Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-25481 State: PUBLISHED Published: 2022-03-20T00:00:00 Last Updated: 2024-08-03T04:42:49.692Z Vendors: n/a Products: n/a Problem Types: n/a Description: ThinkPHP Framework v5.0.24 was discovered to be configured without the PATHINFO parameter. This allows attackers to access all system environment parameters from index.php. NOTE: this is disputed by a third party because system environment exposure is an intended feature of the debugging mode. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/Lyther/VulnDiscover/blob/master/Web/ThinkPHP_InfoLeak.md
CVE ID: CVE-2022-25484 State: PUBLISHED Published: 2022-03-22T16:49:01 Last Updated: 2024-08-03T04:42:49.318Z Vendors: n/a Products: n/a Problem Types: n/a Description: tcpprep v4.4.1 has a reachable assertion (assert(l2len > 0)) in packet2tree() at tree.c in tcpprep v4.4.1. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/appneta/tcpreplay/issues/715
CVE ID: CVE-2022-25485 State: PUBLISHED Published: 2022-03-15T17:41:10 Last Updated: 2024-08-03T04:42:49.434Z Vendors: n/a Products: n/a Problem Types: n/a Description: CuppaCMS v1.0 was discovered to contain a local file inclusion via the url parameter in /alerts/alertLightbox.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/CuppaCMS/CuppaCMS/issues/24
CVE ID: CVE-2022-25486 State: PUBLISHED Published: 2022-03-15T17:41:02 Last Updated: 2024-08-03T04:42:49.697Z Vendors: n/a Products: n/a Problem Types: n/a Description: CuppaCMS v1.0 was discovered to contain a local file inclusion via the url parameter in /alerts/alertConfigField.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/CuppaCMS/CuppaCMS/issues/25 - https://github.com/hansmach1ne/MyExploits/tree/main/Multiple_LFIs_in_CuppaCMS_alerts - https://github.com/CuppaCMS/CuppaCMS/issues/15
CVE ID: CVE-2022-25487 State: PUBLISHED Published: 2022-03-15T17:40:55 Last Updated: 2024-08-03T04:42:49.561Z Vendors: n/a Products: n/a Problem Types: n/a Description: Atom CMS v2.0 was discovered to contain a remote code execution (RCE) vulnerability via /admin/uploads.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/thedigicraft/Atom.CMS/issues/256 - http://packetstormsecurity.com/files/166532/Atom-CMS-1.0.2-Shell-Upload.html
CVE ID: CVE-2022-25488 State: PUBLISHED Published: 2022-03-15T17:40:48 Last Updated: 2024-08-03T04:42:49.574Z Vendors: n/a Products: n/a Problem Types: n/a Description: Atom CMS v2.0 was discovered to contain a SQL injection vulnerability via the id parameter in /admin/ajax/avatar.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/thedigicraft/Atom.CMS/issues/257
CVE ID: CVE-2022-25489 State: PUBLISHED Published: 2022-03-15T17:40:40 Last Updated: 2024-08-03T04:42:49.573Z Vendors: n/a Products: n/a Problem Types: n/a Description: Atom CMS v2.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the "A" parameter in /widgets/debug.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/thedigicraft/Atom.CMS/issues/258
CVE ID: CVE-2022-25490 State: PUBLISHED Published: 2022-03-15T17:40:33 Last Updated: 2024-08-03T04:42:49.497Z Vendors: n/a Products: n/a Problem Types: n/a Description: HMS v1.0 was discovered to contain a SQL injection vulnerability via the editid parameter in department.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/kabirkhyrul/HMS/discussions/8
CVE ID: CVE-2022-25491 State: PUBLISHED Published: 2022-03-15T17:38:11 Last Updated: 2024-08-03T04:42:49.548Z Vendors: n/a Products: n/a Problem Types: n/a Description: HMS v1.0 was discovered to contain a SQL injection vulnerability via the editid parameter in appointment.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/kabirkhyrul/HMS/discussions/8
CVE ID: CVE-2022-25492 State: PUBLISHED Published: 2022-03-15T17:37:15 Last Updated: 2024-08-03T04:42:49.574Z Vendors: n/a Products: n/a Problem Types: n/a Description: HMS v1.0 was discovered to contain a SQL injection vulnerability via the medicineid parameter in ajaxmedicine.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/kabirkhyrul/HMS/discussions/8
CVE ID: CVE-2022-25493 State: PUBLISHED Published: 2022-03-15T17:36:21 Last Updated: 2024-08-03T04:42:49.492Z Vendors: n/a Products: n/a Problem Types: n/a Description: HMS v1.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via treatmentrecord.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/kabirkhyrul/HMS/discussions/10
CVE ID: CVE-2022-25494 State: PUBLISHED Published: 2022-03-15T17:34:41 Last Updated: 2024-08-03T04:42:49.608Z Vendors: n/a Products: n/a Problem Types: n/a Description: Online Banking System v1.0 was discovered to contain a SQL injection vulnerability via staff_login.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/g33kyrash/Online-Banking-system/issues/16
CVE ID: CVE-2022-25495 State: PUBLISHED Published: 2022-03-15T17:33:35 Last Updated: 2024-08-03T04:42:49.471Z Vendors: n/a Products: n/a Problem Types: n/a Description: The component /jquery_file_upload/server/php/index.php of CuppaCMS v1.0 allows attackers to upload arbitrary files and execute arbitrary code via a crafted PHP file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/CuppaCMS/CuppaCMS/issues/26
CVE ID: CVE-2022-25497 State: PUBLISHED Published: 2022-03-15T17:31:35 Last Updated: 2024-08-03T04:42:49.475Z Vendors: n/a Products: n/a Problem Types: n/a Description: CuppaCMS v1.0 was discovered to contain an arbitrary file read via the copy function. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/CuppaCMS/CuppaCMS/issues/28
CVE ID: CVE-2022-25498 State: PUBLISHED Published: 2022-03-15T17:29:35 Last Updated: 2024-08-03T04:42:49.603Z Vendors: n/a Products: n/a Problem Types: n/a Description: CuppaCMS v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the saveConfigData function in /classes/ajax/Functions.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/CuppaCMS/CuppaCMS/issues/29
CVE ID: CVE-2022-25505 State: PUBLISHED Published: 2022-03-21T00:01:11 Last Updated: 2024-08-03T04:42:49.515Z Vendors: n/a Products: n/a Problem Types: n/a Description: Taocms v3.0.2 was discovered to contain a SQL injection vulnerability via the id parameter in \include\Model\Category.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/taogogo/taocms/issues/27
CVE ID: CVE-2022-25506 State: PUBLISHED Published: 2022-03-10T23:35:37 Last Updated: 2024-08-03T04:42:49.458Z Vendors: n/a Products: n/a Problem Types: n/a Description: FreeTAKServer-UI v1.9.8 was discovered to contain a SQL injection vulnerability via the API endpoint /AuthenticateUser. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/FreeTAKTeam/UI/issues/27
CVE ID: CVE-2022-25507 State: PUBLISHED Published: 2022-03-10T23:35:37 Last Updated: 2024-08-03T04:42:49.562Z Vendors: n/a Products: n/a Problem Types: n/a Description: FreeTAKServer-UI v1.9.8 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Callsign parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/FreeTAKTeam/UI/issues/28
CVE ID: CVE-2022-25508 State: PUBLISHED Published: 2022-03-10T23:35:38 Last Updated: 2024-08-03T04:42:49.453Z Vendors: n/a Products: n/a Problem Types: n/a Description: An access control issue in the component /ManageRoute/postRoute of FreeTAKServer v1.9.8 allows unauthenticated attackers to cause a Denial of Service (DoS) via an unusually large amount of created routes, or create unsafe or false routes for legitimate users. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/FreeTAKTeam/FreeTakServer/issues/291
CVE ID: CVE-2022-25510 State: PUBLISHED Published: 2022-03-10T23:35:40 Last Updated: 2024-08-03T04:42:49.504Z Vendors: n/a Products: n/a Problem Types: n/a Description: FreeTAKServer 1.9.8 contains a hardcoded Flask secret key which allows attackers to create crafted cookies to bypass authentication or escalate privileges. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/FreeTAKTeam/FreeTakServer/issues/292
CVE ID: CVE-2022-25511 State: PUBLISHED Published: 2022-03-10T23:35:40 Last Updated: 2024-08-03T04:42:49.571Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in the ?filename= argument of the route /DataPackageTable in FreeTAKServer-UI v1.9.8 allows attackers to place arbitrary files anywhere on the system. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/FreeTAKTeam/UI/issues/29
CVE ID: CVE-2022-25512 State: PUBLISHED Published: 2022-03-10T23:35:41 Last Updated: 2024-08-03T04:42:49.847Z Vendors: n/a Products: n/a Problem Types: n/a Description: FreeTAKServer-UI v1.9.8 was discovered to leak sensitive API and Websocket keys. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/FreeTAKTeam/UI/issues/26
CVE ID: CVE-2022-25514 State: PUBLISHED Published: 2022-03-17T00:00:00 Last Updated: 2024-10-30T13:24:40.017Z Vendors: n/a Products: n/a Problem Types: n/a Description: stb_truetype.h v1.26 was discovered to contain a heap-buffer-overflow via the function ttUSHORT() at stb_truetype.h. NOTE: Third party has disputed stating that the source code has also a disclaimer that it should only be used with trusted input. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/nothings/stb/issues/1286
