Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-24166 State: PUBLISHED Published: 2022-02-04T01:33:01 Last Updated: 2024-08-03T04:07:01.940Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a stack overflow in the function formSetSysTime. This vulnerability allows attackers to cause a Denial of Service (DoS) via the manualTime parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pjqwudi/my_vuln/blob/main/Tenda/vuln_42/42.md
CVE ID: CVE-2022-24167 State: PUBLISHED Published: 2022-02-04T01:33:01 Last Updated: 2024-08-03T04:07:01.389Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a command injection vulnerability in the function formSetDMZ. This vulnerability allows attackers to execute arbitrary commands via the dmzHost1 parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pjqwudi/my_vuln/blob/main/Tenda/vuln_39/39.md
CVE ID: CVE-2022-24168 State: PUBLISHED Published: 2022-02-04T01:32:59 Last Updated: 2024-08-03T04:07:01.543Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a command injection vulnerability in the function formSetIpGroup. This vulnerability allows attackers to execute arbitrary commands via the IPGroupStartIP and IPGroupEndIP parameters. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pjqwudi/my_vuln/blob/main/Tenda/vuln_37/37.md
CVE ID: CVE-2022-24169 State: PUBLISHED Published: 2022-02-04T01:32:59 Last Updated: 2024-08-03T04:07:02.317Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a stack overflow in the function formIPMacBindAdd. This vulnerability allows attackers to cause a Denial of Service (DoS) via the IPMacBindRule parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pjqwudi/my_vuln/blob/main/Tenda/vuln_41/41.md
CVE ID: CVE-2022-24170 State: PUBLISHED Published: 2022-02-04T01:32:58 Last Updated: 2024-08-03T04:07:01.577Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a command injection vulnerability in the function formSetIpSecTunnel. This vulnerability allows attackers to execute arbitrary commands via the IPsecLocalNet and IPsecRemoteNet parameters. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pjqwudi/my_vuln/blob/main/Tenda/vuln_36/36.md
CVE ID: CVE-2022-24171 State: PUBLISHED Published: 2022-02-04T01:32:57 Last Updated: 2024-08-03T04:07:01.501Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a command injection vulnerability in the function formSetPppoeServer. This vulnerability allows attackers to execute arbitrary commands via the pppoeServerIP, pppoeServerStartIP, and pppoeServerEndIP parameters. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pjqwudi/my_vuln/blob/main/Tenda/vuln_35/35.md
CVE ID: CVE-2022-24172 State: PUBLISHED Published: 2022-02-04T01:32:56 Last Updated: 2024-08-03T04:07:01.524Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a stack overflow in the function formAddDhcpBindRule. This vulnerability allows attackers to cause a Denial of Service (DoS) via the addDhcpRules parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pjqwudi/my_vuln/blob/main/Tenda/vuln_43/43.md
CVE ID: CVE-2022-24177 State: PUBLISHED Published: 2022-03-07T19:44:55 Last Updated: 2024-08-03T04:07:01.525Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in the component cgi-bin/ej.cgi of Ex libris ALEPH 500 v18.1 and v20 allows attackers to execute arbitrary web scripts or HTML. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/zhao1231/cve_payload/issues/1
CVE ID: CVE-2022-24181 State: PUBLISHED Published: 2022-04-01T11:42:09 Last Updated: 2024-08-03T04:07:01.505Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) via Host Header injection in PKP Open Journals System 2.4.8 >= 3.3 allows remote attackers to inject arbitary code via the X-Forwarded-Host Header. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pkp/pkp-lib/issues/7649
CVE ID: CVE-2022-24187 State: PUBLISHED Published: 2022-11-28T00:00:00.000Z Last Updated: 2025-04-29T13:39:33.899Z Vendors: n/a Products: n/a Problem Types: n/a Description: The user_id and device_id on the Ourphoto App version 1.4.1 /device/* end-points both suffer from insecure direct object reference vulnerabilities. Other end-users user_id and device_id values can be enumerated by incrementing or decrementing id numbers. The impact of this vulnerability allows an attacker to discover sensitive information such as end-user email addresses, and their unique frame_token value of all other Ourphoto App end-users. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Ref
