRF tokens, and use of an authenticated user's browser or session to attack other systems. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.servicenow.com/ - https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1221892
CVE ID: CVE-2022-39049 State: PUBLISHED Published: 2022-09-05T06:40:11.053227Z Last Updated: 2024-09-16T23:10:38.532Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N) Vendors: OTRS AG Products: OTRS, ((OTRS)) Community Edition Problem Types: CWE-79 Description: An attacker who is logged into OTRS as an admin user may manipulate the URL to cause execution of JavaScript in the context of OTRS. Additional Analyst Notes: - CVE Program Container: References: - https://otrs.com/release-notes/otrs-security-advisory-2022-10/
CVE ID: CVE-2022-39050 State: PUBLISHED Published: 2022-09-05T06:40:11.972213Z Last Updated: 2024-09-16T19:24:11.199Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: OTRS AG Products: OTRS, ((OTRS)) Community Edition Problem Types: CWE-79 Description: An attacker who is logged into OTRS as an admin user may manipulate customer URL field to store JavaScript code to be run later by any other agent when clicking the customer URL link. Then the stored JavaScript is executed in the context of OTRS. The same issue applies for the usage of external data sources e.g. database or ldap Additional Analyst Notes: - CVE Program Container: References: - https://otrs.com/r
l data sources e.g. database or ldap Additional Analyst Notes: - CVE Program Container: References: - https://otrs.com/release-notes/otrs-security-advisory-2022-11/
CVE ID: CVE-2022-39051 State: PUBLISHED Published: 2022-09-05T06:40:12.771350Z Last Updated: 2024-09-16T17:18:42.122Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H) Vendors: OTRS AG Products: OTRS, ((OTRS)) Community Edition Problem Types: CWE-913 Description: Attacker might be able to execute malicious Perl code in the Template toolkit, by having the admin installing an unverified 3th party package Additional Analyst Notes: - CVE Program Container: References: - https://otrs.com/release-notes/otrs-security-advisory-2022-12/
CVE ID: CVE-2022-39052 State: PUBLISHED Published: 2022-10-17T08:55:10.047Z Last Updated: 2025-05-10T02:55:29.306Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: OTRS AG Products: OTRS, ((OTRS)) Community Edition Problem Types: CWE-835 Description: An external attacker is able to send a specially crafted email (with many recipients) and trigger a potential DoS of the system Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://otrs.com/release-notes/otrs-security-advisory-2022-13/
CVE ID: CVE-2022-39053 State: PUBLISHED Published: 2022-09-28T03:25:40.994Z Last Updated: 2025-05-21T14:20:02.459Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: HEIMAVISTA INC. Products: Rpage Problem Types: CWE-79 Description: Heimavista Rpage has insufficient filtering for platform web URL. An unauthenticated remote attacker can inject JavaScript and perform XSS (Reflected Cross-Site Scripting) attack. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-6523-d4c60-1.html
CVE ID: CVE-2022-39054 State: PUBLISHED Published: 2022-09-28T03:25:41.788Z Last Updated: 2025-05-21T14:19:39.784Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: COWELL INFORMATION SYSTEM CO., LTD. Products: enterprise travel management system Problem Types: CWE-79 Description: Cowell enterprise travel management system has insufficient filtering for special characters within web URL. An unauthenticated remote attacker can inject JavaScript and perform XSS (Reflected Cross-Site Scripting) attack. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-6524-74530-1.html
CVE ID: CVE-2022-39055 State: PUBLISHED Published: 2022-10-18T05:40:19.195Z Last Updated: 2025-05-09T14:51:35.855Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Changing Information Technology Inc. Products: RAVA certificate validation system Problem Types: CWE-918 Description: RAVA certificate validation system has inadequate filtering for URL parameter. An unauthenticated remote attacker can perform SSRF attack to discover internal network topology base on query response. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-6616-9092f-1.html
CVE ID: CVE-2022-39056 State: PUBLISHED Published: 2022-10-18T05:40:20.277Z Last Updated: 2025-05-09T14:51:04.359Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Changing Information Technology Inc. Products: RAVA certificate validation system Problem Types: CWE-89 Description: RAVA certificate validation system has insufficient validation for user input. An unauthenticated remote attacker can inject arbitrary SQL command to access, modify and delete database. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-6617-109b0-1.html
