Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-42111 State: PUBLISHED Published: 2022-11-15T00:00:00 Last Updated: 2024-08-03T13:03:44.112Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross-site scripting (XSS) vulnerability in the Sharing module's user notification in Liferay Portal 7.2.1 through 7.4.2, and Liferay DXP 7.2 before fix pack 19, and 7.3 before update 4 allows remote attackers to inject arbitrary web script or HTML by sharing an asset with a crafted payload. Additional Analyst Notes: - CVE Program Container: References: - https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42111 - https://issues.liferay.com/browse/LPE-17379
CVE ID: CVE-2022-42112 State: PUBLISHED Published: 2022-10-18T00:00:00.000Z Last Updated: 2025-05-10T02:44:34.087Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross-site scripting (XSS) vulnerability in the Portal Search module's Sort widget in Liferay Portal 7.2.0 through 7.4.3.24, and Liferay DXP 7.2 before fix pack 19, 7.3 before update 5, and DXP 7.4 before update 25 allows remote attackers to inject arbitrary web script or HTML via a crafted payload. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://liferay.com - https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-
y.com - https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42112
CVE ID: CVE-2022-42113 State: PUBLISHED Published: 2022-10-18T00:00:00.000Z Last Updated: 2025-05-10T02:43:03.094Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross-site scripting (XSS) vulnerability in Document Library module in Liferay Portal 7.4.3.30 through 7.4.3.36, and Liferay DXP 7.4 update 30 through update 36 allows remote attackers to inject arbitrary web script or HTML via the `redirect` parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://liferay.com - https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42113
CVE ID: CVE-2022-42114 State: PUBLISHED Published: 2022-10-18T00:00:00.000Z Last Updated: 2025-05-10T02:41:17.822Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross-site scripting (XSS) vulnerability in the Role module's edit role assignees page in Liferay Portal 7.4.0 through 7.4.3.36, and Liferay DXP 7.4 before update 37 allows remote attackers to inject arbitrary web script or HTML. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://liferay.com - https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42114
CVE ID: CVE-2022-42115 State: PUBLISHED Published: 2022-10-18T00:00:00.000Z Last Updated: 2025-05-13T14:40:38.114Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Object module's edit object details page in Liferay Portal 7.4.3.4 through 7.4.3.36 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into the object field's `Label` text field. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://liferay.com - https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42115
CVE ID: CVE-2022-42116 State: PUBLISHED Published: 2022-10-18T00:00:00.000Z Last Updated: 2025-05-13T14:39:12.020Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross-site scripting (XSS) vulnerability in the Frontend Editor module's integration with CKEditor in Liferay Portal 7.3.2 through 7.4.3.14, and Liferay DXP 7.3 before update 6, and 7.4 before update 15 allows remote attackers to inject arbitrary web script or HTML via the (1) name, or (2) namespace parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://liferay.com - https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/conten
tp://liferay.com - https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42116
CVE ID: CVE-2022-42117 State: PUBLISHED Published: 2022-10-18T00:00:00.000Z Last Updated: 2025-05-12T17:58:44.842Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross-site scripting (XSS) vulnerability in the Frontend Taglib module in Liferay Portal 7.3.2 through 7.4.3.16, and Liferay DXP 7.3 before update 6, and 7.4 before update 17 allows remote attackers to inject arbitrary web script or HTML. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://liferay.com - https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42117
CVE ID: CVE-2022-42118 State: PUBLISHED Published: 2022-11-15T00:00:00.000Z Last Updated: 2025-04-30T14:38:30.221Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross-site scripting (XSS) vulnerability in the Portal Search module in Liferay Portal 7.1.0 through 7.4.2, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 15, and 7.3 before service pack 3 allows remote attackers to inject arbitrary web script or HTML via the `tag` parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://liferay.com - https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42118 - htt
ps://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42118 - https://issues.liferay.com/browse/LPE-17342
CVE ID: CVE-2022-42119 State: PUBLISHED Published: 2022-11-15T00:00:00.000Z Last Updated: 2025-04-30T14:37:13.439Z Vendors: n/a Products: n/a Problem Types: n/a Description: Certain Liferay products are vulnerable to Cross Site Scripting (XSS) via the Commerce module. This affects Liferay Portal 7.3.5 through 7.4.2 and Liferay DXP 7.3 before update 8. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://liferay.com - https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42119 - https://issues.liferay.com/browse/LPE-17632
