Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-39953 State: PUBLISHED Published: 2023-03-07T16:04:40.876Z Last Updated: 2024-10-23T14:31:37.161Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:H/RL:U/RC:C) Vendors: Fortinet Products: FortiNAC Problem Types: CWE-269 Description: A improper privilege management in Fortinet FortiNAC version 9.4.0 through 9.4.1, FortiNAC version 9.2.0 through 9.2.6, FortiNAC version 9.1.0 through 9.1.8, FortiNAC all versions 8.8, FortiNAC all versions 8.7, FortiNAC all versions 8.6, FortiNAC all versions 8.5, FortiNAC version 8.3.7 allows attacker to escalation of privilege via specially crafted commands. Additional Analyst Notes: - CVE Program Container: - CISA ADP V
escalation of privilege via specially crafted commands. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-22-309
CVE ID: CVE-2022-39954 State: PUBLISHED Published: 2023-02-16T18:06:50.083Z Last Updated: 2024-10-23T14:45:55.394Z Severity: MEDIUM (CVSS 6.9 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:U/RC:C) Vendors: Fortinet Products: FortiNAC Problem Types: CWE-611 Description: An improper restriction of xml external entity reference in Fortinet FortiNAC version 9.4.0 through 9.4.1, FortiNAC version 9.2.0 through 9.2.7, FortiNAC version 9.1.0 through 9.1.8, FortiNAC version 8.8.0 through 8.8.11, FortiNAC version 8.7.0 through 8.7.6, FortiNAC version 8.6.0 through 8.6.5, FortiNAC version 8.5.0 through 8.5.4, FortiNAC version 8.3.7 allows attacker to read arbitrary files or trigger a denial of ser
C version 8.5.0 through 8.5.4, FortiNAC version 8.3.7 allows attacker to read arbitrary files or trigger a denial of service via specifically crafted XML documents. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-22-304
CVE ID: CVE-2022-39955 State: PUBLISHED Published: 2022-09-20T00:00:00.000Z Last Updated: 2025-11-03T19:27:28.861Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: OWASP Products: ModSecurity Core Rule Set Problem Types: CWE-863 Description: The OWASP ModSecurity Core Rule Set (CRS) is affected by a partial rule set bypass by submitting a specially crafted HTTP Content-Type header field that indicates multiple character encoding schemes. A vulnerable back-end can potentially be exploited by declaring multiple Content-Type "charset" names and therefore bypassing the configurable CRS Content-Type header "charset" allow list. An encoded payload can bypass CRS dete
herefore bypassing the configurable CRS Content-Type header "charset" allow list. An encoded payload can bypass CRS detection this way and may then be decoded by the backend. The legacy CRS versions 3.0.x and 3.1.x are affected, as well as the currently supported versions 3.2.1 and 3.3.2. Integrators and users are advised to upgrade to 3.2.2 and 3.3.3 respectively. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://coreruleset.org/20220919/crs-version-3-3-3-and-3-2-2-covering-several-cves/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PD56EAYNGB6E6QQH62LAYCONOP6OH5DZ/ - https://lists.fedorapro
ives/list/package-announce%40lists.fedoraproject.org/message/PD56EAYNGB6E6QQH62LAYCONOP6OH5DZ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YPQ6CCMX3MU4A7MTCGQJA7VMJW3IQDXV/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HL2L2GF7GOCWPMJZDUE5OXDSXHGG3XUJ/ - https://lists.debian.org/debian-lts-announce/2023/01/msg00033.html - https://security.gentoo.org/glsa/202305-25
CVE ID: CVE-2022-39956 State: PUBLISHED Published: 2022-09-20T00:00:00.000Z Last Updated: 2025-11-03T19:27:30.250Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: OWASP Products: ModSecurity Core Rule Set Problem Types: CWE-863 Description: The OWASP ModSecurity Core Rule Set (CRS) is affected by a partial rule set bypass for HTTP multipart requests by submitting a payload that uses a character encoding scheme via the Content-Type or the deprecated Content-Transfer-Encoding multipart MIME header fields that will not be decoded and inspected by the web application firewall engine and the rule set. The multipart payload will therefore bypass detection. A vulnera
