Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-48299 State: PUBLISHED Published: 2023-02-09T00:00:00.000Z Last Updated: 2025-03-25T13:41:06.566Z Vendors: Huawei Products: HarmonyOS, EMUI Problem Types: Improper authentification vulnerability Description: The WMS module lacks the authentication mechanism in some APIs. Successful exploitation of this vulnerability may affect data confidentiality. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://device.harmonyos.com/en/docs/security/update/security-bulletins-202302-0000001454769474 - https://consumer.huawei.com/en/support/bulletin/2023/2/
CVE ID: CVE-2022-48300 State: PUBLISHED Published: 2023-02-09T00:00:00.000Z Last Updated: 2025-03-24T20:37:02.909Z Vendors: Huawei Products: HarmonyOS, EMUI Problem Types: Improper authentification vulnerability Description: The WMS module lacks the authentication mechanism in some APIs. Successful exploitation of this vulnerability may affect data confidentiality. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://device.harmonyos.com/en/docs/security/update/security-bulletins-202302-0000001454769474 - https://consumer.huawei.com/en/support/bulletin/2023/2/
CVE ID: CVE-2022-48301 State: PUBLISHED Published: 2023-02-09T00:00:00.000Z Last Updated: 2025-03-24T20:36:02.740Z Vendors: Huawei Products: HarmonyOS, EMUI Problem Types: Improper authentification vulnerability Description: The bundle management module lacks permission verification in some APIs. Successful exploitation of this vulnerability may restore the pre-installed apps that have been uninstalled. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://device.harmonyos.com/en/docs/security/update/security-bulletins-202302-0000001454769474 - https://consumer.huawei.com/en/support/bulletin/2023/2/
CVE ID: CVE-2022-48302 State: PUBLISHED Published: 2023-02-09T00:00:00.000Z Last Updated: 2025-03-24T20:34:24.881Z Vendors: Huawei Products: HarmonyOS, EMUI Problem Types: Improper authentification vulnerability Description: The AMS module has a vulnerability of lacking permission verification in APIs.Successful exploitation of this vulnerability may affect data confidentiality. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://device.harmonyos.com/en/docs/security/update/security-bulletins-202302-0000001454769474 - https://consumer.huawei.com/en/support/bulletin/2023/2/
CVE ID: CVE-2022-48303 State: PUBLISHED Published: 2023-01-30T00:00:00.000Z Last Updated: 2025-03-27T20:35:03.448Z Vendors: n/a Products: n/a Problem Types: n/a Description: GNU Tar through 1.34 has a one-byte out-of-bounds read that results in use of uninitialized memory for a conditional jump. Exploitation to change the flow of control has not been demonstrated. The issue occurs in from_header in list.c via a V7 archive in which mtime has approximately 11 whitespace characters. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://savannah.gnu.org/bugs/?62387 - https://savannah.gnu.org/patch/?10307 - https://lists.fedoraproject.org/archives/list/
://savannah.gnu.org/bugs/?62387 - https://savannah.gnu.org/patch/?10307 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CRY7VEL4AIG3GLIEVCTOXRZNSVYDYYUD/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X5VQYCO52Z7GAVCLRYUITN7KXHLRZQS4/
CVE ID: CVE-2022-48305 State: PUBLISHED Published: 2023-02-27T00:00:00.000Z Last Updated: 2025-03-11T17:43:08.581Z Vendors: n/a Products: Simba-AL00 Problem Types: Identity Authentication Bypass Description: There is an identity authentication bypass vulnerability in Huawei Children Smart Watch (Simba-AL00) 1.1.1.274. Successful exploitation of this vulnerability may cause the access control function of specific applications to fail. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.huawei.com/en/psirt/security-advisories/2023/huawei-sa-iabvithcswsa-c385b2dc-en
