Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
s Desktop Processors with Radeon™ Graphics, AMD Ryzen™ 4000 Series Mobile Processors, AMD Ryzen™ 3000 Series Mobile Processor / 2nd Gen AMD Ryzen™ Mobile Processor with Radeon™ Graphics, AMD Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics, AMD Ryzen™ Threadripper™ PRO Processor, 1st Gen AMD EPYC™ Processors, 2nd Gen AMD EPYC™ Processors, 3rd Gen AMD EPYC™ Processors, AMD EPYC™ Embedded 3000, AMD EPYC (TM) Embedded 7002, AMD EPYC™ Embedded 7003, AMD RyzenTM Embedded R1000, AMD RyzenTM Embedded R2000, AMD RyzenTM Embedded 5000, AMD RyzenTM Embedded V1000, AMD RyzenTM Embedded V2000, AMD RyzenTM Embedded V3000 Description: A potential weakness in AMD SPI protection features may allo
nTM Embedded V2000, AMD RyzenTM Embedded V3000 Description: A potential weakness in AMD SPI protection features may allow a malicious attacker with Ring0 (kernel mode) access to bypass the native System Management Mode (SMM) ROM protections. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.amd.com/en/resources/product-security/bulletin/amd-sb-1041.html
CVE ID: CVE-2022-23830 State: PUBLISHED Published: 2023-11-14T18:53:28.408Z Last Updated: 2024-08-03T03:51:45.987Z Severity: LOW (CVSS 1.9 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N) Vendors: AMD Products: 3rd Gen AMD EPYC™ Processors, 4th Gen AMD EPY™ Processors, AMD EPYC™ Embedded 7003 Description: SMM configuration may not be immutable, as intended, when SNP is enabled resulting in a potential limited loss of guest memory integrity. Additional Analyst Notes: - CVE Program Container: References: - https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-3002 - https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-5001
CVE ID: CVE-2022-23831 State: PUBLISHED Published: 2022-11-09T20:45:40.420Z Last Updated: 2025-05-01T14:09:12.498Z Vendors: AMD Products: AMD μProf Problem Types: NA Description: Insufficient validation of the IOCTL input buffer in AMD μProf may allow an attacker to send an arbitrary buffer leading to a potential Windows kernel crash resulting in denial of service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1046
CVE ID: CVE-2022-23832 State: REJECTED Published: N/A Last Updated: 2023-01-17T00:00:00 Description: No description available.
CVE ID: CVE-2022-23833 State: PUBLISHED Published: 2022-02-03T00:00:00 Last Updated: 2024-08-03T03:51:46.008Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in MultiPartParser in Django 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2. Passing certain inputs to multipart forms could result in an infinite loop when parsing files. Additional Analyst Notes: - CVE Program Container: References: - https://groups.google.com/forum/#%21forum/django-announce - https://docs.djangoproject.com/en/4.0/releases/security/ - https://www.djangoproject.com/weblog/2022/feb/01/security-releases/ - https://lists.fedoraproject.org/archives/list/package-announce%40list
roject.com/weblog/2022/feb/01/security-releases/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B4SQG2EAF4WCI2SLRL6XRDJ3RPK3ZRDV/ - https://security.netapp.com/advisory/ntap-20220221-0003/ - https://www.debian.org/security/2022/dsa-5254 - https://github.com/django/django/commit/c477b761804984c932704554ad35f78a2e230c6a - https://github.com/django/django/commit/d16133568ef9c9b42cb7a08bdf9ff3feec2e5468 - https://github.com/django/django/commit/f9c7d48fdd6f198a6494a9202f90242f176e4fc9
CVE ID: CVE-2022-23835 State: PUBLISHED Published: 2022-02-25T03:31:02 Last Updated: 2024-08-03T03:51:46.044Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Visual Voice Mail (VVM) application through 2022-02-24 for Android allows persistent access if an attacker temporarily controls an application that has the READ_SMS permission, and reads an IMAP credentialing message that is (by design) not displayed to the victim within the AOSP SMS/MMS messaging application. (Often, the IMAP credentials are usable to listen to voice mail messages sent before the vulnerability was exploited, in addition to new ones.) NOTE: some vendors characterize this as not a "concrete and exploitable