y the web application firewall engine and the rule set. The multipart payload will therefore bypass detection. A vulnerable backend that supports these encoding schemes can potentially be exploited. The legacy CRS versions 3.0.x and 3.1.x are affected, as well as the currently supported versions 3.2.1 and 3.3.2. Integrators and users are advised upgrade to 3.2.2 and 3.3.3 respectively. The mitigation against these vulnerabilities depends on the installation of the latest ModSecurity version (v2.9.6 / v3.0.8). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://coreruleset.org/20220919/crs-version-3-3-3-and-3-2-2-covering-several-cves/ - https://l
nrichment: References: - https://coreruleset.org/20220919/crs-version-3-3-3-and-3-2-2-covering-several-cves/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PD56EAYNGB6E6QQH62LAYCONOP6OH5DZ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YPQ6CCMX3MU4A7MTCGQJA7VMJW3IQDXV/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HL2L2GF7GOCWPMJZDUE5OXDSXHGG3XUJ/ - https://lists.debian.org/debian-lts-announce/2023/01/msg00033.html - https://security.gentoo.org/glsa/202305-25
CVE ID: CVE-2022-39957 State: PUBLISHED Published: 2022-09-20T00:00:00.000Z Last Updated: 2025-11-03T19:27:31.661Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: OWASP Products: ModSecurity Core Rule Set Problem Types: CWE-693 Description: The OWASP ModSecurity Core Rule Set (CRS) is affected by a response body bypass. A client can issue an HTTP Accept header field containing an optional "charset" parameter in order to receive the response in an encoded form. Depending on the "charset", this response can not be decoded by the web application firewall. A restricted resource, access to which would ordinarily be detected, may therefore bypass detection. The lega
firewall. A restricted resource, access to which would ordinarily be detected, may therefore bypass detection. The legacy CRS versions 3.0.x and 3.1.x are affected, as well as the currently supported versions 3.2.1 and 3.3.2. Integrators and users are advised to upgrade to 3.2.2 and 3.3.3 respectively. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://coreruleset.org/20220919/crs-version-3-3-3-and-3-2-2-covering-several-cves/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PD56EAYNGB6E6QQH62LAYCONOP6OH5DZ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.o
56EAYNGB6E6QQH62LAYCONOP6OH5DZ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YPQ6CCMX3MU4A7MTCGQJA7VMJW3IQDXV/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HL2L2GF7GOCWPMJZDUE5OXDSXHGG3XUJ/ - https://lists.debian.org/debian-lts-announce/2023/01/msg00033.html - https://security.gentoo.org/glsa/202305-25
CVE ID: CVE-2022-39958 State: PUBLISHED Published: 2022-09-20T00:00:00.000Z Last Updated: 2025-11-03T19:27:33.077Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: OWASP Products: ModSecurity Core Rule Set Problem Types: CWE-863 Description: The OWASP ModSecurity Core Rule Set (CRS) is affected by a response body bypass to sequentially exfiltrate small and undetectable sections of data by repeatedly submitting an HTTP Range header field with a small byte range. A restricted resource, access to which would ordinarily be detected, may be exfiltrated from the backend, despite being protected by a web application firewall that uses CRS. Short subsections of a restr
ated from the backend, despite being protected by a web application firewall that uses CRS. Short subsections of a restricted resource may bypass pattern matching techniques and allow undetected access. The legacy CRS versions 3.0.x and 3.1.x are affected, as well as the currently supported versions 3.2.1 and 3.3.2. Integrators and users are advised to upgrade to 3.2.2 and 3.3.3 respectively and to configure a CRS paranoia level of 3 or higher. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://coreruleset.org/20220919/crs-version-3-3-3-and-3-2-2-covering-several-cves/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedo
ion-3-3-3-and-3-2-2-covering-several-cves/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PD56EAYNGB6E6QQH62LAYCONOP6OH5DZ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YPQ6CCMX3MU4A7MTCGQJA7VMJW3IQDXV/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HL2L2GF7GOCWPMJZDUE5OXDSXHGG3XUJ/ - https://lists.debian.org/debian-lts-announce/2023/01/msg00033.html - https://security.gentoo.org/glsa/202305-25
