Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-30596 State: PUBLISHED Published: 2022-05-18T16:59:52 Last Updated: 2024-08-03T06:56:12.964Z Vendors: n/a Products: moodle Problem Types: CWE-79 Description: A flaw was found in moodle where ID numbers displayed when bulk allocating markers to assignments required additional sanitizing to prevent a stored XSS risk. Additional Analyst Notes: - CVE Program Container: References: - https://moodle.org/mod/forum/discuss.php?d=434578 - https://bugzilla.redhat.com/show_bug.cgi?id=2083583 - http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-74204 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PIMSIRKCFLIC646K4GMU
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PIMSIRKCFLIC646K4GMUSZU7THOUVPAJ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OGF35EN5K2R6X3NTY3XPZSJ3UDASMXI6/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QCTWSE3JDMSYL7DPCMXMMJEXZSS6VIA5/
CVE ID: CVE-2022-30597 State: PUBLISHED Published: 2022-05-18T17:02:35 Last Updated: 2024-08-03T06:56:13.022Z Vendors: n/a Products: moodle Problem Types: CWE-472 Description: A flaw was found in moodle where the description user field was not hidden when being set as a hidden user field. Additional Analyst Notes: - CVE Program Container: References: - https://moodle.org/mod/forum/discuss.php?d=434579 - https://bugzilla.redhat.com/show_bug.cgi?id=2083585 - http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-74318 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PIMSIRKCFLIC646K4GMUSZU7THOUVPAJ/ - https://lists.fedoraproject.
list/package-announce%40lists.fedoraproject.org/message/PIMSIRKCFLIC646K4GMUSZU7THOUVPAJ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OGF35EN5K2R6X3NTY3XPZSJ3UDASMXI6/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QCTWSE3JDMSYL7DPCMXMMJEXZSS6VIA5/
CVE ID: CVE-2022-30598 State: PUBLISHED Published: 2022-05-18T17:06:36 Last Updated: 2024-08-03T06:56:12.967Z Vendors: n/a Products: moodle Problem Types: CWE-200 Description: A flaw was found in moodle where global search results could include author information on some activities where a user may not otherwise have access to it. Additional Analyst Notes: - CVE Program Container: References: - https://moodle.org/mod/forum/discuss.php?d=434580 - https://bugzilla.redhat.com/show_bug.cgi?id=2083592 - http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-71623 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PIMSIRKCFLIC646K4GMUS
CVE ID: CVE-2022-30599 State: PUBLISHED Published: 2022-05-18T17:09:01 Last Updated: 2024-08-03T06:56:12.939Z Vendors: n/a Products: moodle Problem Types: CWE-89 Description: A flaw was found in moodle where an SQL injection risk was identified in Badges code relating to configuring criteria. Additional Analyst Notes: - CVE Program Container: References: - https://moodle.org/mod/forum/discuss.php?d=434581 - https://bugzilla.redhat.com/show_bug.cgi?id=2083610 - http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-74333 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PIMSIRKCFLIC646K4GMUSZU7THOUVPAJ/ - https://lists.fedoraproj
ves/list/package-announce%40lists.fedoraproject.org/message/PIMSIRKCFLIC646K4GMUSZU7THOUVPAJ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OGF35EN5K2R6X3NTY3XPZSJ3UDASMXI6/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QCTWSE3JDMSYL7DPCMXMMJEXZSS6VIA5/