ability was exploited, in addition to new ones.) NOTE: some vendors characterize this as not a "concrete and exploitable risk. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/kop316/vvm-disclosure - https://www.kb.cert.org/vuls/id/383864
CVE ID: CVE-2022-23837 State: PUBLISHED Published: 2022-01-21T00:00:00 Last Updated: 2024-08-03T03:51:45.990Z Vendors: n/a Products: n/a Problem Types: n/a Description: In api.rb in Sidekiq before 5.2.10 and 6.4.0, there is no limit on the number of days when requesting stats for the graph. This overloads the system, affecting the Web UI, and makes it unavailable to users. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mperham/sidekiq/commit/7785ac1399f1b28992adb56055f6acd88fd1d956 - https://github.com/TUTUMSPACE/exploits/blob/main/sidekiq.md - https://github.com/rubysec/ruby-advisory-db/pull/495 - https://lists.debian.org/debian-lts-announce/2022/03/msg0
iq.md - https://github.com/rubysec/ruby-advisory-db/pull/495 - https://lists.debian.org/debian-lts-announce/2022/03/msg00015.html - https://lists.debian.org/debian-lts-announce/2023/03/msg00011.html
CVE ID: CVE-2022-23848 State: PUBLISHED Published: 2022-02-20T18:09:57 Last Updated: 2024-08-03T03:51:45.989Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Alluxio before 2.7.3, the logserver does not validate the input stream. NOTE: this is not the same as the CVE-2021-44228 Log4j vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://www.alluxio.io/download/releases/alluxio-2-7-3-release/
CVE ID: CVE-2022-23849 State: PUBLISHED Published: 2022-03-03T02:07:47 Last Updated: 2024-08-03T03:51:46.061Z Vendors: n/a Products: n/a Problem Types: n/a Description: The biometric lock in Devolutions Password Hub for iOS before 2021.3.4 allows attackers to access the application because of authentication bypass. An attacker must rapidly make failed biometric authentication attempts. Additional Analyst Notes: - CVE Program Container: References: - https://devolutions.net/security/advisories/ - https://devolutions.net/security/advisories/DEVO-2022-0001
CVE ID: CVE-2022-23850 State: PUBLISHED Published: 2022-01-23T06:47:45 Last Updated: 2024-08-03T03:51:46.059Z Vendors: n/a Products: n/a Problem Types: n/a Description: xhtml_translate_entity in xhtml.c in epub2txt (aka epub2txt2) through 2.02 allows a stack-based buffer overflow via a crafted EPUB document. Additional Analyst Notes: - CVE Program Container: References: - https://cwe.mitre.org/data/definitions/121.html - https://github.com/kevinboone/epub2txt2/issues/17
CVE ID: CVE-2022-23852 State: PUBLISHED Published: 2022-01-24T01:06:50.000Z Last Updated: 2025-05-05T16:25:00.235Z Vendors: n/a Products: n/a Problem Types: n/a Description: Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/libexpat/libexpat/pull/550 - https://www.debian.org/security/2022/dsa-5073 - https://lists.debian.org/debian-lts-announce/2022/03/msg00007.html - https://www.oracle.com/security-alerts/cpuapr2022.html - https://www.tenable.com/security/tns-2022-05 - https://security.netapp.com/advi
le.com/security-alerts/cpuapr2022.html - https://www.tenable.com/security/tns-2022-05 - https://security.netapp.com/advisory/ntap-20220217-0001/ - https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf - https://security.gentoo.org/glsa/202209-24
CVE ID: CVE-2022-23853 State: PUBLISHED Published: 2022-02-11T00:00:00 Last Updated: 2024-08-03T03:51:45.993Z Vendors: n/a Products: n/a Problem Types: n/a Description: The LSP (Language Server Protocol) plugin in KDE Kate before 21.12.2 and KTextEditor before 5.91.0 tries to execute the associated LSP server binary when opening a file of a given type. If this binary is absent from the PATH, it will try running the LSP server binary in the directory of the file that was just opened (due to a misunderstanding of the QProcess API, that was never intended). This can be an untrusted directory. Additional Analyst Notes: - CVE Program Container: References: - https://apps.kde.org/kate/ - https://k