lue of all other Ourphoto App end-users. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://apps.apple.com/us/app/ourphoto-keep-our-memories/id1476241568 - https://www.scrawledsecurityblog.com/2022/11/automating-unsolicited-richard-pics.html
CVE ID: CVE-2022-24188 State: PUBLISHED Published: 2022-11-28T00:00:00.000Z Last Updated: 2025-04-29T13:37:33.862Z Vendors: n/a Products: n/a Problem Types: n/a Description: The /device/signin end-point for the Ourphoto App version 1.4.1 discloses clear-text password information for functionality within the picture frame devices. The deviceVideoCallPassword and mqttPassword are returned in clear-text. The lack of sessions management and presence of insecure direct object references allows to return password information for other end-users devices. Many of the picture frame devices offer video calling, and it is likely this information can be used to abuse that functionality. Additional Analy
devices offer video calling, and it is likely this information can be used to abuse that functionality. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.scrawledsecurityblog.com/2022/11/automating-unsolicited-richard-pics.html
CVE ID: CVE-2022-24189 State: PUBLISHED Published: 2022-11-28T00:00:00.000Z Last Updated: 2025-04-29T13:36:14.016Z Vendors: n/a Products: n/a Problem Types: n/a Description: The user_token authorization header on the Ourphoto App version 1.4.1 /apiv1/* end-points is not implemented properly. Removing the value causes all requests to succeed, bypassing authorization and session management. The impact of this vulnerability allows an attacker POST api calls with other users unique identifiers and enumerate information of all other end-users. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.scrawledsecurityblog.com/2022/11/automating-unsolicit
gram Container: - CISA ADP Vulnrichment: References: - https://www.scrawledsecurityblog.com/2022/11/automating-unsolicited-richard-pics.html
CVE ID: CVE-2022-24190 State: PUBLISHED Published: 2022-11-28T00:00:00.000Z Last Updated: 2025-04-29T13:35:11.846Z Vendors: n/a Products: n/a Problem Types: n/a Description: The /device/acceptBind end-point for Ourphoto App version 1.4.1 does not require authentication or authorization. The user_token header is not implemented or present on this end-point. An attacker can send a request to bind their account to any users picture frame, then send a POST request to accept their own bind request, without the end-users approval or interaction. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.scrawledsecurityblog.com/2022/11/automating-unsolici
ogram Container: - CISA ADP Vulnrichment: References: - https://www.scrawledsecurityblog.com/2022/11/automating-unsolicited-richard-pics.html
CVE ID: CVE-2022-24191 State: PUBLISHED Published: 2022-04-04T10:33:45 Last Updated: 2024-08-03T04:07:01.496Z Vendors: n/a Products: n/a Problem Types: n/a Description: In HTMLDOC 1.9.14, an infinite loop in the gif_read_lzw function can lead to a pointer arbitrarily pointing to heap memory and resulting in a buffer overflow. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/michaelrsweet/htmldoc/issues/470 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6RPDZLHOMPSA2LBXXFTZ5UADZWGYYWH7/
CVE ID: CVE-2022-24193 State: PUBLISHED Published: 2022-03-07T12:48:21 Last Updated: 2024-08-03T04:07:01.484Z Vendors: n/a Products: n/a Problem Types: n/a Description: CasaOS before v0.2.7 was discovered to contain a command injection vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://www.star123.top/2022/01/08/A-vulnerability-in-CasaOS/#more - https://github.com/IceWhaleTech/CasaOS/issues/84 - https://github.com/IceWhaleTech/CasaOS/commit/d060968b7ab08e7f8cbfe7ca9ccdfa47afe9bb06 - https://www.star123.top/2022/01/08/A-vulnerability-in-CasaOS/
CVE ID: CVE-2022-24196 State: PUBLISHED Published: 2022-02-01T00:00:00 Last Updated: 2024-08-03T04:07:02.310Z Vendors: n/a Products: n/a Problem Types: n/a Description: iText v7.1.17, up to (exluding)": 7.1.18 and 7.2.2 was discovered to contain an out-of-memory error via the component readStreamBytesRaw, which allows attackers to cause a Denial of Service (DoS) via a crafted PDF file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/itext/itext7/pull/78 - https://github.com/itext/itext7/pull/78#issuecomment-1089279222 - https://github.com/itext/itext7/releases/tag/7.1.18