CVE ID: CVE-2022-30600 State: PUBLISHED Published: 2022-05-18T17:19:55 Last Updated: 2024-08-03T06:56:12.672Z Vendors: n/a Products: moodle Problem Types: CWE-682 Description: A flaw was found in moodle where logic used to count failed login attempts could result in the account lockout threshold being bypassed. Additional Analyst Notes: - CVE Program Container: References: - https://moodle.org/mod/forum/discuss.php?d=434582 - https://bugzilla.redhat.com/show_bug.cgi?id=2083613 - http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-73736 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PIMSIRKCFLIC646K4GMUSZU7THOUVPAJ/ - https
raproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PIMSIRKCFLIC646K4GMUSZU7THOUVPAJ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OGF35EN5K2R6X3NTY3XPZSJ3UDASMXI6/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QCTWSE3JDMSYL7DPCMXMMJEXZSS6VIA5/
CVE ID: CVE-2022-30601 State: PUBLISHED Published: 2022-08-18T00:00:00.000Z Last Updated: 2025-05-05T16:17:22.718Z Vendors: n/a Products: Intel(R) AMT and Intel(R) Standard Manageability Problem Types: information disclosure and escalation of privilege Description: Insufficiently protected credentials for Intel(R) AMT and Intel(R) Standard Manageability may allow an unauthenticated user to potentially enable information disclosure and escalation of privilege via network access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00709.html - https://security.netapp.com/advisory/nta
/www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00709.html - https://security.netapp.com/advisory/ntap-20221014-0004/
CVE ID: CVE-2022-30602 State: PUBLISHED Published: 2022-07-11T00:40:22 Last Updated: 2024-08-03T06:56:12.966Z Vendors: Cybozu, Inc. Products: Cybozu Garoon Problem Types: Improper Authorization Description: Operation restriction bypass in multiple applications of Cybozu Garoon 4.0.0 to 5.9.1 allows a remote authenticated attacker to alter the file information and/or delete the files. Additional Analyst Notes: - CVE Program Container: References: - https://cs.cybozu.co.jp/2022/007682.html - https://jvn.jp/en/jp/JVN14077132/index.html
CVE ID: CVE-2022-30603 State: PUBLISHED Published: 2022-10-25T16:33:39.207Z Last Updated: 2025-04-15T18:47:58.789Z Severity: CRITICAL (CVSS 10 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: abode systems, inc. Products: iota All-In-One Security Kit Problem Types: CWE-78 Description: An OS command injection vulnerability exists in the web interface /action/iperf functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - h
trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2022-1562
CVE ID: CVE-2022-30604 State: PUBLISHED Published: 2022-08-18T07:12:01 Last Updated: 2024-08-03T06:56:12.973Z Vendors: Cybozu, Inc. Products: Cybozu Office Problem Types: Cross-site scripting Description: Cross-site scripting vulnerability in the specific parameters of Cybozu Office 10.0.0 to 10.8.5 allows a remote attacker to inject an arbitrary script via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://cs.cybozu.co.jp/2022/007584.html - https://jvn.jp/en/jp/JVN20573662/index.html
CVE ID: CVE-2022-30605 State: PUBLISHED Published: 2022-08-22T18:24:29.434Z Last Updated: 2025-04-15T18:51:31.163Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: WWBN Products: AVideo Problem Types: CWE-384 Description: A privilege escalation vulnerability exists in the session id functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to increased privileges. An attacker can get an authenticated user to send a crafted HTTP request to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/WWBN/AVideo/blob/e04b1cd7062e16564157a8
CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/WWBN/AVideo/blob/e04b1cd7062e16564157a82bae389eedd39fa088/updatedb/updateDb.v12.0.sql - https://talosintelligence.com/vulnerability_reports/TALOS-2022-1535
CVE ID: CVE-2022-30606 State: REJECTED Published: N/A Last Updated: 2025-05-28T18:19:31.015Z Description: No description available.
