Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-2000 State: PUBLISHED Published: 2022-06-07T00:00:00.000Z Last Updated: 2025-11-03T20:34:41.619Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: vim Products: vim/vim Problem Types: CWE-787 Description: Out-of-bounds Write in GitHub repository vim/vim prior to 8.2. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/f61a64e2-d163-461b-a77e-46ab38e021f0 - https://github.com/vim/vim/commit/44a3f3353e0407e9fffee138125a6927d1c9e7e5 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4JJNUS4AEVYSEJMCK6JZB57QHD5V2G4O/ - https://security.gentoo.org/glsa/202208-32 -
ounce%40lists.fedoraproject.org/message/4JJNUS4AEVYSEJMCK6JZB57QHD5V2G4O/ - https://security.gentoo.org/glsa/202208-32 - https://support.apple.com/kb/HT213443 - https://support.apple.com/kb/HT213444 - https://support.apple.com/kb/HT213488 - http://seclists.org/fulldisclosure/2022/Oct/41 - http://seclists.org/fulldisclosure/2022/Oct/28 - http://seclists.org/fulldisclosure/2022/Oct/43 - http://seclists.org/fulldisclosure/2022/Oct/45 - https://lists.debian.org/debian-lts-announce/2022/11/msg00032.html - https://security.gentoo.org/glsa/202305-16
CVE ID: CVE-2022-2001 State: PUBLISHED Published: 2022-07-18T16:17:07.000Z Last Updated: 2025-05-05T16:20:50.206Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: nofearinc Products: DX Share Selection Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The DX Share Selection plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.4. This is due to missing nonce protection on the dxss_admin_page() function found in the ~/dx-share-selection.php file. This makes it possible for unauthenticated attackers to inject malicious web scripts into the page, granted they can trick a site's administrator into pe
enticated attackers to inject malicious web scripts into the page, granted they can trick a site's administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6a85fe7f-2d28-4509-99f2-875cb63c6500?source=cve - https://wordpress.org/plugins/dx-share-selection/ - https://plugins.trac.wordpress.org/browser/dx-share-selection/trunk/dx-share-selection.php#L284 - https://www.wordfence.com/vulnerability-advisories/#CVE-2022-2001 - https://plugins.trac.wordpress.org/changeset/2747572/dx-share-selection/trunk?contextall=1&old=2384535&old_path=%2Fdx
- https://plugins.trac.wordpress.org/changeset/2747572/dx-share-selection/trunk?contextall=1&old=2384535&old_path=%2Fdx-share-selection%2Ftrunk
CVE ID: CVE-2022-2002 State: PUBLISHED Published: 2022-12-07T22:56:50.504Z Last Updated: 2025-04-16T17:41:56.274Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: GE Products: CIMPLICITY Problem Types: CWE-822 Description: GE CIMPICITY versions 2022 and prior is vulnerable when data from faulting address controls code flow starting at gmmiObj!CGmmiOptionContainer, which could allow an attacker to execute arbitrary code. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-326-04
CVE ID: CVE-2022-2003 State: PUBLISHED Published: 2022-08-31T15:59:33.369Z Last Updated: 2025-04-16T17:49:17.171Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: AutomationDirect Products: DirectLOGIC D0-06 series CPUs Problem Types: CWE-319 Description: AutomationDirect DirectLOGIC is vulnerable to a specifically crafted serial message to the CPU serial port that will cause the PLC to respond with the PLC password in cleartext. This could allow an attacker to access and make unauthorized changes. This issue affects: AutomationDirect DirectLOGIC D0-06 series CPUs D0-06DD1 versions prior to 2.72; D0-06DD2 versions prior to 2.72; D0-06DR versions prior to 2.72;
GIC D0-06 series CPUs D0-06DD1 versions prior to 2.72; D0-06DD2 versions prior to 2.72; D0-06DR versions prior to 2.72; D0-06DA versions prior to 2.72; D0-06AR versions prior to 2.72; D0-06AA versions prior to 2.72; D0-06DD1-D versions prior to 2.72; D0-06DD2-D versions prior to 2.72; D0-06DR-D versions prior to 2.72; Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-167-02 - https://www.cisa.gov/uscert/ics/advisories/icsa-22-167-03
