Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
cs/security/update/security-bulletins-phones-202209-0000001392278845 - https://consumer.huawei.com/en/support/bulletin/2022/9/
CVE ID: CVE-2022-39009 State: PUBLISHED Published: 2022-09-16T17:57:50.000Z Last Updated: 2025-06-03T14:33:53.390Z Vendors: Huawei Products: HarmonyOS, EMUI Problem Types: Permission verification vulnerability Description: The WLAN module has a vulnerability in permission verification. Successful exploitation of this vulnerability may cause third-party apps to affect WLAN functions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202209-0000001392278845 - https://consumer.huawei.com/en/support/bulletin/2022/9/
CVE ID: CVE-2022-39010 State: PUBLISHED Published: 2022-09-16T17:57:54 Last Updated: 2024-08-03T11:10:32.247Z Vendors: Huawei Products: HarmonyOS, EMUI Problem Types: Permission control vulnerability Description: The HwChrService module has a vulnerability in permission control. Successful exploitation of this vulnerability may cause disclosure of user network information. Additional Analyst Notes: - CVE Program Container: References: - https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202209-0000001392278845 - https://consumer.huawei.com/en/support/bulletin/2022/9/
CVE ID: CVE-2022-39011 State: PUBLISHED Published: 2022-10-14T00:00:00.000Z Last Updated: 2025-05-15T14:36:25.201Z Vendors: Huawei Products: HarmonyOS, EMUI Problem Types: Unauthorized access vulnerability Description: The HISP module has a vulnerability of bypassing the check of the data transferred in the kernel space.Successful exploitation of this vulnerability may cause unauthorized access to the HISP module. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://consumer.huawei.com/en/support/bulletin/2022/10/ - https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202210-0000001416095697
CVE ID: CVE-2022-39012 State: PUBLISHED Published: 2022-12-28T00:00:00.000Z Last Updated: 2025-04-11T16:13:20.378Z Vendors: Huawei Products: Aslan-AL10 Problem Types: Improper Input Description: Huawei Aslan Children's Watch has an improper input validation vulnerability. Successful exploitation may cause the watch's application service abnormal. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.huawei.com/en/psirt/security-advisories/2022/huawei-sa-iivviahcw-5fb2d55c-en
CVE ID: CVE-2022-39013 State: PUBLISHED Published: 2022-10-11T00:00:00 Last Updated: 2024-08-03T11:10:32.325Z Vendors: SAP SE Products: SAP BusinessObjects Business Intelligence Platform (Program Objects) Problem Types: CWE-200 Description: Under certain conditions an authenticated attacker can get access to OS credentials. Getting access to OS credentials enables the attacker to modify system data and make the system unavailable leading to high impact on confidentiality and low impact on integrity and availability of the application. Additional Analyst Notes: - CVE Program Container: References: - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html - https://laun
Container: References: - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html - https://launchpad.support.sap.com/#/notes/3229132
CVE ID: CVE-2022-39014 State: PUBLISHED Published: 2022-09-13T15:43:47 Last Updated: 2024-08-03T11:10:32.320Z Vendors: SAP SE Products: SAP BusinessObjects Business Intelligence Platform (CMC) Problem Types: CWE-311 Description: Under certain conditions SAP BusinessObjects Business Intelligence Platform Central Management Console (CMC) - version 430, allows an attacker to access certain unencrypted sensitive parameters which would otherwise be restricted. Additional Analyst Notes: - CVE Program Container: References: - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html - https://launchpad.support.sap.com/#/notes/3217303
CVE ID: CVE-2022-39015 State: PUBLISHED Published: 2022-10-11T00:00:00 Last Updated: 2024-08-03T11:10:32.374Z Vendors: SAP SE Products: SAP BusinessObjects Business Intelligence Platform (AdminTools/Query Builder) Problem Types: CWE-668 Description: Under certain conditions, BOE AdminTools/ BOE SDK allows an attacker to access information which would otherwise be restricted. Additional Analyst Notes: - CVE Program Container: References: - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html - https://launchpad.support.sap.com/#/notes/3239293