CVE ID: CVE-2022-30607 State: PUBLISHED Published: 2022-06-17T15:20:16.163512Z Last Updated: 2024-09-16T21:57:48.331Z Severity: LOW (CVSS 2.7 CVSS:3.0/PR:H/C:L/AV:N/I:N/A:N/S:U/UI:N/AC:L/E:U/RL:O/RC:C) Vendors: IBM Products: Robotic Process Automation Problem Types: Obtain Information Description: IBM Robotic Process Automation 20.10.0, 20.12.5, 21.0.0, 21.0.1, and 21.0.2 contains a vulnerability that could allow a user to obtain sensitive information due to information properly masked in the control center UI. IBM X-Force ID: 227294. Additional Analyst Notes: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/6595759 - https://exchange.xforce.ibmcloud.com/vulnerab
Container: References: - https://www.ibm.com/support/pages/node/6595759 - https://exchange.xforce.ibmcloud.com/vulnerabilities/227294
CVE ID: CVE-2022-30608 State: PUBLISHED Published: 2022-11-03T00:00:00.000Z Last Updated: 2025-05-05T13:34:26.003Z Vendors: n/a Products: IBM InfoSphere Information Server Problem Types: Cross-Site Request Forgery Description: "IBM InfoSphere Information Server 11.7 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a "user that the website trusts. IBM X-Force ID: 227295. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/6829335
CVE ID: CVE-2022-30610 State: PUBLISHED Published: 2022-06-10T16:00:24.304952Z Last Updated: 2024-09-16T23:16:32.261Z Severity: MEDIUM (CVSS 4.4 CVSS:3.0/A:N/AV:N/UI:N/AC:H/I:H/S:U/C:N/PR:H/RC:C/RL:O/E:U) Vendors: IBM Products: Spectrum Copy Data Management Problem Types: Bypass Security Description: IBM Spectrum Copy Data Management 2.2.0.0 through 2.2.15.0 is vulnerable to reverse tabnabbing where it could allow a page linked to from within IBM Spectrum Copy Data Management to rewrite it. An administrator could enter a link to a malicious URL that another administrator could then click. Once clicked, that malicious URL could then rewrite the original page with a phishing page. IBM X-Force
uld then click. Once clicked, that malicious URL could then rewrite the original page with a phishing page. IBM X-Force ID: 227363. Additional Analyst Notes: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/6593721 - https://exchange.xforce.ibmcloud.com/vulnerabilities/227363
CVE ID: CVE-2022-30611 State: PUBLISHED Published: 2022-06-10T16:00:25.958845Z Last Updated: 2024-09-16T17:33:30.216Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/UI:R/AV:N/S:C/C:L/I:L/AC:L/A:N/PR:L/RC:C/RL:O/E:H) Vendors: IBM Products: Spectrum Copy Data Management Problem Types: Cross-Site Scripting Description: IBM Spectrum Copy Data Management 2.2.0.0 through 2.2.15.0 is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability using some fields of the form in the portal UI to inject malicious script into a Web page which would be executed in a victim's Web browser within the security context of the hosting Web sit
ipt into a Web page which would be executed in a victim's Web browser within the security context of the hosting Web site, once the page is viewed. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials. IBM X-Force ID: 227364. Additional Analyst Notes: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/6593721 - https://exchange.xforce.ibmcloud.com/vulnerabilities/227364
CVE ID: CVE-2022-30613 State: PUBLISHED Published: 2022-10-07T17:00:28.052336Z Last Updated: 2024-09-17T03:37:59.917Z Severity: MEDIUM (CVSS 4.4 CVSS:3.0/I:N/AC:L/S:U/PR:H/A:N/UI:N/AV:L/C:H/RL:O/E:U/RC:C) Vendors: IBM Products: QRadar SIEM Problem Types: Obtain Information Description: IBM QRadar SIEM 7.4 and 7.5 could disclose sensitive information via a local service to a privileged user. IBM X-Force ID: 227366. Additional Analyst Notes: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/6826693 - https://exchange.xforce.ibmcloud.com/vulnerabilities/227366
CVE ID: CVE-2022-30614 State: PUBLISHED Published: 2022-09-01T19:00:28.959064Z Last Updated: 2024-09-17T00:57:07.943Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/C:N/AV:N/AC:L/I:N/S:U/UI:N/A:H/PR:L/RC:C/E:U/RL:O) Vendors: IBM Products: Cognos Analytics Problem Types: Denial of Service Description: IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 is vulnerable to a denial of service via email flooding caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to cause the server to consume all available CPU resources. IBM X-Force ID: 227591. Additional Analyst Notes: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/6615285 - https://e
itional Analyst Notes: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/6615285 - https://exchange.xforce.ibmcloud.com/vulnerabilities/227591 - https://security.netapp.com/advisory/ntap-20221014-0005/
CVE ID: CVE-2022-30615 State: PUBLISHED Published: 2022-11-03T00:00:00.000Z Last Updated: 2025-05-05T13:33:37.655Z Vendors: n/a Products: IBM InfoSphere Information Server Problem Types: Cross-Site Scripting Description: "IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 227592. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/6829311