CVE ID: CVE-2022-42120 State: PUBLISHED Published: 2022-11-15T00:00:00.000Z Last Updated: 2025-09-05T17:26:32.738Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection vulnerability in the Fragment module in Liferay Portal 7.3.3 through 7.4.3.16, and Liferay DXP 7.3 before update 4, and 7.4 before update 17 allows attackers to execute arbitrary SQL commands via a PortletPreferences' `namespace` attribute. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://liferay.com - https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42120 - https://issues.liferay.com/browse/LPE-
ity/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42120 - https://issues.liferay.com/browse/LPE-17513
CVE ID: CVE-2022-42121 State: PUBLISHED Published: 2022-11-15T00:00:00.000Z Last Updated: 2025-09-05T17:25:54.666Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection vulnerability in the Layout module in Liferay Portal 7.1.3 through 7.4.3.4, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 17, 7.3 before service pack 3, and 7.4 GA allows remote authenticated attackers to execute arbitrary SQL commands via a crafted payload injected into a page template's 'Name' field. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://liferay.com - https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher
nt: References: - http://liferay.com - https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42121 - https://issues.liferay.com/browse/LPE-17414
CVE ID: CVE-2022-42122 State: PUBLISHED Published: 2022-11-15T00:00:00.000Z Last Updated: 2025-09-05T17:25:36.911Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection vulnerability in the Friendly Url module in Liferay Portal 7.3.7, and Liferay DXP 7.3 fix pack 2 through update 4 allows attackers to execute arbitrary SQL commands via a crafted payload injected into the `title` field of a friendly URL. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://liferay.com - https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42122 - https://issues.liferay.com/browse/LPE-175
/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42122 - https://issues.liferay.com/browse/LPE-17520
CVE ID: CVE-2022-42123 State: PUBLISHED Published: 2022-11-15T00:00:00.000Z Last Updated: 2025-09-05T17:25:07.238Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Zip slip vulnerability in the Elasticsearch Connector in Liferay Portal 7.3.3 through 7.4.3.18, and Liferay DXP 7.3 before update 6, and 7.4 before update 19 allows attackers to create or overwrite existing files on the filesystem via the installation of a malicious Elasticsearch Sidecar plugin. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://liferay.com - https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-4212
m - https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42123 - https://issues.liferay.com/browse/LPE-17518
CVE ID: CVE-2022-42124 State: PUBLISHED Published: 2022-11-15T00:00:00.000Z Last Updated: 2025-09-05T17:24:08.419Z Vendors: n/a Products: n/a Problem Types: n/a Description: ReDoS vulnerability in LayoutPageTemplateEntryUpgradeProcess in Liferay Portal 7.3.2 through 7.4.3.4 and Liferay DXP 7.2 fix pack 9 through fix pack 18, 7.3 before update 4, and DXP 7.4 GA allows remote attackers to consume an excessive amount of server resources via a crafted payload injected into the 'name' field of a layout prototype. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://liferay.com - https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_pub
richment: References: - http://liferay.com - https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42124 - https://issues.liferay.com/browse/LPE-17435 - https://issues.liferay.com/browse/LPE-17535
CVE ID: CVE-2022-42125 State: PUBLISHED Published: 2022-11-15T00:00:00.000Z Last Updated: 2025-04-30T14:35:27.476Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zip slip vulnerability in FileUtil.unzip in Liferay Portal 7.4.3.5 through 7.4.3.35 and Liferay DXP 7.4 update 1 through update 34 allows attackers to create or overwrite existing files on the filesystem via the deployment of a malicious plugin/module. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://liferay.com - https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42125 - https://issues.liferay.com/browse/LPE-1751
known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42125 - https://issues.liferay.com/browse/LPE-17517
CVE ID: CVE-2022-42126 State: PUBLISHED Published: 2022-11-15T00:00:00.000Z Last Updated: 2025-04-30T14:32:32.468Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Asset Libraries module in Liferay Portal 7.3.5 through 7.4.3.28, and Liferay DXP 7.3 before update 8, and DXP 7.4 before update 29 does not properly check permissions of asset libraries, which allows remote authenticated users to view asset libraries via the UI. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://liferay.com - https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42126 - https://issues.liferay.com/b