CVE ID: CVE-2022-2004 State: PUBLISHED Published: 2022-08-31T15:59:33.591Z Last Updated: 2025-04-16T16:11:14.677Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: AutomationDirect Products: DirectLOGIC D0-06 series CPUs Problem Types: CWE-400 Description: AutomationDirect DirectLOGIC is vulnerable to a a specially crafted packet can be sent continuously to the PLC to prevent access from DirectSoft and other devices, causing a denial-of-service condition. This issue affects: AutomationDirect DirectLOGIC D0-06 series CPUs D0-06DD1 versions prior to 2.72; D0-06DD2 versions prior to 2.72; D0-06DR versions prior to 2.72; D0-06DA versions prior to 2.72; D0-06AR versi
to 2.72; D0-06DD2 versions prior to 2.72; D0-06DR versions prior to 2.72; D0-06DA versions prior to 2.72; D0-06AR versions prior to 2.72; D0-06AA versions prior to 2.72; D0-06DD1-D versions prior to 2.72; D0-06DD2-D versions prior to 2.72; D0-06DR-D versions prior to 2.72; Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-167-03
CVE ID: CVE-2022-2005 State: PUBLISHED Published: 2022-08-31T15:33:03.273Z Last Updated: 2025-04-16T16:11:43.495Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: AutomationDirect Products: C-more EA9 Problem Types: CWE-319 Description: AutomationDirect C-more EA9 HTTP webserver uses an insecure mechanism to transport credentials from client to web server, which may allow an attacker to obtain the login credentials and login as a valid user. This issue affects: AutomationDirect C-more EA9 EA9-T6CL versions prior to 6.73; EA9-T6CL-R versions prior to 6.73; EA9-T7CL versions prior to 6.73; EA9-T7CL-R versions prior to 6.73; EA9-T8CL versions prior to 6.73; EA9-T1
ior to 6.73; EA9-T7CL versions prior to 6.73; EA9-T7CL-R versions prior to 6.73; EA9-T8CL versions prior to 6.73; EA9-T10CL versions prior to 6.73; EA9-T10WCL versions prior to 6.73; EA9-T12CL versions prior to 6.73; EA9-T15CL versions prior to 6.73; EA9-RHMI versions prior to 6.73; EA9-PGMSW versions prior to 6.73; Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-167-01
CVE ID: CVE-2022-2006 State: PUBLISHED Published: 2022-08-31T15:33:03.440Z Last Updated: 2025-04-16T17:49:35.105Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: AutomationDirect Products: C-more EA9 Problem Types: CWE-427 Description: AutomationDirect DirectLOGIC has a DLL vulnerability in the install directory that may allow an attacker to execute code during the installation process. This issue affects: AutomationDirect C-more EA9 EA9-T6CL versions prior to 6.73; EA9-T6CL-R versions prior to 6.73; EA9-T7CL versions prior to 6.73; EA9-T7CL-R versions prior to 6.73; EA9-T8CL versions prior to 6.73; EA9-T10CL versions prior to 6.73; EA9-T10WCL versions prior t
R versions prior to 6.73; EA9-T8CL versions prior to 6.73; EA9-T10CL versions prior to 6.73; EA9-T10WCL versions prior to 6.73; EA9-T12CL versions prior to 6.73; EA9-T15CL versions prior to 6.73; EA9-RHMI versions prior to 6.73; EA9-PGMSW versions prior to 6.73; Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-167-01
CVE ID: CVE-2022-2007 State: PUBLISHED Published: 2022-07-28T00:10:27 Last Updated: 2024-08-03T00:24:43.999Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in WebGPU in Google Chrome prior to 102.0.5005.115 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: References: - https://crbug.com/1326210 - https://chromereleases.googleblog.com/2022/06/stable-channel-update-for-desktop.html - https://security.gentoo.org/glsa/202208-25 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4NMJURTG5RO3TGD7ZMIQ6Z4ZZ3SAVYE/
CVE ID: CVE-2022-2008 State: PUBLISHED Published: 2022-07-28T00:10:40 Last Updated: 2024-08-03T00:24:44.107Z Vendors: Google Products: Chrome Problem Types: Out of bounds memory access Description: Double free in WebGL in Google Chrome prior to 102.0.5005.115 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2022/06/stable-channel-update-for-desktop.html - https://crbug.com/1317673 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4NMJURTG5RO3TGD7ZMIQ6Z4ZZ3SAVYE/