CVE ID: CVE-2022-30616 State: PUBLISHED Published: 2022-07-31T17:30:45.639495Z Last Updated: 2024-09-17T02:22:01.956Z Severity: HIGH (CVSS 8 CVSS:3.0/UI:N/PR:H/AV:N/A:H/C:H/AC:H/I:H/S:C/E:U/RC:C/RL:O) Vendors: IBM Products: Robotic Process Automation Problem Types: Gain Privileges Description: IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 could allow a privileged user to elevate their privilege to platform administrator through manipulation of APIs. IBM X-Force ID: 227978. Additional Analyst Notes: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/6608430 - https://exchange.xforce.ibmcloud.com/vulnerabilities/227978
CVE ID: CVE-2022-30617 State: PUBLISHED Published: 2022-05-19T17:07:36 Last Updated: 2024-08-03T06:56:12.964Z Vendors: Strapi Products: Strapi Problem Types: CWE-212 Description: An authenticated user with access to the Strapi admin panel can view private and sensitive data, such as email and password reset tokens, for other admin panel users that have a relationship (e.g., created by, updated by) with content accessible to the authenticated user. For example, a low-privileged “author” role account can view these details in the JSON response for an “editor” or “super admin” that has updated one of the author’s blog posts. There are also many other scenarios where such details from other user
that has updated one of the author’s blog posts. There are also many other scenarios where such details from other users can leak in the JSON response, either through a direct or indirect relationship. Access to this information enables a user to compromise other users’ accounts by successfully invoking the password reset workflow. In a worst-case scenario, a low-privileged user could get access to a “super admin” account with full control over the Strapi instance, and could read and modify any data as well as block access to both the admin panel and API by revoking privileges for all other users. Additional Analyst Notes: - CVE Program Container: References: - https://www.synopsys.com/blog
eges for all other users. Additional Analyst Notes: - CVE Program Container: References: - https://www.synopsys.com/blogs/software-security/cyrc-advisory-strapi
CVE ID: CVE-2022-30618 State: PUBLISHED Published: 2022-05-19T17:08:47 Last Updated: 2024-08-03T06:56:13.298Z Vendors: Strapi Products: Strapi Problem Types: CWE-212 Description: An authenticated user with access to the Strapi admin panel can view private and sensitive data, such as email and password reset tokens, for API users if content types accessible to the authenticated user contain relationships to API users (from:users-permissions). There are many scenarios in which such details from API users can leak in the JSON response within the admin panel, either through a direct or indirect relationship. Access to this information enables a user to compromise these users’ accounts if the pas
irect or indirect relationship. Access to this information enables a user to compromise these users’ accounts if the password reset API endpoints have been enabled. In a worst-case scenario, a low-privileged user could get access to a high-privileged API account, and could read and modify any data as well as block access to both the admin panel and API by revoking privileges for all other users. Additional Analyst Notes: - CVE Program Container: References: - https://www.synopsys.com/blogs/software-security/cyrc-advisory-strapi
CVE ID: CVE-2022-30619 State: PUBLISHED Published: 2022-07-06T13:12:27.967627Z Last Updated: 2024-09-16T18:13:35.207Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L) Vendors: Agile Point Products: Agile Point NX Problem Types: CWE-89 Description: Editable SQL Queries behind Base64 encoding sending from the Client-Side to The Server-Side for a particular API used in legacy Work Center module. He attack is available for any authenticated user, in any kind of rule. under the function : /AgilePointServer/Extension/FetchUsingEncodedData in the parameter: EncodedData Additional Analyst Notes: - CVE Program Container: References: - https://www.gov.il/en/Departments/faq/cve_
EncodedData Additional Analyst Notes: - CVE Program Container: References: - https://www.gov.il/en/Departments/faq/cve_advisories
CVE ID: CVE-2022-30620 State: PUBLISHED Published: 2022-07-18T12:54:33.885583Z Last Updated: 2024-09-17T01:21:34.670Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:H) Vendors: Cellinx Products: Cellinx NVT - IP PTZ Camera Problem Types: Privilege Escalation Description: On Cellinx Camera with guest enabled, attacker with web access can elevate privileges to administrative: "1" to "0" privileges by changing the following cookie values from "is_admin", "showConfig". Administrative Privileges which allows changing various configuration in the camera. Additional Analyst Notes: - CVE Program Container: References: - https://www.gov.il/en/departments/faq/cve_advisories