CVE ID: CVE-2022-39016 State: PUBLISHED Published: 2022-10-31T20:06:26.219Z Last Updated: 2025-05-06T19:20:26.357Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L) Vendors: M-Files Products: Hubshare Problem Types: CWE-20, CWE-79 Description: Javascript injection in PDFtron in M-Files Hubshare before 3.3.10.9 allows authenticated attackers to perform an account takeover via a crafted PDF upload. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.themissinglink.com.au/security-advisories/cve-2022-39016
CVE ID: CVE-2022-39017 State: PUBLISHED Published: 2022-10-31T20:07:26.779Z Last Updated: 2025-05-02T19:46:52.204Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L) Vendors: M-Files Products: Hubshare Problem Types: CWE-20, CWE-79 Description: Improper input validation and output encoding in all comments fields, in M-Files Hubshare before 3.3.10.9 allows authenticated attackers to introduce cross-site scripting attacks via specially crafted comments. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.themissinglink.com.au/security-advisories/cve-2022-39017
CVE ID: CVE-2022-39018 State: PUBLISHED Published: 2022-10-31T20:09:57.134Z Last Updated: 2025-05-02T17:46:24.638Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L) Vendors: M-Files Products: Hubshare Problem Types: CWE-200, CWE-639, CWE-287 Description: Broken access controls on PDFtron data in M-Files Hubshare before 3.3.11.3 allows unauthenticated attackers to access restricted PDF files via a known URL. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.themissinglink.com.au/security-advisories/cve-2022-39018
CVE ID: CVE-2022-39019 State: PUBLISHED Published: 2022-10-31T20:09:40.656Z Last Updated: 2025-05-02T19:40:06.297Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: M-Files Products: Hubshare Problem Types: CWE-287, CWE-434 Description: Broken access controls on PDFtron WebviewerUI in M-Files Hubshare before 3.3.11.3 allows unauthenticated attackers to upload malicious files to the application server. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.themissinglink.com.au/security-advisories/cve-2022-39019
CVE ID: CVE-2022-39020 State: PUBLISHED Published: 2022-10-31T20:06:12.157Z Last Updated: 2025-05-06T19:21:01.913Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L) Vendors: Schoolbox Pty Ltd Products: Schoolbox Problem Types: CWE-79 Description: Multiple instances of XSS (stored and reflected) was found in the application. For example, features such as student assessment submission, file upload, news, ePortfolio and calendar event creation were found to be vulnerable to cross-site scripting. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.themissinglink.com.au/security-advisories/cve-2022-39020
CVE ID: CVE-2022-39021 State: PUBLISHED Published: 2022-10-31T06:40:33.606Z Last Updated: 2025-05-06T19:25:24.972Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: e-Excellence Inc. Products: U-Office Force Problem Types: CWE-601 Description: U-Office Force login function has an Open Redirect vulnerability. An unauthenticated remote attacker can exploit this vulnerability to redirect user to arbitrary website. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-6636-a35ed-1.html
CVE ID: CVE-2022-39022 State: PUBLISHED Published: 2022-10-31T06:40:34.591Z Last Updated: 2025-05-06T19:26:15.419Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: e-Excellence Inc. Products: U-Office Force Problem Types: CWE-22 Description: U-Office Force Download function has a path traversal vulnerability. A remote attacker with general user privilege can exploit this vulnerability to download arbitrary system file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-6637-eed19-1.html
CVE ID: CVE-2022-39023 State: PUBLISHED Published: 2022-10-31T06:40:35.568Z Last Updated: 2025-05-06T19:26:49.046Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: e-Excellence Inc. Products: U-Office Force Problem Types: CWE-22 Description: U-Office Force Download function has a path traversal vulnerability. A remote attacker with general user privilege can exploit this vulnerability to download arbitrary system file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-6638-08596-1.html