earn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42126 - https://issues.liferay.com/browse/LPE-17593
CVE ID: CVE-2022-42127 State: PUBLISHED Published: 2022-11-15T00:00:00.000Z Last Updated: 2025-04-30T14:29:19.028Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Friendly Url module in Liferay Portal 7.4.3.5 through 7.4.3.36, and Liferay DXP 7.4 update 1 though 36 does not properly check user permissions, which allows remote attackers to obtain the history of all friendly URLs that was assigned to a page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://liferay.com - https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42127 - https://issues.liferay.com/browse/LPE-17607
CVE ID: CVE-2022-42128 State: PUBLISHED Published: 2022-11-15T00:00:00.000Z Last Updated: 2025-04-30T14:27:15.968Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Hypermedia REST APIs module in Liferay Portal 7.4.1 through 7.4.3.4, and Liferay DXP 7.4 GA does not properly check permissions, which allows remote attackers to obtain a WikiNode object via the WikiNodeResource.getSiteWikiNodeByExternalReferenceCode API. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://liferay.com - https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42128 - https://issues.liferay.com/browse/L
curity/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42128 - https://issues.liferay.com/browse/LPE-17595
CVE ID: CVE-2022-42129 State: PUBLISHED Published: 2022-11-15T00:00:00.000Z Last Updated: 2025-04-30T18:27:49.397Z Vendors: n/a Products: n/a Problem Types: n/a Description: An Insecure direct object reference (IDOR) vulnerability in the Dynamic Data Mapping module in Liferay Portal 7.3.2 through 7.4.3.4, and Liferay DXP 7.3 before update 4, and 7.4 GA allows remote authenticated users to view and access form entries via the `formInstanceRecordId` parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://liferay.com - https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42129 - https:
//portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42129 - https://issues.liferay.com/browse/LPE-17448
CVE ID: CVE-2022-42130 State: PUBLISHED Published: 2022-11-15T00:00:00.000Z Last Updated: 2025-04-30T18:27:03.823Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Dynamic Data Mapping module in Liferay Portal 7.1.0 through 7.4.3.4, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 19, 7.3 before update 4, and 7.4 GA does not properly check permission of form entries, which allows remote authenticated users to view and access all form entries. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://liferay.com - https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42130
- https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42130 - https://issues.liferay.com/browse/LPE-17447
CVE ID: CVE-2022-42131 State: PUBLISHED Published: 2022-11-15T00:00:00.000Z Last Updated: 2025-04-30T14:24:11.461Z Vendors: n/a Products: n/a Problem Types: n/a Description: Certain Liferay products are affected by: Missing SSL Certificate Validation in the Dynamic Data Mapping module's REST data providers. This affects Liferay Portal 7.1.0 through 7.4.2 and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 17, and 7.3 before service pack 3. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://liferay.com - https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42131 - https://issues.li
feray.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42131 - https://issues.liferay.com/browse/LPE-17377
CVE ID: CVE-2022-42132 State: PUBLISHED Published: 2022-11-15T00:00:00.000Z Last Updated: 2025-04-30T14:18:27.784Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Test LDAP Users functionality in Liferay Portal 7.0.0 through 7.4.3.4, and Liferay DXP 7.0 fix pack 102 and earlier, 7.1 before fix pack 27, 7.2 before fix pack 17, 7.3 before update 4, and DXP 7.4 GA includes the LDAP credential in the page URL when paginating through the list of users, which allows man-in-the-middle attackers or attackers with access to the request logs to see the LDAP credential. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://liferay.com - https://
Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://liferay.com - https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42132 - https://issues.liferay.com/browse/LPE-17438
CVE ID: CVE-2022-42136 State: PUBLISHED Published: 2023-01-13T00:00:00.000Z Last Updated: 2025-04-07T18:57:17.268Z Vendors: n/a Products: n/a Problem Types: n/a Description: Authenticated mail users, under specific circumstances, could add files with unsanitized content in public folders where the IIS user had permission to access. That action, could lead an attacker to store arbitrary code on that files and execute RCE commands. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mailenable.com/kb/content/article.asp?ID=ME020737 - https://pastebin.com/ahLNMf5n