CVE ID: CVE-2022-25515 State: PUBLISHED Published: 2022-03-17T00:00:00 Last Updated: 2024-08-03T04:42:49.699Z Vendors: n/a Products: n/a Problem Types: n/a Description: stb_truetype.h v1.26 was discovered to contain a heap-buffer-overflow via the function ttULONG() at stb_truetype.h. NOTE: Third party has disputed stating that the source code has also a disclaimer that it should only be used with trusted input. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nothings/stb/issues/1286 - https://github.com/nothings/stb/issues/1288
CVE ID: CVE-2022-25516 State: PUBLISHED Published: 2022-03-17T00:00:00 Last Updated: 2024-08-03T04:42:49.866Z Vendors: n/a Products: n/a Problem Types: n/a Description: stb_truetype.h v1.26 was discovered to contain a heap-buffer-overflow via the function stbtt__find_table at stb_truetype.h. NOTE: Third party has disputed stating that the source code has also a disclaimer that it should only be used with trusted input. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nothings/stb/issues/1286 - https://github.com/nothings/stb/issues/1287
CVE ID: CVE-2022-25517 State: PUBLISHED Published: 2022-03-22T00:00:00 Last Updated: 2024-08-03T04:42:49.865Z Vendors: n/a Products: n/a Problem Types: n/a Description: MyBatis plus v3.4.3 was discovered to contain a SQL injection vulnerability via the Column parameter in /core/conditions/AbstractWrapper.java. NOTE: the vendor's position is that the reported execution of a SQL statement was intended behavior. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/HaHarden/mybatis-plus-sql-Injection - https://github.com/baomidou/mybatis-plus/issues/4407
CVE ID: CVE-2022-25518 State: PUBLISHED Published: 2022-03-22T21:12:52 Last Updated: 2024-08-03T04:42:49.699Z Vendors: n/a Products: n/a Problem Types: n/a Description: In CMDBuild from version 3.0 to 3.3.2 payload requests are saved in a temporary log table, which allows attackers with database access to read the password of the users who login to the application by querying the database table. Additional Analyst Notes: - CVE Program Container: References: - https://www.cmdbuild.org/en/reference/news/cmdbuild-3-3-3-intermediate-release-vulnerability-patch
CVE ID: CVE-2022-25521 State: PUBLISHED Published: 2022-03-29T00:00:00 Last Updated: 2024-08-03T04:42:49.697Z Vendors: n/a Products: n/a Problem Types: n/a Description: NUUO v03.11.00 was discovered to contain access control issue. Additional Analyst Notes: - CVE Program Container: References: - https://medium.com/%40dnyaneshgawande111/use-of-default-credentials-to-unauthorised-remote-access-of-internal-panel-of-network-video-5490d107fa0 - http://nuuo.com
CVE ID: CVE-2022-25523 State: PUBLISHED Published: 2022-03-25T20:40:40 Last Updated: 2024-08-03T04:42:50.100Z Vendors: n/a Products: n/a Problem Types: n/a Description: TypesetterCMS v5.1 was discovered to contain a Cross-Site Request Forgery (CSRF) which is exploited via a crafted POST request. Additional Analyst Notes: - CVE Program Container: References: - http://typesettercms.com - https://www.typesettercms.com/User - https://github.com/Typesetter/Typesetter/issues/697
CVE ID: CVE-2022-25546 State: PUBLISHED Published: 2022-03-09T18:27:35 Last Updated: 2024-08-03T04:42:49.699Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda AX1806 v1.0.0.1 was discovered to contain a stack overflow in the function formSetSysToolDDNS. This vulnerability allows attackers to cause a Denial of Service (DoS) via the ddnsUser parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sec-bin/IoT-CVE/tree/main/Tenda/AX1806/6
CVE ID: CVE-2022-25547 State: PUBLISHED Published: 2022-03-09T18:27:45 Last Updated: 2024-08-03T04:42:49.875Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda AX1806 v1.0.0.1 was discovered to contain a stack overflow in the function fromSetSysTime. This vulnerability allows attackers to cause a Denial of Service (DoS) via the time parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sec-bin/IoT-CVE/tree/main/Tenda/AX1806/1
CVE ID: CVE-2022-25548 State: PUBLISHED Published: 2022-03-09T18:27:38 Last Updated: 2024-08-03T04:42:49.689Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda AX1806 v1.0.0.1 was discovered to contain a stack overflow in the function fromSetSysTime. This vulnerability allows attackers to cause a Denial of Service (DoS) via the serverName parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sec-bin/IoT-CVE/tree/main/Tenda/AX1806/5
CVE ID: CVE-2022-25549 State: PUBLISHED Published: 2022-03-09T18:27:39 Last Updated: 2024-08-03T04:42:49.914Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda AX1806 v1.0.0.1 was discovered to contain a stack overflow in the function formSetSysToolDDNS. This vulnerability allows attackers to cause a Denial of Service (DoS) via the ddnsEn parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sec-bin/IoT-CVE/tree/main/Tenda/AX1806/4
CVE ID: CVE-2022-25550 State: PUBLISHED Published: 2022-03-09T18:27:39 Last Updated: 2024-08-03T04:42:49.760Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda AX1806 v1.0.0.1 was discovered to contain a stack overflow in the function saveParentControlInfo. This vulnerability allows attackers to cause a Denial of Service (DoS) via the deviceName parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sec-bin/IoT-CVE/tree/main/Tenda/AX1806/9
CVE ID: CVE-2022-25551 State: PUBLISHED Published: 2022-03-09T18:27:40 Last Updated: 2024-08-03T04:42:49.914Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda AX1806 v1.0.0.1 was discovered to contain a stack overflow in the function formSetSysToolDDNS. This vulnerability allows attackers to cause a Denial of Service (DoS) via the ddnsDomain parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sec-bin/IoT-CVE/tree/main/Tenda/AX1806/8
CVE ID: CVE-2022-25552 State: PUBLISHED Published: 2022-03-09T18:27:40 Last Updated: 2024-08-03T04:42:49.956Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda AX1806 v1.0.0.1 was discovered to contain a stack overflow in the function form_fast_setting_wifi_set. This vulnerability allows attackers to cause a Denial of Service (DoS) via the ssid parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sec-bin/IoT-CVE/tree/main/Tenda/AX1806/3
CVE ID: CVE-2022-25553 State: PUBLISHED Published: 2022-03-09T18:27:42 Last Updated: 2024-08-03T04:42:49.849Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda AX1806 v1.0.0.1 was discovered to contain a stack overflow in the function formSetSysToolDDNS. This vulnerability allows attackers to cause a Denial of Service (DoS) via the ddnsPwd parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sec-bin/IoT-CVE/tree/main/Tenda/AX1806/7
CVE ID: CVE-2022-25554 State: PUBLISHED Published: 2022-03-09T18:27:42 Last Updated: 2024-08-03T04:42:49.901Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda AX1806 v1.0.0.1 was discovered to contain a stack overflow in the function saveParentControlInfo. This vulnerability allows attackers to cause a Denial of Service (DoS) via the deviceId parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sec-bin/IoT-CVE/tree/main/Tenda/AX1806/10
CVE ID: CVE-2022-25555 State: PUBLISHED Published: 2022-03-09T18:27:47 Last Updated: 2024-08-03T04:42:49.769Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda AX1806 v1.0.0.1 was discovered to contain a stack overflow in the function fromSetSysTime. This vulnerability allows attackers to cause a Denial of Service (DoS) via the ntpServer parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sec-bin/IoT-CVE/tree/main/Tenda/AX1806/2
CVE ID: CVE-2022-25556 State: PUBLISHED Published: 2022-03-09T18:27:48 Last Updated: 2024-08-03T04:42:49.921Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda AX12 v22.03.01.21 was discovered to contain a stack overflow in the function sub_42E328. This vulnerability allows attackers to cause a Denial of Service (DoS) via the list parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sec-bin/IoT-CVE/tree/main/Tenda/AX12/6
CVE ID: CVE-2022-25557 State: PUBLISHED Published: 2022-03-09T18:27:49 Last Updated: 2024-08-03T04:42:49.871Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda AX1806 v1.0.0.1 was discovered to contain a heap overflow in the function saveParentControlInfo. This vulnerability allows attackers to cause a Denial of Service (DoS) via the urls parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sec-bin/IoT-CVE/tree/main/Tenda/AX1806/11
CVE ID: CVE-2022-25558 State: PUBLISHED Published: 2022-03-09T18:27:49 Last Updated: 2024-08-03T04:42:49.922Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda AX1806 v1.0.0.1 was discovered to contain a stack overflow in the function formSetProvince. This vulnerability allows attackers to cause a Denial of Service (DoS) via the ProvinceCode parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sec-bin/IoT-CVE/tree/main/Tenda/AX1806/13
CVE ID: CVE-2022-25560 State: PUBLISHED Published: 2022-03-09T18:27:51 Last Updated: 2024-08-03T04:42:49.822Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda AX12 v22.03.01.21 was discovered to contain a stack overflow in the function sub_4327CC. This vulnerability allows attackers to cause a Denial of Service (DoS) via the list parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sec-bin/IoT-CVE/tree/main/Tenda/AX12/4
CVE ID: CVE-2022-25561 State: PUBLISHED Published: 2022-03-09T18:27:51 Last Updated: 2024-08-03T04:42:50.031Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda AX12 v22.03.01.21 was discovered to contain a stack overflow in the function sub_42DE00. This vulnerability allows attackers to cause a Denial of Service (DoS) via the list parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sec-bin/IoT-CVE/tree/main/Tenda/AX12/5
CVE ID: CVE-2022-25566 State: PUBLISHED Published: 2022-03-09T18:27:55 Last Updated: 2024-08-03T04:42:49.937Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda AX1806 v1.0.0.1 was discovered to contain a stack overflow in the function saveParentControlInfo. This vulnerability allows attackers to cause a Denial of Service (DoS) via the time parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sec-bin/IoT-CVE/tree/main/Tenda/AX1806/12
CVE ID: CVE-2022-25568 State: PUBLISHED Published: 2022-03-24T16:40:20 Last Updated: 2024-08-03T04:42:50.017Z Vendors: n/a Products: n/a Problem Types: n/a Description: MotionEye v0.42.1 and below allows attackers to access sensitive information via a GET request to /config/list. To exploit this vulnerability, a regular user password must be unconfigured. Additional Analyst Notes: - CVE Program Container: References: - https://www.pizzapower.me/2022/02/17/motioneye-config-info-disclosure/ - https://github.com/ccrisan/motioneye/issues/2292
CVE ID: CVE-2022-25569 State: PUBLISHED Published: 2022-04-04T17:23:45 Last Updated: 2024-08-03T04:42:49.959Z Vendors: n/a Products: n/a Problem Types: n/a Description: Bettini Srl GAMS Product Line v4.3.0 was discovered to re-use static SSH keys across installations, allowing unauthenticated attackers to login as root users via extracting a key from the software. Additional Analyst Notes: - CVE Program Container: References: - https://www.andreabruschi.net/2022/02/17/bettini-s-r-l-sgsetup-hard-coded-ssh-private-key/
CVE ID: CVE-2022-25570 State: PUBLISHED Published: 2022-03-21T12:59:25 Last Updated: 2024-08-03T04:42:50.184Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Click Studios (SA) Pty Ltd Passwordstate 9435, users with access to a passwordlist can gain access to additional password lists without permissions. Specifically, an authenticated user who has write permissions to a password list in one folder (with the default permission model) can extend his permissions to all other password lists in the same folder. Additional Analyst Notes: - CVE Program Container: References: - https://www.clickstudios.com.au/passwordstate-changelog.aspx - https://sysadms.de/2022/03/cve-2022-25570-sta
ferences: - https://www.clickstudios.com.au/passwordstate-changelog.aspx - https://sysadms.de/2022/03/cve-2022-25570-standard-berechtigungsmodell-im-passwortmanager-passwordstate-ermoeglicht-rechteausweitung/
CVE ID: CVE-2022-25571 State: PUBLISHED Published: 2022-03-24T20:23:16 Last Updated: 2024-08-03T04:42:50.013Z Vendors: n/a Products: n/a Problem Types: n/a Description: Bluedon Information Security Technologies Co.,Ltd Internet Access Detector v1.0 was discovered to contain an information leak which allows attackers to access the contents of the password file via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://www.yuque.com/docs/share/a3a6f248-364b-459a-b572-52e7584192ba
CVE ID: CVE-2022-25574 State: PUBLISHED Published: 2022-03-25T15:59:56 Last Updated: 2024-08-03T04:42:50.325Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability in the upload function of /admin/show.php allows attackers to execute arbitrary web scripts or HTML via a crafted image file. Additional Analyst Notes: - CVE Program Container: References: - http://douphp.com - https://github.com/aqianhei/aqian/issues/1#issue-1142472278