CVE ID: CVE-2022-48306 State: PUBLISHED Published: 2023-02-16T00:00:00.000Z Last Updated: 2025-03-18T15:08:04.732Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N) Vendors: Palantir Products: Palantir Gotham Chat IRC helper Problem Types: CWE-297 Description: Improper Validation of Certificate with Host Mismatch vulnerability in Gotham Chat IRC helper of Palantir Gotham allows A malicious attacker in a privileged network position could abuse this to perform a man-in-the-middle attack. A successful man-in-the-middle attack would allow them to intercept, read, or modify network communications to and from the affected service. This issue affects: Palantir Palantir Gotham
t, read, or modify network communications to and from the affected service. This issue affects: Palantir Palantir Gotham Chat IRC helper versions prior to 30221005.210011.9242. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/palantir/security-bulletins/blob/main/PLTRSEC-2022-09.md
CVE ID: CVE-2022-48307 State: PUBLISHED Published: 2023-02-16T00:00:00.000Z Last Updated: 2025-03-18T15:05:06.264Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N) Vendors: Palantir Products: Foundry Magritte Problem Types: CWE-297 Description: It was discovered that the Magritte-ftp was not verifying hostnames in TLS certificates due to a misuse of the javax.net.ssl.SSLSocketFactory API. A malicious attacker in a privileged network position could abuse this to perform a man-in-the-middle attack. A successful man-in-the-middle attack would allow them to intercept, read, or modify network communications to and from the affected service. In the case of a successful man
to intercept, read, or modify network communications to and from the affected service. In the case of a successful man in the middle attack on magritte-ftp, an attacker would be able to read and modify network traffic such as authentication tokens or raw data entering a Palantir Foundry stack. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/palantir/security-bulletins/blob/main/PLTRSEC-2022-13.md
CVE ID: CVE-2022-48308 State: PUBLISHED Published: 2023-02-16T00:00:00.000Z Last Updated: 2025-03-18T15:04:29.968Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N) Vendors: Palantir Products: sls-logging Problem Types: CWE-297 Description: It was discovered that the sls-logging was not verifying hostnames in TLS certificates due to a misuse of the javax.net.ssl.SSLSocketFactory API. A malicious attacker in a privileged network position could abuse this to perform a man-in-the-middle attack. A successful man-in-the-middle attack would allow them to intercept, read, or modify network communications to and from the affected service. Additional Analyst Notes: - CVE Progra
tercept, read, or modify network communications to and from the affected service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/palantir/security-bulletins/blob/main/PLTRSEC-2022-14.md
CVE ID: CVE-2022-48309 State: PUBLISHED Published: 2023-03-01T00:00:00.000Z Last Updated: 2025-03-07T20:42:23.646Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: Sophos Products: Sophos Connect Client Problem Types: n/a Description: A CSRF vulnerability allows malicious websites to retrieve logs and technical support archives in Sophos Connect versions older than 2.2.90. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.sophos.com/en-us/security-advisories/sophos-sa-20230301-scc-csrf
CVE ID: CVE-2022-48310 State: PUBLISHED Published: 2023-03-01T00:00:00.000Z Last Updated: 2025-03-07T20:41:57.054Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Sophos Products: Sophos Connect Client Problem Types: n/a Description: An information disclosure vulnerability allows sensitive key material to be included in technical support archives in Sophos Connect versions older than 2.2.90. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.sophos.com/en-us/security-advisories/sophos-sa-20230301-scc-csrf