CVE ID: CVE-2022-39959 State: PUBLISHED Published: 2022-10-07T00:00:00 Last Updated: 2024-08-03T12:07:42.948Z Vendors: n/a Products: n/a Problem Types: n/a Description: Panini Everest Engine 2.0.4 allows unprivileged users to create a file named Everest.exe in the %PROGRAMDATA%\Panini folder. This leads to privilege escalation because a service, running as SYSTEM, uses the unquoted path of %PROGRAMDATA%\Panini\Everest Engine\EverestEngine.exe and therefore a Trojan horse %PROGRAMDATA%\Panini\Everest.exe may be executed instead of the intended vendor-supplied EverestEngine.exe file. Additional Analyst Notes: - CVE Program Container: References: - https://www.panini.com/en/news-events/panini-p
xe file. Additional Analyst Notes: - CVE Program Container: References: - https://www.panini.com/en/news-events/panini-patents-revolutionary-new-%E2%80%9Ceverest%E2%80%9D-architecture - https://github.com/usmarine2141/CVE-2022-39959
CVE ID: CVE-2022-39960 State: PUBLISHED Published: 2022-09-17T17:49:35 Last Updated: 2024-08-03T12:07:43.012Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Netic Group Export add-on before 1.0.3 for Atlassian Jira does not perform authorization checks. This might allow an unauthenticated user to export all groups from the Jira instance by making a groupexport_download=true request to a plugins/servlet/groupexportforjira/admin/ URI. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/CveCt0r/ca8c6e46f536e9ae69fc6061f132463e - https://marketplace.atlassian.com/apps/1222388/group-export-for-jira/version-history
CVE ID: CVE-2022-39974 State: PUBLISHED Published: 2022-09-20T17:12:48.000Z Last Updated: 2025-05-28T18:50:00.544Z Vendors: n/a Products: n/a Problem Types: n/a Description: WASM3 v0.5.0 was discovered to contain a segmentation fault via the component op_Select_i32_srs in wasm3/source/m3_exec.h. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/wasm3/wasm3/issues/379
CVE ID: CVE-2022-39975 State: PUBLISHED Published: 2022-09-21T23:35:57.000Z Last Updated: 2025-05-27T18:56:16.035Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Layout module in Liferay Portal v7.3.3 through v7.4.3.34, and Liferay DXP 7.3 before update 10, and 7.4 before update 35 does not check user permission before showing the preview of a "Content Page" type page, allowing attackers to view unpublished "Content Page" pages via URL manipulation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://liferay.com - https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-39975
CVE ID: CVE-2022-39976 State: PUBLISHED Published: 2022-10-27T00:00:00.000Z Last Updated: 2025-05-07T16:24:28.583Z Vendors: n/a Products: n/a Problem Types: n/a Description: School Activity Updates with SMS Notification v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /modules/announcement/index.php?view=edit&id=. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/z1pwn/bug_report/blob/main/vendors/janobe/school-activity-updates-sms-notification/SQLi-1.md
CVE ID: CVE-2022-39977 State: PUBLISHED Published: 2022-10-27T00:00:00.000Z Last Updated: 2025-05-07T16:23:51.517Z Vendors: n/a Products: n/a Problem Types: n/a Description: Online Pet Shop We App v1.0 was discovered to contain an arbitrary file upload vulnerability via the Editing function in the User module. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file uploaded through the picture upload point. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/z1pwn/bug_report/blob/main/vendors/oretnom23/online-pet-shop-we-app/RCE-2.md
CVE ID: CVE-2022-39978 State: PUBLISHED Published: 2022-10-27T00:00:00.000Z Last Updated: 2025-05-07T16:23:07.418Z Vendors: n/a Products: n/a Problem Types: n/a Description: Online Pet Shop We App v1.0 was discovered to contain an arbitrary file upload vulnerability via the Editing function in the Product List module. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file uploaded through the picture upload point. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/z1pwn/bug_report/blob/main/vendors/oretnom23/online-pet-shop-we-app/RCE-1.md