CVE ID: CVE-2022-39024 State: PUBLISHED Published: 2022-10-31T06:40:36.532Z Last Updated: 2025-05-06T15:39:04.832Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: e-Excellence Inc. Products: U-Office Force Problem Types: CWE-79 Description: U-Office Force Bulletin function has insufficient filtering for special characters. An unauthenticated remote attacker can exploit this vulnerability to inject JavaScript and perform XSS (Reflected Cross-Site Scripting) attack. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-6639-fad13-1.html
CVE ID: CVE-2022-39025 State: PUBLISHED Published: 2022-10-31T06:40:37.605Z Last Updated: 2025-05-06T15:38:12.934Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: e-Excellence Inc. Products: U-Office Force Problem Types: CWE-79 Description: U-Office Force PrintMessage function has insufficient filtering for special characters. An unauthenticated remote attacker can exploit this vulnerability to inject JavaScript and perform XSS (Reflected Cross-Site Scripting) attack. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-6640-e74a3-1.html
CVE ID: CVE-2022-39026 State: PUBLISHED Published: 2022-10-31T06:40:38.607Z Last Updated: 2025-05-06T15:37:19.192Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: e-Excellence Inc. Products: U-Office Force Problem Types: CWE-79 Description: U-Office Force UserDefault page has insufficient filtering for special characters in the HTTP header fields. A remote attacker with general user privilege can exploit this vulnerability to inject JavaScript and perform XSS (Stored Cross-Site Scripting) attack. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-6641-55796-1.html
CVE ID: CVE-2022-39027 State: PUBLISHED Published: 2022-10-31T06:40:39.616Z Last Updated: 2025-05-06T15:33:51.091Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: e-Excellence Inc. Products: U-Office Force Problem Types: CWE-79 Description: U-Office Force Forum function has insufficient filtering for special characters. A remote attacker with general user privilege can inject JavaScript and perform XSS (Stored Cross-Site Scripting) attack. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-6642-bf567-1.html
CVE ID: CVE-2022-39028 State: PUBLISHED Published: 2022-08-30T00:00:00 Last Updated: 2024-08-03T11:10:32.472Z Vendors: n/a Products: n/a Problem Types: n/a Description: telnetd in GNU Inetutils through 2.3, MIT krb5-appl through 1.0.3, and derivative works has a NULL pointer dereference via 0xff 0xf7 or 0xff 0xf8. In a typical installation, the telnetd application would crash but the telnet service would remain available through inetd. However, if the telnetd application has many crashes within a short time interval, the telnet service would become unavailable after inetd logs a "telnet/tcp server failing (looping), service terminated" error. NOTE: MIT krb5-appl is not supported upstream but
ogs a "telnet/tcp server failing (looping), service terminated" error. NOTE: MIT krb5-appl is not supported upstream but is shipped by a few Linux distributions. The affected code was removed from the supported MIT Kerberos 5 (aka krb5) product many years ago, at version 1.8. Additional Analyst Notes: - CVE Program Container: References: - https://lists.gnu.org/archive/html/bug-inetutils/2022-08/msg00002.html - https://pierrekim.github.io/blog/2022-08-24-2-byte-dos-freebsd-netbsd-telnetd-netkit-telnetd-inetutils-telnetd-kerberos-telnetd.html - https://git.hadrons.org/cgit/debian/pkgs/inetutils.git/commit/?id=113da8021710d871c7dd72d2a4d5615d42d64289 - https://lists.debian.org/debian-lts-annou
ebian/pkgs/inetutils.git/commit/?id=113da8021710d871c7dd72d2a4d5615d42d64289 - https://lists.debian.org/debian-lts-announce/2022/11/msg00033.html
CVE ID: CVE-2022-39029 State: PUBLISHED Published: 2022-09-28T03:25:35.383Z Last Updated: 2025-05-21T14:53:58.484Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Smart eVision Information Technology Inc. Products: Smart eVision Problem Types: CWE-200 Description: Smart eVision has inadequate authorization for the database query function. A remote attacker with general user privilege, who is not explicitly authorized to access the information, can access sensitive information. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-6566-3805b-1.html