CVE ID: CVE-2022-48311 State: PUBLISHED Published: 2023-02-06T00:00:00.000Z Last Updated: 2025-03-26T13:37:47.686Z Vendors: n/a Products: n/a Problem Types: n/a Description: **UNSUPPORTED WHEN ASSIGNED** Cross Site Scripting (XSS) in HP Deskjet 2540 series printer Firmware Version CEP1FN1418BR and Product Model Number A9U23B allows authenticated attacker to inject their own script into the page via HTTP configuration page. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/swzhouu/CVE-2022-48311
CVE ID: CVE-2022-48312 State: PUBLISHED Published: 2023-04-16T06:01:46.922Z Last Updated: 2025-02-06T17:02:53.520Z Vendors: Huawei Products: HarmonyOS, EMUI Problem Types: out-of-bounds read/write vulnerability Description: The HwPCAssistant module has the out-of-bounds read/write vulnerability. Successful exploitation of this vulnerability may affect confidentiality and integrity. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://consumer.huawei.com/en/support/bulletin/2023/4/ - https://device.harmonyos.com/en/docs/security/update/security-bulletins-202304-0000001506528486
CVE ID: CVE-2022-48313 State: PUBLISHED Published: 2023-04-16T07:07:28.234Z Last Updated: 2025-02-06T16:32:45.227Z Vendors: Huawei Products: HarmonyOS, EMUI Problem Types: Business Logic Errors Description: The Bluetooth module has a vulnerability of bypassing the user confirmation in the pairing process. Successful exploitation of this vulnerability may affect confidentiality. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://consumer.huawei.com/en/support/bulletin/2023/4/ - https://device.harmonyos.com/en/docs/security/update/security-bulletins-202304-0000001506528486
CVE ID: CVE-2022-48314 State: PUBLISHED Published: 2023-04-16T07:11:54.749Z Last Updated: 2025-02-06T16:54:36.615Z Vendors: Huawei Products: HarmonyOS, EMUI Problem Types: Bluetooth vulnerability confidentiality Description: The Bluetooth module has a vulnerability of bypassing the user confirmation in the pairing process. Successful exploitation of this vulnerability may affect confidentiality. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://consumer.huawei.com/en/support/bulletin/2023/4/ - https://device.harmonyos.com/en/docs/security/update/security-bulletins-202304-0000001506528486
CVE ID: CVE-2022-48317 State: PUBLISHED Published: 2023-02-20T16:55:28.000Z Last Updated: 2025-03-12T18:12:47.322Z Severity: MEDIUM (CVSS 5.6 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: Tribe29 Products: Checkmk Problem Types: CWE-613 Description: Expired sessions were not securely terminated in the RestAPI for Tribe29's Checkmk <= 2.1.0p10 and Checkmk <= 2.0.0p28 allowing an attacker to use expired session tokens when communicating with the RestAPI. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://checkmk.com/werk/14485
CVE ID: CVE-2022-48318 State: PUBLISHED Published: 2023-02-20T16:55:53.162Z Last Updated: 2025-03-12T18:12:07.460Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Tribe29 Products: Checkmk Problem Types: CWE-862 Description: No authorisation controls in the RestAPI documentation for Tribe29's Checkmk <= 2.1.0p13 and Checkmk <= 2.0.0p29 which may lead to unintended information disclosure through automatically generated user specific tags within Rest API documentation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://checkmk.com/werk/14509