CVE ID: CVE-2022-39983 State: PUBLISHED Published: 2023-02-22T00:00:00.000Z Last Updated: 2025-07-17T15:29:25.929Z Vendors: n/a Products: n/a Problem Types: n/a Description: File upload vulnerability in Pro Gamma Instant Developer RD3 22.5 r23, r30, and possibly earlier versions, allows attackers to execute arbitrary code. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.swascan.com/it/vulnerability-report-instant-developer/ - https://www.tinextacyber.com/security-advisory-instant-developer-rd3-cve-2022-39983/ - https://github.com/edi-marc/Vulnerability_List/tree/main/Update_Variant_of_CVE-2022-39983 - https://www.instantdeveloper.com/en
CVE ID: CVE-2022-39986 State: PUBLISHED Published: 2023-08-01T00:00:00 Last Updated: 2024-10-21T14:32:09.094Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Command injection vulnerability in RaspAP 2.8.0 thru 2.8.7 allows unauthenticated attackers to execute arbitrary commands via the cfg_id parameter in /ajax/openvpn/activate_ovpncfg.php and /ajax/openvpn/del_ovpncfg.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/RaspAP/raspap-webgui/blob/master/ajax/openvpn/activate_ovpncfg.php - https://medium.com/%40ismael0x00/multiple-vulnerabilities-in-raspap-3c35e78809f2 - http://packetstormsecurity.com/files/174190/Rasp
ium.com/%40ismael0x00/multiple-vulnerabilities-in-raspap-3c35e78809f2 - http://packetstormsecurity.com/files/174190/RaspAP-2.8.7-Unauthenticated-Command-Injection.html
CVE ID: CVE-2022-39987 State: PUBLISHED Published: 2023-08-01T00:00:00 Last Updated: 2024-10-21T13:51:48.803Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Command injection vulnerability in RaspAP 2.8.0 thru 2.9.2 allows an authenticated attacker to execute arbitrary OS commands as root via the "entity" POST parameters in /ajax/networking/get_wgkey.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/RaspAP/raspap-webgui/blob/master/ajax/networking/get_wgkey.php - https://medium.com/%40ismael0x00/multiple-vulnerabilities-in-raspap-3c35e78809f2
CVE ID: CVE-2022-39988 State: PUBLISHED Published: 2022-10-06T00:00:00 Last Updated: 2024-08-03T12:07:43.027Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in Centreon 22.04.0 allows attackers to execute arbitrary web script or HTML via a crafted payload injected into the Service>Templates service_alias parameter. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/168585/Centreon-22.04.0-Cross-Site-Scripting.html
CVE ID: CVE-2022-39989 State: PUBLISHED Published: 2023-04-26T00:00:00.000Z Last Updated: 2025-02-03T17:48:59.848Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Fighting Cock Information System 1.0, which uses default credentials, but does not force nor prompt the administrators to change the credentials. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.sourcecodester.com/php/12824/fighting-cock-information-system.html - https://gist.github.com/0xHop/6ed962a1978edb1bd620c9c487400403 - https://gist.github.com/0xHop/43c4da65e0d101328a46b1bd5a11b262
CVE ID: CVE-2022-39996 State: PUBLISHED Published: 2024-08-27T00:00:00 Last Updated: 2024-08-28T13:36:11.733Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in Teldats Router RS123, RS123w allows attacker to execute arbitrary code via the cmdcookie parameter to the upgrade/query.php page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/uyhacked/Teldat-s-Router/blob/main/Teldat - https://github.com/uyhacked/Teldat-s-Router/blob/main/Teldat%27s%20Router%20Vulnerability.md
CVE ID: CVE-2022-39997 State: PUBLISHED Published: 2024-08-27T00:00:00 Last Updated: 2024-08-28T13:37:25.159Z Vendors: n/a Products: n/a Problem Types: n/a Description: A weak password requirement issue was discovered in Teldats Router RS123, RS123w allows a remote attacker to escalate privileges Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/uyhacked/Teldat-s-Router/blob/main/Teldat - https://github.com/uyhacked/Teldat-s-Router/blob/main/Teldat%27s%20Router%20Vulnerability.md
CVE ID: CVE-2022-3000 State: PUBLISHED Published: 2022-09-20T07:10:09.000Z Last Updated: 2025-05-29T13:39:36.316Z Severity: MEDIUM (CVSS 6.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: yetiforcecompany Products: yetiforcecompany/yetiforcecrm Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/a060d3dd-6fdd-4958-82a9-364df1cb770c - https://github.com/yetiforcecompany/yetiforcecrm/commit/eebc12601495ada38495076bec12841b2477516b