CVE ID: CVE-2022-24197 State: PUBLISHED Published: 2022-02-01T00:00:00 Last Updated: 2024-08-03T04:07:01.586Z Vendors: n/a Products: n/a Problem Types: n/a Description: iText v7.1.17 was discovered to contain a stack-based buffer overflow via the component ByteBuffer.append, which allows attackers to cause a Denial of Service (DoS) via a crafted PDF file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/itext/itext7/pull/78 - https://github.com/itext/itext7/pull/78#issuecomment-1089282165 - https://github.com/itext/itext7/releases/tag/7.1.18
CVE ID: CVE-2022-24198 State: PUBLISHED Published: 2022-02-01T00:00:00 Last Updated: 2024-08-03T04:07:01.606Z Vendors: n/a Products: n/a Problem Types: n/a Description: iText v7.1.17 was discovered to contain an out-of-bounds exception via the component ARCFOUREncryption.encryptARCFOUR, which allows attackers to cause a Denial of Service (DoS) via a crafted PDF file. NOTE: Vendor does not view this as a vulnerability and has not found it to be exploitable. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/itext/itext7/pull/78 - https://github.com/itext/itext7/pull/78#issuecomment-1089287808
CVE ID: CVE-2022-24206 State: PUBLISHED Published: 2022-02-14T20:18:17 Last Updated: 2024-08-03T04:07:01.494Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tongda2000 v11.10 was discovered to contain a SQL injection vulnerability in /mobile_seal/get_seal.php via the DEVICE_LIST parameter. Additional Analyst Notes: - CVE Program Container: References: - http://note.youdao.com/noteshare?id=87fd3a0b18abf28fccd690e97c7ea3c6
CVE ID: CVE-2022-24218 State: PUBLISHED Published: 2022-02-01T18:36:52 Last Updated: 2024-08-03T04:07:01.508Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in /admin/delete_image.php of eliteCMS v1.0 allows attackers to delete arbitrary files. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jsjbcyber/bug_report/blob/main/bug_b
CVE ID: CVE-2022-24219 State: PUBLISHED Published: 2022-02-01T18:36:53 Last Updated: 2024-08-03T04:07:01.560Z Vendors: n/a Products: n/a Problem Types: n/a Description: eliteCMS v1.0 was discovered to contain a SQL injection vulnerability via /admin/edit_page.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jsjbcyber/bug_report/blob/main/bug_c
CVE ID: CVE-2022-24220 State: PUBLISHED Published: 2022-02-01T18:36:57 Last Updated: 2024-08-03T04:07:01.545Z Vendors: n/a Products: n/a Problem Types: n/a Description: eliteCMS v1.0 was discovered to contain a SQL injection vulnerability via /admin/edit_post.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jsjbcyber/bug_report/blob/main/bug_d
CVE ID: CVE-2022-24221 State: PUBLISHED Published: 2022-02-01T18:36:54 Last Updated: 2024-08-03T04:07:02.519Z Vendors: n/a Products: n/a Problem Types: n/a Description: eliteCMS v1.0 was discovered to contain a SQL injection vulnerability via /admin/functions/functions.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jsjbcyber/bug_report/blob/main/bug_e
CVE ID: CVE-2022-24222 State: PUBLISHED Published: 2022-02-01T18:36:55 Last Updated: 2024-08-03T04:07:02.411Z Vendors: n/a Products: n/a Problem Types: n/a Description: eliteCMS v1.0 was discovered to contain a SQL injection vulnerability via /admin/edit_user.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jsjbcyber/bug_report/blob/main/bug_f
CVE ID: CVE-2022-24223 State: PUBLISHED Published: 2022-02-01T18:36:56 Last Updated: 2024-08-03T04:07:01.534Z Vendors: n/a Products: n/a Problem Types: n/a Description: AtomCMS v2.0 was discovered to contain a SQL injection vulnerability via /admin/login.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/thedigicraft/Atom.CMS/issues/255 - http://packetstormsecurity.com/files/165922/Atom-CMS-2.0-SQL-Injection.html
CVE ID: CVE-2022-24226 State: PUBLISHED Published: 2022-02-15T15:30:37 Last Updated: 2024-08-03T04:07:01.539Z Vendors: n/a Products: n/a Problem Types: n/a Description: Hospital Management System v4.0 was discovered to contain a blind SQL injection vulnerability via the register function in func2.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Nguyen-Trung-Kien/CVE - https://github.com/Nguyen-Trung-Kien/CVE/blob/main/CVE-2022-24226/CVE-2022-24226.pdf