CVE ID: CVE-2022-39030 State: PUBLISHED Published: 2022-09-28T03:25:36.185Z Last Updated: 2025-05-21T14:52:48.240Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Smart eVision Information Technology Inc. Products: Smart eVision Problem Types: CWE-200 Description: smart eVision has inadequate authorization for system information query function. An unauthenticated remote attacker, who is not explicitly authorized to access the information, can access sensitive information. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-6567-01fa3-1.html
CVE ID: CVE-2022-39031 State: PUBLISHED Published: 2022-09-28T03:25:37.035Z Last Updated: 2025-05-21T14:57:33.011Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Smart eVision Information Technology Inc. Products: Smart eVision Problem Types: CWE-200 Description: Smart eVision has insufficient authorization for task acquisition function. An unauthorized remote attacker can exploit this vulnerability to acquire the Session IDs of other general users only. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-6568-331c1-1.html
CVE ID: CVE-2022-39032 State: PUBLISHED Published: 2022-09-28T03:25:37.813Z Last Updated: 2025-05-21T14:52:17.455Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Smart eVision Information Technology Inc. Products: Smart eVision Problem Types: CWE-269 Description: Smart eVision has an improper privilege management vulnerability. A remote attacker with general user privilege can exploit this vulnerability to escalate to administrator privilege, and then perform arbitrary system command or disrupt service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-6569-9fcf4-1.html
CVE ID: CVE-2022-39033 State: PUBLISHED Published: 2022-09-28T03:25:38.574Z Last Updated: 2025-05-21T14:51:32.612Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Smart eVision Information Technology Inc. Products: Smart eVision Problem Types: CWE-22 Description: Smart eVision’s file acquisition function has a path traversal vulnerability due to insufficient filtering for special characters in the URL parameter. An unauthenticated remote attacker can exploit this vulnerability to bypass authentication, access restricted paths to download and delete arbitrary system files to disrupt service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vuln
and delete arbitrary system files to disrupt service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-6570-9c632-1.html
CVE ID: CVE-2022-39034 State: PUBLISHED Published: 2022-09-28T03:25:39.361Z Last Updated: 2025-05-21T14:51:03.109Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Smart eVision Information Technology Inc. Products: Smart eVision Problem Types: CWE-22 Description: Smart eVision has a path traversal vulnerability in the Report API function due to insufficient filtering for special characters in URLs. A remote attacker with general user privilege can exploit this vulnerability to bypass authentication, access restricted paths and download system files. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.twcert.o
em files. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-6571-fc930-1.html
CVE ID: CVE-2022-39035 State: PUBLISHED Published: 2022-09-28T03:25:40.135Z Last Updated: 2025-05-21T14:50:02.915Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Smart eVision Information Technology Inc. Products: Smart eVision Problem Types: CWE-79 Description: Smart eVision has insufficient filtering for special characters in the POST Data parameter in the specific function. An unauthenticated remote attacker can inject JavaScript to perform XSS (Stored Cross-Site Scripting) attack. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-6572-5c2c8-1.html
CVE ID: CVE-2022-39036 State: PUBLISHED Published: 2022-11-10T02:20:44.321Z Last Updated: 2025-05-01T19:06:40.147Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: FLOWRING Products: Agentflow BPM Problem Types: CWE-434 Description: The file upload function of Agentflow BPM has insufficient filtering for special characters in URLs. An unauthenticated remote attacker can exploit this vulnerability to upload arbitrary file and execute arbitrary code to manipulate system or disrupt service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-6682-21207-1.html - https://www.flowring.com/2
CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-6682-21207-1.html - https://www.flowring.com/2022/09/19/%e7%94%a2%e5%93%81%e6%9b%b4%e6%96%b0agentflow-v4-0%e3%80%81v3-7%e5%a4%be%e6%aa%94%e5%8a%9f%e8%83%bd%e8%b3%87%e5%ae%89%e4%bf%ae%e6%ad%a3/
CVE ID: CVE-2022-39037 State: PUBLISHED Published: 2022-11-10T02:20:45.381Z Last Updated: 2025-05-01T14:00:05.111Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: FLOWRING Products: Agentflow BPM Problem Types: CWE-22 Description: Agentflow BPM file download function has a path traversal vulnerability. An unauthenticated remote attacker can exploit this vulnerability to bypass authentication and download arbitrary system files. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.flowring.com/2022/09/19/%e7%94%a2%e5%93%81%e6%9b%b4%e6%96%b0agentflow-v4-0%e3%80%81v3-7%e5%a4%be%e6%aa%94%e5%8a%9f%e8%83%bd%e8%b3%87%e
022/09/19/%e7%94%a2%e5%93%81%e6%9b%b4%e6%96%b0agentflow-v4-0%e3%80%81v3-7%e5%a4%be%e6%aa%94%e5%8a%9f%e8%83%bd%e8%b3%87%e5%ae%89%e4%bf%ae%e6%ad%a3/ - https://www.twcert.org.tw/tw/cp-132-6683-57b71-1.html
CVE ID: CVE-2022-39038 State: PUBLISHED Published: 2022-11-10T02:20:46.420Z Last Updated: 2025-05-01T19:06:11.492Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: FLOWRING Products: Agentflow BPM Problem Types: CWE-287 Description: Agentflow BPM enterprise management system has improper authentication. A remote attacker with general user privilege can change the name of the user account to acquire arbitrary account privilege, and access, manipulate system or disrupt service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.flowring.com/2022/09/19/%e7%94%a2%e5%93%81%e6%9b%b4%e6%96%b0agentflow-v4-0%e3%80%81v3-
chment: References: - https://www.flowring.com/2022/09/19/%e7%94%a2%e5%93%81%e6%9b%b4%e6%96%b0agentflow-v4-0%e3%80%81v3-7%e5%a4%be%e6%aa%94%e5%8a%9f%e8%83%bd%e8%b3%87%e5%ae%89%e4%bf%ae%e6%ad%a3/ - https://www.twcert.org.tw/tw/cp-132-6684-53149-1.html
CVE ID: CVE-2022-39039 State: PUBLISHED Published: 2023-01-03T00:00:00.000Z Last Updated: 2025-04-10T15:34:48.454Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: aEnrich Products: a+HRD Problem Types: CWE-918 Description: aEnrich’s a+HRD has inadequate filtering for specific URL parameter. An unauthenticated remote attacker can exploit this vulnerability to send arbitrary HTTP(s) request to launch Server-Side Request Forgery (SSRF) attack, to perform arbitrary system command or disrupt service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-6792-c4a62-1.html
CVE ID: CVE-2022-39040 State: PUBLISHED Published: 2023-01-03T00:00:00.000Z Last Updated: 2025-04-10T15:32:10.602Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: aEnrich Products: a+HRD Problem Types: CWE-22 Description: aEnrich a+HRD log read function has a path traversal vulnerability. An unauthenticated remote attacker can exploit this vulnerability to bypass authentication and download arbitrary system files. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-6793-66aee-1.html
CVE ID: CVE-2022-39041 State: PUBLISHED Published: 2023-01-03T00:00:00.000Z Last Updated: 2025-04-10T15:49:33.990Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: aEnrich Products: a+HRD Problem Types: CWE-89 Description: aEnrich a+HRD has insufficient user input validation for specific API parameter. An unauthenticated remote attacker can exploit this vulnerability to inject arbitrary SQL commands to access, modify and delete database. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-6794-35928-1.html
CVE ID: CVE-2022-39042 State: PUBLISHED Published: 2023-01-03T00:00:00.000Z Last Updated: 2025-04-10T15:49:09.860Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: aEnrich Products: a+HRD Problem Types: CWE-287 Description: aEnrich a+HRD has improper validation for login function. An unauthenticated remote attacker can exploit this vulnerability to bypass authentication and access API function to perform arbitrary system command or disrupt service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-6795-f7fe6-1.html