CVE ID: CVE-2022-48319 State: PUBLISHED Published: 2023-02-20T16:56:18.397Z Last Updated: 2025-03-12T14:00:50.779Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: Tribe29 Products: Checkmk Problem Types: CWE-200 Description: Sensitive host secret disclosed in cmk-update-agent.log file in Tribe29's Checkmk <= 2.1.0p13, Checkmk <= 2.0.0p29, and all versions of Checkmk 1.6.0 (EOL) allows an attacker to gain access to the host secret through the unprotected agent updater log file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://checkmk.com/werk/14916
CVE ID: CVE-2022-48320 State: PUBLISHED Published: 2023-02-20T16:56:40.889Z Last Updated: 2025-03-12T18:10:01.870Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: Tribe29 Products: Checkmk Problem Types: CWE-352 Description: Cross-site Request Forgery (CSRF) in Tribe29's Checkmk <= 2.1.0p17, Checkmk <= 2.0.0p31, and all versions of Checkmk 1.6.0 (EOL) allow an attacker to add new visual elements to multiple pages. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://checkmk.com/werk/14924
CVE ID: CVE-2022-48321 State: PUBLISHED Published: 2023-02-20T16:54:44.369Z Last Updated: 2024-08-03T15:10:59.655Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L) Vendors: Tribe29 Products: Checkmk Problem Types: CWE-20 Description: Limited Server-Side Request Forgery (SSRF) in agent-receiver in Tribe29's Checkmk <= 2.1.0p11 allows an attacker to communicate with local network restricted endpoints by use of the host registration API. Additional Analyst Notes: - CVE Program Container: References: - https://checkmk.com/werk/14385 - https://www.sonarsource.com/blog/checkmk-rce-chain-1/
CVE ID: CVE-2022-48322 State: PUBLISHED Published: 2023-02-13T00:00:00.000Z Last Updated: 2025-03-21T18:32:43.215Z Vendors: n/a Products: n/a Problem Types: n/a Description: NETGEAR Nighthawk WiFi Mesh systems and routers are affected by a stack-based buffer overflow vulnerability. This affects MR60 before 1.1.7.132, MS60 before 1.1.7.132, R6900P before 1.3.3.154, R7000P before 1.3.3.154, R7960P before 1.4.4.94, and R8000P before 1.4.4.94. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://kb.netgear.com/000065265/Security-Advisory-for-Pre-authentication-Buffer-Overflow-on-Multiple-Products-PSV-2022-0155
CVE ID: CVE-2022-48323 State: PUBLISHED Published: 2023-02-13T00:00:00.000Z Last Updated: 2025-03-21T14:43:30.439Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sunlogin Sunflower Simplified (aka Sunflower Simple and Personal) 1.0.1.43315 is vulnerable to a path traversal issue. A remote and unauthenticated attacker can execute arbitrary programs on the victim host by sending a crafted HTTP request, as demonstrated by /check?cmd=ping../ followed by the pathname of the powershell.exe program. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cnvd.org.cn/flaw/show/CNVD-2022-03672 - https://github.com/projectdiscovery/nuclei-templ
ment: References: - https://www.cnvd.org.cn/flaw/show/CNVD-2022-03672 - https://github.com/projectdiscovery/nuclei-templates/blob/8500efb7c5c52261229bb87b3af8a6e4e5afc877/cnvd/2022/CNVD-2022-03672.yaml - https://asec.ahnlab.com/en/47088/
CVE ID: CVE-2022-48324 State: PUBLISHED Published: 2023-02-16T00:00:00.000Z Last Updated: 2025-03-19T14:36:12.350Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple Cross Site Scripting (XSS) vulnerabilities in Mapos 4.39.0 allow attackers to execute arbitrary code. Affects the following parameters: (1) pesquisa, (2) data, (3) data2, (4) nome, (5) descricao, (6) idDocumentos, (7) id in file application/controllers/Arquivos.php; (8) senha, (9) nomeCliente, (10) contato, (11) documento, (12) telefone, (13) celular, (14) email, (15) rua, (16) numero, (17) complemento, (18) bairro, (19) cidade, (20) estado, (21) cep, (22) idClientes, (23) id in file application/controllers/Clie