CVE ID: CVE-2022-2010 State: PUBLISHED Published: 2022-07-28T00:10:52 Last Updated: 2024-08-03T00:24:44.065Z Vendors: Google Products: Chrome Problem Types: Out of bounds read Description: Out of bounds read in compositing in Google Chrome prior to 102.0.5005.115 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2022/06/stable-channel-update-for-desktop.html - https://crbug.com/1325298 - https://security.gentoo.org/glsa/202208-25 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapr
s://security.gentoo.org/glsa/202208-25 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4NMJURTG5RO3TGD7ZMIQ6Z4ZZ3SAVYE/
CVE ID: CVE-2022-2011 State: PUBLISHED Published: 2022-07-28T00:10:58 Last Updated: 2024-08-03T00:24:44.058Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in ANGLE in Google Chrome prior to 102.0.5005.115 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2022/06/stable-channel-update-for-desktop.html - https://crbug.com/1330379 - https://security.gentoo.org/glsa/202208-25 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4NMJURTG5RO3TGD7ZMIQ6Z4ZZ3SAVYE/
CVE ID: CVE-2022-2013 State: PUBLISHED Published: 2022-06-12T23:50:09 Last Updated: 2024-08-03T00:24:43.695Z Vendors: Octopus Deploy Products: Octopus Server Problem Types: Broken Access Control Description: In Octopus Server after version 2022.1.1495 and before 2022.1.2647 if private spaces were enabled via the experimental feature flag all new users would have access to the Script Console within their private space. Additional Analyst Notes: - CVE Program Container: References: - https://advisories.octopus.com/post/2022/sa2022-05/
CVE ID: CVE-2022-2014 State: PUBLISHED Published: 2022-06-08T07:25:11 Last Updated: 2024-08-03T00:24:44.057Z Severity: CRITICAL (CVSS 9.6 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L) Vendors: jgraph Products: jgraph/drawio Problem Types: CWE-94 Description: Code Injection in GitHub repository jgraph/drawio prior to 19.0.2. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/911a4ada-7fd6-467a-a464-b88604b16ffc - https://github.com/jgraph/drawio/commit/3d3f819d7a04da7d53b37cc0ca4269c157ba2825
CVE ID: CVE-2022-2015 State: PUBLISHED Published: 2022-06-08T08:30:14 Last Updated: 2024-08-03T00:24:43.934Z Severity: MEDIUM (CVSS 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: jgraph Products: jgraph/drawio Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository jgraph/drawio prior to 19.0.2. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jgraph/drawio/commit/3d3f819d7a04da7d53b37cc0ca4269c157ba2825 - https://huntr.dev/bounties/0d32f448-155c-4b71-9291-9e8bcd522b37
CVE ID: CVE-2022-2016 State: PUBLISHED Published: 2022-06-07T08:50:10 Last Updated: 2024-08-03T00:24:44.090Z Severity: MEDIUM (CVSS 6.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L) Vendors: neorazorx Products: neorazorx/facturascripts Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Reflected in GitHub repository neorazorx/facturascripts prior to 2022.1. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/5fa17e9b-c767-46b4-af64-aafb8c2aa521 - https://github.com/neorazorx/facturascripts/commit/7b4ddb9269a230e2dd07c6a8d3211c9a88f4f09f
CVE ID: CVE-2022-2017 State: PUBLISHED Published: 2022-06-07T11:05:18.000Z Last Updated: 2025-04-15T14:32:35.800Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L) Vendors: SourceCodester Products: Prison Management System Problem Types: CWE-89 Description: A vulnerability was found in SourceCodester Prison Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /pms/admin/visits/view_visit.php of the component Visit Handler. The manipulation of the argument id with the input 2%27and%201=2%20union%20select%201,2,3,4,5,6,7,user(),database()--+ leads to sql injection. The attack may be initiated remotely. The exploit h
0select%201,2,3,4,5,6,7,user(),database()--+ leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ch0ing/vul/blob/main/WebRay.com.cn/Prison%20Management%20System%28SQLI%292.md - https://vuldb.com/?id.201365