CVE ID: CVE-2022-39057 State: PUBLISHED Published: 2022-10-18T05:40:21.259Z Last Updated: 2025-05-08T19:44:04.416Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Changing Information Technology Inc. Products: RAVA certificate validation system Problem Types: CWE-78 Description: RAVA certificate validation system has insufficient filtering for special parameter of the web page input field. A remote attacker with administrator privilege can exploit this vulnerability to perform arbitrary system command and disrupt service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-6618-11fd8-1.h
otes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-6618-11fd8-1.html
CVE ID: CVE-2022-39058 State: PUBLISHED Published: 2022-10-18T05:40:22.296Z Last Updated: 2025-05-09T15:12:55.918Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Changing Information Technology Inc. Products: RAVA certificate validation system Problem Types: CWE-22 Description: RAVA certification validation system has a path traversal vulnerability. An unauthenticated remote attacker can exploit this vulnerability to bypass authentication and access arbitrary system files. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-6619-9b5a7-1.html
CVE ID: CVE-2022-39059 State: PUBLISHED Published: 2023-01-31T00:00:00.000Z Last Updated: 2025-03-27T18:23:17.830Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: ChangingTec Products: MegaServiSignAdapter Problem Types: CWE-22 Description: ChangingTech MegaServiSignAdapter component has a path traversal vulnerability within its file reading function. An unauthenticated remote attacker can exploit this vulnerability to access arbitrary system files. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-6886-2c546-1.html
CVE ID: CVE-2022-39060 State: PUBLISHED Published: 2023-01-31T00:00:00.000Z Last Updated: 2025-03-27T18:22:55.303Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: ChangingTec Products: MegaServiSignAdapter Problem Types: CWE-20 Description: ChangingTech MegaServiSignAdapter component has a vulnerability of improper input validation. An unauthenticated remote attacker can exploit this vulnerability to access and modify HKEY_CURRENT_USER subkey (ex: AutoRUN) in Registry where malicious scripts can be executed to take control of the system or to terminate the service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - ht
r to terminate the service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-6887-6ed4f-1.html
CVE ID: CVE-2022-39061 State: PUBLISHED Published: 2023-01-31T00:00:00.000Z Last Updated: 2025-03-27T18:21:57.065Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L) Vendors: ChangingTec Products: MegaServiSignAdapter Problem Types: CWE-125 Description: ChangingTech MegaServiSignAdapter component has a vulnerability of Out-of-bounds Read due to insufficient validation for parameter length. An unauthenticated remote attacker can exploit this vulnerability to access partial sensitive content in memory and disrupts partial services. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-6888-b5f81-1.htm
es: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-6888-b5f81-1.html
CVE ID: CVE-2022-39062 State: PUBLISHED Published: 2023-08-08T09:20:11.510Z Last Updated: 2025-02-27T21:10:34.368Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: SICAM TOOLBOX II Problem Types: CWE-732 Description: A vulnerability has been identified in SICAM TOOLBOX II (All versions < V07.10). Affected applications do not properly set permissions for product folders. This could allow an authenticated attacker with low privileges to replace DLLs and conduct a privilege escalation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-975961.
VE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-975961.pdf
CVE ID: CVE-2022-39063 State: PUBLISHED Published: 2022-09-16T18:02:12 Last Updated: 2024-08-03T11:10:32.459Z Vendors: Open5GS Products: Open5GS Problem Types: CWE-676 Description: When Open5GS UPF receives a PFCP Session Establishment Request, it stores related values for building the PFCP Session Establishment Response. Once UPF receives a request, it gets the f_teid_len from incoming message, and then uses it to copy data from incoming message to struct f_teid without checking the maximum length. If the pdi.local_f_teid.len exceeds the maximum length of the struct of f_teid, the memcpy() overwrites the fields (e.g., f_teid_len) after f_teid in the pdr struct. After parsing the request, th
eid, the memcpy() overwrites the fields (e.g., f_teid_len) after f_teid in the pdr struct. After parsing the request, the UPF starts to build a response. The f_teid_len with its overwritten value is used as a length for memcpy(). A segmentation fault occurs, as a result of a memcpy(), if this overwritten value is large enough. Additional Analyst Notes: - CVE Program Container: References: - https://www.synopsys.com/blogs/software-security/cyrc-advisory-open5gs/