CVE ID: CVE-2022-3001 State: PUBLISHED Published: 2022-09-15T14:38:17.410931Z Last Updated: 2024-09-16T17:47:40.718Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Milesight Products: Video Management Systems Problem Types: CWE-20 Description: This vulnerability exists in Milesight Video Management Systems (VMS), all firmware versions prior to 40.7.0.79-r1, due to improper input handling at camera’s web-based management interface. A remote attacker could exploit this vulnerability by sending a specially crafted http request on the targeted network camera. Successful exploitation of this vulnerability could allow the attacker to cause a Denial of Service condi
etwork camera. Successful exploitation of this vulnerability could allow the attacker to cause a Denial of Service condition on the targeted device. Additional Analyst Notes: - CVE Program Container: References: - https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2022-0352
CVE ID: CVE-2022-3002 State: PUBLISHED Published: 2022-10-06T00:00:00 Last Updated: 2024-08-03T00:52:59.883Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: yetiforcecompany Products: yetiforcecompany/yetiforcecrm Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/d213d7ea-fe92-40b2-a1f9-2ba32dec50f5 - https://github.com/yetiforcecompany/yetiforcecrm/commit/54728becfdad9b6e686bbe336007cba2ce518248
CVE ID: CVE-2022-3004 State: PUBLISHED Published: 2022-09-20T09:40:09.000Z Last Updated: 2025-05-27T18:06:01.242Z Severity: MEDIUM (CVSS 6.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: yetiforcecompany Products: yetiforcecompany/yetiforcecrm Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/461e5f8f-17cf-4be4-9149-111d0bd92d14 - https://github.com/yetiforcecompany/yetiforcecrm/commit/cd82ecce44d83f1f6c10c7766bf36f3026de024a
CVE ID: CVE-2022-3005 State: PUBLISHED Published: 2022-09-20T10:15:26.000Z Last Updated: 2025-05-27T18:06:43.368Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: yetiforcecompany Products: yetiforcecompany/yetiforcecrm Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/4b144433-a979-4c4e-a627-659838acc217 - https://github.com/yetiforcecompany/yetiforcecrm/commit/e55886781509fe39951fc7528347696474a17884
CVE ID: CVE-2022-3007 State: PUBLISHED Published: 2023-10-31T11:18:23.411Z Last Updated: 2024-08-03T00:53:00.582Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) Vendors: Syska Led Lights Pvt Ltd Products: Syska SW100 Smartwatch Problem Types: CWE-862 Description: The vulnerability exists in Syska SW100 Smartwatch due to an improper implementation and/or configuration of Nordic Device Firmware Update (DFU) which is used for performing Over-The-Air (OTA) firmware updates on the Bluetooth Low Energy (BLE) devices. An unauthenticated attacker could exploit this vulnerability by setting arbitrary values to handle on the vulnerable device over Bluetooth. Successful exploita
it this vulnerability by setting arbitrary values to handle on the vulnerable device over Bluetooth. Successful exploitation of this vulnerability could allow the attacker to perform firmware update, device reboot or data manipulation on the target device. Additional Analyst Notes: - CVE Program Container: References: - https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2023-0333
CVE ID: CVE-2022-3008 State: PUBLISHED Published: 2022-09-05T09:10:11.000Z Last Updated: 2025-04-21T13:50:13.934Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H) Vendors: syoyo Products: tinygltf Problem Types: CWE-78 Description: The tinygltf library uses the C library function wordexp() to perform file path expansion on untrusted paths that are provided from the input file. This function allows for command injection by using backticks. An attacker could craft an untrusted path input that would result in a path expansion. We recommend upgrading to 2.6.0 or past commit 52ff00a38447f06a17eab1caa2cf0730a119c751 Additional Analyst Notes: - CVE Program Container: - CISA AD
6.0 or past commit 52ff00a38447f06a17eab1caa2cf0730a119c751 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/syoyo/tinygltf/commit/52ff00a38447f06a17eab1caa2cf0730a119c751 - https://github.com/syoyo/tinygltf/issues/368 - https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49053 - https://github.com/syoyo/tinygltf/blob/master/README.md - https://www.debian.org/security/2022/dsa-5232