usted directory. Additional Analyst Notes: - CVE Program Container: References: - https://apps.kde.org/kate/ - https://kde.org/info/security/advisory-20220131-1.txt - https://security.gentoo.org/glsa/202401-21
CVE ID: CVE-2022-23854 State: PUBLISHED Published: 2022-12-23T20:50:24.757Z Last Updated: 2025-02-13T16:32:24.155Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: AVEVA Products: InTouch Access Anywhere Problem Types: CWE-23 Description: AVEVA InTouch Access Anywhere versions 2020 R2 and older are vulnerable to a path traversal exploit that could allow an unauthenticated user with network access to read files on the system outside of the secure gateway web server. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-342-02 - https://www.aveva.com/content/dam/aveva/documents
erences: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-342-02 - https://www.aveva.com/content/dam/aveva/documents/support/cyber-security-updates/SecurityBulletin_AVEVA-2023-001_r.pdf - https://crisec.de/advisory-aveva-intouch-access-anywhere-secure-gateway-path-traversal
CVE ID: CVE-2022-23855 State: PUBLISHED Published: 2022-01-24T01:43:48 Last Updated: 2024-08-03T03:51:45.997Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Saviynt Enterprise Identity Cloud (EIC) 5.5 SP2.x. An authentication bypass in ECM/maintenance/forgotpasswordstep1 allows an unauthenticated user to reset passwords and login as any local account. Additional Analyst Notes: - CVE Program Container: References: - https://www.kb.cert.org/vuls/id/692873
CVE ID: CVE-2022-23856 State: PUBLISHED Published: 2022-01-24T01:43:34 Last Updated: 2024-08-03T03:51:46.116Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Saviynt Enterprise Identity Cloud (EIC) 5.5 SP2.x. An attacker can enumerate users by changing the id parameter, such as for the ECM/maintenance/forgotpasswordstep1 URI. Additional Analyst Notes: - CVE Program Container: References: - https://www.kb.cert.org/vuls/id/692873
CVE ID: CVE-2022-23857 State: PUBLISHED Published: 2022-01-24T01:56:34 Last Updated: 2024-08-03T03:51:46.119Z Vendors: n/a Products: n/a Problem Types: n/a Description: model/criteria/criteria.go in Navidrome before 0.47.5 is vulnerable to SQL injection attacks when processing crafted Smart Playlists. An authenticated user could abuse this to extract arbitrary data from the database, including the user table (which contains sensitive information such as the users' encrypted passwords). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/navidrome/navidrome/releases/tag/v0.47.5 - https://github.com/navidrome/navidrome/commit/9e79b5cbf2a48c1e4344df00fea4ed3844ea
rome/navidrome/releases/tag/v0.47.5 - https://github.com/navidrome/navidrome/commit/9e79b5cbf2a48c1e4344df00fea4ed3844ea965d
CVE ID: CVE-2022-23858 State: PUBLISHED Published: 2022-01-24T02:01:52 Last Updated: 2024-08-03T03:51:46.130Z Vendors: n/a Products: n/a Problem Types: n/a Description: A flaw was found in the REST API. An improperly handled REST API call could allow any logged user to elevate privileges up to the system account. This affects StarWind Command Center build 6003 v2. Additional Analyst Notes: - CVE Program Container: References: - https://www.starwindsoftware.com/security/sw-20220121-0001/
CVE ID: CVE-2022-23861 State: PUBLISHED Published: 2024-10-22T00:00:00 Last Updated: 2024-10-22T18:30:05.273Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple Stored Cross-Site Scripting vulnerabilities were discovered in Y Soft SAFEQ 6 Build 53. Multiple fields in the YSoft SafeQ web application can be used to inject malicious inputs that, due to a lack of output sanitization, result in the execution of arbitrary JS code. These fields can be leveraged to perform XSS attacks on legitimate users accessing the SafeQ web interface. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://ysoft.com - https://github.com/mbadanoiu/CVE-2022-23861 - https://github.
- CISA ADP Vulnrichment: References: - https://ysoft.com - https://github.com/mbadanoiu/CVE-2022-23861 - https://github.com/mbadanoiu/CVE-2022-23861/blob/main/SafeQ%20-%20CVE-2022-23861.pdf
CVE ID: CVE-2022-23862 State: PUBLISHED Published: 2024-10-22T00:00:00 Last Updated: 2024-10-22T18:30:53.788Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Local Privilege Escalation issue was discovered in Y Soft SAFEQ 6 Build 53. The SafeQ JMX service running on port 9696 is vulnerable to JMX MLet attacks. Because the service did not enforce authentication and was running under the "NT Authority\System" user, an attacker is able to use the vulnerability to execute arbitrary code and elevate to the system user. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://ysoft.com - https://github.com/mbadanoiu/CVE-2022-23862 - https://github.com/mbadanoiu/CVE-202
nt: References: - https://ysoft.com - https://github.com/mbadanoiu/CVE-2022-23862 - https://github.com/mbadanoiu/CVE-2022-23862/blob/main/SafeQ%20-%20CVE-2022-23862.pdf
CVE ID: CVE-2022-23863 State: PUBLISHED Published: 2022-01-28T15:33:26 Last Updated: 2024-08-03T03:51:46.014Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine Desktop Central before 10.1.2137.10 allows an authenticated user to change any user's login password. Additional Analyst Notes: - CVE Program Container: References: - https://www.manageengine.com/products/desktop-central/privilege-escalation-vulnerability.html
CVE ID: CVE-2022-23865 State: PUBLISHED Published: 2022-04-15T15:28:40 Last Updated: 2024-08-03T03:51:46.085Z Vendors: n/a Products: n/a Problem Types: n/a Description: Nyron 1.0 is affected by a SQL injection vulnerability through Nyron/Library/Catalog/winlibsrch.aspx. To exploit this vulnerability, an attacker must inject '"> on the thes1 parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/50674
CVE ID: CVE-2022-23868 State: PUBLISHED Published: 2022-03-30T10:14:16 Last Updated: 2024-08-03T03:51:46.096Z Vendors: n/a Products: n/a Problem Types: n/a Description: RuoYi v4.7.2 contains a CSV injection vulnerability through ruoyi-admin when a victim opens .xlsx log file. Additional Analyst Notes: - CVE Program Container: References: - https://gitee.com/y_project/RuoYi/issues/I4RBBD
CVE ID: CVE-2022-23869 State: PUBLISHED Published: 2022-03-30T10:15:55 Last Updated: 2024-08-03T03:51:46.039Z Vendors: n/a Products: n/a Problem Types: n/a Description: In RuoYi v4.7.2 through the WebUI, user test1 does not have permission to reset the password of user test3, but the password of user test3 can be reset through the /system/user/resetPwd request. Additional Analyst Notes: - CVE Program Container: References: - https://gitee.com/y_project/RuoYi/issues/I4RCO2
CVE ID: CVE-2022-23871 State: PUBLISHED Published: 2022-02-03T02:05:27 Last Updated: 2024-08-03T03:51:46.080Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in the component outcomes_addProcess.php of Gibbon CMS v22.0.01 allow attackers to execute arbitrary web scripts or HTML via a crafted payload insterted into the name, category, description parameters. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/truonghuuphuc/CVE - https://github.com/truonghuuphuc/CVE/blob/main/CVE-2022-23871.pdf
CVE ID: CVE-2022-23872 State: PUBLISHED Published: 2022-01-31T21:26:53 Last Updated: 2024-08-03T03:51:46.139Z Vendors: n/a Products: n/a Problem Types: n/a Description: Emlog pro v1.1.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the component /admin/configure.php via the parameter footer_info. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/truonghuuphuc/CVE - https://github.com/emlog/emlog/issues/147