CVE ID: CVE-2022-42139 State: PUBLISHED Published: 2022-12-13T00:00:00.000Z Last Updated: 2025-04-22T15:36:52.790Z Vendors: n/a Products: n/a Problem Types: n/a Description: Delta Electronics DVW-W02W2-E2 1.5.0.10 is vulnerable to Command Injection via Crafted URL. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cyberdanube.com/en/en-authenticated-command-injection-in-delta-electronics-dvw-w02w2-e2/
CVE ID: CVE-2022-42140 State: PUBLISHED Published: 2022-12-13T00:00:00.000Z Last Updated: 2025-04-22T15:33:27.154Z Vendors: n/a Products: n/a Problem Types: n/a Description: Delta Electronics DX-2100-L1-CN 2.42 is vulnerable to Command Injection via lform/net_diagnose. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cyberdanube.com/en/en-multiple-vulnerabilities-in-delta-electronics-dx-2100-l1-cn/
CVE ID: CVE-2022-42141 State: PUBLISHED Published: 2022-12-13T00:00:00.000Z Last Updated: 2025-04-22T15:28:28.651Z Vendors: n/a Products: n/a Problem Types: n/a Description: Delta Electronics DX-2100-L1-CN 2.42 is vulnerable to Cross Site Scripting (XSS) via lform/urlfilter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cyberdanube.com/en/en-multiple-vulnerabilities-in-delta-electronics-dx-2100-l1-cn/
CVE ID: CVE-2022-42142 State: PUBLISHED Published: 2022-10-17T00:00:00.000Z Last Updated: 2025-05-14T20:38:01.451Z Vendors: n/a Products: n/a Problem Types: n/a Description: Online Tours & Travels Management System v1.0 is vulnerable to Arbitrary code execution via ip/tour/admin/operations/update_settings.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/xd201qaz/bug_report/blob/main/vendors/mayuri_k/online-tours-travels-management-system/RCE-1.md
CVE ID: CVE-2022-42143 State: PUBLISHED Published: 2022-10-17T00:00:00.000Z Last Updated: 2025-05-14T20:39:06.687Z Vendors: n/a Products: n/a Problem Types: n/a Description: Open Source SACCO Management System v1.0 is vulnerable to SQL Injection via /sacco_shield/manage_payment.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/xd201qaz/bug_report/blob/main/vendors/mayuri_k/open-source-sacco-management-system/SQLi-1.md
CVE ID: CVE-2022-42147 State: PUBLISHED Published: 2022-10-17T00:00:00.000Z Last Updated: 2025-05-14T20:42:42.279Z Vendors: n/a Products: n/a Problem Types: n/a Description: kkFileView 4.0 is vulnerable to Cross Site Scripting (XSS) via controller\ Filecontroller.java. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/xiaojiangxl/paper/blob/main/kkFileView/xss_vul_en.md
CVE ID: CVE-2022-42149 State: PUBLISHED Published: 2022-10-17T00:00:00.000Z Last Updated: 2025-05-14T20:50:37.368Z Vendors: n/a Products: n/a Problem Types: n/a Description: kkFileView 4.0 is vulnerable to Server-side request forgery (SSRF) via controller\OnlinePreviewController.java. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/xiaojiangxl/paper/blob/main/kkFileView/ssrf_vul_en.md
CVE ID: CVE-2022-42150 State: PUBLISHED Published: 2023-10-19T00:00:00 Last Updated: 2024-09-12T20:51:15.941Z Vendors: n/a Products: n/a Problem Types: n/a Description: TinyLab linux-lab v1.1-rc1 and cloud-labv0.8-rc2, v1.1-rc1 are vulnerable to insecure permissions. The default configuration could cause Container Escape. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/tinyclub/linux-lab/issues/14 - https://hackmd.io/%40UR9gnr32QymtmtZHnZceOw/ry428EZGo - https://github.com/tinyclub/cloud-lab/blob/d19ff92713685a7fb84b423dea6a184b25c378c9/configs/common/seccomp-profiles-default.json - https://github.com/eBPF-Research/eBPF-Attack/blob
84b423dea6a184b25c378c9/configs/common/seccomp-profiles-default.json - https://github.com/eBPF-Research/eBPF-Attack/blob/main/PoC.md#attack-requirements - https://www.usenix.org/conference/usenixsecurity23/presentation/he
CVE ID: CVE-2022-42154 State: PUBLISHED Published: 2022-10-17T00:00:00.000Z Last Updated: 2025-05-14T20:57:08.968Z Vendors: n/a Products: n/a Problem Types: n/a Description: An arbitrary file upload vulnerability in the component /apiadmin/upload/attach of 74cmsSE v3.13.0 allows attackers to execute arbitrary code via a crafted PHP file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/xxhzz1/74cmsSE-Arbitrary-file-upload-vulnerability/issues/1
CVE ID: CVE-2022-42156 State: PUBLISHED Published: 2022-10-13T00:00:00.000Z Last Updated: 2025-05-15T14:24:31.602Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link COVR 1200,1203 v1.08 was discovered to contain a command injection vulnerability via the tomography_ping_number parameter at function SetNetworkTomographySettings. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.dlink.com/en/security-bulletin/ - https://github.com/14isnot40/vul_discovery/blob/master/D-Link%20COVR%2012xx%20.pdf
CVE ID: CVE-2022-42159 State: PUBLISHED Published: 2022-10-13T00:00:00.000Z Last Updated: 2025-05-16T13:27:49.817Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link COVR 1200,1202,1203 v1.08 was discovered to have a predictable seed in a Pseudo-Random Number Generator. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.dlink.com/en/security-bulletin/ - https://github.com/14isnot40/vul_discovery/blob/master/D-Link%20COVR%2012xx%20.pdf