CVE ID: CVE-2022-30621 State: PUBLISHED Published: 2022-07-18T12:55:04.063454Z Last Updated: 2024-09-17T03:18:09.802Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:H) Vendors: Cellinx Products: Cellinx NVT - IP PTZ Camera Problem Types: local file inclusion Description: Allows a remote user to read files on the camera's OS "GetFileContent.cgi". Reading arbitrary files on the camera's OS as root user. Additional Analyst Notes: - CVE Program Container: References: - https://www.gov.il/en/departments/faq/cve_advisories
CVE ID: CVE-2022-30622 State: PUBLISHED Published: 2022-07-17T20:11:56.873595Z Last Updated: 2024-09-17T02:53:15.209Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: Chcnav Products: Chcnav - P5E GNSS Problem Types: Information disclosure Description: Disclosure of information - the system allows you to view usernames and passwords without permissions, thus it will be possible to enter the system. Path access: http://api/sys_username_passwd.cmd - The server loads the request clearly by default. Disclosure of hard-coded credit information within the JS code sent to the customer within the Login.js file is a strong user (which is not documented) and also the p
thin the JS code sent to the customer within the Login.js file is a strong user (which is not documented) and also the password, which allow for super-user access. Username: chcadmin, Password: chcpassword. Additional Analyst Notes: - CVE Program Container: References: - https://www.gov.il/en/Departments/faq/cve_advisories
CVE ID: CVE-2022-30623 State: PUBLISHED Published: 2022-07-18T12:59:03.084712Z Last Updated: 2024-09-17T00:16:12.641Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: Chcnav Products: Chcnav - P5E GNSS Problem Types: CWE-288 Description: The server checks the user's cookie in a non-standard way, and a value is entered in the cookie value name of the status and its value is set to true to bypass the identification with the system using a username and password. Additional Analyst Notes: - CVE Program Container: References: - https://www.gov.il/en/Departments/faq/cve_advisories
CVE ID: CVE-2022-30624 State: PUBLISHED Published: 2022-07-18T12:57:47.673973Z Last Updated: 2024-09-17T00:25:40.854Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L) Vendors: Chcnav Products: Chcnav - P5E GNSS Problem Types: Authentication bypass admin password reset Description: Browsing the admin.html page allows the user to reset the admin password. Also appears in the JS code for the password. Additional Analyst Notes: - CVE Program Container: References: - https://www.gov.il/en/Departments/faq/cve_advisories
CVE ID: CVE-2022-30625 State: PUBLISHED Published: 2022-07-18T12:58:39.399552Z Last Updated: 2024-09-17T03:47:36.623Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Chcnav Products: Chcnav - P5E GNSS Problem Types: CWE-548 Description: Directory listing is a web server function that displays the directory contents when there is no index file in a specific website directory. A directory listing provides an attacker with the complete index of all the resources located inside of the directory. The specific risks and consequences vary depending on which files are listed and accessible. Additional Analyst Notes: - CVE Program Container: References: - https://www
g on which files are listed and accessible. Additional Analyst Notes: - CVE Program Container: References: - https://www.gov.il/en/Departments/faq/cve_advisories
CVE ID: CVE-2022-30626 State: PUBLISHED Published: 2022-07-18T12:58:11.506185Z Last Updated: 2024-09-17T01:26:16.593Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L) Vendors: Chcnav Products: Chcnav - P5E GNSS Problem Types: API not secure Description: Browsing the path: http://ip/wifi_ap_pata_get.cmd, will show in the name of the existing access point on the component, and a password in clear text. Additional Analyst Notes: - CVE Program Container: References: - https://www.gov.il/en/Departments/faq/cve_advisories
CVE ID: CVE-2022-30627 State: PUBLISHED Published: 2022-07-18T12:57:00.569692Z Last Updated: 2024-09-17T00:57:04.145Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Chcnav Products: Chcnav - P5E GNSS Problem Types: Information disclosure hard coded credentials. Description: This vulnerability affects all of the company's products that also include the FW versions: update_i90_cv2.021_b20210104, update_i50_v1.0.55_b20200509, update_x6_v2.1.2_b202001127, update_b5_v2.0.9_b20200706. This vulnerability makes it possible to extract from the FW the existing user passwords on their operating systems and passwords. Additional Analyst Notes: - CVE Program Container: