Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
iQ-R Series R00CPU, MELSEC iQ-R Series R01CPU, MELSEC iQ-R Series R02CPU, MELSEC iQ-R Series R04CPU, MELSEC iQ-R Series R08CPU, MELSEC iQ-R Series R16CPU, MELSEC iQ-R Series R32CPU, MELSEC iQ-R Series R120CPU, MELSEC iQ-R Series R04ENCPU, MELSEC iQ-R Series R08ENCPU, MELSEC iQ-R Series R16ENCPU, MELSEC iQ-R Series R32ENCPU, MELSEC iQ-R Series R120ENCPU, MELSEC iQ-F Series FX5UJ-24MT/ES, MELSEC iQ-F Series FX5UJ-40MT/ES, MELSEC iQ-F Series FX5UJ-60MT/ES, MELSEC iQ-F Series FX5UJ-24MR/ES, MELSEC iQ-F Series FX5UJ-40MR/ES, MELSEC iQ-F Series FX5UJ-60MR/ES, MELSEC iQ-F Series FX5UJ-24MT/ESS, MELSEC iQ-F Series FX5UJ-40MT/ESS, MELSEC iQ-F Series FX5UJ-60MT/ESS, MELSEC iQ-F Series FX5UJ-24MT/ES-A
FX5UJ-24MT/ESS, MELSEC iQ-F Series FX5UJ-40MT/ESS, MELSEC iQ-F Series FX5UJ-60MT/ESS, MELSEC iQ-F Series FX5UJ-24MT/ES-A, MELSEC iQ-F Series FX5UJ-40MT/ES-A, MELSEC iQ-F Series FX5UJ-60MT/ES-A, MELSEC iQ-F Series FX5UJ-24MR/ES-A, MELSEC iQ-F Series FX5UJ-40MR/ES-A, MELSEC iQ-F Series FX5UJ-60MR/ES-A, MELSEC iQ-F Series FX5S-30MT/ES, MELSEC iQ-F Series FX5S-40MT/ES, MELSEC iQ-F Series FX5S-60MT/ES, MELSEC iQ-F Series FX5S-80MT/ES, MELSEC iQ-F Series FX5S-30MR/ES, MELSEC iQ-F Series FX5S-40MR/ES, MELSEC iQ-F Series FX5S-60MR/ES, MELSEC iQ-F Series FX5S-80MR/ES, MELSEC iQ-F Series FX5S-30MT/ESS, MELSEC iQ-F Series FX5S-40MT/ESS, MELSEC iQ-F Series FX5S-60MT/ESS, MELSEC iQ-F Series FX5S-80MT/ESS
ries FX5S-30MT/ESS, MELSEC iQ-F Series FX5S-40MT/ESS, MELSEC iQ-F Series FX5S-60MT/ESS, MELSEC iQ-F Series FX5S-80MT/ESS Problem Types: CWE-337 Description: Predictable Seed in Pseudo-Random Number Generator (PRNG) vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series FX5U-xMy/z (x=32,64,80, y=T,R, z=ES,DS,ESS,DSS) with serial number 17X**** or later, and versions 1.280 and prior, Mitsubishi Electric Corporation MELSEC iQ-F Series FX5U-xMy/z (x=32,64,80, y=T,R, z=ES,DS,ESS,DSS) with serial number 179**** and prior, and versions 1.074 and prior, Mitsubishi Electric Corporation MELSEC iQ-F Series FX5UC-xMy/z (x=32,64,96, y=T, z=D,DSS)) with serial number 17X**** or later, and ver
tric Corporation MELSEC iQ-F Series FX5UC-xMy/z (x=32,64,96, y=T, z=D,DSS)) with serial number 17X**** or later, and versions 1.280 and prior, Mitsubishi Electric Corporation MELSEC iQ-F Series FX5UC-xMy/z (x=32,64,96, y=T, z=D,DSS)) with serial number 179**** and prior, and versions 1.074 and prior, Mitsubishi Electric Corporation MELSEC iQ-F Series FX5UC-32MT/DS-TS versions 1.280 and prior, Mitsubishi Electric Corporation MELSEC iQ-F Series FX5UC-32MT/DSS-TS versions 1.280 and prior, Mitsubishi Electric Corporation MELSEC iQ-F Series FX5UJ-xMy/z (x=24,40,60, y=T,R, z=ES,ESS) versions 1.042 and prior, Mitsubishi Electric Corporation MELSEC iQ-F Series FX5UJ-xMy/ES-A (x=24,40,60, y=T,R) vers
SS) versions 1.042 and prior, Mitsubishi Electric Corporation MELSEC iQ-F Series FX5UJ-xMy/ES-A (x=24,40,60, y=T,R) versions 1.043 and prior, Mitsubishi Electric Corporation MELSEC iQ-F Series FX5S-xMy/z (x=30,40,60,80, y=T,R, z=ES,ESS) versions 1.003 and prior, Mitsubishi Electric Corporation MELSEC iQ-F Series FX5UC-32MR/DS-TS versions 1.280 and prior, Mitsubishi Electric Corporation MELSEC iQ-R Series R00/01/02CPU versions 33 and prior, Mitsubishi Electric Corporation MELSEC iQ-R Series R04/08/16/32/120(EN)CPU versions 66 and prior allows a remote unauthenticated attacker to access the Web server function by guessing the random numbers used for authentication from several used random numb
r to access the Web server function by guessing the random numbers used for authentication from several used random numbers. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-019_en.pdf - https://jvn.jp/vu/JVNVU99673580/index.html - https://www.cisa.gov/uscert/ics/advisories/icsa-23-017-02
CVE ID: CVE-2022-40268 State: PUBLISHED Published: 2023-02-02T07:13:18.109Z Last Updated: 2025-03-26T18:44:10.096Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:N) Vendors: Mitsubishi Electric Corporation Products: GOT2000 Series GT27 model, GOT2000 Series GT25 model, GT SoftGOT2000 Problem Types: CWE-1021 Description: Improper Restriction of Rendered UI Layers or Frames vulnerability in Mitsubishi Electric Corporation GOT2000 Series GT27 model versions 01.14.000 to 01.47.000, Mitsubishi Electric Corporation GOT2000 Series GT25 model versions 01.14.000 to 01.47.000 and Mitsubishi Electric Corporation GT SoftGOT2000 versions 1.265B to 1.285X allows a remote unauthentic
00 to 01.47.000 and Mitsubishi Electric Corporation GT SoftGOT2000 versions 1.265B to 1.285X allows a remote unauthenticated attacker to lead legitimate users to perform unintended operations through clickjacking. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-021_en.pdf - https://jvn.jp/vu/JVNVU91222434/index.html
CVE ID: CVE-2022-40269 State: PUBLISHED Published: 2023-02-02T07:17:09.894Z Last Updated: 2025-03-26T14:28:47.196Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N) Vendors: Mitsubishi Electric Corporation Products: GOT2000 Series GT27 model, GOT2000 Series GT25 model, GT SoftGOT2000 Problem Types: CWE-290 Description: Authentication Bypass by Spoofing vulnerability in Mitsubishi Electric Corporation GOT2000 Series GT27 model versions 01.14.000 to 01.47.000, Mitsubishi Electric Corporation GOT2000 Series GT25 model versions 01.14.000 to 01.47.000 and Mitsubishi Electric Corporation GT SoftGOT2000 versions 1.265B to 1.285X allows a remote unauthenticated attacker to dis
Mitsubishi Electric Corporation GT SoftGOT2000 versions 1.265B to 1.285X allows a remote unauthenticated attacker to disclose sensitive information from users' browsers or spoof legitimate users by abusing inappropriate HTML attributes. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-021_en.pdf - https://jvn.jp/vu/JVNVU91222434/index.html
CVE ID: CVE-2022-40270 State: REJECTED Published: N/A Last Updated: 2023-01-17T00:00:00 Description: No description available.
CVE ID: CVE-2022-40271 State: REJECTED Published: N/A Last Updated: 2023-01-17T00:00:00 Description: No description available.
CVE ID: CVE-2022-40272 State: REJECTED Published: N/A Last Updated: 2023-01-17T00:00:00 Description: No description available.
CVE ID: CVE-2022-40273 State: REJECTED Published: N/A Last Updated: 2023-01-17T00:00:00 Description: No description available.
CVE ID: CVE-2022-40274 State: PUBLISHED Published: 2022-09-30T16:18:57.000Z Last Updated: 2025-05-20T18:33:59.609Z Vendors: n/a Products: Gridea Problem Types: Remote command execution (RCE) Description: Gridea version 0.9.3 allows an external attacker to execute arbitrary code remotely on any client attempting to view a malicious markdown file through Gridea. This is possible because the application has the 'nodeIntegration' option enabled. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fluidattacks.com/advisories/marshmello/ - https://github.com/getgridea/gridea
CVE ID: CVE-2022-40276 State: PUBLISHED Published: 2022-11-03T00:00:00.000Z Last Updated: 2025-05-02T20:10:21.875Z Vendors: n/a Products: Zettlr Problem Types: Insecure or unset HTTP headers - Content-Security-Policy Description: Zettlr version 2.3.0 allows an external attacker to remotely obtain arbitrary local files on any client that attempts to view a malicious markdown file through Zettlr. This is possible because the application does not have a CSP policy (or at least not strict enough) and/or does not properly validate the contents of markdown files before rendering them. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Zettl
them. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Zettlr/Zettlr - https://fluidattacks.com/advisories/avicii/
CVE ID: CVE-2022-40277 State: PUBLISHED Published: 2022-09-30T16:20:59.000Z Last Updated: 2025-05-20T18:32:21.014Z Vendors: n/a Products: Joplin Problem Types: Remote command execution (RCE) Description: Joplin version 2.8.8 allows an external attacker to execute arbitrary commands remotely on any client that opens a link in a malicious markdown file, via Joplin. This is possible because the application does not properly validate the schema/protocol of existing links in the markdown file before passing them to the 'shell.openExternal' function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fluidattacks.com/advisories/skrillex/ - https://git
VE Program Container: - CISA ADP Vulnrichment: References: - https://fluidattacks.com/advisories/skrillex/ - https://github.com/laurent22/joplin
CVE ID: CVE-2022-40278 State: PUBLISHED Published: 2022-09-08T21:06:05 Last Updated: 2024-08-03T12:14:40.090Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Samsung TizenRT through 3.0_GBM (and 3.1_PRE). createDB in security/provisioning/src/provisioningdatabasemanager.c has a missing sqlite3_free after sqlite3_exec, leading to a denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Samsung/TizenRT/issues/5628 - https://www.sqlite.org/c3ref/exec.html - https://github.com/Samsung/TizenRT/blob/f8f776dd183246ad8890422c1ee5e8f33ab2aaaf/external/iotivity/iotivity_1.2-rel/resource/csdk/security/provisioning/src
blob/f8f776dd183246ad8890422c1ee5e8f33ab2aaaf/external/iotivity/iotivity_1.2-rel/resource/csdk/security/provisioning/src/provisioningdatabasemanager.c#L103 - https://github.com/Samsung/TizenRT/blob/f8f776dd183246ad8890422c1ee5e8f33ab2aaaf/external/iotivity/iotivity_1.2-rel/resource/csdk/security/provisioning/src/provisioningdatabasemanager.c#L107
CVE ID: CVE-2022-40279 State: PUBLISHED Published: 2022-09-08T21:05:52 Last Updated: 2024-08-03T12:14:39.973Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Samsung TizenRT through 3.0_GBM (and 3.1_PRE). l2_packet_receive_timeout in wpa_supplicant/src/l2_packet/l2_packet_pcap.c has a missing check on the return value of pcap_dispatch, leading to a denial of service (malfunction). Additional Analyst Notes: - CVE Program Container: References: - https://linux.die.net/man/3/pcap_dispatch - https://github.com/Samsung/TizenRT/issues/5629 - https://github.com/Samsung/TizenRT/blob/f8f776dd183246ad8890422c1ee5e8f33ab2aaaf/external/wpa_supplicant/src/l2_packet/l
https://github.com/Samsung/TizenRT/blob/f8f776dd183246ad8890422c1ee5e8f33ab2aaaf/external/wpa_supplicant/src/l2_packet/l2_packet_pcap.c#L181
CVE ID: CVE-2022-40280 State: PUBLISHED Published: 2022-09-08T21:06:17 Last Updated: 2024-08-03T12:14:40.104Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Samsung TizenRT through 3.0_GBM (and 3.1_PRE). createDB in security/provisioning/src/provisioningdatabasemanager.c has a missing sqlite3_close after sqlite3_open_v2, leading to a denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Samsung/TizenRT/issues/5627 - https://www.sqlite.org/c3ref/open.html - https://github.com/Samsung/TizenRT/blob/f8f776dd183246ad8890422c1ee5e8f33ab2aaaf/external/iotivity/iotivity_1.2-rel/resource/csdk/security/provisioning
nRT/blob/f8f776dd183246ad8890422c1ee5e8f33ab2aaaf/external/iotivity/iotivity_1.2-rel/resource/csdk/security/provisioning/src/provisioningdatabasemanager.c#L100
CVE ID: CVE-2022-40281 State: PUBLISHED Published: 2022-09-08T21:05:39 Last Updated: 2024-08-03T12:14:40.034Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Samsung TizenRT through 3.0_GBM (and 3.1_PRE). cyassl_connect_step2 in curl/vtls/cyassl.c has a missing X509_free after SSL_get_peer_certificate, leading to information disclosure. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Samsung/TizenRT/issues/5626 - https://www.openssl.org/docs/man1.1.1/man3/SSL_get_peer_certificate.html - https://github.com/Samsung/TizenRT/blob/f8f776dd183246ad8890422c1ee5e8f33ab2aaaf/external/curl/vtls/cyassl.c#L545
CVE ID: CVE-2022-40282 State: PUBLISHED Published: 2022-11-25T00:00:00.000Z Last Updated: 2025-04-29T14:54:42.736Z Vendors: n/a Products: n/a Problem Types: n/a Description: The web server of Hirschmann BAT-C2 before 09.13.01.00R04 allows authenticated command injection. This allows an authenticated attacker to pass commands to the shell of the system because the dir parameter of the FsCreateDir Ajax function is not sufficiently sanitized. The vendor's ID is BSECV-2022-21. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.belden.com/support/security-assurance - http://seclists.org/fulldisclosure/2022/Nov/19 - http://packetstormsecurity.com/
belden.com/support/security-assurance - http://seclists.org/fulldisclosure/2022/Nov/19 - http://packetstormsecurity.com/files/170063/Hirschmann-Belden-BAT-C2-8.8.1.0R8-Command-Injection.html
CVE ID: CVE-2022-40284 State: PUBLISHED Published: 2022-11-06T00:00:00.000Z Last Updated: 2025-05-02T18:42:11.770Z Vendors: n/a Products: n/a Problem Types: n/a Description: A buffer overflow was discovered in NTFS-3G before 2022.10.3. Crafted metadata in an NTFS image can cause code execution. A local attacker can exploit this if the ntfs-3g binary is setuid root. A physically proximate attacker can exploit this if NTFS-3G software is configured to execute upon attachment of an external storage device. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/tuxera/ntfs-3g/releases - http://www.openwall.com/lists/oss-security/2022/10/31/2
ent: References: - https://github.com/tuxera/ntfs-3g/releases - http://www.openwall.com/lists/oss-security/2022/10/31/2 - https://lists.debian.org/debian-lts-announce/2022/11/msg00029.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IA2D4PYOR7ABI7BWBMMMYKY2OPHTV2NI/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2BOQ7YLFT43KLXEN3EB6CS4DP635RJWP/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UGDKGXA4R2ZVUQ3CT4D4YGTFMNZQA7HW/ - https://security.gentoo.org/glsa/202301-01
CVE ID: CVE-2022-40285 State: REJECTED Published: N/A Last Updated: 2025-09-30T20:19:03.619Z Description: No description available.
CVE ID: CVE-2022-40287 State: PUBLISHED Published: 2022-10-31T20:08:11.893Z Last Updated: 2025-05-06T19:13:46.860Z Vendors: PHP Point of Sale LLC Products: PHP Point of Sale Problem Types: CWE-79 Description: The application was found to be vulnerable to an authenticated Stored Cross-Site Scripting (XSS) vulnerability in messaging functionality, leading to privilege escalation or a compromise of a targeted account. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.themissinglink.com.au/security-advisories/cve-2022-40287
CVE ID: CVE-2022-40288 State: PUBLISHED Published: 2022-10-31T20:05:35.055Z Last Updated: 2025-05-06T19:22:35.531Z Vendors: PHP Point of Sale LLC Products: PHP Point of Sale Problem Types: CWE-79 Description: The application was vulnerable to an authenticated Stored Cross-Site Scripting (XSS) in the user profile data fields, which could be leveraged to escalate privileges within and compromise any account that views their user profile. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.themissinglink.com.au/security-advisories/cve-2022-40288
CVE ID: CVE-2022-40289 State: PUBLISHED Published: 2022-10-31T20:07:42.527Z Last Updated: 2025-05-06T19:17:27.914Z Vendors: PHP Point of Sale LLC Products: PHP Point of Sale Problem Types: CWE-79 Description: The application was vulnerable to an authenticated Stored Cross-Site Scripting (XSS) in the upload and download functionality, which could be leveraged to escalate privileges or compromise any accounts they can coerce into observing the targeted files. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.themissinglink.com.au/security-advisories/cve-2022-40289
CVE ID: CVE-2022-40290 State: PUBLISHED Published: 2022-10-31T20:09:06.555Z Last Updated: 2025-05-06T19:11:44.820Z Vendors: PHP Point of Sale LLC Products: PHP Point of Sale Problem Types: CWE-79 Description: The application was vulnerable to an unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability in the barcode generation functionality, allowing attackers to generate an unsafe link that could compromise users. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.themissinglink.com.au/security-advisories/cve-2022-40290
CVE ID: CVE-2022-40291 State: PUBLISHED Published: 2022-10-31T20:06:41.873Z Last Updated: 2025-05-06T19:19:48.448Z Vendors: PHP Point of Sale LLC Products: PHP Point of Sale Problem Types: CWE-352 Description: The application was vulnerable to Cross-Site Request Forgery (CSRF) attacks, allowing an attacker to coerce users into sending malicious requests to the site to delete their account, or in rare circumstances, hijack their account and create other admin accounts. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.themissinglink.com.au/security-advisories/cve-2022-40291
CVE ID: CVE-2022-40292 State: PUBLISHED Published: 2022-10-31T20:07:10.233Z Last Updated: 2025-05-06T19:18:55.380Z Vendors: PHP Point of Sale LLC Products: PHP Point of Sale Problem Types: CWE-209 Description: The application allowed for Unauthenticated User Enumeration by interacting with an unsecured endpoint to retrieve information on each account within the system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.themissinglink.com.au/security-advisories/cve-2022-40292
CVE ID: CVE-2022-40293 State: PUBLISHED Published: 2022-10-31T20:05:55.050Z Last Updated: 2025-05-06T19:21:46.154Z Vendors: PHP Point of Sale LLC Products: PHP Point of Sale Problem Types: CWE-384 Description: The application was vulnerable to a session fixation that could be used hijack accounts. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.themissinglink.com.au/security-advisories/cve-2022-40293
CVE ID: CVE-2022-40294 State: PUBLISHED Published: 2022-10-31T20:09:23.823Z Last Updated: 2025-05-06T14:48:34.838Z Vendors: PHP Point of Sale LLC Products: PHP Point of Sale Problem Types: CWE-1236 Description: The application was identified to have an CSV injection in data export functionality, allowing for malicious code to be embedded within export data and then triggered in exported data viewers. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.themissinglink.com.au/security-advisories/cve-2022-40294
CVE ID: CVE-2022-40295 State: PUBLISHED Published: 2022-10-31T20:08:53.909888Z Last Updated: 2024-08-03T12:14:40.090Z Vendors: PHP Point of Sale LLC Products: PHP Point of Sale Problem Types: CWE-916 Description: The application was vulnerable to an authenticated information disclosure, allowing administrators to view unsalted user passwords, which could lead to the compromise of plaintext passwords via offline attacks. Additional Analyst Notes: - CVE Program Container: References: - https://www.themissinglink.com.au/security-advisories/cve-2022-40295
CVE ID: CVE-2022-40296 State: PUBLISHED Published: 2022-10-31T20:07:56.767Z Last Updated: 2025-05-06T19:15:40.038Z Vendors: PHP Point of Sale LLC Products: PHP Point of Sale Problem Types: CWE-918 Description: The application was vulnerable to a Server-Side Request Forgery attacks, allowing the backend server to interact with unexpected endpoints, potentially including internal and local services, leading to attacks in other downstream systems. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.themissinglink.com.au/security-advisories/cve-2022-40296
CVE ID: CVE-2022-40297 State: PUBLISHED Published: 2022-09-08T23:38:32 Last Updated: 2024-08-03T12:14:40.046Z Vendors: n/a Products: n/a Problem Types: n/a Description: UBports Ubuntu Touch 16.04 allows the screen-unlock passcode to be used for a privileged shell via Sudo. This passcode is only four digits, far below typical length/complexity for a user account's password. NOTE: a third party states "The described attack cannot be executed as demonstrated. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/filipkarc/PoC-ubuntutouch-pin-privesc
CVE ID: CVE-2022-40298 State: PUBLISHED Published: 2022-09-22T23:30:16.000Z Last Updated: 2025-05-27T15:23:18.955Z Vendors: n/a Products: n/a Problem Types: n/a Description: Crestron AirMedia for Windows before 5.5.1.84 has insecure inherited permissions, which leads to a privilege escalation vulnerability found in the AirMedia Windows Application, version 4.3.1.39. A low privileged user can initiate a repair of the system and gain a SYSTEM level shell. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.crestron.com/Security/Security_Advisories - https://www.crestron.com/release_notes/airmedia_windows_installer_release_notes_5.5.1.84.pdf
CVE ID: CVE-2022-40299 State: PUBLISHED Published: 2022-09-09T00:18:03 Last Updated: 2024-08-03T12:14:40.045Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Singular before 4.3.1, a predictable /tmp pathname is used (e.g., by sdb.cc), which allows local users to gain the privileges of other users via a procedure in a file under /tmp. NOTE: this CVE Record is about sdb.cc and similar files in the Singular interface that have predictable /tmp pathnames; this CVE Record is not about the lack of a safe temporary-file creation capability in the Singular language. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Singular/Singular/issues/1137 - http
Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Singular/Singular/issues/1137 - https://github.com/Singular/Singular/commit/5f28fbf066626fa9c4a8f0e6408c0bb362fb386c - http://michael.orlitzky.com/cves/cve-2022-40299.xhtml
CVE ID: CVE-2022-40300 State: PUBLISHED Published: 2022-09-16T22:47:55 Last Updated: 2024-08-03T12:14:39.986Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine Password Manager Pro through 12120 before 12121, PAM360 through 5550 before 5600, and Access Manager Plus through 4304 before 4305 have multiple SQL injection vulnerabilities. Additional Analyst Notes: - CVE Program Container: References: - https://www.manageengine.com/products/passwordmanagerpro/advisory/cve-2022-40300.html
CVE ID: CVE-2022-40302 State: PUBLISHED Published: 2023-05-03T00:00:00.000Z Last Updated: 2025-01-30T16:06:39.072Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in bgpd in FRRouting (FRR) through 8.4. By crafting a BGP OPEN message with an option of type 0xff (Extended Length from RFC 9072), attackers may cause a denial of service (assertion failure and daemon restart, or out-of-bounds read). This is possible because of inconsistent boundary checks that do not account for reading 3 bytes (instead of 2) in this 0xff case. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/FRRouting/frr/releases - ht
st Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/FRRouting/frr/releases - https://www.debian.org/security/2023/dsa-5495 - https://lists.debian.org/debian-lts-announce/2023/09/msg00020.html