CVE ID: CVE-2022-23873 State: PUBLISHED Published: 2022-02-03T02:43:53 Last Updated: 2024-08-03T03:51:46.095Z Vendors: n/a Products: n/a Problem Types: n/a Description: Victor CMS v1.0 was discovered to contain a SQL injection vulnerability that allows attackers to inject arbitrary commands via 'user_firstname' parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/truonghuuphuc/CVE - https://github.com/truonghuuphuc/CVE/blob/main/CVE-2022-23873.pdf
CVE ID: CVE-2022-23878 State: PUBLISHED Published: 2022-03-02T18:40:25 Last Updated: 2024-08-03T03:51:46.074Z Vendors: n/a Products: n/a Problem Types: n/a Description: seacms V11.5 is affected by an arbitrary code execution vulnerability in admin_config.php. Additional Analyst Notes: - CVE Program Container: References: - https://blog.csdn.net/miuzzx/article/details/122249953
CVE ID: CVE-2022-23880 State: PUBLISHED Published: 2022-03-23T20:09:38 Last Updated: 2024-08-03T03:51:46.054Z Vendors: n/a Products: n/a Problem Types: n/a Description: An arbitrary file upload vulnerability in the File Management function module of taoCMS v3.0.2 allows attackers to execute arbitrary code via a crafted PHP file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/taogogo/taocms/issues/25
CVE ID: CVE-2022-23881 State: PUBLISHED Published: 2022-03-23T20:09:40 Last Updated: 2024-08-03T03:51:46.103Z Vendors: n/a Products: n/a Problem Types: n/a Description: ZZZCMS zzzphp v2.1.0 was discovered to contain a remote command execution (RCE) vulnerability via danger_key() at zzz_template.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/metaStor/Vuls/blob/main/zzzcms/zzzphp%20V2.1.0%20RCE/zzzphp%20V2.1.0%20RCE.md
CVE ID: CVE-2022-23882 State: PUBLISHED Published: 2022-03-28T11:50:22 Last Updated: 2024-08-03T03:51:46.140Z Vendors: n/a Products: n/a Problem Types: n/a Description: TuziCMS 2.0.6 is affected by SQL injection in \App\Manage\Controller\BannerController.class.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/yeyinshi/tuzicms/issues/10
CVE ID: CVE-2022-23884 State: PUBLISHED Published: 2022-03-28T12:08:40 Last Updated: 2024-08-03T03:59:23.164Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mojang Bedrock Dedicated Server 1.18.2 is affected by an integer overflow leading to a bound check bypass caused by PurchaseReceiptPacket::_read (packet deserializer). Additional Analyst Notes: - CVE Program Container: References: - https://s3.bmp.ovh/imgs/2022/01/962e0c75f5969cfb.png
CVE ID: CVE-2022-23887 State: PUBLISHED Published: 2022-01-28T20:44:58 Last Updated: 2024-08-03T03:59:22.524Z Vendors: n/a Products: n/a Problem Types: n/a Description: YzmCMS v6.3 was discovered to contain a Cross-Site Request Forgery (CSRF) which allows attackers to arbitrarily delete user accounts via /admin/admin_manage/delete. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/yzmcms/yzmcms/issues/59
CVE ID: CVE-2022-23888 State: PUBLISHED Published: 2022-01-28T20:44:59 Last Updated: 2024-08-03T03:59:22.847Z Vendors: n/a Products: n/a Problem Types: n/a Description: YzmCMS v6.3 was discovered to contain a Cross-Site Request Forgey (CSRF) via the component /yzmcms/comment/index/init.html. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/yzmcms/yzmcms/issues/60
CVE ID: CVE-2022-23889 State: PUBLISHED Published: 2022-01-28T20:45:01 Last Updated: 2024-08-03T03:59:22.001Z Vendors: n/a Products: n/a Problem Types: n/a Description: The comment function in YzmCMS v6.3 was discovered as being able to be operated concurrently, allowing attackers to create an unusually large number of comments. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/yzmcms/yzmcms/issues/61