CVE ID: CVE-2022-2018 State: PUBLISHED Published: 2022-06-07T11:05:20.000Z Last Updated: 2025-04-15T14:32:22.651Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L) Vendors: SourceCodester Products: Prison Management System Problem Types: CWE-89 Description: A vulnerability classified as critical has been found in SourceCodester Prison Management System 1.0. Affected is an unknown function of the file /admin/?page=inmates/view_inmate of the component Inmate Handler. The manipulation of the argument id with the input 1%27%20and%201=2%20union%20select%201,user(),3,4,5,6,7,8,9,0,database(),2,3,4,5,6,7,8,9,0,1,2,3,4--+ leads to sql injection. It is possible to launch the at
1,user(),3,4,5,6,7,8,9,0,database(),2,3,4,5,6,7,8,9,0,1,2,3,4--+ leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ch0ing/vul/blob/main/WebRay.com.cn/Prison%20Management%20System%28SQLI%29.md - https://vuldb.com/?id.201366
CVE ID: CVE-2022-2019 State: PUBLISHED Published: 2022-06-07T11:05:21.000Z Last Updated: 2025-04-15T14:32:11.388Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: SourceCodester Products: Prison Management System Problem Types: CWE-285 Description: A vulnerability classified as critical was found in SourceCodester Prison Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /classes/Users.php?f=save of the component New User Creation. The manipulation leads to improper authorization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CVE Program C
unched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ch0ing/vul/blob/main/WebRay.com.cn/Prison%20Management%20System--.md - https://vuldb.com/?id.201367
CVE ID: CVE-2022-2020 State: PUBLISHED Published: 2022-06-07T11:05:23.000Z Last Updated: 2025-04-15T14:31:57.317Z Severity: LOW (CVSS 2.4 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N) Vendors: SourceCodester Products: Prison Management System Problem Types: CWE-79 Description: A vulnerability, which was classified as problematic, has been found in SourceCodester Prison Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/?page=system_info of the component System Name Handler. The manipulation with the input <img src="" onerror="alert(1)"> leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public
t(1)"> leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ch0ing/vul/blob/main/WebRay.com.cn/Prison%20Management%20System%28XSS%29.md - https://vuldb.com/?id.201368
CVE ID: CVE-2022-2022 State: PUBLISHED Published: 2022-06-07T17:50:11 Last Updated: 2024-08-03T00:24:43.911Z Severity: CRITICAL (CVSS 9 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: nocodb Products: nocodb/nocodb Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository nocodb/nocodb prior to 0.91.7. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/f6082949-40d3-411c-b613-23ada2691913 - https://github.com/nocodb/nocodb/commit/ffad5a318ad60d1da1c75dd28152827b94c92e9d
CVE ID: CVE-2022-2023 State: PUBLISHED Published: 2022-06-20T04:00:19 Last Updated: 2024-08-03T00:24:44.032Z Severity: CRITICAL (CVSS 10 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: polonel Products: polonel/trudesk Problem Types: CWE-648 Description: Incorrect Use of Privileged APIs in GitHub repository polonel/trudesk prior to 1.2.4. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/0f35b1d3-56e6-49e4-bc5a-830f52e094b3 - https://github.com/polonel/trudesk/commit/83fd5a89319ba2c2f5934722e39b08aba9b3a4ac
CVE ID: CVE-2022-2024 State: PUBLISHED Published: 2023-02-25T00:00:00.000Z Last Updated: 2025-03-11T15:39:29.120Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: gogs Products: gogs/gogs Problem Types: CWE-78 Description: OS Command Injection in GitHub repository gogs/gogs prior to 0.12.11. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/18cf9256-23ab-4098-a769-85f8da130f97 - https://github.com/gogs/gogs/commit/15d0d6a94be0098a8227b6b95bdf2daed105ec41
CVE ID: CVE-2022-2025 State: PUBLISHED Published: 2022-09-23T15:06:54.166Z Last Updated: 2025-05-22T19:59:54.569Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Grandstream Products: Grandstream GSD3710 Problem Types: CWE-121 Description: an attacker with knowledge of user/pass of Grandstream GSD3710 in its 1.0.11.13 version, could overflow the stack since it doesn't check the param length before use the strcopy instruction. The explotation of this vulnerability may lead an attacker to execute a shell with full access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe-cert.es/en/early-warning/secu
Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe-cert.es/en/early-warning/security-advisories/buffer-overflow-vulnerabilities-grandstream-gsd3710
CVE ID: CVE-2022-2026 State: PUBLISHED Published: 2022-06-08T08:35:28 Last Updated: 2024-08-03T00:24:44.104Z Severity: HIGH (CVSS 8.2 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L) Vendors: kromitgmbh Products: kromitgmbh/titra Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository kromitgmbh/titra prior to 0.77.0. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/kromitgmbh/titra/commit/e606b674a2b7564407d89e38a341d72e22b14694 - https://huntr.dev/bounties/dcfa6790-c609-4ed5-ba5e-8f31f98e5e11
CVE ID: CVE-2022-2027 State: PUBLISHED Published: 2022-06-08T08:35:23 Last Updated: 2024-08-03T00:24:44.064Z Severity: HIGH (CVSS 8 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: kromitgmbh Products: kromitgmbh/titra Problem Types: CWE-1236 Description: Improper Neutralization of Formula Elements in a CSV File in GitHub repository kromitgmbh/titra prior to 0.77.0. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/kromitgmbh/titra/commit/e606b674a2b7564407d89e38a341d72e22b14694 - https://huntr.dev/bounties/fb99c27c-7eaa-48db-be39-b804cb83871d
CVE ID: CVE-2022-2028 State: PUBLISHED Published: 2022-06-08T08:35:18 Last Updated: 2024-08-03T00:24:44.188Z Severity: HIGH (CVSS 8.2 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L) Vendors: kromitgmbh Products: kromitgmbh/titra Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Generic in GitHub repository kromitgmbh/titra prior to 0.77.0. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/kromitgmbh/titra/commit/e606b674a2b7564407d89e38a341d72e22b14694 - https://huntr.dev/bounties/588fb241-bc8f-40fc-82a4-df249956d69f
CVE ID: CVE-2022-2029 State: PUBLISHED Published: 2022-06-08T08:35:13 Last Updated: 2024-08-03T00:24:43.962Z Severity: HIGH (CVSS 8.2 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L) Vendors: kromitgmbh Products: kromitgmbh/titra Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - DOM in GitHub repository kromitgmbh/titra prior to 0.77.0. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/9052a874-634c-473e-a2b3-65112181543f - https://github.com/kromitgmbh/titra/commit/e606b674a2b7564407d89e38a341d72e22b14694
CVE ID: CVE-2022-2030 State: PUBLISHED Published: 2022-07-19T05:55:11 Last Updated: 2024-08-03T00:24:44.144Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Zyxel Products: USG FLEX 100(W) firmware, USG FLEX 200 firmware, USG FLEX 500 firmware, USG FLEX 700 firmware, ATP series firmware, VPN series firmware, USG FLEX 50(W) firmware, USG 20(W)-VPN firmware, USG/ZyWALL series firmware Problem Types: CWE-22 Description: A directory traversal vulnerability caused by specific character sequences within an improperly sanitized URL was identified in some CGI programs of Zyxel USG FLEX 100(W) firmware versions 4.50 through 5.30, USG FLEX 200 firmware versions 4.50 t
in some CGI programs of Zyxel USG FLEX 100(W) firmware versions 4.50 through 5.30, USG FLEX 200 firmware versions 4.50 through 5.30, USG FLEX 500 firmware versions 4.50 through 5.30, USG FLEX 700 firmware versions 4.50 through 5.30, USG FLEX 50(W) firmware versions 4.16 through 5.30, USG20(W)-VPN firmware versions 4.16 through 5.30, ATP series firmware versions 4.32 through 5.30, VPN series firmware versions 4.30 through 5.30, USG/ZyWALL series firmware versions 4.11 through 4.72, that could allow an authenticated attacker to access some restricted files on a vulnerable device. Additional Analyst Notes: - CVE Program Container: References: - https://www.zyxel.com/support/Zyxel-security-advis
ice. Additional Analyst Notes: - CVE Program Container: References: - https://www.zyxel.com/support/Zyxel-security-advisory-authenticated-directory-traversal-vulnerabilities-of-firewalls.shtml