CVE ID: CVE-2022-24227 State: PUBLISHED Published: 2022-02-15T00:00:00.000Z Last Updated: 2025-05-05T16:24:41.971Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in BoltWire v7.10 and v 8.00 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the name and lastname parameters. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Nguyen-Trung-Kien/CVE - https://github.com/Nguyen-Trung-Kien/CVE/blob/main/CVE-2022-24227/CVE-2022-24227.pdf - https://github.com/Cyber-Wo0dy/report/blob/main/boltwire/v8.00/boltwire_xss
CVE ID: CVE-2022-24229 State: PUBLISHED Published: 2022-04-08T11:06:58 Last Updated: 2024-08-03T04:07:02.361Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in ONLYOFFICE Document Server Example before v7.0.0 allows remote attackers inject arbitrary HTML or JavaScript through /example/editor. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ONLYOFFICE/DocumentServer - https://www.onlyoffice.com/ - https://github.com/ONLYOFFICE/document-server-integration/issues/252
CVE ID: CVE-2022-24231 State: PUBLISHED Published: 2022-04-05T01:18:41 Last Updated: 2024-08-03T04:07:01.664Z Vendors: n/a Products: n/a Problem Types: n/a Description: Simple Student Information System v1.0 was discovered to contain a SQL injection vulnerability via add/Student. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nsparker1337/OpenSource/blob/main/Blind_XSS - https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/2022/Simple-Student-Information
CVE ID: CVE-2022-24232 State: PUBLISHED Published: 2022-02-24T18:17:57 Last Updated: 2024-08-03T04:07:01.584Z Vendors: n/a Products: n/a Problem Types: n/a Description: A local file inclusion in Hospital Patient Record Management System v1.0 allows attackers to execute arbitrary code via a crafted PHP file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/09-by-ly/test
CVE ID: CVE-2022-24235 State: PUBLISHED Published: 2022-03-21T17:24:13 Last Updated: 2024-08-03T04:07:01.787Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross-Site Request Forgery (CSRF) in the management portal of Snapt Aria v12.8 allows attackers to escalate privileges and execute arbitrary code via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://www.snapt.net/platforms/aria-adc - https://www.cryptnetix.com/blog/2022/03/19/Snapt-Aria-Vulnerability-Disclosure.html
CVE ID: CVE-2022-24236 State: PUBLISHED Published: 2022-03-21T17:24:11 Last Updated: 2024-08-03T04:07:01.494Z Vendors: n/a Products: n/a Problem Types: n/a Description: An insecure permissions vulnerability in Snapt Aria v12.8 allows unauthenticated attackers to send e-mails from spoofed users' accounts. Additional Analyst Notes: - CVE Program Container: References: - https://www.snapt.net/platforms/aria-adc - https://www.cryptnetix.com/blog/2022/03/19/Snapt-Aria-Vulnerability-Disclosure.html
CVE ID: CVE-2022-24237 State: PUBLISHED Published: 2022-03-21T17:24:09 Last Updated: 2024-08-03T04:07:01.478Z Vendors: n/a Products: n/a Problem Types: n/a Description: The snaptPowered2 component of Snapt Aria v12.8 was discovered to contain a command injection vulnerability. This vulnerability allows authenticated attackers to execute arbitrary commands. Additional Analyst Notes: - CVE Program Container: References: - https://www.snapt.net/platforms/aria-adc - https://www.cryptnetix.com/blog/2022/03/19/Snapt-Aria-Vulnerability-Disclosure.html
CVE ID: CVE-2022-24238 State: PUBLISHED Published: 2022-05-27T18:29:04 Last Updated: 2024-08-03T04:07:02.381Z Vendors: n/a Products: n/a Problem Types: n/a Description: ACEweb Online Portal 3.5.065 was discovered to contain a cross-site scripting (XSS) vulnerability via the txtNmName1 parameter in person.awp. Additional Analyst Notes: - CVE Program Container: References: - http://aceware.com - http://aceweb.com - https://www.aceware.com/forum/viewtopic.php?f=7&t=481
CVE ID: CVE-2022-24239 State: PUBLISHED Published: 2022-05-27T18:29:16 Last Updated: 2024-08-03T04:07:02.628Z Vendors: n/a Products: n/a Problem Types: n/a Description: ACEweb Online Portal 3.5.065 was discovered to contain an unrestricted file upload vulnerability via attachments.awp. Additional Analyst Notes: - CVE Program Container: References: - http://aceware.com - http://aceweb.com - https://www.aceware.com/forum/viewtopic.php?f=7&t=481