plemento, (18) bairro, (19) cidade, (20) estado, (21) cep, (22) idClientes, (23) id in file application/controllers/Clientes.php; (24) id, (25) tipo, (26) forma_pagamento, (27) gateway_de_pagamento, (28) excluir_id, (29) confirma_id, (30) cancela_id in file application/controllers/Cobrancas.php; (31) vencimento_de, (32) vencimento_ate, (33) cliente, (34) tipo, (35) status, (36) valor_desconto, (37) desconto, (38) periodo, (39) per_page, (40) urlAtual, (41) vencimento, (42) recebimento, (43) valor, (44) recebido, (45) formaPgto, (46) desconto_parc, (47) entrada, (48) qtdparcelas_parc, (49) valor_parc, (50) dia_pgto, (51) dia_base_pgto, (52) comissao, (53) descricao_parc, (54) cliente_parc, (5
elas_parc, (49) valor_parc, (50) dia_pgto, (51) dia_base_pgto, (52) comissao, (53) descricao_parc, (54) cliente_parc, (55) observacoes_parc, (56) formaPgto_parc, (57) tipo_parc, (58) pagamento, (59) pago, (60) valor_desconto_editar, (61) descricao, (62) fornecedor, (63) observacoes, (64) id in file application/controllers/Financeiro.php; (65) refGarantia, (66) textoGarantia, (67) idGarantias in file application/controllers/Garantias.php; (68) email, (69) senha in file application/controllers/Login.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gist.github.com/enferas/7c7f0a3c6cb30939d9039043c0b86ea8 - https://github.com/RamonSilva20/map
nt: References: - https://gist.github.com/enferas/7c7f0a3c6cb30939d9039043c0b86ea8 - https://github.com/RamonSilva20/mapos/issues/2010 - https://github.com/RamonSilva20/mapos/pull/2015#pullrequestreview-1271395780
CVE ID: CVE-2022-48325 State: PUBLISHED Published: 2023-02-16T00:00:00.000Z Last Updated: 2025-03-19T14:34:56.600Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple Cross Site Scripting (XSS) vulnerabilities in Mapos 4.39.0 allow attackers to execute arbitrary code. Affects the following parameters: (1) year, (2) oldSenha, (3) novaSenha, (4) termo, (5) nome, (6) cnpj, (7) ie, (8) cep, (9) logradouro, (10) numero, (11) bairro, (12) cidade, (13) uf, (14) telefone, (15) email, (16) id, (17) app_name, (18) per_page, (19) app_theme, (20) os_notification, (21) email_automatico, (22) control_estoque, (23) notifica_whats, (24) control_baixa, (25) control_editos, (26) control_edit_v
mail_automatico, (22) control_estoque, (23) notifica_whats, (24) control_baixa, (25) control_editos, (26) control_edit_vendas, (27) control_datatable, (28) pix_key, (29) os_status_list, (30) control_2vias, (31) status, (32) start, (33) end in file application/controllers/Mapos.php; (34) token, (35) senha, (36) email, (37) nomeCliente, (38) documento, (39) telefone, (40) celular, (41) rua, (42) numero, (43) complemento, (44) bairro, (45) cidade, (46) estado, (47) cep, (48) idClientes, (49) descricaoProduto, (50) defeito in file application/controllers/Mine.php; (51) pesquisa, (52) status, (53) data, (54) data2, (55) dataInicial, (56) dataFinal, (57) termoGarantia, (58) garantias_id, (59) clie
, (52) status, (53) data, (54) data2, (55) dataInicial, (56) dataFinal, (57) termoGarantia, (58) garantias_id, (59) clientes_id, (60) usuarios_id, (61) idOs, (62) garantia, (63) descricaoProduto, (64) defeito, (65) observacoes, (66) laudoTecnico, (67) id, (68) preco, (69) quantidade, (70) idProduto, (71) idOsProduto, (72) produto, (73) idServico, (74) idOsServico, (75) desconto, (76) tipoDesconto, (77) resultado, (78) vencimento, (79) recebimento, (80) os_id, (81) valor, (82) recebido, (83) formaPgto, (84) tipo, (85) anotacao, (86) idAnotacao in file application/controllers/Os.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gist.github.c
/Os.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gist.github.com/enferas/7c7f0a3c6cb30939d9039043c0b86ea8 - https://github.com/RamonSilva20/mapos/issues/2010 - https://github.com/RamonSilva20/mapos/pull/2015#pullrequestreview-1271395780