CVE ID: CVE-2022-39064 State: PUBLISHED Published: 2022-10-14T00:00:00.000Z Last Updated: 2025-05-15T14:32:45.498Z Vendors: Ikea Products: TRÅDFRI smart lighting system Problem Types: CWE-241 Description: An attacker sending a single malformed IEEE 802.15.4 (Zigbee) frame makes the TRÅDFRI bulb blink, and if they replay (i.e. resend) the same frame multiple times, the bulb performs a factory reset. This causes the bulb to lose configuration information about the Zigbee network and current brightness level. After this attack, all lights are on with full brightness, and a user cannot control the bulbs with either the IKEA Home Smart app or the TRÅDFRI remote control. The malformed Zigbee frame
r cannot control the bulbs with either the IKEA Home Smart app or the TRÅDFRI remote control. The malformed Zigbee frame is an unauthenticated broadcast message, which means all vulnerable devices within radio range are affected. CVSS 3.1 Base Score 7.1 vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.synopsys.com/blogs/software-security/cyrc-advisory-ikea-tradfri-smart-lighting/
CVE ID: CVE-2022-39065 State: PUBLISHED Published: 2022-10-14T00:00:00.000Z Last Updated: 2025-05-15T13:46:29.965Z Vendors: Ikea Products: TRÅDFRI gateway system Problem Types: CWE-241 Description: A single malformed IEEE 802.15.4 (Zigbee) frame makes the TRÅDFRI gateway unresponsive, such that connected lighting cannot be controlled with the IKEA Home Smart app and TRÅDFRI remote control. The malformed Zigbee frame is an unauthenticated broadcast message, which means all vulnerable devices within radio range are affected. CVSS 3.1 Base Score: 6.5 Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - htt
/PR:N/UI:N/S:U/C:N/I:N/A:H Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.synopsys.com/blogs/software-security/cyrc-advisory-ikea-tradfri-smart-lighting-gateway/
CVE ID: CVE-2022-39066 State: PUBLISHED Published: 2022-11-22T00:00:00.000Z Last Updated: 2025-04-29T04:32:36.772Z Vendors: n/a Products: MF286R Problem Types: SQL injection Description: There is a SQL injection vulnerability in ZTE MF286R. Due to insufficient validation of the input parameters of the phonebook interface, an authenticated attacker could use the vulnerability to execute arbitrary SQL injection. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1027744
CVE ID: CVE-2022-39067 State: PUBLISHED Published: 2022-11-22T00:00:00.000Z Last Updated: 2025-04-29T04:31:08.545Z Vendors: n/a Products: MF286R Problem Types: buffer overflow Description: There is a buffer overflow vulnerability in ZTE MF286R. Due to lack of input validation on parameters of the wifi interface, an authenticated attacker could use the vulnerability to perform a denial of service attack. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1027784
CVE ID: CVE-2022-39068 State: PUBLISHED Published: 2024-09-18T01:57:54.052Z Last Updated: 2024-09-18T15:27:59.586Z Severity: MEDIUM (CVSS 4.5 CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: ZTE Products: MF296R Problem Types: CWE-122 Description: There is a buffer overflow vulnerability in ZTE MF296R. Due to insufficient validation of the SMS parameter length, an authenticated attacker could use the vulnerability to perform a denial of service attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1028984
CVE ID: CVE-2022-39069 State: PUBLISHED Published: 2022-11-08T00:00:00.000Z Last Updated: 2025-05-01T14:08:18.523Z Vendors: n/a Products: ZAIP-AIE Problem Types: SQL injection Description: There is a SQL injection vulnerability in ZTE ZAIP-AIE. Due to lack of input verification by the server, an attacker could trigger an attack by building malicious requests. Exploitation of this vulnerability could cause the leakage of the current table content. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1026604
CVE ID: CVE-2022-39070 State: PUBLISHED Published: 2022-11-22T00:00:00.000Z Last Updated: 2025-04-29T04:29:24.706Z Vendors: n/a Products: ZXA10 C3XX Problem Types: access control vulnerability Description: There is an access control vulnerability in some ZTE PON OLT products. Due to improper access control settings, remote attackers could use the vulnerability to log in to the device and execute any operation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1027824
CVE ID: CVE-2022-39071 State: PUBLISHED Published: 2023-05-30T00:00:00 Last Updated: 2025-01-13T20:40:41.363Z Vendors: n/a Products: ZTE Blade A52, ZTE Blade A51, ZTE Blade A3 Lite, ZTE Blade A5 2020, ZTE Blade L210, ZTE Blade A7s, ZTE Blade A31, ZTE Blade A31 Plus, ZTE Blade A5 (2019), ZTE Blade A71, ZTE Blade A72, ZTE Blade V20 Smart, ZTE Blade V30, ZTE Blade V30 Vita, ZTE V40 Pro, ZTE Blade V40 Vita, ZTE Axon 40 Ultra Problem Types: unauthorized access Description: There is an unauthorized access vulnerability in some ZTE mobile phones. If a malicious application is installed on the phone, it could overwrite some system configuration files and user installers without user permission. Addi
alled on the phone, it could overwrite some system configuration files and user installers without user permission. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1030664