CVE ID: CVE-2022-24240 State: PUBLISHED Published: 2022-05-27T18:29:26 Last Updated: 2024-08-03T04:07:02.365Z Vendors: n/a Products: n/a Problem Types: n/a Description: ACEweb Online Portal 3.5.065 was discovered to contain a SQL injection vulnerability via the criteria parameter in showschedule.awp. Additional Analyst Notes: - CVE Program Container: References: - http://aceware.com - http://aceweb.com - https://www.aceware.com/forum/viewtopic.php?f=7&t=481
CVE ID: CVE-2022-24241 State: PUBLISHED Published: 2022-05-27T18:29:37 Last Updated: 2024-08-03T04:07:02.355Z Vendors: n/a Products: n/a Problem Types: n/a Description: ACEweb Online Portal 3.5.065 was discovered to contain an External Controlled File Path and Name vulnerability via the txtFilePath parameter in attachments.awp. Additional Analyst Notes: - CVE Program Container: References: - http://aceware.com - http://aceweb.com - https://www.aceware.com/forum/viewtopic.php?f=7&t=481
CVE ID: CVE-2022-24247 State: PUBLISHED Published: 2022-04-12T11:10:04 Last Updated: 2024-08-03T04:07:02.350Z Vendors: n/a Products: n/a Problem Types: n/a Description: RiteCMS version 3.1.0 and below suffers from an arbitrary file overwrite via path traversal vulnerability in Admin Panel. Exploiting the vulnerability allows an authenticated attacker to overwrite any file in the web root (along with any other file on the server that the PHP process user has the proper permissions to write) resulting a remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/50614 - https://cxsecurity.com/issue/WLB-2022010019
CVE ID: CVE-2022-24248 State: PUBLISHED Published: 2022-04-12T11:19:55 Last Updated: 2024-08-03T04:07:02.316Z Vendors: n/a Products: n/a Problem Types: n/a Description: RiteCMS version 3.1.0 and below suffers from an arbitrary file deletion via path traversal vulnerability in Admin Panel. Exploiting the vulnerability allows an authenticated attacker to delete any file in the web root (along with any other file on the server that the PHP process user has the proper permissions to delete). Furthermore, an attacker might leverage the capability of arbitrary file deletion to circumvent certain web server security mechanisms such as deleting .htaccess file that would deactivate those security con
rcumvent certain web server security mechanisms such as deleting .htaccess file that would deactivate those security constraints. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/50615 - https://en.0day.today/exploit/description/37177
CVE ID: CVE-2022-24249 State: PUBLISHED Published: 2022-02-04T18:20:28 Last Updated: 2024-08-03T04:07:02.329Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Null Pointer Dereference vulnerability exists in GPAC 1.1.0 via the xtra_box_write function in /box_code_base.c, which causes a Denial of Service. This vulnerability was fixed in commit 71f9871. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gpac/gpac/issues/2081
CVE ID: CVE-2022-24251 State: PUBLISHED Published: 2022-03-01T23:00:09 Last Updated: 2024-08-03T04:07:02.360Z Vendors: n/a Products: n/a Problem Types: n/a Description: Extensis Portfolio v4.0 was discovered to contain an authenticated unrestricted file upload vulnerability via the Catalog Asset Upload function. Additional Analyst Notes: - CVE Program Container: References: - http://extensis.com - http://portfolio.com - https://www.whiteoaksecurity.com/blog/extensis-portfolio-vulnerability-disclosure/
CVE ID: CVE-2022-24252 State: PUBLISHED Published: 2022-03-01T23:00:15 Last Updated: 2024-08-03T04:07:02.340Z Vendors: n/a Products: n/a Problem Types: n/a Description: An unrestricted file upload vulnerability in the FileTransferServlet component of Extensis Portfolio v4.0 allows remote attackers to execute arbitrary code via a crafted file. Additional Analyst Notes: - CVE Program Container: References: - http://extensis.com - http://portfolio.com - https://www.whiteoaksecurity.com/blog/extensis-portfolio-vulnerability-disclosure/
CVE ID: CVE-2022-24253 State: PUBLISHED Published: 2022-03-01T23:00:21 Last Updated: 2024-08-03T04:07:02.369Z Vendors: n/a Products: n/a Problem Types: n/a Description: Extensis Portfolio v4.0 was discovered to contain an authenticated unrestricted file upload vulnerability via the component AdminFileTransferServlet. Additional Analyst Notes: - CVE Program Container: References: - http://extensis.com - http://portfolio.com - https://www.whiteoaksecurity.com/blog/extensis-portfolio-vulnerability-disclosure/