CVE ID: CVE-2022-48326 State: PUBLISHED Published: 2023-02-16T00:00:00.000Z Last Updated: 2025-03-19T14:30:18.681Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple Cross Site Scripting (XSS) vulnerabilities in Mapos 4.39.0 allow attackers to execute arbitrary code. Affects the following parameters: (1) nome, (2) aCliente, (3) eCliente, (4) dCliente, (5) vCliente, (6) aProduto, (7) eProduto, (8) dProduto, (9) vProduto, (10) aServico, (11) eServico, (12) dServico, (13) vServico, (14) aOs, (15) eOs, (16) dOs, (17) vOs, (18) aVenda, (19) eVenda, (20) dVenda, (21) vVenda, (22) aGarantia, (23) eGarantia, (24) dGarantia, (25) vGarantia, (26) aArquivo, (27) eArquivo, (28) dArquivo
(21) vVenda, (22) aGarantia, (23) eGarantia, (24) dGarantia, (25) vGarantia, (26) aArquivo, (27) eArquivo, (28) dArquivo, (29) vArquivo, (30) aPagamento, (31) ePagamento, (32) dPagamento, (33) vPagamento, (34) aLancamento, (35) eLancamento, (36) dLancamento, (37) vLancamento, (38) cUsuario, (39) cEmitente, (40) cPermissao, (41) cBackup, (42) cAuditoria, (43) cEmail, (44) cSistema, (45) rCliente, (46) rProduto, (47) rServico, (48) rOs, (49) rVenda, (50) rFinanceiro, (51) aCobranca, (52) eCobranca, (53) dCobranca, (54) vCobranca, (55) situacao, (56) idPermissao, (57) id in file application/controllers/Permissoes.php; (58) precoCompra, (59) precoVenda, (60) descricao, (61) unidade, (62) estoque
le application/controllers/Permissoes.php; (58) precoCompra, (59) precoVenda, (60) descricao, (61) unidade, (62) estoque, (63) estoqueMinimo, (64) idProdutos, (65) id, (66) estoqueAtual in file application/controllers/Produtos.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gist.github.com/enferas/7c7f0a3c6cb30939d9039043c0b86ea8 - https://github.com/RamonSilva20/mapos/issues/2010 - https://github.com/RamonSilva20/mapos/pull/2015#pullrequestreview-1271395780
CVE ID: CVE-2022-48327 State: PUBLISHED Published: 2023-02-16T00:00:00.000Z Last Updated: 2025-03-18T18:51:50.582Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple Cross Site Scripting (XSS) vulnerabilities in Mapos 4.39.0 allow attackers to execute arbitrary code. Affects the following parameters: (1) dataInicial, (2) dataFinal, (3) tipocliente, (4) format, (5) precoInicial, (6) precoFinal, (7) estoqueInicial, (8) estoqueFinal, (9) de_id, (10) ate_id, (11) clientes_id, (12) origem, (13) cliente, (14) responsavel, (15) status, (16) tipo, (17) situacao in file application/controllers/Relatorios.php; (18) preco, (19) nome, (20) descricao, (21) idServicos, (22) id in file app
file application/controllers/Relatorios.php; (18) preco, (19) nome, (20) descricao, (21) idServicos, (22) id in file application/controllers/Servicos.php; (23) senha, (24) permissoes_id, (25) idUsuarios, (26) situacao, (27) nome, (28) rg, (29) cpf, (30) cep, (31) rua, (32) numero, (33) bairro, (34) cidade, (35) estado, (36) email, (37) telefone, (38) celular in file application/controllers/Usuarios.php; (39) dataVenda, (40) observacoes, (41) observacoes_cliente, (42) clientes_id, (43) usuarios_id, (44) idVendas, (45) id, (46) idVendasProduto, (47) preco, (48) quantidade, (49) idProduto, (50) produto, (51) desconto, (52) tipoDesconto, (53) resultado, (54) vendas_id, (55) vencimento, (56) rece
9) idProduto, (50) produto, (51) desconto, (52) tipoDesconto, (53) resultado, (54) vendas_id, (55) vencimento, (56) recebimento, (57) valor, (58) recebido, (59) formaPgto, (60) tipo in file application/controllers/Vendas.php; (61) situacao, (62) periodo, (63) vencimento_de, (64) vencimento_ate, (65) tipo, (66) status, (67) cliente in file application/views/financeiro/lancamentos.php; (68) year in file application/views/mapos/painel.php; (69) pesquisa in file application/views/os/os.php; (70) etiquetaCode in file application/views/relatorios/imprimir/imprimirEtiquetas.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gist.github.com/enferas