CVE ID: CVE-2022-23896 State: PUBLISHED Published: 2022-06-28T12:11:53 Last Updated: 2024-08-03T03:59:22.479Z Vendors: n/a Products: n/a Problem Types: n/a Description: Admidio 4.1.2 version is affected by stored cross-site scripting (XSS). Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/79c2d16c-bae2-417f-ab50-10c52707a30f/
CVE ID: CVE-2022-23898 State: PUBLISHED Published: 2022-03-03T18:01:34 Last Updated: 2024-08-03T03:59:22.025Z Vendors: n/a Products: n/a Problem Types: n/a Description: MCMS v5.2.5 was discovered to contain a SQL injection vulnerability via the categoryId parameter in the file IContentDao.xml. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ming-soft/MCMS/issues/62
CVE ID: CVE-2022-23899 State: PUBLISHED Published: 2022-03-03T18:01:34 Last Updated: 2024-08-03T03:59:22.740Z Vendors: n/a Products: n/a Problem Types: n/a Description: MCMS v5.2.5 was discovered to contain a SQL injection vulnerability via search.do in the file /web/MCmsAction.java. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ming-soft/MCMS/issues/63
CVE ID: CVE-2022-23900 State: PUBLISHED Published: 2022-04-07T10:19:14 Last Updated: 2024-08-03T03:59:22.478Z Vendors: n/a Products: n/a Problem Types: n/a Description: A command injection vulnerability in the API of the Wavlink WL-WN531P3 router, version M31G3.V5030.201204, allows an attacker to achieve unauthorized remote code execution via a malicious POST request through /cgi-bin/adm.cgi. Additional Analyst Notes: - CVE Program Container: References: - https://www.wavlink.com/en_us/product/WL-WN531P3.html - https://stigward.medium.com/wavlink-command-injection-cve-2022-23900-51988f6f15df
CVE ID: CVE-2022-23901 State: PUBLISHED Published: 2022-03-29T11:12:41 Last Updated: 2024-08-03T03:59:22.904Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stack overflow re2c 2.2 exists due to infinite recursion issues in src/dfa/dead_rules.cc. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/skvadrik/re2c/issues/394
CVE ID: CVE-2022-23902 State: PUBLISHED Published: 2022-02-14T20:18:15 Last Updated: 2024-08-03T03:59:22.513Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tongda2000 v11.10 was discovered to contain a SQL injection vulnerability in export_data.php via the d_name parameter. Additional Analyst Notes: - CVE Program Container: References: - http://note.youdao.com/noteshare?id=7b52ec937a029a1b2c7f994d4b174583
CVE ID: CVE-2022-23903 State: PUBLISHED Published: 2022-03-29T11:55:17 Last Updated: 2024-08-03T03:59:22.516Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross Site Scripting (XSS) vulnerability exists in pearadmin pear-admin-think <=5.0.6, which allows a login account to access arbitrary functions and cause stored XSS through a fake User-Agent. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pearadmin/pear-admin-think/issues/1
CVE ID: CVE-2022-23904 State: PUBLISHED Published: 2022-05-02T10:30:29 Last Updated: 2024-08-03T03:59:22.512Z Vendors: n/a Products: n/a Problem Types: n/a Description: Rainworx Auctionworx < 3.1R2 is vulnerable to a Cross-Site Request Forgery (CSRF) attack that allows an authenticated user to upgrade his account to admin and gain access to the auctionworx admin control panel. This vulnerability affects AuctionWorx Enterprise and AuctionWorx: Events Edition. Additional Analyst Notes: - CVE Program Container: References: - https://www.rainworx.com/ - https://ebereorisi.com/blog/account-privilege-upgrade-on-auctionworx-software-cve-2022-23904/